VENUO GENERAL TERMS OF USE

Version effective from: 21. 09. 2026

1. Introductory Provisions and Platform Operator Details

1.1 These General Terms of Use (the "Terms") govern the relationship between the operator of the online platform for reservations and related services operating under the name VENUO (the "Platform" or "VENUO") and any individual using the Platform as a consumer (the "Guest").

1.2 The technical operator and owner of the Platform is:

Company name: FORTIS - IS d.o.o.
Registered office: Mlinska ulica 26, 2000 Maribor, Slovenia
Company registration number: 7583761000
Tax / VAT identification number: SI10641289
Contact e-mail: [email protected]
(the "Operator" or "we")

1.3 These Terms are intended exclusively for consumers, i.e. natural persons acting outside the scope of their commercial or professional activity (a B2C relationship). Separate terms apply to business users (B2B), where concluded separately.

1.4 By using the Platform, submitting a reservation, purchasing a ticket or gift voucher, or accepting these Terms, the Guest declares that they have read, understood and agree to the Terms. If the Guest does not agree to the Terms, they must not use the Platform.

1.5 By accepting these Terms and by submitting a reservation, making a purchase or placing any other order, the Guest confirms that, in addition to these Terms, they also accept the terms of the relevant Provider (the Provider's Terms) applicable to the specific order, which are displayed to the Guest at the time of reservation or purchase, before its final confirmation. The Provider's Terms apply in addition to these Terms; in the event of any inconsistency concerning the service itself, the Provider's Terms shall prevail (see also clauses 2.6 and 5.5). This is without prejudice to the Guest's mandatory consumer rights under mandatory law.

2. Definitions

In these Terms, the following expressions have the meanings set out below:

2.1 Platform (VENUO) – the website, mobile application and related technical solutions operating under the name VENUO, through which the Operator enables Guests to connect with Providers.

2.2 Provider – an independent business entity (hospitality establishment, venue, event organiser, gift voucher issuer or other service provider) that offers its services, experiences, events, tickets or gift vouchers through the Platform. The Provider is the party that actually performs the ordered service.

2.3 Guest – a user who makes a reservation or purchase, or performs another action, through the Platform.

2.4 Reservation – the Guest's request for the provision of a table, service, experience, event or other time slot with a specific Provider.

2.5 Platform Service – technical intermediation between the Guest and the Provider, including the submission of reservations, the execution of payments or payment authorisation through an external payment service provider, and the generation and delivery of gift vouchers and tickets on behalf of the Provider.

2.6 Provider's Terms – the price list, cancellation deadlines, no-show rules, refund conditions, gift voucher validity and other terms determined by the individual Provider for its offering and displayed to the Guest at the time of reservation or purchase.

2.7 Stripe – an external payment service provider (Stripe Payments Europe, Ltd. or an affiliated company) that independently processes payment and card data.

2.8 Privacy Policy – a separate document governing the processing of personal data.

3. Nature of the Platform and the Operator's Role as Intermediary

3.1 The Operator acts exclusively as an intermediary providing the technical infrastructure for connecting Guests with Providers. The Operator is not a seller, service provider, hospitality operator, event organiser, ticket seller or gift voucher issuer.

3.2 The contract for the actual service (table reservation, service, experience, event, ticket or gift voucher) is concluded directly between the Guest and the relevant Provider. The Operator is not a party to that relationship and assumes no obligation of performance under it.

3.3 The Platform makes available, in particular: table reservations, service reservations, experience reservations, event reservations, ticket sales and a gift voucher shop. In all such cases, the Operator acts solely in an intermediary or technical capacity.

3.4 The content of the offering, descriptions, prices, availability, quality and lawfulness of the service are determined by, and the sole responsibility of, the Provider. The Operator does not warrant the accuracy or completeness of the information supplied to the Platform by the Provider.

3.5 Any complaints, claims or disputes concerning the performance of the service shall be raised by the Guest directly with the Provider, as the Guest's contractual counterparty.

3.6 Provider-supplied content. All content relating to an individual offering – in particular prices, price lists, descriptions, texts, offer names and conditions, photographs and images, menus, allergen and ingredient information, availability, time slots, trademarks and logos, and other information – is supplied, entered and updated exclusively by the relevant Provider. The Operator does not create such content, does not verify its accuracy, completeness, currency or lawfulness, and is not responsible for it. The Provider is solely responsible for the correctness of such content and its compliance with applicable regulations. The Operator shall not be liable for any damage suffered by the Guest as a result of inaccurate, incomplete, outdated or misleading information provided by the Provider; this is without prejudice to the Operator's liability under Chapter 14 of these Terms.

