Terms & Conditions for Business Customers

Effective on October 2026

These Terms and Conditions for Business Customers (“Agreement”) govern the provision of age-verification and/or age-estimation services (the “Services”) by Age Verification Technology, S.L. (“AgeGO”, “we”, “us”, “our”) to operators of online services or platforms that offer age-restricted content (the “Business Customers” or “you”).

The Services are rendered based on information submitted by end users of your service (the “End Users”) to AgeGO, with the sole purpose of generating a verification outcome regarding whether an End User is 18 years of age or over.

The Services are intended to help you comply with applicable legal or industry obligations regarding access control to age-restricted content. AgeGO acts exclusively as a technical service provider. The decision to grant or deny access remains at all times with the Business Customer.

Please read this Agreement carefully before contracting the Services.

DEFINITIONS

For this Agreement, the Parties agree that the following capitalized terms shall have the meanings set out below:

Access Decision: means the final determination made by the Business Customer regarding whether an End User may access its content or services, based solely on the Verification Result.
Affiliates: means any legal entity that, directly or indirectly, controls, is controlled by, or is under common control with the Business Customer. For these purposes, “control” means the direct or indirect ownership or power to direct the management and policies of such entity through ownership of voting interests or other corporate rights. Use by any entity that does not meet the definition of “Affiliate” shall be subject to AgeGO’s prior written authorisation.
Agreement: means these Terms and Conditions for Business Customers, together with any policies, notices, or documents incorporated by reference.
Age Estimation Methods: means techniques used by AgeGO (or its Third-Party Providers) to estimate an End User’s probable age based on non-identifying indicators, without authenticating their identity or relying on official documentation.
Age Verification Methods: means processes based on official identity documents or authoritative data sources, intended to confirm both the age and identity of the End User.
Age Verification Solutions: means collectively the Age Verification Methods and Age Estimation Methods provided by AgeGO, either directly or via authorized Third-Party Providers.
AgeGO, we, us, or our: means Age Verification Technology, S.L., VAT B67394494, with registered office at Calle Marina 16-18, 08005 Barcelona, Spain, acting as the commercial brand and technical provider of the Services, in its role as data processor or service provider under applicable law.
Anonymized Data: means information that has been modified so it no longer relates to an identified or identifiable individual, in accordance with applicable data protection laws.
Biometric Data: means personal data resulting from technical processing of physical, physiological, or behavioral characteristics (e.g., facial images), used for uniquely identifying or authenticating a person, as defined in Article 4(14) GDPR. Not all Age Estimation Methods involve Biometric Data.
Passkey: means a device-based authentication credential based on public-key cryptography (e.g., facial recognition, fingerprint, or device PIN) that allows an End User to create and/or access an AgeGO Account without an email address or password, in accordance with the FIDO2/WebAuthn industry standard.
Liveness Detection: technical process used to confirm that a facial image or video originates from a real, live person in real-time. This security measure prevents fraud and is performed transiently by AgeGO or by a Third-Party Provider without creating a permanent biometric profile.
Business Customer or you: means the website operator, platform, or content provider contracting the Services from AgeGO, to verify whether End Users are 18 years of age or older before granting access to age-restricted content or services, in its role as data controller or business under applicable law.
Confidential Information: means any non-public business, technical, or personal information disclosed by either Party in connection with the Services.
Consent: means a freely given, specific, informed, and unambiguous indication of the End User’s agreement to the processing of their Personal Data, as required under applicable data protection laws.
Dashboard: means the online interface provided by AgeGO through which the Business Customer can monitor usage of the Services, including the number of verifications, successful checks, applicable Fees, and account balance.
Data Protection Laws: means all laws and regulations applicable to the processing of Personal Data under this Agreement, including, without limitation, the EU General Data Protection Regulation (GDPR), the UK GDPR, the ePrivacy Directive, the California Consumer Privacy Act (CCPA/CPRA), and any equivalent worldwide legislation.
Data Subject Rights: means the rights granted to individuals under applicable Data Protection Laws, including rights of access, rectification, erasure, restriction, portability, and objection.
End User: means the natural person who submits data to AgeGO to have their age verified or estimated to access the Business Customer’s content or services.
End User Data: means any Personal Data or related information submitted by an End User through AgeGO (such as document scans, facial imagery, or metadata), processed by AgeGO (or its Third-Party Providers) on behalf of the Business Customer strictly for the purpose of generating a Verification Result.
Fees: means the aggregate of all licenses, usage fees, and other charges payable by the Business Customer as set out in the applicable Sales Order.
Information: means all data and inputs provided by an End User through AgeGO to perform the Services, including but not limited to End User Data.
Personal Data: means any information relating to an identified or identifiable individual, as defined under Article 4(1) GDPR, the UK GDPR, the CCPA/CPRA, or other applicable data protection laws worldwide.
Sales Order: means any document, order form, or online acceptance executed between the Business Customer and AgeGO for the provision of Services.
Sensitive Personal Data: means categories of Personal Data requiring enhanced protection under applicable law, including but not limited to biometric data, identity documents, government-issued identifiers, and data revealing racial or ethnic origin.
Service or Services: means the Age Verification Solutions provided by AgeGO in favor of the Business Customer, designed to confirm whether an End User is 18 or over.
Service Start Date: means the effective date on which the Services commence, as specified in the Sales Order or, if none, the date on which the Business Customer accepts this Agreement.
Sub-processor: means any Third-Party Provider engaged by AgeGO to process End User Data on behalf of the Business Customer in connection with the Services.
Term: means the period during which the Services are provided, as defined in this Agreement and/or the applicable Sales Order.
Third-Party Providers: means external vendors engaged by AgeGO under appropriate contractual and legal safeguards to provide components of the Age Verification Solutions (e.g., document scanning, biometric analysis, liveness detection, digital wallets), acting as sub-processors or service providers.
User: means any person who interacts with the AgeGO platform, including End Users and Business Customers.
Verification API: means the application programming interface made available by AgeGO to integrate the Services with the Business Customer’s systems.
Verification Result: means the binary or equivalent outcome of the verification process (“18 or over”, “under 18”, or “unable to verify”), communicated by AgeGO to the Business Customer. No additional Personal Data is disclosed.
Widget: means the technical interface made available by AgeGO to the Business Customer to implement and render the Services.
Cross-Site Verification: means the optional feature within the Services that allows an End User who has been successfully verified on one AgeGO-enabled site (the “originating site”) to be automatically recognised as verified on another AgeGO-enabled site (the “destination site”) through the issuance and server-side validation of an Ag_token, without requiring the End User to repeat the verification.
Ag_token or Cross-Site Verification Token: means the short-lived, single-use verification token generated by AgeGO and passed as a URL parameter to enable Cross-Site Verification. The token is derived from the verified session on Site A but is a separate, newly signed credential with its own short expiry and one-time identifier.
Verified Link: means a standard hyperlink to a destination site that includes an Ag_token as a URL parameter, enabling Cross-Site Verification.

