Host Agreement

1. About this agreement

This Host Agreement ("Agreement") is a contract between FCR RSC Pty Ltd (ABN 37 682 852 213), trading as Panelist ("Panelist", "we", "us", "our"), and the person or organisation that uses the Service as a Host or Customer ("you"). It applies when you create, promote or sell tickets to an event, community or program (as a "Host"); use business tools such as the CRM, enrichment, campaigns, connected mailboxes or Hugo for a team (as a "Customer"); or buy a plan or accept an Order.

You accept this Agreement by clicking or ticking to accept it, by accepting an Order that refers to it, or by using the Service in one of these ways. If you accept for an organisation, you confirm that you may bind it, and "you" means the organisation; if you may not, you are personally bound until it confirms. You must be at least 18. The User Agreement also applies to you and to each Authorised User.

Parts. This Agreement consists of these customer terms; our Acceptable Use Policy, which you and your Authorised Users must follow; the product-specific terms from Your events to APIs and integrations, including the Messaging Schedule; the Data Processing Schedule; and your Orders, each of which binds us once we accept it in writing or by providing the Service under it.

Precedence. If these documents conflict, they prevail in this order: special terms in an Order that expressly override a named section, for that Order only; the Data Processing Schedule, for Customer Data that is personal information; the rest of this Agreement; the Acceptable Use Policy; other Order terms; the User Agreement; and product documentation. Where this Agreement and the Acceptable Use Policy cover the same conduct, you must comply with both. No Order can reduce your Non-Excludable Rights or change The Australian Consumer Law or Changes to this Agreement except in your favour. Your purchase order or vendor terms bind us only where we expressly agree to a specific term in writing. A related body corporate of yours that signs an Order makes its own agreement with us on these terms.

2. Key terms

In this Agreement:

• Attendee Data means personal information about people who register for, attend or take part in your Events, including registration answers and attendance.
• Business Day means a day that is not a Saturday, Sunday or public holiday in Sydney.
• Commercial Message means a commercial electronic message under the Spam Act 2003 (Cth), and any other email, text or call that promotes goods, services, events or business opportunities.
• Customer Data means data that you, your Authorised Users or people acting for you put into the Service, or that the Service collects or receives for you, including Attendee Data, CRM records, imported, synced and enriched records, messages, files, recordings, and mail and calendar data from mailboxes and calendars connected to your Workspace. It does not include Panelist Data.
• Data Breach means unauthorised access to or disclosure of Customer Data that is personal information held by Panelist or a sub-processor, or its loss where unauthorised access or disclosure is likely.
• Fees means the amounts payable for the Service under your Order, your plan or this Agreement.
• Order means an order form, quote, statement of work or checkout page that you accept, and that sets out the plan, features, Fees, term or other commercial details for your use of the Service.
• Panelist Data means a Member's own account and profile information, information about how the Service is used, billing and account administration information, security logs, and aggregated or de-identified information that does not identify you, your contacts or any individual.
• Personal information has the meaning given in the Privacy Act 1988 (Cth), and includes personal data under the GDPR where it applies.
• Privacy Law means the Privacy Act 1988 (Cth), including the Australian Privacy Principles and the Notifiable Data Breaches scheme, and any other privacy, surveillance or data protection law that applies to a party, including the GDPR.
• Sensitive Information means sensitive information under the Privacy Act 1988 (Cth), including health information, and similar categories under other Privacy Law.
• Sponsor means a sponsor, exhibitor, partner or other third party to whom you give a role at, access to, or information from your Event.

"Including" does not limit what comes before it, and a reference to a law includes it as amended or replaced. Non-Excludable Rights are defined in The Australian Consumer Law. Other capitalised terms, such as Authorised User, Event, Member, AI Output and Workspace, have their meanings in the User Agreement.

3. Workspaces, Authorised Users and administrators

Your Workspace. You are responsible for your Workspace, everyone you allow into it and everything done in it, except to the extent caused by our breach, a defect in the Service or our negligence. Authorised Users may use it up to the seats in your plan. Each needs their own Panelist account, must be at least 18 and must accept the User Agreement, and you are responsible for their acts and omissions as your own. Do not share logins, and remove access promptly when someone leaves or no longer needs it.

Administrators. You must appoint at least one administrator. Administrators may be able to manage users and permissions, export and delete content, connect mailboxes and integrations, grant mailbox access, choose Hugo's settings and manage billing, and we may treat anything done or instructed through an administrator's account as done or instructed by you. If people in your organisation disagree about who controls a Workspace, we may follow the person we reasonably believe can bind you, usually the entity on the Order or paying for the plan, and may restrict changes meanwhile, telling you if we do.

Security and third parties. Keep credentials secure, use the security features the Service offers where reasonable, and tell support@panelist.com promptly about any compromise. If you give a Sponsor, speaker or contractor access to your Workspace or Event, you decide what they may do and are responsible for their use of it.

4. The Service we provide

Depending on your plan, the Service may include tools for event pages, registration, ticketing, check-in, matchmaking and virtual sessions; a CRM with imports, enrichment, and email and SMS campaigns; a shared inbox, calendar connections and company mailbox grants for Google and Microsoft accounts; and Hugo, an AI assistant that can draft, search, answer questions and, as Hugo autonomy, approvals and safeguards describes, send messages and take actions. Some features depend on third-party services and their terms, as APIs and integrations describes.

Our standard. We will provide the Service with due care and skill, in line with this Agreement and the laws that apply to us as its provider.

Changes to the Service. We may add, change or remove features, but we will not materially reduce the core functionality of a paid plan during a paid billing period unless the law, a provider we depend on, or a security or safety risk requires it. If we remove or materially reduce a material part of your paid plan, we will give you at least 30 days' notice where we reasonably can, and you may cancel before the change, or within 30 days after we tell you if we gave less than 30 days' notice, and receive a pro-rata refund of prepaid Fees.

Availability. We use reasonable efforts to keep the Service available, but it may be unavailable during maintenance or outages of services we rely on. We commit to uptime or service credits only if your Order does, and any credits in an Order are your sole financial remedy for that service level, without limiting your Non-Excludable Rights or any right to terminate for material breach.

Event day. Events happen at a fixed time, so you must have reasonable contingency plans, such as exporting attendee and check-in lists beforehand, a fallback way to admit attendees, and testing registration, check-in, streaming and messaging. Subject to your Non-Excludable Rights, we are not liable for loss that reasonable contingency plans would have avoided. Your own connections, devices, venue networks and connected domains and accounts are your responsibility.

Professional services. We will perform any setup, migration, training or event-day support in an Order with due care and skill, as the Order describes. Unless it says otherwise, we are not your event manager, marketing agency, legal adviser or data protection officer.

5. Support and beta features

Support. We provide support at support@panelist.com and through any channel in your Order, and use reasonable efforts to respond within a reasonable time. We commit to response times only if your Order sets them. Unless your Order says otherwise, support covers using the Service and problems with it, not on-site attendance, event production, custom work, legal advice or third-party services. To investigate a problem you report, our support staff may access the relevant part of your Workspace under the Data Processing Schedule.

Beta features. Features labelled beta, preview, early access or experimental are provided as they are, subject to your Non-Excludable Rights. They may be unreliable, may change or be withdrawn at any time, have no service level or support commitment, and may never become generally available, so do not rely on them for anything critical. If you paid separately for one and we withdraw it, we will refund prepaid Fees for it for the period after it stops. This Agreement applies to them.

6. Your responsibility for how you use the Service

What you do with your Workspace is your business and your responsibility. Panelist provides the tools. You decide whom you import, whom you contact, what you send, which Events you run and how you use Hugo, and you are responsible for those decisions and for complying with the law.

Your decisions are yours. Panelist does not decide how you use the Service or supervise it. You are responsible for how you use the CRM, including whom you import, sync or enrich and your right to use their information; whom you contact, what you send, whether they consented, and stopping when they ask; your Events and offers; how you set up Hugo, including the autonomy you allow; the content in the spaces you run; and your compliance with the law, including Privacy Law, the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), and consumer, online safety, anti-discrimination, workplace surveillance and work health and safety law.

Tools, not supervision. Unless the law requires otherwise, Panelist has no duty to prescreen, monitor, verify consent for or edit Customer Data or your messages, and does not routinely do so. Unsubscribe links, suppression lists, sending limits, approval settings and Hugo's safeguards are aids: they do not mean we have checked your use or that it is lawful, and they do not move your legal obligations to us.

A Customer's misuse is the Customer's. If a Customer imports a list it has no right to use, sends spam, messages people who have not consented, runs an unlawful Event or publishes unlawful content, then, to the extent the law allows, Panelist is not responsible, even though the Customer used Panelist's tools; the Customer is responsible to the people affected, to regulators and to us. This does not limit our responsibility for our own breach, defects in the Service, our negligence, or a message or action caused by the Service failing to follow your settings, or affect your Non-Excludable Rights.

