Terms of Sale and Use — OTOY BOOKING

Article 1 — Who we are

The OTOY BOOKING service is published and sold by:

OTOY BOOKING — Patxi Hiribarren, sole proprietor (micro-entrepreneur)
488 chemin d'Aguerria, 64500 Saint-Jean-de-Luz, France
SIRET: 825 137 276 00028
Contact: contact@otoy-booking.com

hereinafter "Otoy Booking".

Article 2 — Purpose and scope

2.1. These general terms and conditions (the "Terms") govern the subscription to and use of the OTOY BOOKING service, an online application for booking, payment collection and management intended for schools and professionals in the sports, leisure and wellness sectors (the "Service").

2.2. The Service is reserved for professionals acting in the course of their business (the "Client"). The right of withdrawal granted to consumers therefore does not apply. By subscribing, the Client declares that it is acting for professional purposes.

2.3. Subscribing constitutes full and unreserved acceptance of the Terms in the version in force on the date of subscription, accepted by ticking a checkbox before payment. This version is retained and remains available to the Client.

Article 3 — Definitions

• School: the Client's space within the Service, accessible at <subdomain>.otoy-booking.com.
• End Users: the persons who use the School — the School's customers, participants (including minors), instructors, administrators.
• Plan: Solo or School, as described in Article 4. The Centre plan is subject to a quotation and to specific terms and conditions.
• Option: a feature added to the Plan for an additional monthly fee.
• Business day: Monday to Friday, excluding public holidays in France.

Article 4 — The Service, Plans and Options

4.1. The content of each Plan and the list of Options are described on the Pricing page of the website on the date of subscription, and restated in the order summary.

4.2. Solo Plan: a single instructor. School Plan: five instructors included, and up to ten with the "additional instructor" Option. These numbers are commercial commitments: the Client undertakes not to exceed them without subscribing to the corresponding seats.

4.3. Options: each Option is billed at €5 per month in addition to the Plan. Some features are Options in Solo and are included in School, as set out on the Pricing page.

4.4. Third-party services. Certain features rely on a contract that the Client enters into directly with a third party:

• Online payment collection: payments from the School's customers are collected on the Client's Stripe account. Otoy Booking never holds the funds and takes no commission on bookings; Stripe's fees are borne by the Client in accordance with its contract with Stripe.
• SMS notifications: the SMS Option requires the Client to open an account with SMS Vert Pro and purchase its SMS credits there. These credits are billed by SMS Vert Pro and are not included in the subscription.

Otoy Booking is not responsible for the performance of these third-party contracts, nor for any unavailability of these services.

Article 5 — Subscription

5.1. The Client subscribes online: it chooses its Plan and Options, enters the details of its school and its administrator, chooses its subdomain, accepts the Terms, and then pays for the first month.

5.2. The Client warrants the accuracy of the information provided, in particular the information that will appear on the invoices the School issues to its own customers (company name, address, company registration number).

5.3. Subdomain. The subdomain is allocated subject to availability. It confers no ownership rights. Otoy Booking may refuse or withdraw a subdomain that is misleading, contrary to public policy, or infringes the rights of a third party (trademark, trade name).

Article 6 — Activation

6.1. The School is activated within 24 business hours of payment.

6.2. Otoy Booking then sends the designated administrator an e-mail containing the School's address, their username and a personal link to set their password. Otoy Booking never communicates any password and has no knowledge of it.

6.3. The configuration of the School (activities, locations, prices, instructors, content, connection to Stripe and to SMS Vert Pro) is the Client's responsibility.

Article 7 — Prices, invoicing and payment

7.1. Prices are stated in euros. VAT not applicable, article 293 B of the French General Tax Code (Code général des impôts). If Otoy Booking becomes liable for VAT, its prices may be revised: the Client will be informed under the conditions set out in Article 7.4.

7.2. Launch price: during the first six months, the Plan is billed at the launch price stated at the time of subscription. The standard price applies thereafter. Options are billed at €5 per month from the first month.