Both AgeGO and the Business Customer represent and warrant that they have all rights and authority to enter into this Agreement and that they have all necessary licenses, permits, and registrations required to perform their obligations hereunder.

CLAUSES

1. OBJECT.

1.1 Under this Agreement, AgeGO shall provide the age verification and/or age estimation services to the Business Customer, confirming that an End User sent by the Business Customer is 18 years of age or older, based on AgeGO’s Age Verification Solutions. The outcome of this verification will be communicated to the Business Customer in the form of a Verification Result (e.g., “18 or over”, “under 18”, or “unable to verify”).

1.2 AgeGO acts solely as a service provider and data processor on behalf of the Business Customer. AgeGO does not have access to or control over the accuracy or truthfulness of the End User Data. The End User is solely responsible for the accuracy and validity of the data provided. The Business Customer acknowledges that AgeGO shall not be held liable for any claims, damages, or losses arising from inaccurate, incomplete, or fraudulent End User Data provided by the End User. Should AgeGO become aware of any false or misleading information, it will take reasonable steps to remove or rectify it upon notification. The Business Customer agrees to indemnify and hold AgeGO harmless from any liability related to the End User Data, including compliance with applicable data protection laws such as GDPR, UK GDPR, and CCPA.

2. OTHER APPLICABLE TERMS.

2.1 The following additional terms also form part of this Agreement and apply to your use of AgeGO:

Our Privacy Policy sets out the terms on which we process any personal data we collect from the Users.
Our Cookies Policy sets out how and which cookies we use.

3. PLACING AN ORDER.

3.1 Placing an Order: To place an order for the Services offered by AgeGO to Business Customers, the order shall be submitted through the “Contact for Business” form on the AgeGO website. Upon receiving the order, AgeGO will provide a service proposal that includes the specific details of the order and any applicable fees associated with the Services. Any Service not included in the Sales Order proposal will not be considered part of the agreement. The Sales Order shall be binding only when signed and/or mutually agreed upon by both Parties.

3.2 Expiration of Sales Order: A Sales Order will expire at the end of the agreed term if the Sales Order has a term specified that differs from the term outlined in this Agreement. Unless otherwise stated in the Sales Order, the terms of this Agreement shall apply indefinitely, until terminated by either Party in accordance with the termination provisions herein.

4. THE SERVICES.

4.1 AgeGO recognizes that different regulations require website operators to verify the age of users before granting access to certain content or services. The purpose of AgeGO’s services is to provide an effective and legally secure solution for age verification, which is processed between End Users and Business Customers.

4.2 The Service provided by AgeGO includes the following:

4.2.1 A mechanism at the point of access to the Business Customer’s services and/or content, which verifies that the End User is 18 or older at the time of registration or access, in accordance with applicable laws.

4.2.2 The age-verification data used in the methods included within AgeGO are designed to be confidential and cannot be reasonably known by anyone other than the End User, except in the case of theft or fraudulent use of data or identification documents.

4.2.3 The inclusion of safeguards that authenticate age-verification data, with measures to prevent fraudulent use by non-human operators, including the use of algorithms.