We may still act. We may act on complaints, on notices from carriers, providers, regulators or law enforcement, and on apparent abuse. Where reasonably needed, we may ask you about a suspected breach, for example for consent records or a list's source (an "abuse inquiry"), which you must answer within the time the Acceptable Use Policy sets; pause sending or other features, or remove content; cooperate with regulators, carriers and mailbox providers; and disclose your name and contact details as the Customer responsible for a message, Event or page where the law requires, when lawfully asked, or so that a complainant can take it up with you. Acting once does not oblige us to act again. You must deal promptly and in good faith with complaints we refer to you.

7. Acceptable use

The Acceptable Use Policy is part of this Agreement. You and your Authorised Users must comply with our Acceptable Use Policy, including its rules on email, text messages and calls, prohibited content, restricted industries, sensitive information and AI. You are responsible for breaches by anyone you let use your Workspace or post in your spaces. A serious or repeated breach is a material breach of this Agreement, and we respond in proportion, as the policy's enforcement terms and Term, suspension and termination describe.

You must also not resell or sublicense the Service, except to run Events and communications for clients where your Order allows; copy, reverse engineer or decompile it, except as the law allows; use it to build a competing product, or publish benchmarks of it without our consent; test its security without our agreement; or exceed your plan's limits or avoid Fees, for example by sharing logins. A reseller or agency using the Service for clients is responsible for their use as its own and must have their authority for their Customer Data.

8. Your data

Ownership and licence. As between you and Panelist, you own Customer Data. You grant Panelist a non-exclusive, worldwide, royalty-free licence, for as long as we hold Customer Data under this Agreement, to host, copy, process, transmit, display and adapt it only as needed to provide, secure, support and maintain the Service for you, to follow your instructions, to prevent fraud and abuse, and as the law requires. Our sub-processors may use this licence only to provide services to us.

How we handle it. We handle Customer Data on your instructions, under the Data Processing Schedule. We do not sell it, use it to market to your contacts, or use it for Panelist's own events business, Factor, and we disclose it to other customers only as you direct, for example to your Sponsors through the Service. We may create and use aggregated or de-identified information, such as usage statistics, to operate and improve the Service, if it identifies no one and we do not try to re-identify it.

Panelist Data. Panelist Data is ours and is handled under our Privacy Policy. A Member's own account and profile remain Panelist Data even if the same details are in your Customer Data. A person who connects a Google or Microsoft account keeps their rights under our Privacy Policy, including to disconnect it and ask us to delete data obtained from it, and we may act on those requests even where the data is also Customer Data.

Your responsibilities. You are responsible for the accuracy, quality and legality of Customer Data and for complying with Privacy Law in relation to it. In particular, you must collect personal information only lawfully, fairly and as reasonably necessary; have a privacy policy and give the collection notices the law requires, covering disclosures to Panelist, to Sponsors and overseas, and any use of AI; obtain the consents the law requires, including for direct marketing, sharing with Sponsors, recording and Sensitive Information; keep Sensitive Information and children's information out of the Service except as Sensitive information allows, and never put card numbers, passwords or identity documents in notes, messages or files; answer people's access, correction and deletion requests and complaints; delete data you no longer need; and comply with Privacy Law even if you would otherwise be exempt, for example as a small business. You must not use the Service for a serious invasion of privacy under Schedule 2 of the Privacy Act 1988 (Cth). Keep your own copies of the data that matters to you.

9. Sensitive information

The Service is not designed to hold Sensitive Information, except the limited health information this section allows, which is also protected by the Health Records and Information Privacy Act 2002 (NSW) and similar laws. You must not collect or store Sensitive Information in the Service, including in registration questions, CRM fields, notes, files or instructions to Hugo, unless the feature is designed for it and you meet this section. Sensitive Information that arrives incidentally, for example in correspondence or recordings, is not a breach, but you must not seek out or compile it, and you may use it only for the matter it relates to. Our Acceptable Use Policy sets further rules.

Dietary and access needs. You may ask attendees about dietary and access needs only as far as you need to cater for them. Answers that reveal an allergy, a condition or a disability are health information. For them, you must ask for the arrangement needed, not the diagnosis; collect them with consent, saying why you ask and who will see the answer, and make the question optional where you can; use and share them only to cater for the person, for example with your caterer or venue; limit access to those who need it; delete them, or tell us to, when they are no longer needed; and handle access and correction requests as the law requires.

If you need other Sensitive Information, for example for a health-sector event, ask user-compliance@panelist.com first, and collect it only if we agree in writing. You are responsible for Sensitive Information you put into the Service in breach of this section, and the Data Processing Schedule still applies to it.

10. Plans, fees and billing

Fees. You must pay the Fees for your plan and any usage-based Fees, such as for messages, contacts, seats or enrichment lookups, at the rates in your Order.

Currency and tax. Unless stated otherwise, Fees are in Australian dollars and exclude GST, which you must pay in addition against our tax invoice. Outside Australia, any local tax, including reverse-charge tax, is yours. If you must withhold tax from a payment to us, you must increase the payment so that we receive the full amount, unless we can recover the tax.

Billing. Unless your Order says otherwise, you authorise us and our payment provider, Stripe, to charge your payment method, including updated card details from your card issuer, in advance for each billing period and for usage-based Fees as they are incurred. Invoices are payable within 14 days, or as your Order states, without deduction except a set-off this section allows or a deduction the law requires.

Late payment. If you do not pay on time, we may suspend paid features after at least 10 Business Days' notice, but if you have an Event less than 10 Business Days away, we will first contact you to try to resolve it. We may charge interest at 2% a year above the Reserve Bank of Australia cash rate target, and reasonable recovery costs, but not on an amount you dispute in good faith.

Disputed charges. Tell us at support@panelist.com within 60 days if you think a charge is wrong, with reasons, and pay any undisputed part on time. If we agree, we will refund or credit it. Please contact us before going to your card issuer. This does not limit your rights under the law.

Price changes. A price change applies only from your next renewal, after at least 30 days' notice, and you can cancel before then if you do not accept it. Prices fixed for an Order's fixed term do not change during that term.

Refunds. Fees are non-refundable except where this Agreement or the law, including the Australian Consumer Law, provides. This Agreement gives a pro-rata refund of prepaid Fees when you cancel because of a feature removal or adverse change you do not accept, when we terminate for convenience or you terminate for our breach, and in the other cases it states.

Set-off. Either party may, by notice, set off an undisputed amount due to it under this Agreement against an amount it owes the other party under this Agreement, but not an amount disputed in good faith.

Records. We will give you our billing records for any charge on request.

11. Automatic renewal, free trials and credits

Automatic renewal. Paid plans renew automatically for a period of the same length unless you cancel before the renewal date. Your billing period, price and renewal terms are shown when you buy and in your Order, and unless your Order says otherwise, renewal is at our then-current price, subject to the notice in Plans, fees and billing. If your plan is annual or longer, we will remind you a reasonable time before it renews.

Cancelling. You can cancel at any time in the billing settings, where available, or by emailing support@panelist.com from an administrator's address. You need not give a reason, call us or accept a retention offer, and we will acknowledge your cancellation. It takes effect at the end of the paid billing period, or of any minimum term in your Order, and you keep access until then.

Free trials. A trial lasts for the period we tell you when it starts. Before you start, we will tell you whether payment details are needed and, if they are, the price and the date of the first charge. Such a trial converts to a paid plan at the end unless you cancel first, and we will tell you before it converts. A trial without payment details simply ends. We may end a misused trial early, with notice. Subject to your Non-Excludable Rights, trials are provided as they are.

Allowances and credits. Plan allowances do not roll over. Usage credits you buy separately last 12 months from purchase, and promotional credits and discounts apply only on their stated terms. Unless your Order says otherwise, credits are non-refundable except where this Agreement or the law provides, have no cash value and cannot be transferred.

Upgrades and downgrades. An upgrade applies at once and may be charged pro rata for the rest of the period. A downgrade takes effect at renewal, and you must fit your use to the lower plan by then.

12. Term, suspension and termination

Term. This Agreement continues until all your plans and Orders have ended and you stop using the Service as a Host or Customer.

Termination by you. You can cancel a plan at any time, as Automatic renewal, free trials and credits describes, or terminate this Agreement or an Order by notice if we materially breach it and do not fix the breach within 30 days of your notice, with a refund of prepaid Fees for the period after termination.

Termination by us. We may terminate this Agreement or a plan by notice:

1. for convenience, on at least 30 days' notice, with a refund of prepaid Fees for the period after termination, but not so that it takes effect before an Event you have announced, unless you agree or the law requires;
2. for a material breach that cannot be fixed or is not fixed within 30 days of our notice;
3. for a serious or repeated breach of the Messaging Schedule or the Acceptable Use Policy, fraud or scams, or an Event you do not intend to deliver;
4. on your insolvency, to the extent the law allows; or
5. if a law, regulator, court or provider we depend on requires it, with a refund of prepaid Fees for the period after termination unless your breach caused it.