4. Use of the Platform and User Account

4.1 The Platform may be used by adults who have legal capacity to enter into contracts.

4.2 Registration of a user account is mandatory only where the relevant Provider requires registration for its offering; in that case, the Guest cannot complete a reservation or purchase with that Provider without an account. In all other cases, account registration is merely an option and not a condition for using the Platform. Where the Guest creates an account, they must provide true, accurate and complete information and keep it up to date.

4.3 The Guest is solely responsible for safeguarding their login credentials and for all activity carried out through their account. The Guest must immediately notify the Operator of any suspected unauthorised use at [email protected].

4.4 The Guest undertakes not to use the Platform contrary to the law or these Terms, not to interfere with its operation or security, not to use automated means for mass reservations, and not to resell reservations, tickets or gift vouchers without the Provider's express permission.

4.5 The Operator may temporarily restrict or terminate access to the account or the Platform if the Guest breaches these Terms or the law, or where necessary for the security of the Platform, other Guests or Providers.

5. Conclusion of Contract and Reservation Process

5.1 The Guest selects a Provider and the desired service through the Platform and submits a reservation or order following the steps displayed by the Platform. Before final submission, the Guest is shown the essential information about the offering, including the price (where determined in advance) and the applicable Provider's Terms.

5.2 By submitting a reservation or order, the Guest makes an offer to the Provider. The contract is concluded when the Provider (or the Platform on its behalf) confirms the reservation, normally by means of an electronic confirmation message. The Operator sends the confirmation to the Guest on behalf of the Provider.

5.3 Availability of time slots is determined at the time of the enquiry and is based on the Provider's data; availability is not guaranteed until confirmation.

5.4 The Guest consents to receiving reservation confirmations, changes, reminders and cancellations electronically (by e-mail, SMS or push notifications, as agreed).

5.5 The essential characteristics of the service, the identity of the Provider and the conditions relating to the specific offering are determined by the Provider and displayed at the time of reservation. In the event of any inconsistency between the general description on the Platform and the specific Provider's Terms, the latter shall prevail.

6. Waitlist

6.1 Where a Provider offers a waitlist function and the selected time slot is already taken or unavailable, the Guest may join the waitlist for that slot.

6.2 Joining the waitlist is not a reservation. Joining the waitlist does not in itself constitute a reservation, does not guarantee the availability of the time slot and does not create a contract between the Guest and the Provider. No payment obligation arises for the Guest on this basis.

6.3 If a time slot becomes available, the Platform notifies the Guest electronically (normally by e-mail) and offers them the option to confirm the reservation. The release of a time slot depends on the circumstances and is not guaranteed.

6.4 Confirmation deadline. The Guest must confirm the reservation within the deadline stated in the notification. This deadline is set dynamically depending on how far in the future the time slot is (a shorter deadline for imminent slots, a longer one for more distant slots) and is in every case clearly stated in the notification (the reservation confirmation request).

6.5 Confirmation conditions identical to a regular reservation. Confirmation of a reservation from the waitlist is subject to the same conditions as a regular reservation with that Provider. If the Provider uses a reservation method involving prepayment or card authorisation for no-show situations (see Chapter 7), the Guest must, upon confirmation, make the prepayment or enter and authorise a payment card in the same manner as for a regular reservation. The contract between the Guest and the Provider is concluded only upon such confirmation, in accordance with Chapter 5.

6.6 Missed deadline. If the Guest does not confirm the reservation within the stated deadline, the offer lapses and the time slot may be offered to another Guest on the waitlist or released. No obligation or cost arises for the Guest as a result of a late confirmation.

6.7 The Guest may remove themselves from the waitlist at any time in the manner enabled by the Platform.

7. Prices, Reservation Methods and Payment Processing via Stripe

7.1 Service prices are set by the Provider. Prices displayed to the Guest as a consumer are final and include value added tax and all mandatory charges, and are displayed in euros unless expressly stated otherwise for a specific offering. Any additional costs (e.g. the costs of an individual Provider service) shall be clearly stated by the Provider before the reservation is completed.

7.2 Reservation methods. For its offering, each Provider selects one of three reservation methods, which is displayed to the Guest at the time of reservation, before its final confirmation:

a) Reservation without a card. No payment card details are required at the time of reservation, no charge is made, and no prepayment or no-show rule applies. Any payment for the service is made directly to the Provider upon performance.

b) Reservation with prepayment. To confirm the reservation, the Guest pays a specified amount in advance via Stripe, as displayed at the time of reservation. Payment is made upon confirmation of the reservation. The conditions governing the prepayment, any refunds and cancellations are determined by the Provider and displayed at the time of reservation (see Chapter 8).

c) Reservation with card authorisation for no-show situations. No charge is made to the Guest's payment card at the time of reservation and no amount is held (reserved). The Guest merely enters and authorises a payment card via a strong customer authentication mechanism (3-D Secure / SCA), enabling the Provider to make a possible subsequent charge of a no-show or late cancellation fee, solely under the conditions set out in Chapter 8.

