Terms & Conditions

FLEEXA MASTER SOFTWARE-AS-A-SERVICE AGREEMENT

Effective date: 29 October 2026<br>
Version: 1.0<br>
Applicable product at launch: Fleexa Fleet Management

1. Parties, acceptance and scope

1.1. This Master Software-as-a-Service Agreement (the Agreement) is made between Fleexa, meaning the business that operates the Fleexa software service at https://fleexa-group.com and is identified as the supplier on the relevant subscription invoice or electronic subscription confirmation (Fleexa, we, us), and the business or other legal entity for whose benefit the service account is registered (Customer, you). Fleexa is the product and trading name, not a representation that it is the supplier's registered corporate name. The supplier identified in the issued subscription invoice or electronic subscription confirmation is the contractual provider.

1.2. Customer accepts this Agreement by having an authorised representative select the platform's agreement acceptance control, sign an electronic subscription confirmation, or place a subscription order expressly referring to this Agreement. The person accepting warrants that they are at least 18 and authorised to bind Customer. An employee who registers without authority does not thereby create liability for an unrelated legal entity; Fleexa may ask Customer to confirm its authorisation before providing paid service.

1.3. The service is offered exclusively on a business-to-business basis. It is not a consumer vehicle-hire service and is not sold for personal, family or household use. Customer must hold all licences and permissions required to conduct its vehicle-rental or fleet business.

1.4. This Agreement incorporates the following published or supplied documents, each as a contractual schedule: (a) Subscription and Billing Policy; (b) Data Processing Agreement; (c) Security and Data Retention Schedule; (d) Service Level and Support Policy; (e) Electronic Documents and AI Addendum; and (f) Acceptable Use Policy. The public Privacy Notice, Website Terms, and Cookie Notice provide additional notices and govern the relevant activities as stated in them; the Privacy Notice is not a substitute for the Data Processing Agreement. An accepted, customer-specific subscription confirmation may supplement these terms but may override them only if it expressly identifies the affected clause and states the agreed replacement.

1.5. In case of conflict, mandatory law prevails, followed by an expressly negotiated subscription confirmation, the Data Processing Agreement for personal data processing, the Service Level and Support Policy for service-credit remedies, the Subscription and Billing Policy for fee calculation, the Electronic Documents and AI Addendum for document-generation features, and then this Agreement. All other schedules apply to their respective subjects.

2. Definitions

2.1. Account means Customer's logically segregated workspace, including its authorised users, vehicle records, reservations and configurations.

2.2. Authorised User means a natural person whom Customer permits to access the Account within their assigned permissions.

2.3. Customer Data means all information entered, uploaded, transmitted or generated by Customer or its Authorised Users through the Service for Customer's business, including reservations, vehicle details, drivers' and renters' personal data, documents, invoices and rental-agreement content. Customer Data excludes Fleexa software, Fleexa Confidential Information, and Aggregated Data as defined below.

2.4. Service means the cloud-hosted Fleexa Fleet Management functionality made available under Customer's subscription, together with maintenance and support stated in the applicable schedules. It includes fleet and vehicle records, availability and reservations, rental-operations workflows, document generation and payment-record management to the extent made available to Customer. Fleexa Plus, Fleexa Enterprise, omnichannel messaging, marketing analytics, optional AI tools, third-party integrations and future features are not included merely because they are described elsewhere on the website.

2.5. Subscription Period means the paid monthly billing cycle, or a separately accepted annual period where expressly offered and purchased.

2.6. Third-Party Services means services, products, payment gateways, identity-recognition engines, messaging providers, electronic-signature vendors, maps, hosting services or other technologies that Fleexa does not itself own and that are used with or to provide the Service.

2.7. Aggregated Data means technical and business-usage statistics that have been aggregated and de-identified so that they do not identify Customer, an Authorised User, an individual renter or another person and are not reasonably capable of re-identification.

3. Licence and permitted use

3.1. Subject to timely payment and compliance with this Agreement, Fleexa grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right for Authorised Users to access the purchased Service during the applicable Subscription Period solely for Customer's internal business operations.

3.2. Customer may permit its employees and individual contracted personnel to use the Account on its behalf but must ensure that each is subject to enforceable confidentiality and access obligations. Customer is responsible for its users' actions and must promptly remove access when users leave or no longer need it.

3.3. No source-code licence, sale, assignment of intellectual property or right to reproduce or white-label the Service is granted. Rights not expressly granted remain with Fleexa and its licensors.

3.4. Fleexa may use personnel and appropriately contracted vendors to provide the Service, subject to the confidentiality, security and data-processing commitments in this Agreement.

3.5. Customer must not use non-public software functionality, architecture, screens, customer documentation or other confidential elements of the Service to create or assist a substantially competing software product, except to the extent that a prohibition would be unlawful. This restriction does not prevent lawful independent development without use of Fleexa Confidential Information, or ordinary comparison of available vendors for Customer's own procurement.

4. Customer responsibilities; fundamental allocation of rental risk

4.1. Customer, and not Fleexa, is the vehicle owner, operator, lessor, broker or rental-service provider in its dealings with drivers, renters, partners and authorities. Fleexa is a software provider. Unless the parties separately execute a document expressly appointing Fleexa in another capacity, Fleexa is not a party to any vehicle-rental agreement, does not supply or insure any rental vehicle, does not accept deposits from renters as principal, and does not guarantee that any rental customer will perform their obligations.

4.2. Customer alone determines and is responsible for vehicle ownership and availability; lawful vehicle registration; insurance; fleet maintenance; vehicle condition; driver eligibility and licence verification; lawful rental prices, deposits, fines, Salik/Darb and other tolls; accidents and damage handling; debt collection; tax classification; rental contracts; communications with renters; partner and broker relationships; and compliance with applicable rental, traffic, insurance, consumer, labour and regulatory requirements.

4.3. Customer must verify the accuracy, completeness and legal suitability of every invoice, rental agreement, consent, electronic signature, charge, tax calculation, insurance statement, passport/licence extraction, booking confirmation and other output before using it or sending it to a third party. Automated results and displayed figures are decision-support records; they do not replace professional review or legally required procedures.

4.4. Customer must enter and maintain correct source information, obtain all required notices and valid legal bases for collecting renter and staff data, provide required privacy information to individuals, respond to individual rights requests for its own processing, and ensure that the documents it uploads or sends are lawful and do not infringe third-party rights.

4.5. Customer must not enter card verification values (CVV/CVC), PINs, complete payment-card track data, passwords belonging to third parties, unlawful surveillance data, or information irrelevant to legitimate rental operations. Identity documents and driver's licences may be uploaded only when needed for a lawful and disclosed purpose and subject to appropriately restricted access.

4.6. Customer must maintain its own essential business-continuity measures, including an alternative process for vehicle pickup, return, renter verification and issuing legally required paperwork when the Service is unavailable. This does not excuse Fleexa from its express obligations under this Agreement.

5. Account administration and security

5.1. Customer shall designate an administrator, set appropriate role-based permissions, use strong individual credentials, protect authentication tokens, and promptly report suspected compromise to support@fleexa-group.com.

5.2. Customer is responsible for activity under credentials it issues, except to the extent caused by Fleexa's breach of its own security obligations. Fleexa may rely on Account instructions reasonably appearing to originate from authorised administrators until notified of a security incident.

5.3. Customer shall not share one user's credentials among multiple people or deliberately disable available access controls. Fleexa may verify reasonable account and subscription usage to detect abuse, billing anomalies or security threats; this does not give Fleexa a general right to inspect renter records for marketing purposes.

6. Free implementation period and paid subscriptions

6.1. New Fleet Management subscriptions begin with a 30-consecutive-calendar-day free implementation/trial period measured from Account activation, unless a more favourable offer is expressly confirmed by Fleexa. Subscription charges start only after this period ends. No card or bank account is charged during the trial without Customer's separately authorised purchase.