4.3 The Age-Verification Solutions provided through AgeGO’s Service are designed and implemented with the following principles in mind:

4.3.1 The minimum amount of Personal Data necessary is collected to confirm that the End User is 18 or older.

4.3.2 The Service is user-friendly and easily usable by the End User.

4.3.3 Clear information is provided to the End User regarding the data protection policies, ensuring transparency in how their data is processed.

4.3.4 The Service is used solely for the purpose of verifying the End User’s age.

4.4 The Services are provided to the Business Customer on a non-exclusive basis. Therefore, the Business Customer is not allowed to license, sub-license, resell, or otherwise commercialize the Service to third parties.

4.5 The provision of the Service shall begin on the Service Start Date and continue for the duration of the Term as specified in the Sales Order, subject to the terms of this Agreement.

4.6 Subject to the Business Customer’s compliance with the terms of this Agreement, AgeGO grants the Business Customer a worldwide, non-exclusive, non-transferable license to:

- access and use the Widget; and

- install and use the Service.

This license is granted solely in connection with the Service and, unless otherwise agreed, is limited to the Business Customer’s internal use for providing services directly to End Users.

4.7 The Business Customer shall not attempt to interfere with, disrupt, or reverse-engineer the Service or Widget. Specifically, the Business Customer shall not:

4.7.1 Decompile, disassemble, reverse engineer, or attempt to reconstruct any source code, algorithms, design structures, or any other proprietary information related to the Widget or the Service.

4.7.2 Remove any copyright notices, trademarks, or other proprietary markings from the Widget or the Service.

4.7.3 Modify, enhance, or create derivative works of the Widget or the Service.

4.7.4 Resell, lease, sublicense, assign, distribute, or transfer the Widget or Service in any form, either in whole or in part.

4.7.5 Use the Widget or Service to develop or distribute any competing software product or service.

4.7.6 Transfer any of its rights or obligations under this Agreement without prior written consent from AgeGO.

4.8 The Business Customer acknowledges that AgeGO does not monitor the content transmitted through the Service and is not responsible for the content of any communications or data transmitted by End Users. The Business Customer agrees to use the Service only for lawful purposes and in compliance with all applicable laws.

4.9 The Business Customer shall implement reasonable security measures to prevent unauthorized access to the Service or the Widget, and to protect any End User Data it has access to. The Business Customer will also ensure that all authorized users refrain from disclosing, duplicating, or reproducing the Widget or Service, except as permitted under this Agreement.

4.10 The Business Customer may permit its Affiliates to use AgeGO’s Services, provided that:

4.10.1 Such Affiliates use the Widget and the Services solely for their own internal operations and not for the benefit of any third party;

4.10.2 The Business Customer remains fully responsible and liable to AgeGO for any use of the Widget and the Services by its Affiliates, including compliance with this Agreement; and

4.10.3 AgeGO may, at any time and upon reasonable request, require the Business Customer to identify or confirm which Affiliates are using the Widget and the Services.

4.11 AgeGO may suspend the Services, with prompt notice, where use poses a security, legal, or compliance risk, or breaches this Agreement or applicable law.

4.12 Cross-Site Verification (Ag_token). The Services include the optional Cross-Site Verification feature, as defined above and further described in Annex 1 (DPA), Section 11. The feature operates through a Verified Link, as defined above, validated server-side by AgeGO. The feature is enabled by default for each site and may be disabled per site at the Business Customer’s request. Further technical details are set out in AgeGO’s integration documentation, available at https://docs.agego.com/cross-site-verification (s’ouvre dans un nouvel onglet) (or any successor URL), as updated from time to time.

4.13 Business Customer obligations for Cross-Site Verification. The data protection obligations of the Business Customer and of AgeGO in connection with this feature — including the categories of data involved, the applicable retention periods, and each party’s role and duties as controller and processor — are set out in Annex 1 (DPA), Section 11, and shall prevail in case of any inconsistency with this Clause 4.13. Without prejudice to those obligations, the Business Customer remains solely responsible for maintaining its own lawful basis for age verification on its site and for any regulatory consequences arising from its decision to enable this feature.

4.14 Suspension or discontinuation. AgeGO may suspend, restrict or discontinue the Cross-Site Verification feature at any time, including on a per-jurisdiction or per-site basis, where required by applicable law, regulatory guidance or supervisory authority instruction. AgeGO shall use commercially reasonable efforts to notify the Business Customer promptly of any such suspension or discontinuation.

5. AVAILABILITY OF AGE-VERIFICATION SOLUTIONS.

5.1 AgeGO, through Third-Party Providers, offers a range of Age-Verification Solutions as part of its Services. These solutions may include, but are not limited to, document-based identity verification, biometric analysis, liveness detection, digital wallets, and other configurable technical tools. The list of available Age-Verification Solutions is regularly maintained and updated, which can be accessed here.

5.2 Depending on the applicable jurisdiction, the Liveness Detection technology used to ensure the integrity of the process may be provided directly by AgeGO or through a Third-Party Provider. All other components, data analysis, and technical results (including, but not limited to, age estimation, face matching, or document validation) are provided exclusively by specialized Third-Party Providers.