7.3 Consent to a possible subsequent charge (method under clause 7.2(c)). By authorising the card, the Guest expressly consents that their authorised payment method may subsequently be charged the amount of a no-show or late cancellation fee, only when, and only to the extent, provided for in the Provider's Terms displayed at the time of reservation. This consent does not in itself constitute a payment, a prepayment or a hold on funds at the time of reservation.

7.4 Stripe as payment processor. Payments, payment authentication and any subsequent charge are technically executed by the external payment service provider Stripe. Full payment card data is processed directly by Stripe and is neither received nor stored by the Operator. With regard to payment data, Stripe acts as an independent controller of personal data in accordance with its own terms and privacy policy.

7.5 Even in the case of prepayment (7.2(b)), the Operator does not receive or hold funds as a seller or service provider; payment is executed via Stripe for the benefit of the Provider as the Guest's contractual counterparty. The Operator is not a payment institution and has no access to full card data.

8. Provider's Cancellation and No-Show Rules

8.1 The Operator does not prescribe uniform cancellation or no-show rules. Each Provider independently determines its own cancellation deadline, late cancellation conditions and no-show rules, as well as the amount of any fee.

8.2 The applicable Provider's Terms are displayed to the Guest at the time of reservation, before its final confirmation. By submitting the reservation, the Guest agrees to be bound by the specific terms of the displayed Provider.

8.3 If the Guest cancels the reservation within the deadline and in the manner specified by the Provider, no fee is normally payable, other than any costs announced by the Provider in advance. In the case of a reservation with prepayment (7.2(b)), the Guest is, upon timely cancellation, entitled to a refund of the prepaid amount, reduced at most by any costs clearly announced by the Provider in advance.

8.4 If the Guest fails to appear at the agreed time or cancels the reservation too late (after the Provider's cancellation deadline):

a) in the case of a reservation with card authorisation (7.2(c)), the Guest's authorised payment method may, in accordance with the Provider's Terms, be charged the amount of the no-show or late cancellation fee;

b) in the case of a reservation with prepayment (7.2(b)), the Provider may, in accordance with its own terms, retain all or a proportionate part of the prepayment as a cancellation fee.

In both cases, the amount and conditions of the fee or retention are determined exclusively by the Provider and are displayed at the time of reservation.

8.5 The Operator merely technically enables and facilitates the charging mechanism on behalf of the Provider. The Operator does not decide on the justification for a charge and is not liable for it; any objection to a charge shall be addressed by the Guest to the Provider, although the Operator may provide technical assistance in this respect.

8.6 The no-show or late cancellation fee has the nature of a cancellation fee (agreed compensation for withdrawal) or an agreed consequence of non-performance and is without prejudice to any mandatory consumer rights of the Guest under applicable law.

9. Tickets

9.1 The purchase of a ticket concludes a contract directly between the Guest and the Provider (the event organiser). The Operator merely technically generates and delivers the ticket on behalf of the organiser and does not act as the organiser or seller.

9.2 The conditions of the event, any changes of date, entry restrictions and refund conditions are determined by the organiser and displayed at the time of purchase.

9.3 In the event of cancellation or material change of the event by the organiser (including force majeure), the Guest exercises their rights to a refund or a replacement ticket directly with the organiser, in accordance with the organiser's terms and applicable law.

9.4 Resale of tickets without the organiser's permission is not allowed and may be grounds for invalidation of the ticket.

9.5 Chapter 11 of these Terms applies with respect to the right of withdrawal for tickets to leisure events tied to a specific date.

10. Gift Vouchers

10.1 The Provider is the issuer and obligor. Gift vouchers are issued by the individual Provider, who also determines their content and validity. From an accounting and contractual perspective, the transaction belongs to the Provider; the Provider is the seller and the party liable for redemption of the voucher.

10.2 Role of the Operator. The Operator merely technically generates and delivers the gift voucher in the name and for the account of the Provider. The Operator is not the issuer of the voucher, is not liable for its redemption and does not guarantee performance of the service to which the voucher relates.

10.3 Redemption and validity. The voucher is redeemed with the Provider that issued it, in accordance with the stated validity and conditions. The validity period must be clearly stated at the time of purchase.

10.4 Protection of voucher value. The prepaid value of a gift voucher may not be unfairly forfeited. In accordance with Slovenian and EU consumer law, any conditions on validity and redemption are interpreted in favour of the consumer; unfair terms that would unjustifiably deprive the consumer of paid value are of no effect.

10.5 Any claims relating to a gift voucher (redemption, validity, refund of value) shall be raised by the Guest with the Provider as the issuer.

11. Right of Withdrawal and Exceptions

11.1 For distance contracts, the consumer generally has the right to withdraw from the contract within 14 days without giving any reason, in accordance with the Slovenian Consumer Protection Act (ZVPot-1) and the Consumer Rights Directive. However, since the service contract is concluded directly with the Provider, the right of withdrawal is exercised against the Provider.