6.2. The then-applicable price and precise charge calculations are governed by the Subscription and Billing Policy. For the currently published Fleet Management plan the standard recurring rates are USD 5 per active owned vehicle per month, subject to a USD 75 monthly minimum, and USD 3 per chargeable activated partner-vehicle (B2B) rental, excluding any applicable tax. Fleet Management user accounts are unlimited subject to fair and lawful use. No additional setup fee applies unless expressly accepted in an individual written order.

6.3. Before the free period ends Fleexa shall give the Account administrator an electronic notice of the scheduled paid start. At the end of the free period, Customer may elect a paid subscription; if Customer has not accepted a paid order or authorised payment arrangement, Fleexa may change the Account to non-operational or read-only status rather than unilaterally incur fees. Access to data exports remains governed by Section 14.

6.4. After a paid subscription begins, each monthly Subscription Period renews automatically until properly cancelled. Fleexa shall not charge for optional modules or integrations that Customer has not ordered or activated with disclosure of the applicable fees.

7. Invoices, payments and taxes

7.1. Customer shall pay valid invoices by the due date shown on each invoice. If no due date is specified, payment is due 14 calendar days after the invoice date. Invoices may be sent electronically to the Account billing contact. Payment obligations are in USD unless Customer accepts an invoice in another currency; banking conversion and third-party transfer fees imposed on Customer are Customer's responsibility.

7.2. Published amounts are exclusive of applicable VAT, sales tax, withholding and similar transaction taxes. Where legally required, Fleexa will issue a compliant tax invoice and itemise the applicable taxes. Customer is not required to pay any tax not lawfully due or incorrectly invoiced, and may request correction.

7.3. Customer must notify Fleexa of a good-faith invoice dispute within 15 calendar days of receipt, describe the specific items disputed and timely pay undisputed sums. Fleexa shall investigate reasonably and correct proven errors. An invoice is not made legally incontestable solely because the 15-day period expires.

7.4. If an undisputed amount remains unpaid 14 calendar days after written reminder, Fleexa may suspend paid functionality on at least three business days' additional notice, provided the total overdue period is at least 21 days. Fleexa may suspend immediately for verified fraud, material security risk or unlawful activity. Suspension does not cancel accrued fees and does not erase Customer Data.

7.5. No late-interest charge or collection penalty applies unless separately agreed in writing and permitted by applicable law. Each party bears its own routine banking and collection costs, without prejudice to costs awarded by a competent tribunal.

8. Service modifications, maintenance and third parties

8.1. Fleexa may change features, interfaces and technical architecture for security, maintenance, compliance and improvement. Fleexa shall give at least 30 days' notice before materially removing functionality that a paying Customer regularly uses, unless urgent security or legal reasons prevent notice. Where a removal materially impairs the purchased core Service and no substantially equivalent functionality is available, Customer may terminate and obtain a pro-rata refund of prepaid unused subscription fees.

8.2. Fleexa is responsible for performance of the Service within its reasonable control, including its subcontractors to the extent required by this Agreement. Fleexa does not guarantee independent Third-Party Services, banking rails, telecoms, governmental databases, email deliverability or external APIs; however, it will use reasonable efforts to monitor and resolve incidents within its integration boundaries and notify Customer of material issues.

8.3. Customer must independently maintain any third-party licences, approvals, access tokens and fees for services it elects to connect. Integration data exchange is governed by the Data Processing Agreement where personal data is involved.

9. Customer Data, privacy and confidentiality

9.1. As between the parties, Customer retains its rights to Customer Data. Customer grants Fleexa a limited right to host, copy, format, transmit, display, back up and otherwise process Customer Data only to provide, secure, support and improve the subscribed Service in accordance with this Agreement and Customer's lawful documented instructions. Customer Data is not sold to third-party advertisers.

9.2. The Data Processing Agreement governs processing of personal data on Customer's behalf; the Security and Data Retention Schedule governs contractual safeguards and deletion. Fleexa may use Aggregated Data for product performance analysis and improvement, provided reasonable safeguards against re-identification are maintained.

9.3. Each party shall keep the other party's non-public business, technical, pricing, financial and personal information confidential, use it only to carry out this Agreement, restrict access to persons with a need to know who are subject to confidentiality obligations, and protect it with reasonable care. Confidentiality does not apply to information independently developed without use of the other's protected information, already lawfully known, publicly available without breach, or lawfully received from a third party without duty of confidence.

9.4. A party legally compelled to disclose Confidential Information may do so to the minimum required by law, giving prior notice where legally permitted and reasonably possible. This section survives three years after termination and, for personal data and trade secrets, for so long as applicable law or their confidential nature requires.

10. Intellectual property and feedback

10.1. Fleexa and its licensors own all rights in the Service, code, interfaces, documentation, proprietary templates, designs, algorithms, trademarks and improvements, excluding Customer Data and customer-provided contract clauses or other customer-authored content.

10.2. Customer may use generated documents and exports for its ordinary business, including after termination, subject to the rights of any third-party authors. Customer retains ownership of its own document text, logos and uploaded materials.

10.3. If Customer voluntarily provides suggestions, Fleexa may use those suggestions without charge and without obligation to implement them, but not disclose Customer's confidential information or personal data as feedback.

11. Limited warranties and disclaimers

11.1. Fleexa warrants that it will use reasonable care and skill to operate and support the Service in material accordance with its then-current description and the Service Level and Support Policy, and will not knowingly introduce malicious code into the Service.

11.2. Customer warrants that it has authority to enter this Agreement and to provide and use Customer Data and that its operations and instructions comply with applicable law.

11.3. Subject to the express warranties and mandatory law, Fleexa does not warrant uninterrupted or error-free operation, a particular commercial result, increased fleet profitability, successful booking, recovery of fines or debts, legal validity of customer-drafted terms, automatic compliance of generated tax invoices, acceptance of electronic signatures by every authority, or accuracy of AI-generated or extracted data. No customer-facing guarantee is created by a marketing illustration, sample dataset, demo or roadmap statement.

11.4. Nothing in this Agreement excludes non-excludable statutory guarantees or obligations. Fleexa remains responsible for its own proven breaches to the extent required under law and this Agreement.

12. Indemnity and third-party claims

12.1. Customer shall defend and indemnify Fleexa, its directors, officers, employees and contracted service providers against third-party claims, damages and reasonable external legal costs to the extent arising from (a) Customer's illegal rental or fleet operations; (b) vehicle accidents, injury, property damage, fines or renter disputes not caused by Fleexa's independent wrongdoing; (c) Customer's contract terms, invoices, data, content or instructions infringing third-party rights; or (d) Customer's unlawful collection, use or disclosure of personal data. This indemnity is reduced proportionally to the extent a claim was caused by Fleexa's breach, negligence or wilful misconduct.

12.2. Fleexa shall defend Customer against a third-party claim that the unmodified Service as provided by Fleexa infringes that third party's UAE copyright or trade mark rights and pay final awarded damages or an approved settlement, except where the claim arises from Customer content, unauthorised modification, a third-party combination not required by Fleexa, or use after a non-infringing alternative is supplied. Fleexa may obtain a right of continued use, modify or replace the affected feature, or terminate the affected Service and refund prepaid unused fees.

12.3. The indemnified party must give prompt written notice of a claim, reasonable cooperation at the indemnifying party's expense, and control of defence to the indemnifying party. No settlement may impose an admission or non-monetary obligation on the indemnified party without its written consent, not unreasonably withheld. Late notice reduces the indemnity only to the extent of actual prejudice.

13. Liability allocation

13.1. Neither party is liable to the other for indirect or consequential loss, lost profits, lost anticipated savings, lost business opportunities or reputational harm, whether foreseeable or not, to the fullest extent permitted by law. This exclusion does not apply to claims that cannot lawfully be excluded.

13.2. Subject to Section 13.4, Fleexa's aggregate contractual liability for all claims arising in any rolling 12-month period is limited to the greater of (i) USD 1,000 and (ii) the subscription fees paid or payable by Customer for the Service during the 12 months immediately preceding the first event giving rise to the claims. Charges relating to vehicle rentals between Customer and its renters are not subscription fees for this calculation. Related events form a single claim.