Suspension. We may suspend all or part of the Service for you where we reasonably believe it is needed because of a security risk, a risk of harm or legal liability, a serious or repeated breach of this Agreement or the Community Guidelines, a breach of the Acceptable Use Policy, unlawful or high-complaint messaging, an unanswered abuse inquiry, non-payment after notice, or a legal or provider requirement. Where reasonable, we will warn you first and let you fix the problem; for an urgent risk, a legal requirement or a serious breach, we may suspend first and tell you promptly. We will tell you why, limit the suspension to what is reasonably needed, lift it once the reason is resolved, and review it if you think we are wrong. If you did not cause it, we will credit or refund Fees for that period.

When this Agreement ends

When this Agreement, a plan or an Order ends, access to the related features ends (Authorised Users keep their own Panelist accounts); you must pay Fees owing to the end date and any minimum-term Fees, unless you ended it for our breach or under a right with a refund; Event pages may be taken down and scheduled campaigns stop; Hugo's authority to act for your Workspace ends, so disconnect your mailboxes; Data Processing Schedule: requests, deletion and audit applies to Customer Data; and each party must return or destroy the other's Confidential Information on request, except as the law requires or in routine backups.

If you ask before the end, we will give you reasonable help to move to another provider, at agreed rates beyond the export tools. You remain responsible to the attendees of Events you have scheduled. Terms that by their nature continue after this Agreement ends survive it, including those on amounts owing, Customer Data, intellectual property, liability, indemnity, confidentiality and disputes.

13. Promises each of us makes

Your promises. You promise that you have authority to enter into this Agreement; that you have all the rights, consents, notices and authorisations needed for your Customer Data, content, Events, connected mailboxes and integrations, messages and AI settings, and for us to handle them under this Agreement; that you, your Authorised Users and your Events comply with the law and the Acceptable Use Policy; that the information you give us about your organisation, sender IDs and payout details is accurate; and that you are not subject to sanctions under Australian or other applicable law.

Our promises. We promise that we have authority to enter into this Agreement; that we will provide the Service with due care and skill, and substantially as described in your Order; that we will handle Customer Data in accordance with the Data Processing Schedule; that we will comply with the laws that apply to us as its provider; that we will not materially reduce the Service's overall security during your plan; and that we will take reasonable steps to keep malicious code out of it. If we breach a promise, tell us and we will use reasonable efforts to fix it. If we do not fix a material breach within 30 days, you may terminate the affected Order and receive a refund of prepaid Fees for the period after termination, in addition to your Non-Excludable Rights.

What we do not promise. Subject to your Non-Excludable Rights and the promises above, we do not promise that the Service will be uninterrupted or error-free, that data will never be lost, that any message will be delivered or any sale, meeting or lead will result, that enriched, imported or AI-generated information is accurate, or that the Service's defaults or compliance features will make your use lawful. We are not responsible for third-party services, and we exclude all other warranties to the extent the law allows.

14. The Australian Consumer Law

Nothing in this Agreement excludes, restricts or modifies any right or remedy, or any guarantee, warranty or other term, implied or imposed by the Australian Consumer Law or any other law that cannot lawfully be excluded, restricted or modified ("Non-Excludable Rights"). Every exclusion and limitation in this Agreement applies only to the extent the law allows.

If you acquire the Service as a consumer within the meaning of the Australian Consumer Law, our services come with guarantees that cannot be excluded under the Australian Consumer Law. For major failures with the service, you are entitled to cancel your service contract with us and to a refund for the unused portion, or to compensation for its reduced value. You are also entitled to be compensated for any other reasonably foreseeable loss or damage. If the failure does not amount to a major failure, you are entitled to have problems with the service rectified in a reasonable time and, if this is not done, to cancel your contract and obtain a refund for the unused portion of the contract.

Where the law allows, and the services are not of a kind ordinarily acquired for personal, domestic or household use, our liability for breach of a Non-Excludable Right is limited, at our option, to supplying the services again or paying the cost of having them supplied again. If you are an individual using the Service other than for a business, the limits on liability and the indemnity apply to you only as Liability and Indemnity state for consumers.

15. Liability

This section is subject to The Australian Consumer Law. It does not limit either party's liability for fraud, for wilful misconduct, for personal injury or death caused by its negligence, or for anything else the law does not allow it to limit. Nothing in this Agreement limits any right or remedy an individual has under Privacy Law, or either party's liability to an individual under Privacy Law.

Excluded loss. To the extent the law allows, neither party is liable to the other for indirect or consequential loss, or for loss of profit, revenue, business, opportunity, goodwill or anticipated savings. This does not limit your obligation to pay Fees or your liability under Indemnity.

Losses we are not responsible for. To the extent the law allows, we are not liable for loss to the extent it arises from your Events or the acts of your attendees, Sponsors, suppliers or Authorised Users; messages from your account or mailboxes, or your Customer Data, settings or instructions; AI Output you rely on, send or approve, or Hugo's actions within settings you enabled; third-party services; or events beyond our reasonable control, except to the extent caused by our breach, a defect in the Service, our failure to follow your settings or our negligence.

General cap. Except as set out below, and to the extent the law allows, each party's total liability to the other arising out of or in connection with this Agreement and the Service, whether in contract, tort (including negligence), under statute or otherwise, is limited to the greater of the Fees paid or payable by you in the 12 months before the claim and AUD 1,000.

Data protection cap. Instead of the general cap, each party's total liability to the other for breach of Your data, Sensitive information or the Data Processing Schedule is limited, to the extent the law allows, to the greater of the general cap and three times the Fees paid or payable in the 12 months before the claim.

What the caps do not cover. Neither cap applies to your obligation to pay Fees and the amounts you owe us for refunds, chargebacks, dispute fees and passed-through messaging charges; or to your liability under Indemnity.

Contribution and consumers. Each party's liability is reduced to the extent the other, or its personnel, Authorised Users or contractors, contributed to the loss, and each must mitigate its loss. If you are an individual using the Service other than for a business, the exclusions and caps in this section do not limit our liability to you for reasonably foreseeable loss caused by our breach or negligence.

16. Indemnity

To the extent the law allows, you indemnify Panelist, its related bodies corporate and their officers, employees and contractors against any third-party claim, regulatory action, investigation or complaint, and any resulting loss, liability, fine, penalty, settlement and reasonable cost (including legal costs), to the extent it arises from:

• your Events, including any injury, loss or damage at or connected with them;
• Customer Data, or your handling of personal information, including claims under Privacy Law, under the statutory tort for serious invasions of privacy, or under surveillance laws;
• messages sent from your account, Workspace or connected mailboxes, including breaches of the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), the Telemarketing Industry Standard or overseas anti-spam law;
• your Sponsors' use of Attendee Data or lead data you made available to them;
• your ticket sales, prices and refunds, including under the Australian Consumer Law;
• User Content in your spaces, and content published through your account, including defamation claims; or
• your content or Customer Data infringing anyone's rights, or your or your Authorised Users' breach of this Agreement or the law.

Where we are at fault. Your liability under this indemnity is reduced to the extent our breach, a defect in the Service, or the negligence or wilful misconduct of Panelist or its personnel caused or contributed to the claim or loss.

Process. We will tell you promptly about a claim (a delay reduces your liability only to the extent it prejudiced you), let you control its defence and settlement where reasonable once you confirm in writing that the indemnity applies, and give you reasonable help at your cost. We may join the defence with our own lawyers at our cost. Neither party may settle a claim in a way that requires an admission by, or imposes an obligation on, the other without the other's consent, which must not be unreasonably withheld.

Consumers. This indemnity does not apply to an individual using the Service other than for a business, who is responsible, to the extent the law allows, only for loss caused by their breach of this Agreement or the law.

17. Intellectual property

Panelist's rights. Panelist and its licensors own all rights in the Service, including its software, design, documentation, templates and prompts, and in our names and logos. Subject to this Agreement and payment of the Fees, we grant you a non-exclusive, non-transferable right, for the term of your plan, for you and your Authorised Users to use the Service for your internal business purposes and your Events.

Your rights. You own your Customer Data, Event content, brands and the AI Output generated for you. You grant us the licence in Your data, and the right to show your name and logo on your Event pages and as Publicity describes. We may use your feedback freely, but we will not publicly name you as its source without your consent.

If the Service infringes. If a third party claims that your use of the Service in line with this Agreement infringes their intellectual property, we will, at our option and cost, get you the right to keep using it, modify it so that it does not infringe without materially reducing its functionality, or stop providing the affected part and refund prepaid Fees for it. This does not apply to claims caused by Customer Data, your content, third-party services or combinations we did not provide.

18. Confidentiality

"Confidential Information" means non-public information one party gives the other in connection with this Agreement that is marked confidential or would reasonably be understood to be confidential, including Order terms, pricing, security information and product plans. The recipient must keep it confidential, use it only for this Agreement, protect it with reasonable care, and disclose it only to personnel, contractors, advisers and related bodies corporate who need to know it and are bound by confidentiality, and it is responsible for their compliance.