11.2 Statutory exceptions to the right of withdrawal. The 14-day right of withdrawal does not apply, in particular, in the following cases, which are common for these types of reservations:

a) hospitality (catering) services and the supply of food and beverages – as these are services tied to a specific time slot, or quickly perishable goods;

b) accommodation services other than for residential purposes;

c) leisure services tied to a specific date or period of performance (e.g. events, experiences, tickets for events on a specific day).

11.3 Accordingly, by type of reservation:

• Table reservation / hospitality service: the right of withdrawal generally does not apply (points (a) and (c)). The Provider's cancellation and no-show rules under Chapter 8 apply.
• Experience or event on a specific date: the right of withdrawal generally does not apply (point (c)).
• Ticket for an event on a specific day: the right of withdrawal generally does not apply (point (c)). By confirming the purchase, the Guest confirms that they are aware of this.
• Gift voucher: the right of withdrawal may apply for as long as the voucher has not been redeemed or tied to a specific service on a specific date; if the voucher is personalised or tied to a specific time slot, it may be exempt. The specific assessment is made by the Provider as the issuer.
• Service not tied to a specific date: where the service is not tied to a specific time slot, the 14-day right of withdrawal may apply; in that case, the Guest exercises it against the Provider.

11.4 If, in the case of a service to be performed within the 14-day period, the Guest expressly agrees to performance commencing before the expiry of the withdrawal period and confirms this, the Guest may lose the right of withdrawal or be required to pay a proportionate part of the price for the service already performed, in accordance with the ZVPot-1.

11.5 The above exceptions arise from the law and are not determined by the Operator; in case of doubt, and for any specific offering, the information provided by the Provider at the time of reservation prevails.

12. Guest's Obligations and Acceptable Use

12.1 The Guest undertakes to use the Platform honestly and in accordance with the law, to provide accurate information and to comply with the Provider's Terms accepted at the time of reservation.

12.2 The Guest must inform the Provider in good time, before placing an order, of any allergies, intolerances or special requirements. The Provider is responsible for allergen information and for any accommodations.

12.3 The Guest must not: submit false or malicious reservations, make mass reservations using automated means, resell reservations, tickets or vouchers without permission, or interfere with the security or operation of the Platform.

12.4 Breach of these obligations may constitute grounds for cancellation of reservations, restriction of access to the Platform and the assertion of damages claims by the Provider or the Operator in accordance with the law.

13. Reporting Illegal or Objectionable Content

13.1 A Guest or a third party may notify the Operator of any offering, content, description, image, link or other information on the Platform that they consider to be illegal, misleading or infringing third-party rights, at [email protected].

13.2 The report should contain a description of the disputed content, its location or link, the reasons it is considered objectionable, and the reporter's contact details.

13.3 Upon receipt of a report, or on its own initiative, the Operator may temporarily restrict, hide or remove manifestly illegal or objectionable content, acting proportionately and in accordance with applicable law, including the rules of the Digital Services Act (DSA) where applicable. Where a report relates to a Provider's content, the Operator may forward it to that Provider.

14. Limitation of Liability and Disclaimer of Warranties

14.1 Since the Operator acts exclusively as an intermediary and is not the provider of the service, it is not liable for the performance, quality, safety or lawfulness of the Providers' services, nor for their business decisions (prices, cancellations, refunds, no-show rules).

14.2 The Operator is liable without limitation:

a) for intent and gross negligence;

b) for damage resulting from injury to life, body or health;

c) in accordance with mandatory product liability provisions;

d) where it has expressly given a guarantee.

14.3 In cases of slight negligence, the Operator is liable only for breach of essential contractual obligations (those whose performance makes the performance of the contract possible at all and on whose fulfilment the Guest may reasonably rely), with liability limited to typical and foreseeable damage.

14.4 In all other respects, the Operator's liability is excluded to the fullest extent permitted by applicable law.

14.5 These limitations also apply to the Operator's legal representatives, employees and contractual partners. Nothing in these Terms limits the Guest's mandatory consumer rights under mandatory law.

14.6 The Operator makes reasonable efforts to ensure the smooth operation of the Platform but does not guarantee its uninterrupted availability, compatibility with all devices or freedom from errors. Access to the Platform requires an internet connection, the costs of which are borne by the Guest.

15. Intellectual Property

15.1 All intellectual property rights in the Platform (software, design, texts, trademarks, logos, databases) belong to the Operator or its licensors. Content supplied by a Provider remains the property of that Provider.

15.2 The Guest may use the Platform solely for their own non-commercial purposes within the scope of these Terms. Copying, reproduction, distribution, modification or any other commercial use of the Platform's content is prohibited without prior written permission.