13.3. Subject to Section 13.4, Customer's aggregate liability for breaches other than payment and Sections 12.1 and 10 is limited to the greater of USD 1,000 and the same 12-month subscription fees. The exclusions and caps apply across contract, tort and other civil causes of action insofar as legally permitted.

13.4. The caps and exclusions do not limit unpaid subscription charges, fraud, deliberate misconduct, gross negligence where non-excludable, intentional infringement or misuse of intellectual property, customer indemnities under Section 12.1, confidentiality breaches involving deliberate disclosure, or liabilities that applicable law prohibits limiting. No limitation purports to exclude death or personal injury caused by a party where prohibited by law. Any penalty or regulatory fine is borne by the party legally responsible for it; this clause does not purport to transfer an authority's enforcement powers.

13.5. Each party shall use reasonable efforts to mitigate losses. Any service credits are governed by the Service Level and Support Policy and, unless mandatory law requires otherwise, will be applied against future subscription fees and not paid as cash.

14. Suspension, cancellation, termination and export

14.1. Customer may cancel its monthly paid subscription at any time through an available account cancellation control or written request to support@fleexa-group.com. Cancellation takes effect at the end of the then-current paid billing period; no further monthly subscription renewal is charged. Accrued partner-rental usage and unpaid invoices remain payable. Except for legal rights and express remedies, charges for a commenced monthly period are not refunded.

14.2. Either party may terminate for a material breach that remains uncured 30 days after written notice describing the breach; an incurable material breach, unlawful activity, or severe security threat permits immediate termination where lawful. Fleexa may terminate following 45 days of unpaid undisputed charges after the notices in Section 7.4. Neither party may terminate retroactively to avoid accrued obligations.

14.3. Following expiry or termination, the Account becomes unavailable for routine operations. Customer may request an export of reasonably accessible Customer Data for 30 days after the effective termination date. Fleexa shall provide export via then-available export tools or a reasonably usable structured file format, ordinarily CSV for tabular records and original or PDF format for stored documents, subject to technical feasibility and legal restrictions. Customer should independently retain executed rental agreements and legally required business records. Paid bespoke migration or transformation work requires Customer's separate agreement; routine export is not subject to a new fee.

14.4. Customer Data will be deleted or de-identified after the export window subject to the Data Processing Agreement and Security and Data Retention Schedule, legitimate legal holds and mandatory record-retention requirements. Expired backups are purged on the schedule described there. Fleexa will not use suspension as permission to sell or disclose Customer Data.

14.5. On termination, licence rights cease and each party returns or destroys the other's Confidential Information, subject to lawful retention. Sections that by nature survive, including payment, intellectual property, confidentiality, liability, indemnity, data-protection obligations during retention and dispute resolution, survive.

15. Compliance, sanctions and anti-bribery

15.1. Each party shall comply with laws applicable to its performance, including relevant UAE commercial, data-protection, electronic-transactions and anti-corruption laws. Customer must not use the Service for money laundering, sanctions evasion, fraudulent rentals, identity theft, unlawful messaging or record falsification. Fleexa may decline a transaction or suspend access where reasonably necessary to comply with binding law.

15.2. Customer remains responsible for its own regulatory approvals and, where applicable, obtaining independent tax, accounting, insurance and legal advice.

16. Notices and changes to terms

16.1. Notices to Fleexa under this Agreement must be sent to contact@fleexa-group.com; support and security notices may also be sent to support@fleexa-group.com. Fleexa may send notices to the Account administrator's and billing contact's registered email addresses and through an in-product notice. A notice is treated as received when transmitted without a delivery-failure notification, except formal notices for breach or termination, for which proof of sending must be reasonably retained.

16.2. Fleexa may update these terms prospectively with 30 days' written notice of material changes. Changes needed promptly for law, security or abuse may take effect sooner with an explanation. If a material adverse change is unacceptable, Customer may cancel before its effective date; any prepaid unused fees for the affected period will be refunded pro rata. Continuing paid use after the effective date constitutes acceptance only where the notice clearly explained that result and applicable law permits it. No unilateral change retroactively increases charges already incurred or eliminates an accrued claim.

17. Governing law and disputes

17.1. This Agreement is governed by the federal laws of the United Arab Emirates and the laws of the Emirate of Dubai applicable outside financial free zones, without regard to conflict-of-law principles, subject to mandatory law.

17.2. A party shall first send a written description of a dispute to the other and give 30 calendar days for good-faith commercial negotiations. If unresolved, the courts of Dubai, United Arab Emirates, have exclusive jurisdiction to the extent the parties may validly agree to that forum. Either party may seek immediate urgent relief from a competent court to protect confidential information, intellectual property, data or property.

17.3. This English-language text expresses the parties' contractual agreement. Where Arabic pleadings or certified translations are legally required by a competent court, the parties will comply. This clause does not assert that Dubai onshore courts conduct all proceedings in English.

18. General provisions

18.1. Parties are independent contractors; no partnership, joint venture, insurance, agency or fiduciary relationship is created. Fleexa cannot bind Customer to rental agreements merely by supplying software.

18.2. Neither party is responsible for delay caused by events beyond its reasonable control, excluding obligations to pay for services already supplied. The affected party must promptly notify the other and mitigate impacts. A continuous material force-majeure event lasting more than 45 days entitles either party to terminate the affected Service with refund of unused prepaid subscription fees.

18.3. Customer may not assign this Agreement to a separate business without Fleexa's prior written consent, not unreasonably withheld. Fleexa may assign it in connection with a bona fide merger, sale or reorganisation where the successor assumes this Agreement and all data-protection commitments; Fleexa shall notify Customer and provide an exit right if the successor materially reduces Customer's rights.

18.4. Neither party waives a right by delay in exercising it. If a provision is unenforceable, the remaining provisions stay in effect and the invalid provision is read down only to the extent permitted by law.

18.5. The Agreement, its incorporated schedules and any duly accepted subscription confirmation are the complete agreement concerning the Service and supersede prior inconsistent discussions. Customer purchase-order boilerplate is not incorporated unless expressly countersigned by Fleexa and identified as amending a specific clause.

18.6. Electronic acceptance, invoices, records and notices may be used to conclude and administer this Agreement, consistent with applicable UAE electronic-transactions law. Fleexa retains reasonably available records of version, acceptance timestamp and accepting account; Customer should retain its own records.

Contractual notices: contact@fleexa-group.com<br>
Support and security incidents: support@fleexa-group.com<br>
Service information: https://fleexa-group.com

FLEEXA SUBSCRIPTION AND BILLING POLICY

Effective date: 29 October 2026 · Version 1.0<br>
Part of the Fleexa Master Software-as-a-Service Agreement

1. Product covered and published prices

This Policy governs Fleexa Fleet Management, the initial subscription offered to car-rental and fleet businesses. Prices are expressed in US dollars (USD) and exclude any legally applicable VAT or other transaction tax.

Fleexa Plus, Enterprise, CRM seats, omnichannel messages, AI-recognition usage and other separately priced services are not included in the Fleet Management subscription and will not be billed without affirmative activation of a priced order. This Policy does not represent those features as deployed or available in the initial product.

2. Meaning of an active owned vehicle

An owned vehicle is a vehicle in the Account that Customer represents it owns or controls as its own fleet asset, distinct from a vehicle temporarily sourced from a partner. An active owned vehicle is an owned vehicle with operational active status for any relevant day, including a vehicle temporarily booked out, reserved or undergoing ordinary maintenance while remaining in Customer's managed active fleet. Vehicles placed into draft, sold, retired or properly archived status are not active beginning the following calendar day. Merely deleting a booking does not archive an owned vehicle.

For clarity, Fleexa may check reasonable system audit information where active-vehicle counts have been manipulated to evade the subscription; corrections must be evidence-based and may be disputed as stated below.