This does not apply to information that is public through no fault of the recipient, that the recipient already had or developed independently, or that it received from someone free to disclose it. A recipient may disclose what the law, a court, a regulator or a stock exchange requires, with notice where lawful. Customer Data is governed by Your data and the Data Processing Schedule, and this section does not prevent the disclosures this Agreement describes elsewhere. These obligations last for three years after this Agreement ends, and longer for trade secrets.

19. Publicity

You may say publicly that you use Panelist. While you are a customer, we may name you as a customer and show your logo on our website and in our marketing, unless you ask us not to at support@panelist.com, after which we will stop doing so in new materials within a reasonable time. We will not publish a press release, case study, testimonial or quote about you without your consent, and each party will follow the other's reasonable brand guidelines. Event pages may show that they are powered by Panelist, unless your plan allows you to remove that notice.

20. Changes to this Agreement

We may change this Agreement to reflect changes to the Service, the law, our providers' requirements or our business, and we will post the update here with a new date. For a materially adverse change, we will give you at least 30 days' notice by email or in the Service, unless it is needed sooner for legal, regulatory, provider, security or safety reasons, in which case we will give you as much notice as we reasonably can. If you do not accept a materially adverse change, including one to the Acceptable Use Policy, you may cancel the affected plans before it takes effect, or within 30 days after we tell you if we gave less than 30 days' notice, and receive a refund of prepaid Fees for the period after cancellation.

Changes do not apply to a fixed-term Order until it renews, unless you agree, the change is not adverse to you, or the law requires it. Changes that are not materially adverse may take effect when we post them, and if you keep using the Service after a change takes effect, it applies to you. Price changes are covered by Plans, fees and billing, and changes of sub-processor by Data Processing Schedule: sub-processors.

21. Notices

We may give you notices by email to the account owner, administrator or billing contact for your Workspace, or in the Service, so keep those details current. Send legal notices to user-compliance@panelist.com, and general enquiries, support requests and cancellations to support@panelist.com. A notice given by email, by either party, is received when it is sent to the address on the account or in this section, unless the sender receives a message that it was not delivered. A notice in the Service is received when it is first displayed to you. Notices and Orders may be given and made electronically, and an email notice is in writing.

22. Disputes and governing law

Talk to us first. A party raising a dispute about this Agreement must give the other a notice describing it, and both parties will then try in good faith to resolve it within 30 days, including through a meeting of people with authority to settle it.

Mediation. If the dispute is not resolved within those 30 days, either party may propose mediation, which is voluntary. If both parties agree, it is conducted through the Resolution Institute, in Sydney or online, by a mediator agreed between the parties or, failing agreement, nominated by the Resolution Institute. Each party pays its own costs, and the parties share the mediator's costs equally.

Courts. If the dispute is not resolved by negotiation or mediation, either party may take it to the courts of New South Wales. A party need not wait before seeking urgent interim relief, recovering an undisputed debt or protecting a limitation period. If you are a consumer, you may go to a court or tribunal at any time, and nothing in this Agreement stops you from joining a class action or contacting a regulator, ombudsman or consumer protection agency.

Governing law. The laws of New South Wales govern this Agreement, and each party submits to the non-exclusive jurisdiction of its courts. This does not take away a consumer's right to bring proceedings where they live or under the law that applies there.

Your disputes with others. Disputes between you and your attendees, Sponsors, speakers or suppliers are between you and them. We may help but do not have to, and you must not say that Panelist is responsible for matters this Agreement makes yours.

23. General

• Entire agreement. This Agreement, with the User Agreement and the documents they refer to, is the whole agreement between us about its subject matter and replaces earlier agreements and representations about it, but this does not exclude liability for fraud or misleading conduct, or your Non-Excludable Rights.
• Severability and waiver. An invalid, unfair or unenforceable part of this Agreement is read down or severed, and the rest continues. A waiver must be in writing, and a delay in exercising a right is not a waiver.
• Assignment. You may assign this Agreement only with our written consent, which we will not unreasonably withhold. We may assign or novate it to a related body corporate or a buyer of all or part of our business that agrees to be bound, telling you if we do; if you reasonably object, you may terminate the affected plans with a pro-rata refund of prepaid Fees.
• Subcontracting and relationship. We may use subcontractors and remain responsible for our obligations. Apart from the payment collection agency in Ticket payments, payouts and taxes, this Agreement creates no partnership, joint venture, employment, fiduciary or agency relationship.
• Events beyond reasonable control. Neither party is liable for a delay or failure caused by events beyond its reasonable control, such as internet, telecommunications or third-party failures, cyber attacks that reasonable security would not have prevented, natural disasters, pandemics, industrial action, war or government action, if it tells the other promptly and limits the effect. This does not excuse payments due or your obligations to attendees. If such an event prevents a material obligation for over 30 days, either party may terminate the affected Order, with a refund of prepaid Fees for the period after termination.
• Non-solicitation. During this Agreement and for six months after it, neither party will directly solicit for employment an employee of the other it dealt with in connection with the Service, without consent. General advertising, and hiring people who respond to it or approach first, is allowed, and this applies only as far as the law allows.
• Anti-bribery, sanctions and modern slavery. Each party must comply with the anti-bribery laws that apply to it, including Division 70 of the Criminal Code Act 1995 (Cth), and take reasonable steps against modern slavery, as defined in the Modern Slavery Act 2018 (Cth), in its operations connected with this Agreement. You must not use the Service in breach of sanctions or export control laws, such as the Autonomous Sanctions Act 2011 (Cth), and we may end or suspend the Service at once, with notice, where providing it would breach a sanctions law.
• Third parties, signing and costs. Only you and Panelist may enforce this Agreement, but our related bodies corporate and personnel may rely on the indemnity and the limits on liability. Orders may be signed electronically and in counterparts, and each party pays its own costs of entering into this Agreement.
• Contact. FCR RSC Pty Ltd (ABN 37 682 852 213), trading as Panelist, New South Wales, Australia. General enquiries: support@panelist.com. Privacy, legal and intellectual property: user-compliance@panelist.com.

24. Your events

The sections from here to "APIs and integrations" are product-specific terms. Each applies when you use the product it covers.

You are the organiser. For each Event, you are the organiser and promoter and, where tickets are sold, the seller; Panelist provides the technology and is not the organiser, promoter, seller or venue unless it agrees in writing. You are responsible for accurate Event pages; your right to feature the people, logos and materials you use; delivering the Event as described, and any change or cancellation; publishing ticket, refund and attendee terms that comply with the Australian Consumer Law before people register; permits and licences; the conduct of your staff, speakers, Sponsors and contractors; and taxes on your Event income.

Screening. Your criteria and decisions on who may attend, and which registrations and meeting or roundtable requests are approved, including decisions Hugo makes for you, must comply with anti-discrimination law.

Messages about your Event. Messages only about an Event a person registered for are generally not Commercial Messages, but one that also carries a sponsor offer or other promotion may be, and the Messaging Schedule then applies. Push notifications must relate to your Event.

Your domain and matchmaking. If you publish Event pages on your own domain, you must have the right to use it, manage its DNS and renewal, and keep its privacy, terms and cookie notices accurate. We do not promise that any meeting will be requested, accepted or attended, or that any match will suit.

Accessibility. You must make your Events accessible as the Disability Discrimination Act 1992 (Cth) and State and Territory laws require, for example through accessible venues, reasonable adjustments such as captions or Auslan interpreting, and rules and questions that do not discriminate unlawfully. We do not promise that the Service meets any particular accessibility standard.

Recordings. If you record, photograph or stream your Event, or let others do so, you must tell participants clearly, before they register and at the session, how the material will be used and kept; obtain the consents and releases the law requires, including for marketing; give people a practicable way to avoid being recorded; never record a private conversation without the consent of everyone in it; hold the rights to music and material you use; and remove recordings when no longer needed or validly asked. Recordings are Customer Data.

Codes of conduct. For each Event, you must publish and enforce a code of conduct at least as protective as our Community Guidelines, saying what is unacceptable and how to report it; respond to reports, including by keeping people safe and involving police where needed; and meet any positive duty under the Sex Discrimination Act 1984 (Cth) and work health and safety law. We may pass reports we receive to you, unless that would be unsafe or unlawful or the person asks us not to.

25. Event safety, insurance and venues

Health and safety. You are responsible for the health and safety of everyone at your in-person Events under the Work Health and Safety Act 2011 (NSW) and corresponding laws, including by consulting and coordinating with your venue and contractors. Panelist does not control your venue, operations or attendees, and its registration, check-in and app features do not make it responsible for safety. As each Event's risks require, you must manage crowds, capacity, emergencies, first aid, security and fire risk; use suitable, licensed venues and qualified contractors; serve alcohol responsibly; warn attendees before they register of the risks of recreational or physical activities, as the Civil Liability Act 2002 (NSW) contemplates; report notifiable incidents as the law requires; and follow directions from police, emergency services and the venue. If our personnel attend, you must give them a safe workplace and the information they need.