7.3. The subscription is payable monthly in advance, by bank card or by any other means offered at checkout, through the payment service provider Stripe. Otoy Booking does not store any banking data. Invoices are made available to the Client in its management area.

7.4. Price changes. Otoy Booking may change its prices. The Client is informed by e-mail at least 30 days before they take effect; outside the commitment period, the Client may terminate before that date. The launch price remains guaranteed during the first six months.

Article 8 — Term, commitment and termination

8.1. First month: satisfaction guaranteed or your money back. During the 30 days following subscription, the Client may terminate freely and request a full refund of the first payment, without having to give any reason. Termination ends the subscription; the School is deactivated under the conditions set out in Article 11.

8.2. Commitment. Beyond this first month, the subscription is entered into for a minimum term of six months from the date of subscription. A termination request made during this period takes effect at the end of the six months; the remaining monthly instalments remain due.

8.3. After six months, the subscription continues on a month-to-month basis and may be terminated at any time from the management area; termination takes effect at the end of the current month, with no refund for the month already started.

8.4. Options may be added at any time, with immediate effect and prorated billing. They may be removed at any time, including during the commitment period — which applies to the Plan —, with effect at the end of the current month. Options are added or removed upon simple request to Otoy Booking.

Article 9 — Payment default

9.1. If a payment fails, the Client is informed by e-mail and the charge is automatically retried.

9.2. If the amount due has not been paid 15 days after the first failure, Otoy Booking may suspend the School: it becomes inaccessible, but its data is retained under the conditions set out in Article 11. The School is reactivated as soon as payment is made.

9.3. In accordance with article L. 441-10 du Code de commerce (French Commercial Code), any amount not paid by the due date automatically bears late payment penalties equal to three times the legal interest rate, together with a fixed indemnity for recovery costs of €40.

Article 10 — Availability and support

10.1. Otoy Booking uses reasonable means to ensure access to the Service 24 hours a day, 7 days a week (best-efforts obligation). Interruptions may occur for maintenance, announced in advance where possible, or for external causes (hosting provider, network, third-party services).

10.2. No guaranteed service level (SLA) is provided, except under the specific terms and conditions of the Centre plan.

10.3. Support is provided by e-mail at contact@otoy-booking.com and, where enabled, via the School's support form, on Business days. Otoy Booking endeavours to respond within two Business days, and within one Business day with the "priority support" Option. These timeframes apply to the first response, not to the resolution of the request.

Article 11 — End of subscription, data retention and reversibility

11.1. At the end of the subscription, whatever the cause (termination, first-month refund, payment default), the School is deactivated: it is no longer accessible, but its data is retained for 12 months.

11.2. During these 12 months, the Client may:

• reactivate its School by subscribing again, and recover its data;
• obtain an export of its data in an open and commonly used format (CSV or JSON), upon simple request.

11.3. At the end of the 12 months, the School's data is permanently deleted, including from backups at the end of their rotation cycle. The Client is notified by e-mail one month beforehand.

11.4. Invoices issued by the School: the Client alone is responsible for retaining the invoices it has issued to its own customers for the statutory period (10 years). Otoy Booking does not retain them beyond the period provided for in Article 11.1; it is the Client's responsibility to download or export them before deletion.

Article 12 — Client's obligations

The Client undertakes to:

• keep the login credentials of its administrators and instructors confidential, and be answerable for their use;
• use the Service in accordance with its intended purpose and with the law;
• remain solely responsible for the content it publishes (texts, photos, prices, waivers, terms of sale towards its own customers) and for the information it collects from its End Users;
• inform its End Users of the processing of their data, in its capacity as data controller (Article 14 and Annex 1).

Article 13 — Intellectual property

13.1. The Service, its software, its trademark and its content remain the exclusive property of Otoy Booking. The Client holds a personal, non-exclusive and non-transferable right of use for the duration of the subscription.

13.2. The Client's data belongs to the Client. Otoy Booking uses it solely to provide the Service.

13.3. Certain documents generated by the Service (in particular schedule images intended for social media) bear the mention "Otoy Booking".