3. Monthly calculation and proration

Fleet Management recurring charges are calculated for each UTC calendar month (or the portion of that month falling within the paid subscription). For each vehicle, its charge is USD 5 × (number of days active during that paid month ÷ number of calendar days in that month). The sum across vehicles is the usage-based fleet amount. The recurring charge is the greater of the usage-based fleet amount and USD 75 prorated to the number of paid days in that month. This daily-proration method protects customers who add or remove active vehicles midmonth; the minimum remains applicable.

Examples of the contractual arithmetic: 10 vehicles active for an entire 30-day paid month cost USD 75 rather than USD 50; 20 vehicles active throughout cost USD 100; a vehicle active for 15 of 30 days contributes USD 2.50 toward that month's fleet amount. These examples illustrate the formula and do not replace it.

Partner-rental charges are added after the fleet amount and are not absorbed by the USD 75 minimum. The total before tax is the fleet amount plus chargeable partner-rental activations plus separately accepted optional charges.

4. Partner-vehicle rental events

A partner-vehicle rental is a reservation operated by Customer in which the vehicle is supplied by a separate owner, partner or rental business instead of Customer's owned fleet. A chargeable activation occurs when the reservation changes to an active or started rental and the real-world vehicle handover or rental commencement is confirmed in the Service, whichever is later. Each distinct real-world partner rental is counted once; editing dates, changing a document, recording partial payment or returning the vehicle does not create another charge.

Cancelled partner reservations are free. A booking cancelled before actual rental commencement is not charged. If an advance status change created a USD 3 charge and the booking is later cancelled without handover, Fleexa shall reverse the charge or credit it on the next invoice after verification of the audit trail. If a vehicle was actually handed over and used, the charge remains payable even if the rental ends early. Reversing completed rentals simply to avoid a charge is prohibited. Fleexa will correct duplicate or erroneous activations.

5. Trial and conversion to paid service

The free implementation/trial period starts on the date Fleexa activates the new business Account. It lasts 30 consecutive calendar days, whether or not Customer has completed all configuration. Fleexa may voluntarily extend it in a written account confirmation. No recurring Fleet Management or partner-activation fee accrues during that period.

Fleexa will send a reminder of trial expiry to the Account administrator. The Account will not convert into a billable subscription without Customer's acceptance of a paid order, payment instruction or other clear affirmative authorisation. Where no authorisation is received, Fleexa may disable new operational entries and allow the data-export process described in the Master Agreement.

6. Billing cycle, payment and receipts

Recurring fees accrue for each paid month and are ordinarily invoiced monthly in arrears, including usage recorded during the month. Fleexa may invoice the recurring minimum at the beginning of a monthly period and reconcile vehicle days and partner activations on the following invoice, provided there is no double charge. Where an annual subscription is separately accepted, the applicable order governs timing of annual prepaid fees and usage reconciliation.

Payment is due on the date printed on a valid Fleexa invoice, or, if none, 14 calendar days from issue. Fleexa may offer approved payment methods via invoice or payment instructions. Payment-card details, if collected by a payment processor, are governed by that processor's applicable security and privacy arrangements; Customer should never upload full card details to rental records.

Fleexa invoices show its actual billing entity, lawful invoice information, tax treatment, billable fleet activity and any partner-activation charges. Generated invoices issued by Customer to its renters are separate documents and are not invoices issued by Fleexa.

7. Annual billing and price changes

If Fleexa affirmatively offers and Customer expressly accepts annual prepayment, the publicly advertised 20% annual discount applies to eligible recurring Fleet Management subscription charges for the committed annual term; partner-activation transaction fees, applicable taxes and third-party usage are excluded unless stated otherwise in the accepted order. Annual subscriptions do not arise automatically from a displayed price toggle. For annual commitments, cancellation and renewal obligations are specified in the accepted order; absent an accepted annual order, the subscription is monthly and cancellable under the Master Agreement.

Fleexa may alter published pricing for future Subscription Periods by giving existing monthly Customers 30 days' written notice before the increased charge begins. Customer may cancel before that date without paying the increase. Rates agreed for a prepaid annual term are not increased midterm unless required by a change in law or expressly accepted by Customer.

8. Taxes and currency

Prices exclude applicable VAT and comparable taxes. If Fleexa is required to collect UAE VAT, it will charge the lawful rate, issue an appropriate tax invoice and show its tax registration details where required. The parties shall not represent that Fleexa is VAT-registered unless the billing entity has a valid tax registration. A customer paying from an AED account may incur bank conversion costs; no fixed USD/AED conversion rate is promised.

9. Disputes, corrections and credits

Customer may request a fee review by emailing support@fleexa-group.com with relevant booking and vehicle identifiers. Fleexa will provide a reasonable itemised explanation and correct duplicate activations, misclassified owned vehicles and verified billing errors by refund or next-invoice credit. Customer shall pay undisputed amounts on time. Verified under-billing attributable to a clear software error may be corrected for the three immediately preceding monthly billing periods, on reasonable supporting records and notice; this look-back does not prevent recovery of deliberate fraud or claims required by law.

Customer-initiated downgrade or cancellation does not retrospectively cancel a completed paid month or a genuine partner rental. Any charge imposed in error, or made in breach of the trial rule, is refundable.

10. Cancellation, failed payments and data access

A monthly subscriber may cancel by notifying support@fleexa-group.com or by using any available in-product cancellation mechanism. Cancellation stops renewal at the end of the paid cycle, while valid amounts already incurred remain due. Suspension for overdue amounts, cure periods and export rights are governed by Sections 7 and 14 of the Master Agreement.

11. Commercial fairness and precedence

No undocumented sales conversation, marketing example or unaccepted optional feature authorises an additional charge. Customer-specific written pricing duly accepted by both parties prevails to the extent it expressly changes a line item in this Policy. Fleexa retains subscription and billing audit records for lawful accounting and dispute purposes as described in its Security and Data Retention Schedule.

Billing enquiries: support@fleexa-group.com

FLEEXA DATA PROCESSING AGREEMENT

Effective date: 29 October 2026 · Version 1.0<br>
Incorporated into the Fleexa Master Software-as-a-Service Agreement

1. Scope and parties

1.1. This Data Processing Agreement (DPA) governs personal data that Fleexa processes on behalf of the business Customer through the subscribed Fleet Management Service. The Customer and Fleexa are the parties defined in the Master Agreement. The DPA becomes binding automatically upon acceptance of the Master Agreement and does not require separate signatures.

1.2. For renter, driver, booking, partner and employee personal data entered into Customer's operational workspace (Customer Personal Data), Customer ordinarily acts as the controller and Fleexa acts as the processor. Customer determines why the data is collected and used, which data to include, the legal basis, the content of rental documents and the applicable retention periods. If Customer is itself a processor for another controller, Fleexa is a subprocessor to the extent permitted by that controller's instructions.

1.3. Fleexa acts as a separate controller for its own business-contact information, subscription administration, billing, legal compliance, product-security logs, fraud prevention and direct relationships with site visitors and account administrators. That separate processing is explained in the Fleexa Privacy Notice and is not performed on Customer's instructions. This separation does not entitle Fleexa to market to Customer's rental customers using their operational records.

1.4. Applicable law includes the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, where applicable, and any other data-protection law that legally governs the relevant processing. Distinct DIFC, ADGM or overseas requirements apply only when their jurisdictional conditions are met. Nothing in this DPA creates an unsupported claim that the Service is certified under any specific legal regime.

2. Processing instructions

2.1. Customer instructs Fleexa to process Customer Personal Data solely to provide and administer the subscribed Service; authenticate users; store and retrieve business records; enable configured reservations, documents, payment records and customer communications; provide technical support; investigate misuse; maintain security; perform backups and deletion; and comply with mandatory law. Customer's configurable use of the Service, lawful support requests and this DPA are documented instructions.