5.3 AgeGO reserves the right to add, modify, or discontinue any of the Age-Verification Solutions at its sole discretion, with or without prior notice. While AgeGO will make reasonable efforts to notify the Business Customer of significant changes, it is the responsibility of the Business Customer to stay informed about any updates or modifications.

5.4 Responsibility for Selection and Use of Age-Verification Solutions: The Business Customer acknowledges and agrees that it is solely responsible for selecting, enabling, and using the Age-Verification Solutions provided by AgeGO in compliance with all applicable laws and regulations.

5.4.1 AgeGO provides its Age-Verification Solutions in accordance with recognized industry standards and best practices, including relevant technical criteria, such as compliance with biometric verification, liveness detection, document validation, and other identity assurance technologies. These solutions are designed with a focus on accuracy, robustness, and compliance. However, it is the Business Customer’s responsibility to assess whether the Age-Verification Solutions are suitable and compliant with the regulatory framework applicable to their specific operational context.

5.4.2 Ongoing Compliance Responsibility: The Business Customer is responsible for regularly reviewing and updating the Age-Verification Solutions it uses to ensure compliance with evolving laws and regulations. AgeGO shall not be held liable for any non-compliance, penalties, or enforcement actions resulting from the Business Customer’s failure to implement and maintain the appropriate Age-Verification Solutions.

5.5 Optional Features Modifying the Default Verification Flow. AgeGO may make available optional features that modify the default end-user verification flow, including features that allow End Users to dismiss the age-verification modal prior to completing verification and return to the Business Customer’s site (each, an “Optional Flow Feature”).

5.5.1 The Business Customer may only enable an Optional Flow Feature if: (i) its platform has content that is genuinely accessible to all users without any legal age restriction under applicable law — for the avoidance of doubt, platforms whose entire service requires mandatory age verification regardless of content type do not qualify; and (ii) the Business Customer independently controls the technical mechanisms that prevent dismissed End Users from accessing any age-restricted content.

5.5.2 By enabling an Optional Flow Feature, the Business Customer represents and warrants that: (i) the conditions in Clause 5.5.1 are satisfied at the time of activation and on an ongoing basis; (ii) it has independently assessed whether enabling such feature is permitted under the laws of all jurisdictions in which it operates or from which it receives material End User traffic; and (iii) the in-platform acknowledgment completed at the time of activation constitutes a binding confirmation of the foregoing representations, forming part of this Agreement.

5.5.3 AgeGO accepts no liability for any regulatory sanctions, enforcement actions, third-party claims, fines, or other losses arising from the Business Customer’s decision to enable or configure an Optional Flow Feature. The provisions of Clauses 11.1 and 11.3 apply in full to any claims arising from its use.

6. FEES.

6.1 The Business Customer shall pay AgeGO the Fees as outlined in the Sales Order and this Agreement. All payments will be non-refundable, non-cancellable, and irrevocable, unless otherwise specified in this Agreement. Unless otherwise stated in the Sales Order, the Fees will be payable in Euros.

6.2 Invoices will be made available to the Business Customer via the Dashboard. The Business Customer is responsible for ensuring that payments are made promptly.

6.3 The amounts due to AgeGO under this Agreement do not include bank fees, transfer fees, taxes, duties, or similar charges. If AgeGO is required to pay any such fees or taxes, including but not limited to sales, use, property, VAT, withholding, customs duties, or other fees related to the Services, these will be billed to and paid by the Business Customer.

6.4 Fees Payment and Credit Management: Unless otherwise agreed, Fees are generally prepaid. If the Business Customer seeks to increase its credit limit, it must follow the instructions provided in the Payments section of the Dashboard.

6.5 Late Payments: All overdue payments will accrue interest at a rate of at least 2% per month, or the maximum permitted by law, whichever is higher. Interest will accrue from the due date until the outstanding amount is paid in full.

6.6 Collection of Overdue Payments: The Business Customer agrees to reimburse AgeGO for any costs incurred in the collection of overdue payments, including but not limited to legal fees, court costs, collection agency fees, and attorneys’ fees.

7. OBLIGATIONS OF THE PARTIES.

7.1 The Business Customer undertakes to:

7.1.1 Hold harmless AgeGO, its officers, directors, employees, and affiliates from and against any liabilities, losses, damages, claims, and expenses, including court costs and reasonable attorneys’ fees, arising out of or in connection with any third-party claim:

that a third party has suffered injury, damage, or loss resulting from the Business Customer’s or an End User’s actions;
that the Business Customer or any End User has used the Service in a manner that violates the terms of this Agreement or applicable laws.

7.1.2 Not to introduce any “worm,” “virus,” “malware,” or other harmful code into the AgeGO platform or Service, and to ensure that no actions are taken that could harm AgeGO or any third party.

7.1.3 Use the Service and Widget exclusively for lawful purposes, in compliance with all applicable laws, including data protection laws and regulations.

7.1.4 Comply with all applicable laws, rules, and regulations that may apply to the Business Customer’s use of the Service, including but not limited to Internet and data protection regulations.

7.1.5 Treat all information obtained from AgeGO as confidential, and ensure compliance with applicable data protection laws, applying appropriate safeguards to protect the privacy of End Users and their Personal Data.