Insurance. You must hold the insurance a prudent organisation would hold for your Events and your use of the Service. For in-person Events this usually includes public liability insurance (venues often require AUD 10 million or more), and workers compensation insurance as the law requires. You must give us a certificate of currency on request if your Order requires insurance or our personnel will attend.

Suppliers and online sessions. Your agreements with venues and suppliers are between you and them. For virtual and hybrid sessions, you are responsible for your speakers' set-up, for moderating chat, Q&A and polls, for removing disruptive participants and for the content shown.

26. Online communities and online safety

If you run a community, Event chat, Q&A, directory or other space where people can post or message each other, you run it and are responsible for it. Content posted in it by anyone other than Panelist is "User Content". For each space, you must:

• publish and enforce rules at least as protective as our Community Guidelines, and moderate in proportion to the space's size and risk, including during live Events;
• give people an easy way to report content to you, act on reports promptly, and not allow cyberbullying, cyber abuse, threats, hate, image-based abuse or doxxing;
• remove at once any material that may be child sexual abuse or exploitation material, terrorist or violent extremist material, or other class 1 material under the Online Safety Act 2021 (Cth), tell us at user-compliance@panelist.com so that we can report it as the law requires, and not copy, share or keep it;
• comply with any notice from the eSafety Commissioner, and any request from us to remove content or restrict a person, within the time it requires, which can be as short as 24 hours; and
• keep the space for adults, because the Service is only for people aged 18 and over.

Our own duties. Panelist has its own duties under the Online Safety Act 2021 (Cth), including the Basic Online Safety Expectations and the industry codes and standards, and under the Criminal Code. To meet them, we may review reported content, remove User Content, suspend accounts and give information to the eSafety Commissioner or police, whether or not you have acted, and we will tell you what we did unless the law prevents it or it would put someone at risk. This does not make us the moderator of your spaces.

27. Complaints about content, including defamation

Your Event pages, spaces and messages are published by you. If someone complains to us that content you or your users published is defamatory, infringing or unlawful, or breaches our Community Guidelines, we may pass the complaint to you, with the complainant's details where they agree or the law allows.

Defamation. Under section 31A of the Defamation Act 2005 (NSW) and corresponding laws, a digital intermediary such as Panelist may have a defence if it has an accessible complaints mechanism and, within 7 days after receiving a complaint that meets the legal requirements, takes reasonable steps to prevent access to the content. So you must answer a complaint we pass to you within 2 Business Days, saying whether you will remove or change the content or why it is lawful. If you do not, or if we reasonably believe the content is likely to be defamatory or otherwise unlawful, we may remove or disable it, or ask you to, without waiting for the dispute to be resolved. You remain responsible for the content as its publisher.

Other complaints. Intellectual property complaints are handled under our Copyright Policy. Reports, and reviews of our decisions, work as our Community Guidelines describe for reporting and appeals. We do not decide disputes between you and a complainant, and removing content in good faith is neither an admission that it is unlawful nor a breach of this Agreement.

28. Sponsors, exhibitors and lead retrieval

Your Sponsors. Your agreements with Sponsors are between you and them, and Panelist is not responsible for any Sponsor's acts, content, products or payments. You are responsible for what you promise Sponsors and for any Sponsor you give access to your Workspace, Event or Attendee Data.

What Sponsors receive. You decide what Attendee Data your Sponsors receive, and when. You must tell attendees clearly on your registration page, before they register, which Sponsors will receive their details, what they will receive and when, and what Sponsors may do with them. Sharing with your Sponsors, through the Service or outside it, is your responsibility.

Your agreement with each Sponsor. Before a Sponsor receives Attendee Data or access to attendees, you must have a written agreement requiring it to use Attendee Data only for the purposes disclosed to attendees, and not to sell or pass it on; to comply with Privacy Law, the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth); to keep the data secure, report breaches to you and delete the data when it is no longer needed; to follow your code of conduct and our Community Guidelines; and to let you enforce these terms.

Lead retrieval and content. A Sponsor may capture an attendee's details only with the attendee's knowledge, for example by scanning a badge the attendee presents. You must not let Sponsors scan badges covertly, scrape attendee lists, profile attendees in ways they would not expect, or contact attendees in breach of the Spam Act 2003 (Cth) or other law. Lead data is Customer Data that you disclose to the Sponsor. If we reasonably believe a Sponsor is misusing Attendee Data or the Service, we may restrict it and will tell you why. You are responsible for the Sponsor content you publish being accurate, lawful and not misleading, including about being paid for.

29. Selling to consumers

If you sell tickets, memberships, subscriptions or anything else through the Service, you are the seller, and the Australian Consumer Law applies to you as the seller.

Prices. Wherever you show a ticket price, you must also show, at least as prominently, the single total price, including GST and every compulsory fee that can be worked out, as section 48 of the Australian Consumer Law requires, rather than adding compulsory fees late in checkout ("drip pricing"). Extras must be genuinely optional; discounts, "was" prices, scarcity claims and countdown timers must be true, as sections 18 and 29 require; and surcharges must be disclosed before payment and stay within legal limits.

Refunds and changes. Your refund policy must be clear, published before purchase and consistent with the Australian Consumer Law, and must not suggest attendees have fewer rights than it gives them. If you cancel, postpone or materially change an Event, you must tell attendees promptly and give the refunds and options your policy and the law require, even if you have already received the ticket money.

Panelist's fees. If Panelist charged an attendee a booking fee and the Event is cancelled, we will refund it when you refund their ticket. Your Fees to Panelist are not refundable because you cancel or postpone an Event, except as this Agreement or the law provides. We may refer attendees who contact us about an Event to you, and you must respond promptly.

From 1 July 2027, when the Competition and Consumer Amendment (Unfair Trading Practices) Act 2026 takes effect, you must not use manipulative online practices ("dark patterns"), such as pre-ticked add-ons or making cancelling harder than signing up; you must show transaction and card fees up front, with the base price; and, for subscriptions and memberships, you must give clear terms, send the renewal reminders the law requires and allow easy online cancellation. You are responsible for your prices, offers and checkout set-up, and Panelist for how its own fees and plans are shown.

Ticket resale. For Events in New South Wales, the Fair Trading Act 1987 (NSW) caps ticket resale at 10% above the original price, requires resale advertisements to show the original price, and bars an organiser from cancelling a lawfully resold ticket. Your resale terms must comply with it and similar laws elsewhere. Indemnity applies to claims arising from your sales.

30. Ticket payments, payouts and taxes

You may take Event payments using a method the Service supports, processed by our payment provider, Stripe, or by a provider you connect, under its terms. Nothing in this section makes Panelist the seller of a ticket or responsible to attendees for your obligations.

If attendees pay you directly, or through a payment account in your name that you connect, you are the merchant of record and are responsible for refunds, disputes, chargebacks, provider fees and fraud screening. Panelist does not hold that money.

If Panelist collects ticket money for you, you appoint Panelist as your limited agent only to collect ticket payments and pay them to you, and an attendee's payment to Panelist or its payment provider satisfies the attendee's obligation to pay you. That money is not held on trust and earns you no interest; your right is to be paid what is due. You must give us the business, banking, identity and tax details we or our payment provider reasonably request, including for anti-money laundering checks, and follow the card schemes' rules, and we may delay payouts until you do.

Payouts and reserves. We will pay you the ticket money we collect, less our Fees, processing fees, refunds, chargebacks, dispute fees and other undisputed amounts you owe us, to your nominated bank account on the schedule shown in the Service or your Order, and we are not responsible for payments to that account or for bank delays. Where we reasonably believe there is a material risk of refunds, chargebacks, fraud or breach, for example before an Event takes place, we may hold a reasonable reserve, telling you why and releasing it when the risk has passed.

Refunds and chargebacks. You decide your refund policy, subject to the law, and are responsible for the refunds you approve. If you cancel an Event or do not deliver it as described, you authorise us to refund attendees from ticket money we hold. You are responsible for every chargeback, reversal and dispute fee on your Events, except to the extent caused by our error, and must help us respond to disputes. If these exceed what we hold for you, you must pay us the difference within 10 Business Days of our request.

Currency and unclaimed money. Ticket money is collected and paid in the currency shown, at the payment provider's conversion rates and fees. If we cannot pay you for lack of valid payout details, we will try to contact you, and otherwise deal with the money as the law requires.

Taxes. You are responsible for all taxes on your ticket sales and Event income, including GST, and for giving us your correct ABN and GST status. Receipts and tax invoices for your sales are issued in your name, and you must check them. Panelist is responsible for GST on its own Fees, and you must reimburse us for any tax on your supply that a tax authority treats us as liable for, unless it arose from our error.

Tax reporting. If Panelist collects ticket money for you, it may be an electronic distribution platform under the Sharing Economy Reporting Regime in Division 396 of Schedule 1 to the Taxation Administration Act 1953 (Cth), and may report your name, ABN, contact and bank details and sales to the Australian Taxation Office. You consent to that reporting. Where the law requires us to withhold an amount from payments to you, we may do so, telling you where the law allows.