2.2. Fleexa shall not use Customer Personal Data for independent advertising, sell it, use it to train a public or third-party general-purpose AI model, disclose it to a competing rental company, or combine identifiable renters across Customer accounts for profiling. Fleexa may process strictly de-identified and aggregated operational metrics as permitted by the Master Agreement, with reasonable anti-re-identification safeguards.

2.3. If Fleexa reasonably believes an instruction violates applicable data-protection law, it shall notify Customer unless prohibited by law and may suspend only the affected processing while the issue is resolved. Fleexa is not required to follow unlawful instructions.

3. Controller obligations

3.1. Customer shall establish and document appropriate legal bases and disclosures for the collection and processing of data about renters, prospective renters, drivers, employees and partners. It shall obtain legally valid consent where required, especially for optional marketing or AI processing where another lawful basis is unavailable, and maintain evidence of such consent when necessary.

3.2. Customer determines whether collecting passport scans, driver's licences, photographs, identity numbers, contact details, address data and signature records is necessary and proportionate. Customer shall minimise data, limit employee permissions, respect expiry and legal retention rules and avoid processing unrelated categories of sensitive data.

3.3. Customer is responsible for responding as controller to access, correction, objection, deletion and other rights requests; reporting regulatory incidents where the law places that duty on the controller; and satisfying legal requirements for overseas transfers that Customer initiates through its chosen configuration.

3.4. Customer shall not upload card PINs, card verification codes, prohibited identification material or data obtained unlawfully. Customer shall assess the necessity and legality of any biometric, health or other special-category processing before enabling it. A photo of an identity document does not authorise unrelated facial profiling.

4. Fleexa processor obligations

4.1. Fleexa shall process Customer Personal Data only on Customer's documented lawful instructions except where processing is required by law. Where lawful, Fleexa shall inform Customer before mandatory processing outside those instructions.

4.2. Fleexa shall ensure that personnel with access to Customer Personal Data are bound by confidentiality or an equivalent legal duty, receive access only for a legitimate need, and are instructed on secure handling.

4.3. Fleexa shall implement and maintain appropriate technical and organisational safeguards under the Security and Data Retention Schedule, taking into account the risks from document scans, account separation, unauthorised staff access, theft and loss of availability.

4.4. Taking into account the Service and information available to it, Fleexa shall reasonably assist Customer with responding to privacy rights requests, lawful regulatory enquiries, security incidents and data-protection impact assessments. Requests requiring material bespoke engineering, extensive litigation discovery or unusual forensic work may be subject to separately agreed reasonable costs where lawful.

4.5. Fleexa will not knowingly allow one customer to access another customer's operational workspace. It shall investigate suspected cross-tenant exposure promptly and notify affected controllers as required by this DPA.

5. Subprocessors

5.1. Customer gives Fleexa general authorisation to engage subprocessors in the functional categories described in Annex B: cloud hosting and storage; backup and disaster recovery; transactional email and authentication; service monitoring and technical support; and, only if activated for Customer, document recognition, electronic signing, communications or external integrations.

5.2. Fleexa shall enter into written agreements imposing substantially equivalent confidentiality, security, purpose restrictions and assistance commitments on each subprocessor. Fleexa remains responsible to Customer for the subprocessor's performance of its delegated processing obligations to the extent required by applicable law.

5.3. Before authorising any new or replacement subprocessor to process Customer Personal Data, Fleexa shall give 15 calendar days' advance notice by email or in-product notice, identifying the new provider, its processing function and principal processing location, except for an urgent replacement necessary to protect security or maintain service, in which case it will notify as soon as reasonably practicable. Customer may object on documented reasonable data-protection grounds within that notice period. The parties shall try in good faith to find an alternative; if no lawful reasonable alternative is available, Customer may terminate the affected Service prospectively with a pro-rata refund of prepaid unused fees.

5.4. The categories in Annex B are contractual authorisations, not representations of any named vendor currently engaged. Customer may request the current names and principal processing countries of subprocessors relevant to its Account by emailing support@fleexa-group.com, and Fleexa shall provide that information before transferring Customer Personal Data to a newly engaged materially different provider. Any actual subprocessor register provided to Customer forms part of its processing information.

6. Processing locations and international transfers

6.1. This DPA makes no representation that all Customer Personal Data is hosted exclusively in the UAE. Customer understands that access, storage, support or processing may involve other countries, subject to this section and any applicable law. Fleexa shall provide Customer on request with the principal hosting region and material transfer destinations used for Customer's Account.

6.2. Fleexa shall not transfer Customer Personal Data internationally in a way that breaches the transfer restrictions of applicable data-protection law. Where an adequacy mechanism is unavailable, Fleexa shall implement a legally valid alternative where required, including appropriate contractual safeguards or another permitted legal ground, and shall assess material transfer risks as necessary.

6.3. If EU or UK GDPR legally applies to a particular transfer, the parties shall implement the legally applicable transfer mechanism before making a restricted transfer. This DPA does not claim to incorporate or execute international Standard Contractual Clauses simply by mentioning them. A transfer must not proceed if a legally necessary transfer instrument is missing.

6.4. Customer is responsible for independently assessing transfers to third parties that it directly initiates, including download or sharing of renter data, or optional integrations for which Customer appoints an independent controller.

7. Security incidents and notifications

7.1. A Personal Data Breach means a confirmed breach of security causing accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Customer Personal Data.

7.2. Fleexa shall notify Customer without undue delay and, where reasonably practicable, within 72 hours of becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data. The notice shall describe the known incident, likely categories and approximate scope, containment and remediation actions, and an incident contact. If information is incomplete, Fleexa shall provide updates as reasonably available. This 72-hour period is a contractual response target, not a representation that UAE federal law always imposes a universal 72-hour processor notification deadline.

7.3. Fleexa shall take reasonable steps to contain and remediate its security incident, preserve relevant evidence consistently with law, and assist Customer in assessing required notifications. Customer is responsible for deciding and making notifications to renters, regulators and other affected persons where Customer acts as controller, unless mandatory law independently obliges Fleexa.

7.4. Neither party shall issue misleading public statements about a breach or name the other without consent unless legally required. The parties shall coordinate communications where practical, without preventing lawful reporting.

8. Individual rights and regulator assistance

8.1. If Fleexa receives a verified privacy request concerning Customer Personal Data, it shall promptly direct the requester to the relevant Customer where reasonably identifiable and legally permitted, or notify Customer securely. Fleexa shall not independently decide the merits of a Customer renter's deletion request except where law directly obliges Fleexa.

8.2. Subject to authentication and reasonable technical limits, Fleexa shall make available existing tools or reasonably practicable export, search, correction and deletion assistance, consistent with other persons' rights and record retention law.

8.3. If a regulator contacts Fleexa about Customer Personal Data, Fleexa may respond to the extent required by law and will notify Customer where lawful and appropriate.

9. Audit and assurance

9.1. At Customer's written request not more than once in a 12-month period, Fleexa shall provide reasonably available information sufficient to demonstrate compliance with this DPA, which may include relevant security policy summaries, answers to a reasonable security questionnaire and applicable independent reports if such reports exist. This clause does not represent that any particular certification or audit report currently exists.

9.2. If that information is insufficient to address a documented material compliance concern, the parties shall agree a proportionate confidential audit of the relevant measures, with at least 20 business days' notice, during business hours, subject to security and confidentiality safeguards and without access to other customers' data or Fleexa trade secrets beyond what applicable law requires. Customer bears reasonable third-party auditor costs unless an audit establishes a material breach by Fleexa.

9.3. Fleexa may use a qualified independent assessor to satisfy reasonable audit requests where direct technical access would create security risk.

10. Return, deletion and retention

10.1. During the subscription and the 30-day post-termination export period, Customer may request reasonably available structured exports and copies of stored documents under the Master Agreement. Fleexa shall not withhold routine export solely because disputed sums are unpaid, but may require reasonable identity and authorisation checks.

10.2. After that period Fleexa shall delete or irreversibly de-identify active Customer Personal Data within 60 days unless legal retention, an active dispute, preservation order or other binding law requires retention. Residual backup copies shall be overwritten or deleted through normal backup rotation, targeted to complete within 90 days after active-system deletion, unless technically infeasible or legally prohibited; remaining copies stay protected and are not actively used for other purposes.