7.1.6 Not provide, transfer, or make available the Service (or any application interface made available by AgeGO) to any third party, nor make the Service available to any third party, except as expressly permitted under this Agreement.

7.1.7 Not bypass or attempt to bypass any security measures or access control mechanisms implemented by AgeGO to protect the Service.

7.1.8 Not resell, distribute, or otherwise transfer for financial consideration any information provided by AgeGO, including data, reports, or any other outputs from the Service.

7.1.9 Not engage in any activity that disrupts or interferes with the normal operation of the Service, including unauthorized access, denial of service attacks, or any other disruptive activity.

7.1.10 Not scrape or extract any information or content made available by AgeGO for use in another product or service, without prior written consent from AgeGO.

7.2 AgeGO undertakes to:

7.2.1 Professionally perform the Service in accordance with generally accepted industry standards, ensuring that the Service is provided in a manner that meets quality, security, and compliance requirements.

7.2.2 Grant the Business Customer access to aggregated, anonymized data via the Dashboard, including metrics such as the number of verifications, successful verifications, number of accesses, and incurred fees, without providing identifiable End User data.

7.2.3 Provide the Business Customer with the Dashboard and Reporting features of the Widget, where the Business Customer can monitor key service metrics, including account balance, number of verifications attempted, number of verifications completed, daily access statistics, and other relevant data.

8. TERMINATION; CANCELLATION.

8.1 AgeGO may, at its sole discretion, immediately terminate this Agreement at any time, with or without cause. AgeGO will make commercially reasonable efforts to notify the Business Customer via email of such termination or cancellation within a reasonable timeframe. However, AgeGO shall not be liable for any damages, loss of business, or other consequences resulting from the termination or cancellation of this Agreement.

8.2 Termination for Breach: If either Party fails to fulfill a material obligation under this Agreement, the non-breaching Party has the right to terminate this Agreement with fifteen (15) days’ prior written notice to the breaching Party. This termination right is without prejudice to the non-breaching Party’s right to claim damages for any losses or harm caused by the breach.

8.3 Effect of Termination: Upon termination of this Agreement for any reason, the Business Customer must cease using the AgeGO platform and services, including the Widget, and return or destroy any proprietary information of AgeGO. The termination shall not affect any rights or obligations that have accrued before the termination date.

9. CONFIDENTIALITY.

9.1 Both Parties agree to keep confidential all information disclosed by the other Party that is marked or identified as confidential, or that should reasonably be understood to be confidential, given the nature of the information or the circumstances surrounding its disclosure. Neither Party shall disclose such Confidential Information to any third party without the prior written consent of the disclosing Party, except as necessary for the performance of this Agreement or as required by law.

9.2 Disclosure under Legal or Regulatory Requirement: In certain circumstances, AgeGO may be required to disclose information regarding the Service, End Users’ Data, or any other information provided by the Business Customer or the End User due to a legal order from a court or administrative authority. AgeGO is fully entitled to disclose such information upon receiving a lawful request from an authority that it reasonably deems competent. AgeGO will make commercially reasonable efforts to notify the Business Customer of such disclosure, to the extent permitted by law, unless the law prohibits such notice.

9.3 Obligations Upon Termination: Upon termination of this Agreement, each Party shall return or destroy all Confidential Information received from the other Party, and shall not retain any copies of such information, except to the extent required by law or for internal compliance purposes.

10. DATA PROTECTION AND INFORMATION DISCLOSURE.

10.1 The Parties acknowledge and agree that, in the context of the Services:

The Business Customer acts as the data controller, determining the purposes and means of processing of End User Data.
AgeGO acts as the data processor, processing End User Data solely on behalf of the Business Customer and in accordance with this Agreement and the Data Processing Agreement (“DPA”) attached as Annex 1.

10.2 AgeGO collects and processes End User Data as described in its Privacy Policy, which is accepted by the End Users before initiating the age verification process. AgeGO applies data minimization, pseudonymization, and anonymization measures to the maximum extent possible, ensuring that only the information strictly necessary to perform age verification is processed.

10.3 The information shared with the Business Customer is limited to the Verification Result (i.e., a binary or equivalent outcome such as “18 or over”, “under 18”, or “unable to verify”). Such a result is provided in a standardized and anonymized format via a callback URL, without any identifiers or links to an individual, ensuring that the Business Customer only receives non-personal data necessary to determine access eligibility.

10.4 This structure ensures compliance with the principles of privacy by design, privacy by default, and data minimization under applicable laws, including the GDPR, UK GDPR, and other relevant privacy regulations. Both Parties remain responsible for implementing adequate safeguards and handling data in accordance with their respective legal obligations.

10.5 Any processing of personal data relating to the Business Customer’s personnel or authorized users (including administrators, technical integrators, or support contacts), or any data generated during the Business Customer’s use of the Services, shall be carried out by AgeGO as an independent data controller. Such data may include identification details (name, surname, contact information, role, credentials), usage data (logs, configuration actions, technical interactions), and communications for support purposes. The processing is carried out for service administration, technical support, account management, billing, compliance, and security, on the legal bases of performance of the Agreement, compliance with legal obligations, and AgeGO’s legitimate interests in maintaining and improving the Services. Personal data shall be retained only for as long as necessary to fulfil these purposes and to comply with applicable legal or regulatory requirements. Data subjects are entitled to exercise their rights of access, rectification, erasure, restriction, portability, and objection, as well as to complain to the competent data protection authority, by contacting AgeGO at privacy@agego.com.