31. CRM, imports and sync

Imports. When you import contacts, companies, deals or other records, you confirm that you obtained the information lawfully and may use it for your purposes in the Service, including direct marketing if you will send Commercial Messages. Your lists must also meet our Acceptable Use Policy, which prohibits, for example, messaging purchased, rented or scraped lists and re-importing people who unsubscribed. You are responsible for field mapping, duplicates and checking the results. Bulk imports, merges, edits and deletes may not be reversible, so export a copy first.

Other systems. Where the Service supports connecting another system, you authorise us to access it with the permissions you grant and to import and sync records as you configure. You confirm that you may connect it under your agreement with its provider, and you are responsible for your mappings and sync settings, their effect on records in either system, the lawful use of synced data, and the data while it is in the other system. We are not responsible for changes a sync makes in line with your settings, except to the extent caused by a defect in the Service, our failure to follow your settings, or our negligence. A provider may change or withdraw its API, and the integration may then stop working or change.

Your CRM. The Service is designed so that other Customers cannot see the records in your CRM.

Segments and suggestions. You may message a segment only if you may message everyone in it for that purpose, and you must not use segments or deal data to discriminate unlawfully. Forecasts, scores and suggestions depend on your data and on calculations and AI that can be wrong, so check them before you rely on them. A person's Panelist membership gives you no right to their Panelist Data beyond what they share with you.

32. Contact enrichment

What it is. Where your plan includes it, enrichment can complete records you choose with a contact's current job title, employer, location and LinkedIn profile address. It is provided by EnrichLayer, a data provider based in Singapore whose data is derived from public professional profiles, as our Privacy Policy describes. The results are Customer Data.

Your warranties. Each time you use enrichment, you warrant that:

• you may lawfully collect the information, fairly and as reasonably necessary for your activities (Australian Privacy Principle 3), and you will give people the notice Privacy Law requires (Australian Privacy Principle 5);
• you will use it for direct marketing only where Australian Privacy Principle 7 and the Spam Act 2003 (Cth) allow, honour opt-outs, tell people its source if they ask, and not treat an enriched record as consent to send Commercial Messages;
• you will use LinkedIn-derived information lawfully and in line with any terms that bind you, and not use enrichment to rebuild a network's data or get around its controls;
• you will not sell, publish or share enriched information outside your organisation, or build a data product from it; and
• you will not use it for decisions about a person's employment, credit, insurance, housing or eligibility for services, or to profile people in ways they would not expect.

No promise about the data. Enriched information comes from third-party sources. We do not promise it is accurate or complete, or that you may lawfully use it for your purpose. How you use it is your responsibility. Check it before you rely on it, and correct or delete it if a person tells you it is wrong.

Availability. We may suspend, limit or withdraw enrichment, or change provider, if the provider becomes unavailable or changes its terms, or if continuing would create legal risk. If you paid separately for enrichment, The Service we provide applies as it does to removing a material feature. Indemnity applies to claims arising from your use of enrichment.

33. Messaging Schedule: your responsibilities as sender

This Messaging Schedule applies to every email, text message, push notification, in-app message and call sent using the Service, including messages from connected mailboxes and messages Hugo drafts or sends for you, including chases.

You are the sender. Messages from your account, Workspace or connected mailboxes, including those Hugo sends under your Workspace's settings (defaults included), are sent by you, even though Panelist's systems transmit them. For the Spam Act 2003 (Cth), you are the person who sends them, or causes them to be sent, and who authorises them. Panelist does not decide whom you message or what you say, and you are responsible for the content, recipients, timing and lawfulness of every message.

The rules. You must follow our Acceptable Use Policy's rules for email and for text messages and calls, and the laws that apply to each recipient. Consent, sender identification, unsubscribes, consent records, the Do Not Call Register and calling hours are your duty, not Panelist's. Keep consent records for at least two years after you last message a person.

Our right to suspend. Where we reasonably believe it is needed to protect recipients, deliverability, our providers or our compliance, we may limit, delay or reject messages, suppress recipients, pause campaigns, require you to verify your identity, domains or sender IDs or to show us consent records, and suspend messaging features, for example because of high bounce, complaint or opt-out rates, a complaint, a carrier, provider or regulator requirement, an unanswered abuse inquiry or a suspected breach of this Schedule or the Acceptable Use Policy. We will tell you what we did and why, unless the law prevents it or it would undermine an investigation, and lift the restriction once the reason is resolved.

Records and cooperation. The Service may keep records of messages, including recipients, delivery, complaints, opt-outs and content, and we may use and disclose them to run the Service, answer complaints, carriers, providers and regulators, and enforce this Agreement. You must cooperate promptly with any enquiry about your messages from a regulator, such as the Australian Communications and Media Authority, a carrier or a mailbox provider.

Responsibility and indemnity. You are responsible for fines, penalties and infringement notices imposed on you, for charges passed through under Messaging Schedule: SMS and sender IDs, and, subject to Indemnity, for our reasonable costs of responding to enquiries about your messages. The indemnity covers claims arising from your messages. Subject to your Non-Excludable Rights, we do not promise that any message will be delivered.

34. Messaging Schedule: email

How email is sent. Campaigns go through Panelist's mail servers on Amazon Web Services, which share IP addresses and domains between customers, so one sender's poor practices can harm delivery for others. Email can also be sent through connected Google or Microsoft mailboxes, within those providers' limits and terms, which are your responsibility. Send only from domains you may use, with the authentication records, such as SPF, DKIM and DMARC, that the Service asks for. Our Acceptable Use Policy sets the rules for email.

Bounces and complaints. The Service may suppress addresses that hard bounce, complain or unsubscribe, and you must not get around that. As a guide, if a send produces hard bounces above about 5% of recipients, or spam complaints above about 0.1%, we may pause your sending while you fix the cause.

Unsubscribes and tracking. Emails sent one at a time or in sequences from a connected mailbox may not include an unsubscribe link, so add one to any that is a Commercial Message. Where the Service tracks opens or clicks, tell recipients in your privacy policy and get any consent their law requires, as our Cookie Policy explains.

35. Messaging Schedule: SMS and sender IDs

How SMS is sent. Texts go through our SMS gateway, Mobile Message, in Australia, and then mobile carriers, which decide whether and when to deliver them. Do not rely on the Service as the only way to send urgent safety messages.

Opt-outs. Do not assume the Service adds an opt-out. Make sure every commercial text you send, or Hugo sends for you, includes one, as our Acceptable Use Policy requires.

Sender IDs. Use only a sender number or name that accurately identifies you and that you may use, and complete any verification we or our gateway require. Since 1 July 2026, a message from an alphanumeric sender ID that is not on the SMS Sender ID Register may be blocked or labelled "Unverified". You must register any alphanumeric sender ID you use, or give us what we need to register it, and use it only as registered. We are not responsible for blocked or labelled messages unless we failed to register an ID after you gave us what we needed.

Charges. If a carrier, our gateway or a regulator imposes a fine, penalty or charge on us because of messages from your account, you must pay it to us, and we will give you its details, except to the extent it was caused by our breach or negligence. Long messages, emoji and international texts may cost more.

36. Messaging Schedule: calls, call recording and telemarketing

This section applies when you use the Service (including in-app calls, which Twilio carries), a number obtained through it, or information in it to make or arrange calls.

Telemarketing is your duty. Checking numbers against the Do Not Call Register, keeping to the permitted calling hours, identifying the caller and showing calling line identification, as the Do Not Call Register Act 2006 (Cth) and the Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 require, are your responsibility, not Panelist's. Do not assume the Service does any of them. Our Acceptable Use Policy sets out the rules.

AI voices and recording. If a call uses Hugo, another AI voice or a recording, say so at the start of the call, and follow any law on automated calls where the recipient is. Before you record a call, tell every party and obtain the consent the law requires, including under the Surveillance Devices Act 2007 (NSW), similar laws and the Telecommunications (Interception and Access) Act 1979 (Cth). If anyone does not consent, do not record.

No promise. Subject to your Non-Excludable Rights, we do not promise that your calls comply with any law or that a call will connect. Calling features are not a phone service and cannot be relied on to reach emergency services, so use a phone to call 000.

37. Connected mailboxes and calendars

Connecting. You and your Authorised Users may connect Google and Microsoft 365 mail and calendar accounts. The Service can then read, store and display messages and events, send messages and change calendar items, within the permissions granted. Our Privacy Policy explains how we handle this data.

Who can see it. Mail and calendar data from mailboxes and calendars connected to your Workspace is Customer Data. A connected mailbox is visible to your Workspace team, including administrators, under the Workspace's permission settings. Emails with CRM contacts are logged on those contacts' records, where anyone who can see the contact can read them. You are responsible for those settings, for who has access to shared mailboxes, and for telling the people who connect mailboxes, and anyone else the law requires, how their mail can be seen.

Authority and actions. By connecting a mailbox or calendar, or letting your Authorised Users do so, you confirm that the person connecting it may give Panelist that access, that your organisation has authorised the connection of any mailbox it owns (including any admin consent its Google Workspace or Microsoft 365 tenant requires), and that its use complies with your policies, your obligations to the people in it, and the law. You are responsible for everything sent, changed or deleted through the Service by you, your Authorised Users or Hugo within the permissions enabled, except to the extent caused by a defect, our failure to follow your settings, or our negligence.