10.3. The parties may agree an earlier deletion when lawful and technically reasonable. Fleexa may retain separate-controller information such as invoices and security incident records only for a lawful purpose and only as long as necessary under its Privacy Notice and applicable law.

10.4. Upon written request after the deletion cycle, Fleexa shall provide written confirmation of completion or describe the limited grounds for lawful retention.

11. Liability, precedence and duration

11.1. Liability for breaches of this DPA is governed by the Master Agreement, including its non-excludable liability carve-outs. Nothing purports to remove statutory rights of individuals or powers of supervisory authorities.

11.2. This DPA prevails over the Master Agreement where the provisions directly conflict about personal data processing. It remains in force while Fleexa processes Customer Personal Data, including lawful post-termination retention.

11.3. Privacy notices given to individual renters by Customer remain Customer's responsibility. Fleexa's public Privacy Notice explains Fleexa's separate-controller activities and is not a substitute for those notices.

Annex A — Description of processing

Annex B — Authorised subprocessor functions

Privacy and data-protection contact: contact@fleexa-group.com<br>
Operational security incident contact: support@fleexa-group.com

FLEEXA SECURITY AND DATA RETENTION SCHEDULE

Effective date: 29 October 2026 · Version 1.0<br>
Part of the Fleexa Master Software-as-a-Service Agreement and Data Processing Agreement

1. Security objective and responsibility

Fleexa shall maintain administrative, physical and technical security measures appropriate to the nature, scope, context and risk of the subscribed cloud Service, especially risks involving renter identity documents, fleet records, banking-status records, customer company separation and unauthorised employee access. This Schedule states binding security standards for provision of the paid Service; it does not claim an unverified ISO, SOC 2, PCI DSS, UAE-government, cloud or trust-service certification.

Security is shared: Fleexa protects the platform and processing it controls; Customer controls the legality and content of uploads, its users, endpoint security, access assignments, recipient addresses and use of generated documents.

2. Technical and organisational safeguards

2.1. Access and account isolation. Fleexa shall implement authenticated access to business workspaces; role/permission enforcement in server-side operations; logical segregation of customers' records; restriction of production administrative privileges; and periodic review or timely revocation of privileged access when personnel leave a relevant role. Where available, Customer shall enable additional authentication protection for high-privilege accounts.

2.2. Encrypted transmission. Normal authenticated browser and API access to the Service shall use modern HTTPS/TLS connections. Fleexa shall not deliberately expose renter identification documents or raw passwords over unencrypted public HTTP. Fleexa shall use appropriate protections for secrets and credentials stored under its control.

2.3. Protection of stored data. Fleexa shall use controlled storage access, logical tenant separation and industry-standard protective controls available in the selected infrastructure, including encryption of stored information or equivalent compensating protections proportionate to risk. Customer must not treat the Service as a safe location for payment-card PINs or CVV data.

2.4. Software security. Fleexa shall use reasonable release controls, vulnerability assessment, dependency maintenance, access review and remediation processes. Critical exploitable vulnerabilities identified in production shall be triaged promptly and mitigated according to severity and practical availability of fixes.

2.5. Support access. Support personnel may access a Customer workspace only where reasonably necessary for a customer-authorised support request, integrity/security incident or legal obligation. Access shall be restricted to authorised personnel under confidentiality duties and auditable where technically feasible. Support staff must not use identifiable renter data for unrelated commercial purposes.

2.6. Backups and recovery. Fleexa shall maintain periodic backups or other recovery measures appropriate to the Service's operational risk, with access restrictions and separation from the primary operating data sufficient to reduce common failure risks. Fleexa shall have a recovery procedure and periodically assess its restoration capability. Backup frequency and recovery times are not guaranteed fixed values absent an express written subscription confirmation; Customer remains responsible for exporting critical business records.

2.7. Third parties. Fleexa shall use reasonable vendor diligence and written confidentiality, security and data-processing terms for subprocessors. Fleexa may not excuse its own contractual security commitments merely by subcontracting performance.

2.8. Incident management. Fleexa shall maintain a process to identify, investigate, contain, document and remediate significant information-security incidents. Customer data breaches are notified under the Data Processing Agreement. Service availability incidents are addressed under the Service Level and Support Policy.

3. Customer's security duties

Customer must configure permissions according to job necessity; promptly revoke former personnel; avoid shared passwords; secure workstations, devices and email inboxes; check recipients before sending identity documents; protect API keys; inform Fleexa promptly of suspicious access; and ensure that employees have lawful access to identity and payment records.

Customer must not rely on a visible UI restriction alone to determine whether a person is authorised to see private records. Suspected access-control defects shall be reported promptly and not exploited.

4. Operational data lifecycle

Fleexa shall not promise a general right to retain an individual's passport image forever merely because Customer has an ongoing subscription. Customer shall make proportionate retention decisions under the applicable law and any mandatory rental-record requirements.

5. Export and end-of-service deletion

5.1. Following termination, Customer has 30 calendar days to request export of reasonably accessible operational records in accordance with the Master Agreement. Customer should make and validate an independent copy before deleting its Account or allowing the export period to end.

5.2. Unless legally required to retain particular records, Fleexa shall delete or irreversibly de-identify active Customer Personal Data within 60 days after the export period ends. Backup copies will be removed through normal rotation, targeted within 90 days after active-data deletion unless a technical limitation or legal preservation obligation requires a longer protected period. Preserved copies are not restored to ordinary operational use absent a lawful reason.

5.3. Requests for earlier deletion may be made to support@fleexa-group.com and will be honoured when lawful and technically practicable. Fleexa may preserve evidence of fraud, a security event, nonpayment or litigation for a proportionate period where justified and lawful. The fact of an active dispute does not give unrestricted permission to retain unrelated renter data.

5.4. If Fleexa accidentally restores data scheduled for deletion from a backup, it shall reapply the outstanding deletion instruction within a reasonable time subject to any lawful exception.

6. Recovery and continuity limitations

Fleexa shall make commercially reasonable efforts to restore a material service failure, preserve available records and communicate known operational consequences. Neither party should assume that a cloud management service guarantees recovery of every entry, an uninterrupted live link, or immunity to third-party outages. The remedies for Service availability failures are those described in the Master Agreement and Service Level and Support Policy, without excluding mandatory statutory rights.

7. Updates and verification

Fleexa may update safeguards to respond to changing threats, provided it does not materially reduce the protection required by this Schedule during an existing paid term without a justified equivalent control or Customer's express agreement. On reasonable request Fleexa will provide a written description of material controls relevant to Customer's data, subject to security and confidentiality restrictions.

Security contact: support@fleexa-group.com<br>
Privacy enquiries: contact@fleexa-group.com

FLEEXA SERVICE LEVEL AND SUPPORT POLICY

Effective date: 29 October 2026 · Version 1.0<br>
Part of the Fleexa Master Software-as-a-Service Agreement

1. Coverage

This Policy applies to customers with an active paid Fleexa Fleet Management subscription and covers availability of the core hosted application and support for defects materially affecting its functions. Trials, unpaid suspended Accounts, demonstration systems, beta features, external partner systems and separately supplied integrations do not carry a paid-service availability commitment.

2. Availability objective

Fleexa will use commercially reasonable efforts to achieve 99.5% monthly availability of the core Fleet Management Service, measured from successful authenticated access to its principal cloud application and usable core booking/vehicle functions, excluding the events in Section 3. This is a service objective with a defined service-credit remedy, not an absolute guarantee that every screen, document, bank, SMS gateway, email message or third-party integration will always operate.

Monthly Availability Percentage = ((Eligible Minutes − Unavailable Minutes) ÷ Eligible Minutes) × 100. Eligible Minutes are total calendar minutes in the paid month less properly excluded minutes. Unavailable Minutes are those when the core hosted Service is materially inaccessible to substantially all of Customer's active Account users due to a failure within Fleexa's reasonable control. Partial cosmetic errors, one user's device issues and isolated third-party outages are not automatically full-Service unavailability; material impairment can still constitute a support incident.