16. Personal Data Protection

16.1 The processing of personal data is comprehensively governed by the separate Privacy Policy. These Terms do not replace the Privacy Policy and do not contain a comprehensive set of data protection rules.

16.2 The roles in the processing of personal data differ depending on the purpose of processing:

• For the processing of data relating to reservations, orders, waitlist entries, tickets and gift vouchers, which is necessary for the intermediation and execution of the order, the Operator acts as a processor of personal data on behalf of the relevant Provider, who is the controller of such data.
• For a limited set of its own purposes (ensuring the security and proper functioning of the Platform, preventing abuse and fraud, its own analytics and improvements, anonymised statistical data, and the management of a user account where the Guest creates one with the Operator), the Operator acts as an independent controller of personal data.
• Individual Providers process Guests' personal data for their own purposes (performance of the service, performance of the contract, invoicing, their own marketing) as independent controllers, under their own terms and privacy policies.
• Payment service providers, including Stripe, act as independent controllers with respect to payment and card data.
• The Operator and an individual Provider are not joint controllers.

16.3 Details of the legal bases, retention periods, data subject rights (access, rectification, erasure, restriction, portability, objection) and how to exercise them are set out in the Privacy Policy.

17. Governing Law and Jurisdiction

17.1 These Terms and the relationship between the Guest and the Operator are governed by the law of the Republic of Slovenia, with due regard to European Union law.

17.2 If the Guest, as a consumer, is habitually resident in another EU Member State, they retain the protection afforded to them by the mandatory provisions of the law of the country of their habitual residence.

17.3 Disputes shall be resolved by the court with subject-matter and territorial jurisdiction in the Republic of Slovenia, without prejudice to the consumer's right to bring proceedings before the courts of their country of residence where so provided by mandatory law.

18. Amendments to the Terms

18.1 The Operator may update these Terms from time to time due to changes in legislation, the operation of the Platform or business reasons. The updated version takes effect upon publication on the Platform.

18.2 Each individual reservation, purchase or other action is governed by the Terms in force at the time of that action. The Operator will announce material changes in advance in an appropriate manner; continued use of the Platform after the changes take effect constitutes acceptance of them.

19. Final Provisions

19.1 If any provision of these Terms proves to be invalid or unenforceable, this shall not affect the validity of the remaining provisions. The invalid provision shall be replaced by a valid provision that most closely reflects its purpose.

19.2 The Operator may transfer its rights and obligations under these Terms to a third party, provided that this does not worsen the Guest's position.

VENUO PLATFORM PRIVACY POLICY

Version effective from: 21. 09. 2026

1. Introduction and Controller Details

1.1 This privacy policy (the "Policy") explains how the personal data of individuals (the "Guest" or "you") is processed when using the online reservation platform and related services operating under the name VENUO (the "Platform" or "VENUO").

1.2 The operator of the Platform and the controller of personal data for the purposes of operating the Platform is:

• Name: FORTOS - IS d.o.o.
• Registered office: Mlinska ulica 26, 2000 Maribor, Slovenia
• Company registration number: 7583761000
• Tax / VAT identification number: SI10641289
• Contact e-mail: [email protected]

(the "Controller" or "we")

1.3 This Policy is a separate document from the General Terms and Conditions of Use of the VENUO Platform. Where the General Terms and Conditions refer to the processing of personal data, this Policy shall apply.

1.4 Personal data is processed in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679; "GDPR"), the Personal Data Protection Act (ZVOP-2), and other applicable legislation.

2. VENUO's Role and Allocation of Responsibility

2.1 VENUO as an intermediary. VENUO acts as a technical intermediary that connects Guests with independent service providers (hospitality establishments, venues, event organisers, gift voucher issuers, and other operators; the "Provider"). The contract for the actual service is concluded directly between the Guest and the Provider.

2.2 VENUO as a processor (on behalf of the Provider). For the processing of personal data necessary to facilitate and carry out a reservation, order, placement on a waiting list, or purchase of a ticket or gift voucher (i.e. reservation data and the related Guest data), VENUO acts as a processor of personal data on behalf of the individual Provider, who is the controller of that data. VENUO processes this data solely on the Provider's instructions and to ensure the operation of the Platform, on the basis of a data processing agreement in accordance with Article 28 GDPR.

2.3 VENUO as an independent controller. For a limited set of its own purposes, VENUO acts as an independent controller of personal data (and not as a joint controller), namely for: (a) ensuring the security, stability, and proper functioning of the Platform; (b) preventing, detecting, and investigating fraud, abuse, and security incidents; (c) its own analytics and improvements to the Platform; (d) anonymising and using anonymised or aggregated data (which, following anonymisation, no longer constitutes personal data); and (e) managing the user account where the Guest creates it directly with VENUO, and fulfilling its own legal obligations. The legal bases for this processing are set out in Section 4 of this Policy. VENUO does not use Guests' personal data for its own direct marketing and does not sell it.