Disconnecting a mailbox. When a mailbox is disconnected, Panelist stops accessing the mailbox and deletes its credentials at once. Within 24 hours, Panelist deletes the data it synced from that mailbox, including emails, timeline entries and composer files. A composer file is kept only if it was also sent from another mailbox that is still connected. This does not affect a colleague's copy synced from their own mailbox, or anything the law requires us to keep, and backup copies are removed when the backups expire. Keep any records your organisation needs before a mailbox is disconnected.

Disconnecting a calendar. Disconnecting a calendar stops Panelist using it and deletes the calendar events Panelist synced from it, except meetings booked through Panelist, which remain in Panelist.

Provider terms. Google's and Microsoft's terms continue to apply, and if either changes or withdraws our access, related features may change or stop. Subject to your Non-Excludable Rights, we are not responsible for that, but The Service we provide applies if it materially reduces a paid plan.

38. Company mailbox grants and workplace surveillance

Company mailbox grants. The Service lets an organisation grant colleagues access to a team or company mailbox connected to its Workspace. If you, or an administrator or mailbox owner in your Workspace, grant access, you are responsible for having authority to do so, including the owner's agreement for an individual's mailbox; granting only the access people need for a legitimate business purpose; making sure the person a mailbox belongs to knows others can access it, because accessing stored communications without the intended recipient's knowledge can be an offence under the Telecommunications (Interception and Access) Act 1979 (Cth); keeping personal correspondence private except as the law and your policies allow; removing access when it is no longer needed; and what people with access do. The same applies to the mailbox of a former employee or contractor, for which you also need a lawful basis.

Workplace surveillance duties belong to the employer. Accessing or monitoring employees' email, calendars or computer activity can be "computer surveillance". For example, the Workplace Surveillance Act 2005 (NSW) requires an employer to give employees written notice at least 14 days before surveillance starts, and to carry out computer surveillance only under a policy employees have been notified of, and other laws, such as the Workplace Privacy Act 2011 (ACT), impose similar duties. These duties belong to you as the employer, not to Panelist. You must give every notice, adopt and notify every policy and obtain every consent the law requires before using the Service to access or monitor workers' mailboxes, calendars or communications; never monitor anyone covertly or unlawfully; and comply with any industrial instrument or consultation duty that applies.

Panelist does not decide whose mailboxes are connected or who is given access, and does not monitor your workers for you. Indemnity applies to claims arising from your breach of a workplace surveillance law.

39. Hugo and AI features for your organisation

The AI terms in the User Agreement apply to you and your Authorised Users, including on AI Output, and this section and Hugo autonomy, approvals and safeguards add to them.

How Hugo works. Hugo and other AI features use third-party models, including Anthropic's Claude models through Amazon Bedrock in Panelist's own Amazon Web Services account, as our Privacy Policy describes. Hugo may use Customer Data, connected mailboxes and calendars and other Workspace records to answer questions and carry out tasks. Hugo is designed to work only within the permissions of the person using it.

No training on your data. We do not use your content, connected mailbox or calendar data, or Customer Data to train AI models. Amazon Bedrock and OpenAI do not use the inputs we send through their APIs to train their models. Google user data is never used to develop, improve or train generalised AI or machine-learning models.

AI Output. As between you and Panelist, you own the AI Output generated for your Workspace, to the extent the law allows. It can be wrong, and subject to your Non-Excludable Rights, we do not promise that it is accurate, original, fit for a purpose or free of third-party rights.

Your control and duties. You decide which features, mailboxes, data and permissions Hugo can use and what it may do without asking, and you must supervise it in proportion, reviewing its activity and changing settings that do not work as you intend. You must follow the AI rules in our Acceptable Use Policy, including its rule on human review of decisions with a legal or similarly significant effect, never letting Hugo deny being an AI to someone who sincerely asks, and not impersonating anyone. Any duty under the Privacy Act 1988 (Cth) to describe automated decisions in your privacy policy, including the duty that applies from 10 December 2026, is yours, as is any notice or consent the law requires before someone deals with an automated system or has their conversation recorded or processed by AI. Do not present images Hugo generates as genuine photographs where that could mislead.

Provider policies. Our AI providers' usage policies apply to content processed through them. If we reasonably believe your use would breach them or the law, we may restrict the relevant features, and we will tell you why.

40. Hugo autonomy, approvals and safeguards

What Hugo does by default. Follow-up messages to people who have not replied ("chases") run automatically unless an administrator sets them to preview. Other messages Hugo writes are drafts for a person to approve, unless that person or their administrator turns on sending without approval. Chases may be sent by email or text message.

Your responsibility for chases. Because chases run automatically unless an administrator sets them to preview, an administrator should review Hugo's settings before Hugo is used with your contacts. Each chase is your message: where the law requires, its recipient must have consented, and it must identify you and include a way to opt out. You are responsible for chases sent under your Workspace's settings, including the default.

Autonomy settings. Depending on your plan, settings may let Hugo, without asking first, reply to emails, approve or decline meeting and roundtable requests, book or change meetings, update CRM records or take other supported actions, and an administrator can set the Workspace's reply mode to "anytime", letting Hugo send replies at any time without each being approved. You choose whether to turn these on, and you can turn them off at any time. Test them first and tell the Authorised Users affected.

Your responsibility for autonomous actions. Messages Hugo sends and actions it takes within the permissions you, your administrators or your Authorised Users enabled are yours, except to the extent caused by a defect in the Service, our failure to follow your settings, or our negligence. A person who approves a draft or action is responsible for it as if they had written or taken it.

Telling people it is AI. Messages Hugo sends without a person's approval are designed to say they were sent with Hugo's help. You must not remove that line, or tell recipients that a person wrote a message Hugo sent.

Built-in safeguards. Hugo is designed to ask a person to confirm before it makes a payment or deletes anything, and not to delete meetings or sessions. You must not try to get around these safeguards, for example by telling Hugo to treat a payment or deletion as something else.

Chasing money. If you use Hugo to chase invoices or payments, you are responsible for each amount being genuinely owed; for reminders that do not amount to harassment or coercion under section 50 of the Australian Consumer Law; and for local debt collection law.

Meeting decisions. If Hugo approves or declines meeting or roundtable requests for you, it applies your criteria, and you are responsible for them being lawful and non-discriminatory and for reviewing decisions where it matters.

41. APIs and integrations

Our APIs. Where the Service offers APIs, webhooks or API keys, you may use them only to integrate your own systems for your internal purposes, following our documentation, rate limits and the developer rules in our Acceptable Use Policy. Keep keys secure and rotate any that may have been exposed; you are responsible for all activity using them. We may throttle or suspend API access that threatens the Service's stability or security, telling you why, and we may change or retire APIs, giving reasonable notice of changes that would break an integration you rely on where we can.

Third-party services. When you connect a third-party service, such as Google, Microsoft or a payment provider, you authorise us to exchange data with it as you configure, and your agreement with its provider governs your use of it. Subject to your Non-Excludable Rights, we are not responsible for third-party services, their outages or changes, or what they do with data you send them, but we will take reasonable steps to restore an affected feature or offer an alternative, and The Service we provide applies if a change materially reduces a paid plan. Customer Data you send out of the Service, by export, sync, webhook or API, is your responsibility.

42. Data Processing Schedule: roles and instructions

This Data Processing Schedule sets out how Panelist handles Customer Data that is personal information. It prevails over the rest of this Agreement on that subject.

Roles. You decide why and how Customer Data is collected and used, and you are responsible for it. Panelist handles it for you, as your service provider. Where the GDPR or a similar law applies, you are the controller (or a processor for another controller) and Panelist is your processor (or sub-processor); under laws that use other names, such as "business" and "service provider", the parties have the equivalent roles. Panelist handles Panelist Data under our Privacy Policy.

Instructions. Panelist handles Customer Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you first unless the law prohibits it. Your instructions are this Agreement and your Orders; the settings you choose and actions you take in the Service, including the integrations, mailboxes and AI features you turn on; and other reasonable written instructions consistent with how the Service works. If we think an instruction would breach Privacy Law, we will tell you and may decline it. Work outside the Service's normal functions may be charged at rates agreed in advance.

Purposes. We handle Customer Data to provide, secure, support and maintain the Service; to prevent and investigate fraud, abuse, spam, security incidents and breaches of this Agreement; to comply with the law; and to create aggregated or de-identified information as Your data describes. We handle it for no other purpose, including Panelist's own marketing or Factor.

Data and people. Customer Data may include names, contact and professional details, registration, ticket and attendance details, session activity, messages, calls, connected mailbox and calendar content, deal information, recordings and anything else you upload, about your attendees, prospects, customers, contacts, speakers, Sponsors, staff and the people who correspond with your mailboxes. We handle it for the term of this Agreement and then only as Data Processing Schedule: requests, deletion and audit describes.