3. Exclusions

Excluded minutes include: scheduled maintenance reasonably notified at least 24 hours in advance; emergency maintenance reasonably necessary to address a material security or integrity risk; Customer's internet, devices, credentials, configurations and unauthorised modifications; third-party carriers or APIs outside Fleexa's control; public cloud disruption not caused by Fleexa's own breach of its commitments; force majeure; malicious traffic or cyberattacks not reasonably preventable by appropriate controls; and periods during which Customer requests suspension or fails to complete a required lawful action. An exclusion does not apply where Fleexa's proven breach of its own security or vendor-management obligations materially caused the outage.

Fleexa will use reasonable efforts to schedule disruptive planned maintenance outside normal UAE business hours and minimise its length.

4. Service credits

A paying Customer may claim a credit for a calendar month where the measured Monthly Availability Percentage falls below the objective:

Credits exclude taxes, partner-rental transaction fees, third-party charges and separately agreed services. A credit shall not exceed 10% of the eligible recurring subscription charge for that month. Credits are applied to the next valid invoice; if the subscription has ended, an approved unused credit will be refunded by a reasonable available payment method. Credits cannot be sold or transferred.

A claim must be emailed to support@fleexa-group.com within 30 days after the affected month, identifying the Account, dates, observed problem and available evidence. Fleexa shall review its logs and Customer's evidence fairly, explain any refusal and provide an opportunity to correct factual errors. Credits are the agreed financial remedy for availability shortfalls to the extent permitted by law; they do not exclude remedies for independent breaches, fraud, gross negligence or rights that cannot legally be restricted.

5. Support channels and hours

Standard support requests are accepted by email at support@fleexa-group.com. Support is monitored during Monday–Friday, 09:00–18:00 Gulf Standard Time (UTC+4), excluding UAE public holidays. Critical incidents may be reported at any time by email; receipt outside staffed hours does not imply 24/7 live-agent coverage. VIP onboarding or priority support described in a subscription may prioritise triage, but does not create an unstated guaranteed resolution time.

6. Severity and response targets

Business hours count only during the support window. A response target measures acknowledgment and initial triage, not guaranteed repair time. Fleexa shall provide reasonable incident updates for P1/P2 incidents and make commercially reasonable efforts to resolve or mitigate them based on severity, technical complexity and external dependencies.

7. What support includes

Reasonable explanation of product behaviour; basic technical assistance; investigation of reproducible defects; configuration guidance; billing queries; account-access troubleshooting; advice on supported export functions; and triage of document-generation failures. Support does not include furnishing legal advice, drafting customers' rental terms, accounting certification, government filing, driver screening, recovery of tenant devices, custom engineering or guaranteed resolution of third-party vendor disputes.

8. Customer cooperation and escalation

Customer shall provide sufficient detail, authorised access and reproducible steps while avoiding unnecessary disclosure of real renter identity documents. Fleexa may request redacted test records instead. If a problem exposes private data, Customer should not send that data through an unsecured email attachment unless a secure delivery method is agreed. Unresolved material incidents may be escalated to contact@fleexa-group.com.

9. Changes to this policy

Material adverse changes to paid-service availability commitments or credit thresholds require at least 30 days' written notice, and Customer may terminate under the Master Agreement if the change materially impairs its purchased Service. Changes that improve availability, support or security may take effect sooner.

Support: support@fleexa-group.com<br>
Contractual escalation: contact@fleexa-group.com

FLEEXA ELECTRONIC DOCUMENTS, SIGNATURES AND AUTOMATION ADDENDUM

Effective date: 29 October 2026 · Version 1.0<br>
Part of the Fleexa Master Software-as-a-Service Agreement

1. Purpose

This Addendum governs functions that help a rental company prepare, generate, sign, store or deliver rental agreements, invoices, vehicle handover and return records, and other documents. It also governs AI-assisted recognition or extraction of identity documents only when such functionality is actually enabled for Customer. The Addendum allocates responsibilities; it does not claim that every described feature is operational in every subscription.

2. Separation of contracts and roles

2.1. Documents generated from a Customer Account are issued by Customer as the contracting rental company, not by Fleexa. The rental company and its relevant renter, partner or supplier remain the parties to the rental transaction. Fleexa is not the lessor, fleet insurer, bank, collection agent, guarantor or beneficiary of a renter's deposit.

2.2. The rental company's name, licence, contact details, contractual terms, rental prices, vehicle details, insurance wording, VAT treatment, tolls, fines, excess amounts, payment instructions, signatory details and bank-account details are Customer-controlled information. Customer must provide and verify those details and has sole responsibility for the underlying transaction, except for provable errors caused by Fleexa's breach of its own document-generation obligations.

2.3. Fleexa may provide layout elements, field mappings or suggested generic drafting conventions. Such materials do not constitute legal, tax, financial, insurance or regulatory advice and cannot replace Customer's own legally compliant terms approved for its activities and jurisdiction.

3. Customer approval and document review

3.1. Customer shall review a final document before signature, delivery, accounting use or reliance, including all displayed parties, dates, vehicle and registration data, rental period, price, deposits, insurance, VAT, charges, translated text, mandatory disclosures, signatures and attachments.

3.2. Where generated figures conflict with booking or payment records, Customer must stop issuance and obtain correction. An invoice amount, rental-agreement total and deposit ledger must not be treated as reconciled merely because the files were produced by the same workflow. Customer shall confirm that invoice totals equal their valid line items and that deposits are properly distinguished from rental income and tax items.

3.3. Fleexa shall use reasonable care in implementing document-generation functionality described in the purchased Service and investigate reproducible calculation, mapping, layout, permission or transmission defects notified by Customer. If a document is known to be materially inaccurate due to a platform defect, Fleexa shall use commercially reasonable efforts to fix the defect and enable a corrected document. This does not retrospectively validate an incorrect document already issued.

3.4. When an existing agreement is updated after signature, Customer must determine whether a new consent, amendment or signature is required. Merely regenerating a PDF is not the same as obtaining the other contracting party's legally effective consent. Customer shall maintain the appropriate version and signature records.

4. Electronic signatures and evidentiary limits

4.1. Customer shall determine whether the proposed electronic-signature method is legally suitable for its rental transaction, establish signatory identity and authority, present required information and obtain consent to sign electronically where applicable. Customer shall configure delivery to the correct email address or other authorised channel.

4.2. UAE electronic transactions and signatures are governed, among other instruments, by Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services and its applicable implementing regulations. Electronic signatures can have legal effect when legal requirements are met, but legal validity and evidentiary weight depend on the transaction, identity, consent, technical method and relevant law.

4.3. Unless expressly and separately confirmed in an accepted service order, Fleexa does not claim to act as a licensed qualified trust-service provider or to issue qualified electronic signatures, seals, timestamps or certificates. A click, typed name, image of a handwritten signature or signature pad record is not represented as a qualified signature merely because it appears in a PDF.

4.4. Customer must not copy or reuse any person's signature image, company stamp or signing credential on a new agreement without lawful authority. Customer is responsible for who may upload stamps, access signing flows, approve a document and deliver the signed version.

4.5. To the extent a relevant feature is supplied, Fleexa shall make reasonable efforts to preserve the generated document and available event metadata. Fleexa does not guarantee that a document will be accepted in any specific court, immigration office, insurer, bank or governmental workflow.

5. Invoices, tax records and payment ledgers

5.1. Customer, as the supplier of a rental, must assess whether VAT applies, whether it is tax-registered, the applicable invoice requirements, record retention and any obligation to issue electronic invoices in a prescribed official format. Fleexa's calculation and PDF generation tools assist bookkeeping but do not replace Customer's accounting or compliance function.