10.6 Cross-Site Verification. The Cross-Site Verification feature described in clause 4.12 forms part of the Services. The controller / processor relationship set out in clause 10.1 and in the DPA (Annex 1) applies to that feature in full: the Business Customer remains the data controller, and AgeGO remains the data processor acting on the Business Customer’s documented instructions under Article 28 GDPR (and equivalent provisions of the UK GDPR). The specific processing operations generated by that feature are described in Annex 1 (DPA), Section 11.

10.7 Where an End User chooses to create and/or access an AgeGO account, AgeGO acts as an independent data controller (and not as the Business Customer’s data processor) in relation to the account-related data processed for that purpose. Such processing is governed by AgeGO’s Privacy Policy.

11. INDEMNIFICATION. LIMITATION OF LIABILITY.

11.1 Indemnification: The Business Customer agrees to indemnify, defend, and hold harmless AgeGO, its officers, directors, shareholders, successors, affiliates, employees, agents, and representatives from and against any claims, costs, demands, liabilities, expenses, losses, damages, and attorney’s fees arising out of any claim or lawsuit, including but not limited to those for defamation (libel or slander), copyright infringement, trademark violation, and any other claims resulting from:

11.1.1 The granting or denial of access to the Business Customer’s website and/or services to the End User;

11.1.2 The proper rendering of services by the Business Customer to the End User;

11.1.3 The breach of this Agreement by the Business Customer in relation to the End User; and/or

11.1.4 Any other issue arising from the contractual relationship between the Business Customer and the End User.

11.2 Indemnification for Legal Fees: The Business Customer also agrees to indemnify AgeGO for any legal fees incurred by AgeGO in investigating, defending, or enforcing its rights under this Agreement, provided that AgeGO acts reasonably in relation to such matters and to the extent such fees and expenses arise out of the Business Customer’s breach of this Agreement, negligence, willful misconduct, or violation of applicable law. For the avoidance of doubt, this obligation shall not extend to costs incurred solely in investigating a potential claim, unless such investigation demonstrates a substantiated breach by the Business Customer.

11.3 Limitation of Liability: Under no circumstances will AgeGO be liable to the Business Customer or any third party for any indirect, incidental, consequential, special, or exemplary damages arising from the use of the Service, regardless of the legal theory (whether in contract, tort, negligence, strict liability, or otherwise), and even if AgeGO has been advised of the possibility of such damages. This includes, but is not limited to, loss of profits, data loss, or business interruption, regardless of the cause.

11.4 Disclaimer of Warranties: The Service is provided on an “AS IS” and “AS AVAILABLE” basis. AgeGO does not warrant that any content, information, or results provided through the Service are accurate, reliable, or error-free, or that access to the Service will be uninterrupted, secure, or free from viruses, errors, or defects.

12. INTELLECTUAL PROPERTY RIGHTS.

12.1 Ownership: Unless otherwise stated, AgeGO is the owner or licensee of all intellectual property rights in the Service, including but not limited to the software, content, and materials published on the platform. These works are protected by copyright laws and international treaties, and all such rights are reserved.

12.2 No Ownership Transfer: The use of AgeGO’s products and services does not grant the Business Customer any ownership rights over the intellectual property associated with these products or services, nor does it transfer any rights to the content or materials accessed through the Service.

12.3 Protection of AgeGO’s Intellectual Property: AgeGO, its services, and any content provided by AgeGO are protected by copyright, trademark, patent, trade secret, and other proprietary rights, as well as applicable international laws and security measures that protect digital content. The Business Customer agrees not to interfere with or infringe upon these intellectual property rights and will not circumvent any security or anti-piracy measures designed to prevent the unauthorized reproduction, distribution, or use of the content.

12.4 Restrictions on Use of Trademarks: The Business Customer may not use any of AgeGO’s trade names, trademarks, service marks, logos, domain names, or other proprietary identifiers without the prior written consent of AgeGO.

13. MODIFICATION.

13.1 AgeGO reserves the right to amend the provisions of this Agreement that are minor in scope or nature, and may do so without providing reasons, provided that such modifications do not alter the fundamental terms of this Agreement. Any modified provisions will be made available to the Business Customer via the AgeGO website, and the updated Agreement will govern the relationship between the Parties from the date of publication.

14. DISPUTE RESOLUTION.

14.1 This Agreement shall be governed by and interpreted in accordance with the laws of Spain, without regard to its conflict of law principles.

14.2 For any matter related to the interpretation or execution of this Agreement, the Parties hereby expressly waive any right to submit to any other courts that may have jurisdiction over the subject matter, and agree to submit to the exclusive competence and jurisdiction of the courts of the City of Barcelona.