2.4 The Provider as an independent controller. The Provider is the controller of personal data processed in order to deliver the ordered service (performance of the contract with the Guest, issuance of invoices, keeping its own records, and any direct marketing by the Provider), and the controller of the reservation data referred to in Section 2.2 that VENUO processes on its behalf. The Provider processes this data under its own terms and its own privacy policy, over which VENUO has no influence.

2.5 The payment service provider as an independent controller. Payments and payment authorisation are technically carried out by the external payment service provider Stripe (Stripe Payments Europe, Ltd. or an affiliated company), which acts as an independent controller in relation to payment and card data. Details are available in Stripe's privacy policy.

2.6 VENUO is not a joint controller with the Providers. VENUO and the individual Provider are not joint controllers; each independently determines the purposes of processing within the scope of its own role. Data processed for an individual Provider is handled separately and is not accessible to other Providers.

3. Which Personal Data is Processed

3.1 Identification and contact data. In order to carry out a reservation, order, or purchase — including without registering a user account — the Guest's name and surname, e-mail address, and telephone number are processed. This data is necessary to conclude and carry out the facilitated reservation and for communication relating to it; without it, the reservation or purchase cannot be carried out.

3.2 Account data. Where the Guest creates a user account, in addition to the data referred to in Section 3.1, the password in encrypted form and the account settings and preferences are also processed.

3.3 Reservation, waiting list, ticket, and gift voucher data. Data that the Guest enters or that is generated upon a reservation, order, or placement on a waiting list: the selected Provider, the date and time of the appointment, the number of persons, the contents of the order, any remarks, and any special requests communicated, including information about allergies or intolerances where the Guest provides it themselves. For tickets and gift vouchers, the data necessary for their generation and delivery on the Provider's behalf is also processed (e.g. recipient, code, validity).

3.4 Payment data. For a reservation with prepayment or with card authorisation in the event of a no-show, the payment or authorisation is carried out via Stripe. VENUO does not receive, see, or store full payment card data; this is stored exclusively by Stripe. VENUO may only process the payment method token generated by Stripe — which does not in itself reveal card data — as well as the transaction status (e.g. confirmed, authorised, failed) and the amount.

3.5 Communication data. The e-mail address and telephone number used to send transactional messages (confirmations, changes, reminders, and reservation cancellations) and any communication with user support.

3.6 Technical data. IP address, device and browser information, system logs, and data collected via cookies in accordance with Section 9 of this Policy.

3.7 Data relating to reports of objectionable content. Where a Guest or a third party reports unlawful or objectionable content, the data contained in the report is processed (description, and the reporting party's contact details where provided).

3.8 Source of data. VENUO generally obtains personal data directly from the Guest. Exceptionally, it may obtain it from the person who makes the reservation on the Guest's behalf (e.g. a co-named guest within the same reservation), or from the Provider to the extent necessary to facilitate the reservation.

4. Purposes and Legal Bases of Processing

4.1 Facilitation and carrying out of the reservation. Facilitating reservations, orders, and placements on a waiting list; generating and delivering tickets and gift vouchers on the Provider's behalf; processing the payment method token and transaction status to carry out prepayment or authorisation and any subsequent charge of a no-show fee under the Provider's terms; and sending transactional messages relating to the reservation. Legal basis: performance of a contract or pre-contractual steps between the Guest and the Provider (Article 6(1)(b) GDPR), whereby VENUO processes this data as a processor on behalf of the Provider (see Section 2.2). Where the Guest creates a user account directly with VENUO, VENUO manages that account as an independent controller on the basis of performance of a contract or legitimate interest (Article 6(1)(b) or (f) GDPR).

4.2 Security and abuse prevention. Processing of technical data to ensure security and stability, prevent fraud and abuse, and ensure the proper functioning of the Platform. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

4.3 Legal obligations. Fulfilment of obligations imposed by law (e.g. responding to requests from competent authorities). Legal basis: legal obligation (Article 6(1)(c) GDPR). Accounting and tax obligations relating to the individual service are borne by the Provider as the seller.

4.4 Analytics. Where analytics cookies or similar technologies are used, they are used on the basis of consent. Legal basis: consent (Article 6(1)(a) GDPR).

4.5 No marketing by VENUO. VENUO does not use Guests' personal data for its own direct marketing, does not combine it into marketing profiles, does not monetise it, and does not sell it. VENUO uses the e-mail address and telephone number solely to transmit transactional messages and for communication relating to the reservation. Any marketing by the Provider is the Provider's sole responsibility and is based on its own legal basis.

4.6 No automated decision-making. In processing personal data, VENUO does not carry out automated decision-making, including profiling, that would produce legal or similarly significant effects on the Guest within the meaning of Article 22 GDPR.