5.2. A PDF, scanned image or emailed invoice produced by Fleexa is not automatically a structured UAE e-Invoice recognised under the UAE Federal Tax Authority's e-Invoicing system. Where the law requires a compliant machine-readable e-Invoice, Customer must use an approved compliant process or integration; Fleexa does not represent that ordinary PDF issuance alone satisfies that obligation.

5.3. The labels paid, charged, balance, refunded and deposit describe entries in Customer's operational ledger unless a separately enabled and verified payment integration confirms a financial transaction. An entry in Fleexa is not conclusive proof of money reaching or leaving a bank account. Customer must reconcile bank and payment-processor records independently.

5.4. Customer shall keep refundable deposits and amounts owed to a renter distinguishable from rental revenue, insurance charges, damage charges and tax. Customer is responsible for authorising refunds, identifying the beneficiary, complying with applicable accounting rules and resolving chargebacks.

6. AI-assisted document recognition

6.1. When AI-assisted extraction is activated, the feature may read fields from submitted passport, driving-licence or other lawful identity-document images and suggest values for Customer's reservation records. It is a clerical assistance tool, not identity verification, anti-fraud certification, legal eligibility approval, or a decision on whether a person may drive.

6.2. AI outputs may contain missing fields, altered characters, incorrect dates, wrong document numbers, misread nationality, hallucinated content or mismatched identities. Customer must compare extracted values against original documents and comply with its own lawful driver screening and record-verification procedures before any handover or issuance.

6.3. Customer shall provide legally required privacy notices and bases for submitting documents for recognition. Fleexa shall limit use of those images and output to instructions described in the Data Processing Agreement and shall not use Customer Personal Data to train public general-purpose AI models.

6.4. AI recognition, model services and related transfers may involve an additional subprocessor only after the applicable DPA protections and notices. Customer must not activate the feature for sensitive records whose processing is prohibited or lacks a lawful basis.

6.5. No AI-recognition usage fee applies unless Customer affirmatively accepts the fee and activates the relevant option. A promotional description or pricing calculator does not by itself enable a paid AI service.

7. Third-party messaging and delivery

7.1. When enabled, Fleexa may transmit documents through email or a configured messaging or signing vendor. Delivery depends on accurate recipient information, connection credentials, service-provider availability and third-party rules. Fleexa does not guarantee inbox delivery, message reading or a recipient's action.

7.2. Customer shall obtain any required marketing permissions and comply with applicable channel policies. Transactional rental messages may not be repurposed for unauthorised advertising. Fleexa shall not share Customer's identifiable renter records with marketing partners for Fleexa's independent campaigns.

8. Template content, translations and ownership

8.1. Customer owns its contract language and is responsible for the accuracy and consistency of its English, Arabic and other translations, including mandatory regional requirements. Where the same contract is published bilingually, Customer must determine which legally effective language prevails and must avoid divergent terms.

8.2. Customer must have permission to use uploaded third-party templates, company logos, stamps and translated clauses. Fleexa's platform licence does not convey third-party copyrighted text to Customer or guarantee that any uploaded template may lawfully be reused.

8.3. Customer may export and retain its own generated contracts and invoices under the Master Agreement. Fleexa retains the rights to its software, layouts and platform-specific automation logic.

9. Defects, liability and evidence preservation

9.1. Upon discovering a material output error, each party shall take reasonable steps within its control to prevent further affected documents from being issued, preserve relevant evidence and cooperate on a correction. Customer must assess whether prior renters or authorities need corrected documents or fresh signatures; Fleexa shall provide reasonable technical assistance for its own defect.

9.2. The indemnity, warranties and limitations in the Master Agreement apply to this Addendum, without excluding liability for Fleexa's own proven misconduct, statutory responsibilities or breach of express obligations where such liability cannot lawfully be excluded.

9.3. Customer should retain signed copies, audit evidence available from the Service, correspondence and the original documents necessary to demonstrate lawful contract formation and tax compliance. Fleexa is not a perpetual legal evidence escrow service.

Document and account support: support@fleexa-group.com

FLEEXA ACCEPTABLE USE POLICY

Effective date: 29 October 2026 · Version 1.0<br>
Part of the Fleexa Master Software-as-a-Service Agreement

1. Purpose and scope

This Policy applies to each business Customer, Authorised User and any person using Customer's Fleexa credentials, API access or integrated workflows. Use is permitted only for legitimate business fleet and vehicle-rental administration and within the rights granted in the Master Agreement.

2. Prohibited activity

Customer and its users must not:

1. Use Fleexa to facilitate illegal vehicle rentals, fraudulent insurance claims, fictitious bookings, false invoices, sham payments, money laundering, sanctions evasion, forgery or identity theft.
2. Access another customer's data, attempt to bypass tenant boundaries, exploit access-control errors, impersonate another user or intentionally obtain data beyond assigned permissions.
3. Upload or distribute malware, ransomware, malicious scripts, spam, phishing content or code intended to damage the Service or others.
4. Probe, scan, benchmark, stress-test or attack production infrastructure without Fleexa's written security-testing authorisation; this does not prevent lawful good-faith reporting of a vulnerability without exploitation or data disclosure.
5. Reverse engineer, decompile, copy, resell, sublicense, white-label or replicate proprietary software or interfaces except where mandatory law expressly permits an act that cannot be contractually restricted.
6. Scrape or bulk-extract other customers' information, interfere with performance, evade fair-use restrictions or use unauthorised bots to bypass user controls.
7. Enter card verification codes, payment-card PINs, stolen identity documents, unlawfully acquired personal data or sensitive data irrelevant to lawful rental operations.
8. Send unsolicited bulk marketing, misleading communications or messages lacking a required lawful basis, opt-out mechanism or third-party platform permission.
9. Misuse corporate stamps or signature images, forge a signature, alter executed documents without proper authorisation, or misrepresent a machine-generated record as an independently verified government document.
10. Manipulate active-vehicle status, create or reverse artificial B2B rentals, exploit billing defects or otherwise deliberately falsify subscription usage.
11. Disclose credentials, access tokens, renter documents or privileged information to unauthorised persons or share employee accounts contrary to the Master Agreement.
12. Upload content that violates others' copyrights, confidentiality, data-protection rights or applicable regulations.
13. Use the Service for independently regulated trust services, financial payment processing or government filings without the necessary approvals and specifically supported integration.

3. Security reporting

Anyone who discovers an apparent security weakness must report it promptly to support@fleexa-group.com, avoid viewing, copying or disclosing other users' information and stop testing once enough information exists to explain the issue. Fleexa will investigate good-faith reports and will not deem a report a breach merely because it identifies a genuine vulnerability, provided the reporter does not exploit it or act unlawfully.

4. Fair use and resource protection

Unlimited internal Fleet Management users means there is no separately priced user-seat ceiling for ordinary authorised use; it does not grant unlimited infrastructure, bulk messaging, API traffic or abusive automation. Fleexa may apply proportionate rate limits and protective controls where necessary to maintain platform security and performance. It shall make reasonable efforts to notify the Customer before a material non-emergency restriction and explain the basis of the restriction.

5. Investigation and enforcement

Fleexa may investigate credible abuse, preserve proportionate records, restrict specific credentials, block malicious traffic or suspend affected functionality. Except where urgent risk or law prevents notice, Fleexa will explain the suspected violation and allow a reasonable opportunity to remedy it. Severe fraud, unlawful conduct or a material security threat may justify immediate suspension under the Master Agreement.

Fleexa will not use this Policy as a general permission to inspect unrelated renter records or disclose Customer Data to competitors. Measures shall be proportionate, and Customer's lawful export and personal-data rights remain subject to the Master Agreement and Data Processing Agreement.

6. Consequences

A material or repeated violation can lead to suspension or termination under the Master Agreement and may be reported to competent authorities when required or permitted by law. Customer remains liable for actual documented losses and third-party claims caused by its violation, subject to the Agreement and mandatory law. Fleexa will not impose unannounced contractual fines merely on the basis of this Policy.

Report abuse or security concerns: support@fleexa-group.com