14.3 Alternative Dispute Resolution (ADR): Before submitting any dispute to the courts, the Parties agree to attempt to resolve the dispute through good faith negotiations or through alternative dispute resolution methods, such as mediation or arbitration, if mutually agreed upon by both Parties.

15. GENERAL PROVISIONS.

15.1 Force Majeure: Except for payment obligations, if either Party is unable to perform any of its obligations under this Agreement due to causes beyond its reasonable control, including but not limited to acts of God, government actions, civil unrest, wars, strikes, labor disputes, or other Force Majeure Events, such Party’s performance shall be excused and the time for performance shall be extended accordingly. The Party invoking Force Majeure must notify the other Party promptly and take reasonable steps to resume performance. If performance is not resumed within fifteen (15) days following the Force Majeure Event, the other Party may terminate this Agreement upon written notice.

15.2 Severability: If any provision of this Agreement is declared invalid or unenforceable by a court or administrative body, such provision shall be severed from this Agreement without affecting the enforceability of the remaining provisions. The Parties agree that any such invalid provision shall be reinterpreted to reflect the original intent of the provision, to the extent possible, within the bounds of applicable law.

15.3 Survival: Sections 8 (Termination; Cancellation), 9 (Confidentiality), and 14 (Dispute Resolution) shall survive the termination or expiration of this Agreement for any reason. All other rights and obligations of the Parties under this Agreement shall expire upon termination, except for payment obligations accrued before such termination.

15.4 Assignment: AgeGO may assign, sublicense, delegate, or otherwise transfer its rights or obligations under this Agreement to any third party without the prior written consent of the Business Customer, provided that the assignee assumes all rights and obligations under this Agreement. The Business Customer may not assign or transfer its rights or obligations without the prior written consent of AgeGO.

15.5 Notices: All notices and other communications required under this Agreement shall be in writing and delivered by email with confirmation of receipt. Either Party may change its contact details by providing written notice to the other Party, following this provision.

15.6 Relationship Between the Parties: The Parties are independent contractors. Nothing in this Agreement shall be construed to create any agency, partnership, joint venture, or formal business entity between the Parties. Neither Party shall have the authority to bind or represent the other Party in any manner.

15.7 Waiver: No delay or failure by either Party to exercise any right or remedy under this Agreement shall constitute a waiver of such right or remedy. All waivers must be in writing and signed by an authorized representative of the waiving Party. A waiver of any breach shall not be construed as a waiver of any subsequent breach of the same or any other provision.

15.8 Entire Agreement: This Agreement, along with the Sales Order and any documents referenced herein, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior agreements, written or oral, relating to the same subject matter.

15.9 No Third-Party Beneficiaries: This Agreement shall be binding upon and inure solely to the benefit of the Parties and their permitted assigns. No provision of this Agreement is intended to confer any right, benefit, or remedy upon any third party, nor shall any third party have any legal or equitable rights under this Agreement.

ANNEX 1 – DATA PROCESSING AGREEMENT (DPA)

This Data Processing Agreement (“DPA”) forms an integral part of the Terms and Conditions for Business Customers (the “Agreement”) between the Business Customer (the “Data Controller”) and Age Verification Technology, S.L. (“AgeGO”, the “Data Processor”).

1. DEFINITIONS

1.1 “Personal Data” means any information relating to an identified or identifiable natural person, as defined under applicable data protection laws, including the GDPR, UK GDPR, the CCPA/CPRA, and any other applicable privacy regulations.

1.2 “Processing” means any operation or set of operations performed on Personal Data, such as collection, storage, use, disclosure, or deletion.

1.3 “Data Controller” means the Business Customer, which determines the purposes and means of the Processing of Personal Data.

1.4 “Data Processor” means AgeGO, which processes Personal Data on behalf of the Data Controller in accordance with this DPA and the Agreement.

1.5 “End User Data” means any Personal Data submitted by End Users in the context of the age verification process.

1.6 “Subprocessor” means any third party engaged by AgeGO to process Personal Data on behalf of the Data Controller.

1.7 “Anonymization” means the process of irreversibly rendering Personal Data anonymous, so that it can no longer be linked to any individual.

1.8 “Pseudonymization” means the replacement of identifying fields with pseudonyms, so data cannot be attributed to a specific individual without separate, securely stored information.

1.9 “Verification Result” means the anonymized outcome of the verification process (e.g., “18 or over”, “under 18”, “unable to verify”), communicated by AgeGO to the Data Controller, without revealing any underlying Personal Data.

2. SUBJECT MATTER OF THE PROCESSING

2.1 Purpose: AgeGO processes Personal Data solely for the provision of age verification services under the Agreement.

2.2 Scope: Processing may include identity-related data (biometrics, name, date of birth, ID document details, images, or other verification inputs).

2.3 Categories of Data Subjects: End Users of the Data Controller who submit Personal Data for verification.

3. OBLIGATIONS OF THE PARTIES

3.1 AgeGO’s Obligations as Data Processor

AgeGO shall:

3.1.1 Process Personal Data only on documented instructions from the Data Controller.

3.1.2 Implement appropriate technical and organizational measures, including pseudonymization, anonymization, encryption, access controls, and data minimization.