4.7 Children. The Platform is intended for adults and is not directed at minors. VENUO does not knowingly collect the personal data of minors. If VENUO establishes that an account has been created or a reservation submitted by a minor without an appropriate basis, it will delete such data.

4.8 Anonymised data for analytics and statistics. VENUO may anonymise personal data such that the individual can no longer be identified, and use such anonymised data for analytical and statistical purposes (e.g. measuring usage, improving the Platform, aggregated reports). In accordance with Recital 26 GDPR, anonymised data is not considered personal data, and its use falls outside the scope of this Policy. The anonymisation process is designed to be irreversible; anonymised data is not re-combined with an individual's identification data.

5. Data Encryption and Security

5.1 Personal data is stored in encrypted form. VENUO implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or misuse, including encryption of data at rest, access controls, and regular security monitoring.

5.2 Despite careful measures, no system for the transmission or storage of data is completely secure, and absolute security therefore cannot be guaranteed.

5.3 In the event of a personal data breach that would pose a risk to the rights and freedoms of individuals, VENUO acts in accordance with the notification obligations under Articles 33 and 34 GDPR.

6. Data Retention

6.1 Personal data is retained only for as long as is necessary for the purposes for which it was collected.

6.2 Account data is retained for as long as the account is active; upon deletion of the account, it is deleted or anonymised, except for data that must be retained for legal reasons or for the establishment, exercise, or defence of legal claims.

6.3 Data relating to an individual reservation is retained by VENUO for the period necessary to carry out the facilitation and for any dispute resolution; longer retention relating to the delivery of the service and to legal (e.g. accounting) obligations is carried out by the Provider as an independent controller.

6.4 Consent data (e.g. for analytics) is retained for as long as is necessary to demonstrate the lawfulness of the consent and is deleted following its withdrawal, except where further retention is required by law.

7. Disclosure and Recipients of Data

7.1 Personal data may be disclosed only to the following categories of recipients and only to the extent necessary for the stated purpose:

a) the individual Provider with whom the Guest makes a reservation, purchase, or other action, as an independent controller;

b) the payment service provider Stripe, to carry out the payment or payment authorisation;

c) contractual processors that provide VENUO with IT infrastructure, hosting, communication or e-mail services, and technical support, on the basis of a data processing agreement under Article 28 GDPR;

d) competent authorities, where required by law.

7.2 VENUO does not sell personal data and does not disclose it to third parties for their own marketing purposes.

8. Location of Processing and International Transfers

8.1 Personal data is primarily hosted and stored within the European Union or the European Economic Area (EU/EEA); server hosting is provided by Hetzner Online GmbH in Germany.

8.2 Some contractual processors are established outside the EU/EEA, and a transfer of personal data to third countries therefore takes place with them: for the delivery of transactional e-mail we use Postmark (AC PM LLC, USA); for web analytics we use Google (Google LLC, USA); and for sending SMS messages to non-Slovenian telephone numbers we use Infobip Ltd (United Kingdom).

8.3 These transfers are safeguarded in accordance with Chapter V GDPR: transfers to the USA on the basis of the recipients' certification under the EU-US Data Privacy Framework and/or standard contractual clauses; the transfer to the United Kingdom on the basis of the European Commission's adequacy decision for the United Kingdom.

8.4 If any individual safeguard ceases to be valid, VENUO will, without undue delay, implement another appropriate safeguard or suspend the relevant transfer.

9. Cookies and Similar Technologies

9.1 Strictly necessary cookies. The Platform uses cookies that are strictly necessary for its operation, security, and basic functions. These are used without consent, in accordance with the ePrivacy rules and the Electronic Communications Act (ZEKom-2).

9.2 Analytics cookies. To understand the use of the Platform and improve it, VENUO uses analytics cookies, but only on the basis of the Guest's consent. VENUO itself does not use advertising cookies; however, an individual Provider may, for its own offering, enable its own third-party analytics or marketing cookies (e.g. Google Analytics, Google Tag Manager, or Meta Pixel), which are likewise loaded only on the basis of the Guest's consent. Details are available in the Cookie Policy.

9.3 Managing consent. The Guest may give, change, or withdraw consent for cookies that are not strictly necessary at any time via the cookie settings on the Platform or the browser settings. When certain cookies are disabled, individual functions may not work properly.

9.4 No cookie walls. Refusing non-essential cookies (e.g. analytics cookies) does not prevent the use of the Platform's basic functions, including submitting a reservation and purchasing a ticket or gift voucher. VENUO does not use cookie walls, whereby use of the service would be conditional on consent to non-essential cookies.