Article 14 — Personal data

14.1. End Users' data. With respect to the data of the School's customers, participants and instructors, the Client is the data controller and Otoy Booking is its processor within the meaning of Article 28 of the GDPR. The terms of this processing are set out in Annex 1, which forms part of the Terms.

14.2. Client's data. For the management of the subscription and invoicing, Otoy Booking is the data controller, under the conditions set out in its privacy policy.

Article 15 — Liability

15.1. Otoy Booking is bound by a best-efforts obligation. It is not liable for indirect damages (loss of revenue, of customers, or of data attributable to the Client), nor for any non-compliant use of the Service.

15.2. Third-party services. Otoy Booking is in no event liable for services provided by third parties — in particular Stripe (payments), SMS Vert Pro (SMS), the hosting provider, the e-mail delivery provider, telecommunications operators — nor for their interruptions, errors, decisions (payment refusal, blocking or suspension of an account, withholding of funds, etc.) or their consequences. These services are governed by the contract the Client has entered into with each of them.

15.3. In all other respects, its liability, for all causes combined, is limited to the amount paid by the Client over the last 12 months.

15.4. Neither party is liable for any failure due to force majeure.

Article 16 — Amendments to the Terms

Otoy Booking may amend the Terms. The Client is informed of the new version by e-mail at least 30 days before it comes into force; if the Client does not accept it, it may terminate at no cost before that date, including during the commitment period.

Article 17 — Governing law and disputes

The Terms are governed by French law. In the event of a dispute, the parties shall first seek an amicable solution. Failing that, jurisdiction is conferred on the courts within the jurisdiction of Bayonne.

Annex 1 — Data Processing Agreement (GDPR, Art. 28)

1. Purpose and duration

This annex sets out the conditions under which Otoy Booking (the "Processor") processes personal data on behalf of the Client (the "Controller"), for the duration of the subscription and then of the retention period provided for in Article 11 of the Terms.

2. Description of the processing

Health data. The Service does not request any health data: the free-text field of the emergency contact is labelled "Anything to report?". If the Client or an End User enters health information in it, the Client is responsible for it as data controller (information and, where applicable, explicit consent of the data subject, Art. 9 GDPR).

3. Processor's obligations

The Processor undertakes to:

• process the data only on documented instructions from the Controller — these Terms and the use of the Service constitute such instructions;
• ensure confidentiality: only authorised persons, bound by a duty of confidentiality, have access to the data;
• implement the security measures set out in point 5;
• engage other processors only under the conditions set out in point 4;
• assist the Controller in responding to requests from data subjects exercising their rights, and in carrying out a data protection impact assessment where required;
• notify any personal data breach to the Controller within 48 hours of becoming aware of it, with the information needed for the Controller's own notification to the CNIL;
• at the end of the contract, retain and then delete the data in accordance with Article 11 of the Terms, and return it upon request during the retention period;
• make available the information necessary to demonstrate compliance with these obligations.

4. Sub-processors

The Controller authorises the use of the following providers. It is informed of any change at least 30 days in advance and may object by terminating.

Transfers outside the European Union. Transfers to the United States rely, for each of the providers concerned, on two cumulative legal bases: certification under the EU-U.S. Data Privacy Framework (Commission adequacy decision of 10 July 2023, Art. 45 GDPR) and the European Commission's standard contractual clauses (Decision 2021/914, Art. 46 GDPR), which continue to apply should the first basis cease to exist:

5. Security measures

• Encryption of communications (HTTPS/TLS).
• Data segregation per school; role-based access (customer, instructor, administrator).
• Hashed passwords; access keys to third-party services (Stripe, SMS) encrypted in the database (AES-256-GCM).
• Logging of logins and sensitive actions.
• Daily off-server backups, within the European Union.
• Limited and personal administrative access to the platform.

6. Controller's obligations

The Client informs its End Users, obtains the necessary consents (in particular for minors and medical information), maintains its record of processing activities and responds to requests from data subjects exercising their rights, with the assistance of the Processor.