Your obligations. Your instructions must comply with Privacy Law, and you must give the notices and obtain the consents needed for us to handle Customer Data as this Agreement describes. Nothing in this Agreement limits an individual's rights or remedies under Privacy Law, including to complain to a regulator or seek compensation.

43. Data Processing Schedule: security measures

Personnel and security. We give access to Customer Data only to personnel and contractors who need it and are bound by confidentiality. We take reasonable steps, appropriate to the Service and the data, to protect Customer Data from misuse, interference and loss, and from unauthorised access, modification or disclosure. These are the measures for this Schedule and for Annex II of the standard contractual clauses in Data Processing Schedule: where the GDPR applies, and they include:

• Hosting: our primary data store is hosted by Amazon Web Services in Sydney, Australia, which secures its data centres;
• Encryption in transit: data in transit is encrypted with TLS;
• Credentials: passwords are stored as salted hashes, and the tokens that let Panelist reach a connected mailbox are encrypted;
• Access: access to production systems is limited to staff who need it, and Workspace roles and permissions control what Authorised Users can see and do;
• Mailbox content: staff read mailbox content only if the user asks (for example for support), if it is needed for security or to investigate abuse, or if the law requires it. Google's Limited Use rules require this limit;
• Separation: the Service is designed so that other Customers cannot see the records in your CRM;
• Monitoring and records: we monitor the Service for faults, and the Service keeps records of significant actions, including actions Hugo takes;
• Incidents and vulnerabilities: we investigate suspected incidents, notify Data Breaches as Data Processing Schedule: data breaches describes, and assess vulnerabilities found or reported to user-compliance@panelist.com, aiming to fix them in a time that reflects their severity; and
• Backups and deletion: we keep backups so that the Service can be restored, deleted data leaves the backups when they expire, and we delete Customer Data as Data Processing Schedule: requests, deletion and audit and Connected mailboxes and calendars describe.

We may update these measures, but not so as to materially reduce the overall protection of Customer Data. No system is completely secure, and these measures do not guarantee that an incident will never happen.

Your security. Security is shared. You are responsible for your accounts, credentials, devices and networks; for the permissions you give Authorised Users, Sponsors and integrations, including requiring multi-factor authentication where the Service offers it; for the accounts you connect; and for data you export or send to third parties.

44. Data Processing Schedule: sub-processors

Authorisation. You authorise Panelist to engage sub-processors under this section. Our service providers, including our current sub-processors, are listed in our Privacy Policy, with what each does and where. Each sub-processor is bound by a written agreement to protect Customer Data to a standard consistent with this Schedule, and we remain responsible for its handling of Customer Data as if it were our own. Services you connect, such as Google, Microsoft or another CRM, are not our sub-processors.

Changes and objections. Before a new sub-processor starts handling Customer Data, we will update the list and give you at least 30 days' notice by email to your administrators or in the Service, or shorter notice if we must replace one urgently for security or availability. You may object on reasonable data protection grounds by telling user-compliance@panelist.com why within 30 days after our notice. We will discuss your objection in good faith and may propose a change so that the sub-processor does not handle your data. If we cannot resolve it within a reasonable time, you may terminate the affected plan or part of the Service by notice, without liability, and receive a refund of prepaid Fees for it for the period after termination.

45. Data Processing Schedule: overseas transfers

Our primary data store is in Sydney, Australia. Some Customer Data is disclosed to, or accessed by, sub-processors overseas, in the countries our Privacy Policy lists, when you use the features they support. We take reasonable steps, including by contract, to ensure they handle it consistently with the Australian Privacy Principles. We will give you at least 30 days' notice before moving our primary data store for Customer Data out of Australia, and you may then terminate the affected plan with a pro-rata refund of prepaid Fees.

You are responsible for telling people, in your privacy policy or notices, that their information may go overseas and where, and for the overseas disclosures you direct, such as through integrations, overseas Sponsors or messages. Data Processing Schedule: where the GDPR applies also applies to transfers the GDPR covers.

46. Data Processing Schedule: data breaches

Notice to you. If we become aware of a Data Breach, we will notify you without undue delay after becoming aware of it. Our notice will describe, as far as we then know, what happened, the kinds of Customer Data and number of people involved, the likely consequences and the steps we have taken or propose, and we will add information as we learn it. We send notices to the administrators or contacts recorded for your Workspace, so keep them current.

Containment and assessment. We take reasonable steps to contain a Data Breach, reduce the risk of harm and prevent a recurrence. Under the Notifiable Data Breaches scheme, we take all reasonable steps to complete an assessment within 30 days, and notify affected people and the OAIC where the law requires. We will give you the information and reasonable help you need for your own assessment and notifications under the Privacy Act 1988 (Cth), the GDPR or another Privacy Law.

Who notifies. Where both of us must assess or notify the same breach, we will agree with you which of us does so, so that people receive one clear notice. Unless the law requires it or we agree otherwise, we will consult you before notifying your contacts or a regulator in a way that identifies you. A breach notice is not an admission of fault. You must tell us promptly about a security incident on your side, such as compromised credentials or a misdirected export.

47. Data Processing Schedule: requests, deletion and audit

Requests. If someone asks us to access, correct, delete or stop using personal information that is Customer Data, we will refer them, or pass the request, to you, unless it concerns their own Panelist Data or connected account, which we handle under our Privacy Policy. We will help you respond, mainly through the Service's features for finding, exporting, correcting and deleting records, and may charge agreed costs for help beyond them.

Regulators and legal demands. If a regulator or an individual contacts us about Customer Data, we will tell you unless the law prohibits it, and help you respond. If we are legally required to disclose Customer Data, we will tell you first where the law allows, so that you can seek a protective order, and disclose only what is required.

Return. While your plan is active, you can export Customer Data with the Service's export tools. For 30 days after your plan ends, you may ask us in writing for reasonable help to export what remains, if you have paid all amounts owing.

Deletion. We will delete Customer Data from our active systems after your plan ends, or after your written request if you ask sooner (which ends the export period), usually within 60 days. If you move to another plan instead, the data stays until you delete it or the Workspace closes. We may keep Customer Data in backups until they are overwritten, using it only to restore our systems; where the law requires, or we reasonably need it for legal claims or a regulator, while that need lasts; in deletion and audit records; and where the same information belongs to a Member's own account or another customer. Disconnecting a mailbox or calendar deletes synced data as Connected mailboxes and calendars describes.

Audit by questionnaire. On written request, no more than once in any 12 months (or more often if a regulator requires it or after a Data Breach affecting you), we will answer a reasonable security and privacy questionnaire and give you summaries of relevant policies, which are our Confidential Information. If the law or a regulator requires an inspection that a questionnaire cannot satisfy, we will agree reasonable arrangements in good faith, including timing, scope, confidentiality and reimbursement of our reasonable costs.

48. Data Processing Schedule: where the GDPR applies

This section applies only where the EU General Data Protection Regulation (Regulation (EU) 2016/679), or the UK GDPR and the UK Data Protection Act 2018 (together, the "GDPR"), apply to Panelist's processing of Customer Data for you. Panelist will then:

• process personal data only on your documented instructions, including about transfers to third countries, unless the law requires otherwise, in which case it will inform you first unless the law prohibits that;
• ensure that persons authorised to process the personal data are bound by confidentiality;
• take the measures Article 32 requires, as Data Processing Schedule: security measures describes;
• engage sub-processors only as Data Processing Schedule: sub-processors describes, on data protection terms no less protective than this Schedule, and remain liable for them;
• taking into account the nature of the processing, assist you by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects to exercise their rights;
• assist you with your obligations under Articles 32 to 36, taking into account the nature of processing and the information available to it, at your reasonable cost beyond the Service's features;
• delete or return the personal data at the end of the Service as Data Processing Schedule: requests, deletion and audit describes, unless the law requires storage;
• make available the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, through the process in that section; and
• immediately inform you if, in its opinion, an instruction infringes the GDPR or other data protection law.

International transfers. Australia has no adequacy decision under the GDPR. Where personal data subject to the GDPR is transferred to, or accessed by, Panelist in Australia and no other transfer mechanism applies, the standard contractual clauses approved in Commission Decision (EU) 2021/914 ("SCCs") are incorporated: Module Two applies where you are a controller and Module Three where you are a processor; clause 7 and the optional wording in clause 11 do not apply; Option 2 of clause 9 applies, with the notice period in Data Processing Schedule: sub-processors; Irish law and courts apply under clauses 17 and 18; and Annexes I and II are completed from this Agreement, your Order, Data Processing Schedule: roles and instructions and Data Processing Schedule: security measures.

United Kingdom and Switzerland. For UK transfers, the UK Information Commissioner's International Data Transfer Addendum to the SCCs is incorporated, and for Swiss transfers the SCCs apply with the changes the Swiss Federal Act on Data Protection requires. They prevail over this Agreement for those transfers, and we will sign completed copies on request. If the GDPR requires us to appoint an EU or UK representative, we will.