10. Rights of the Individual

10.1 In respect of personal data for which VENUO is the controller, the Guest has the right to:

a) access their personal data and obtain a copy of the data;

b) rectification of inaccurate or incomplete data;

c) erasure of data under the conditions set out in the GDPR;

d) restriction of processing;

e) data portability;

f) object to processing based on legitimate interest;

g) withdraw consent where processing is based on consent, whereby the withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

10.2 The Guest exercises their rights in respect of data for which VENUO is the controller by writing to [email protected]. VENUO responds to a request without undue delay, and at the latest within one month of receiving the request; this period may be extended in accordance with Article 12(3) GDPR, taking into account the complexity and number of requests, of which VENUO will inform the Guest.

10.3 The Guest exercises their rights in respect of data for which the individual Provider is the controller (reservation data that VENUO processes on its behalf, delivery of the service, issuance of invoices, the Provider's own marketing) directly with that Provider; VENUO, as a processor, provides reasonable assistance to the Provider in this regard. The Guest exercises their rights in respect of payment data with Stripe.

11. Changes to the Policy

11.1 VENUO may update this Policy from time to time due to legislative, technical, or business changes. The updated version takes effect upon publication on the Platform. The version of the Policy in force at the time of any given processing applies to that processing.

12. Contact

For questions regarding this Policy or to exercise rights in relation to processing for which VENUO is the controller, the following e-mail address is available: [email protected].

For questions regarding processing related to the delivery of the service, the issuance of invoices, or the Provider's marketing, the Guest should contact the individual Provider directly as an independent controller.

VENUO PLATFORM COOKIE POLICY

Version effective from: 10 June 2026

1. Introduction

1.1 This cookie policy explains which cookies and similar technologies are used by the online platform operating under the name VENUO (the "Platform" or "VENUO"), for what purpose, and how the user (the "Guest") can manage their consent.

1.2 The processing of personal data that arises in connection with cookies is regulated in more detail in the Privacy Policy.

1.3 Cookies are small text files that a website stores on the Guest's device. Similar technologies include device IDs, pixel tags, and web beacons, which make it possible to recognise the device and to store or read certain information.

1.4 Some cookies last only for an individual session and expire when the browser is closed, while others remain stored for longer so that the Platform can remember settings or the Guest on a return visit.

2. Consent and Legal Basis

2.1 Strictly necessary cookies are used without consent, as they are necessary for the operation, security, and basic functions of the Platform, in accordance with the ePrivacy rules and the Electronic Communications Act (ZEKom-2).

2.2 Analytics and marketing cookies, as well as other technologies that are not strictly necessary, are loaded only after the Guest's consent.

2.3 The Guest may give, change, or withdraw consent at any time via the cookie settings on the Platform.

3. Strictly Necessary Cookies

3.1 These cookies are necessary for the operation of the Platform, its security, and the provision of services explicitly requested by the Guest. They are used without consent.

4. Analytics Cookies

4.1 These cookies allow us to recognise and count visitors and to understand how the Platform is used, which helps us improve its performance. They are loaded only on the basis of the Guest's consent.

5. Provider Marketing Cookies

5.1 VENUO itself does not use advertising cookies. Where an individual Provider enables the Facebook (Meta) Pixel for its own offering, the marketing cookies below may be loaded, but only on the basis of the Guest's consent. The Provider, or Meta as an independent controller, is responsible for the use of the Pixel and the related processing.

6. Analytics and Tags Enabled by the Provider (Google Analytics / Google Tag Manager)

6.1 An individual Provider may, for its own offering, enable its own web analytics via the Google Analytics (GA4) and/or Google Tag Manager (GTM) services. In that case, additional analytics cookies and similar technologies belonging to the Provider's own account or container may be loaded.

6.2 Because these cookies are tied to the account of the individual Provider, their names, identifiers, and validity periods vary depending on the Provider and cannot be listed exhaustively in advance. They are generally cookies of the Google Analytics family (e.g. _ga, _ga_*), as well as any additional tags that the Provider configures in its own GTM container.

6.3 These technologies are loaded only on the basis of the Guest's consent and are not triggered before it. The legal basis is consent (Article 6(1)(a) GDPR).

6.4 For this analytics, the controller of personal data is the individual Provider, who determines its purposes and provides its own legal basis and notices to individuals for it. In this regard, VENUO merely technically enables the collection and transmission of data on behalf of the Provider; VENUO does not use data from the Provider's analytics for its own purposes. The Guest exercises rights in relation to this processing directly with the Provider.

7. Managing and Disabling Cookies

7.1 The Guest may change or withdraw consent for analytics and marketing cookies at any time via the cookie settings on the Platform.

7.2 Cookies can also be managed and deleted via the web browser settings. The instructions differ depending on the browser and are available in the help sections of each browser (Google Chrome, Mozilla Firefox, Safari, Microsoft Edge, Opera, and others).

7.3 When certain cookies are disabled, individual functions of the Platform may not work properly.

8. Changes to the Policy

8.1 We may update this cookie policy from time to time due to legislative or technical changes. The updated version takes effect upon publication on the Platform.