3.1.3 Ensure that personnel authorized to process Personal Data are subject to confidentiality obligations.

3.1.4 Assist the Data Controller in fulfilling its legal obligations, including:

Responding to data subject rights requests.
Conducting Data Protection Impact Assessments (DPIAs).
Managing and reporting data breaches.

3.1.5 Biometric Data: Where biometric data (e.g., facial geometry, liveness detection) is used, AgeGO shall:

Process it solely for verifying whether the End User meets the applicable age threshold.
Apply reinforced security measures (encryption in transit and at rest, strict access control).
Delete biometric inputs immediately once the Verification Result is generated, unless law requires longer retention.
Ensure that no biometric templates or raw images are stored beyond what is strictly necessary.

3.1.6 Duty to inform and use a valid legal basis: AgeGO shall inform End Users before processing, in compliance with Articles 13 and 14 GDPR, UK GDPR, and CCPA/CPRA. Notices shall explain categories of data, purposes, legal bases (including explicit consent for biometrics where applicable), retention periods, and rights of data subjects. Ensure a valid legal basis exists for Processing, including explicit consent for biometric data where required.

3.1.7 International Transfers: If AgeGO or its subprocessors transfer Personal Data outside the EEA, UK, or other adequacy jurisdictions, such transfers will be subject to appropriate safeguards, including Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum (IDTA), or equivalent. AgeGO shall provide transparency on the safeguards used and, upon request, share copies or summaries.

3.1.8 Not disclose Personal Data to third parties except:

as necessary to perform the Services,
as required by law, or
with prior written authorization of the Data Controller.

3.1.9 Maintain records of processing activities and make them available to supervisory authorities upon request.

3.1.10 Cooperate with competent supervisory authorities (e.g., AEPD, CNIL, ICO, FTC) and support the Data Controller in handling inquiries or investigations.

3.1.11 Not sell, rent, or share Personal Data as defined under the CCPA/CPRA, nor use it for any secondary purpose beyond the Services.

3.2 Data Controller’s Obligations

The Data Controller shall:

Provide lawful processing instructions to AgeGO.
Notify AgeGO of any changes in processing requirements.
Remain ultimately responsible for compliance with applicable data protection laws.

4. SUBPROCESSORS

4.1 List: AgeGO may engage subprocessors. A current list of subprocessors engaged by AgeGO is maintained in AgeGO’s Privacy Policy (available at the Third-Party Providers section).

4.2 General Authorization: The Data Controller authorizes AgeGO to appoint subprocessors, provided they are bound by written contracts ensuring equivalent protection.

4.3 Notification and Objection: AgeGO shall notify the Data Controller of new subprocessors at least 15 days before engagement. The Data Controller may object on reasonable grounds; unresolved objections may entitle termination of the Agreement.

5. DATA SECURITY AND INCIDENT MANAGEMENT

5.1 AgeGO shall implement state-of-the-art security measures (as described in Appendix 1 – Technical and Organizational Measures), including encryption, anonymization, pseudonymization, access control, secure development practices, and regular audits.

5.2 In case of a data breach, AgeGO shall notify the Data Controller without undue delay and no later than 72 hours, providing sufficient information to meet regulatory obligations.

5.3 Processing shall follow the principles of privacy by design and by default.

6. DATA RETENTION AND DELETION

6.1 AgeGO shall retain Personal Data only for as long as strictly necessary for the Services and as required by law.

6.2 Upon termination of the Agreement, AgeGO shall securely delete or return all Personal Data, unless legal obligations require retention.

7. DATA SUBJECT RIGHTS

7.1 AgeGO shall enable End Users to exercise their rights directly (access, rectification, erasure, restriction, portability, objection).

7.2 AgeGO shall promptly notify the Data Controller of any rights requests and cooperate to fulfill them.

8. AUDITS

8.1 The Data Controller may audit AgeGO’s compliance once per year with 30 days’ notice, at its cost, unless otherwise agreed.

8.2 AgeGO may provide third-party certifications (e.g., ISO 27001, SOC 2) as evidence of compliance.

9. LIABILITY

9.1 Each Party shall be liable for its own breaches of this DPA or applicable data protection laws.

9.2 AgeGO’s liability shall be limited to breaches of its express obligations under this DPA, subject to the overall liability caps set out in the Agreement.

10. GOVERNING LAW AND DISPUTES

10.1 This DPA is governed by the laws of Spain.

10.2 The courts of Barcelona shall have exclusive jurisdiction, without prejudice to mandatory rights under applicable data protection laws.

11. ADDITIONAL PROCESSING UNDER THE CROSS-SITE VERIFICATION (AG_TOKEN) FEATURE

This Section 11 describes the additional processing operations carried out by AgeGO as a data processor of the Business Customer under the Cross-Site Verification feature. It supplements, and is governed by, the remainder of this DPA.

11.1 Purpose. To enable an End User who has been verified by AgeGO on one AgeGO-enabled site (Site A) to be automatically recognised as verified on another AgeGO-enabled site (Site B), so that both Business Customers can meet their respective age-verification obligations under applicable law without requiring the End User to repeat the verification.

11.2 Nature of the processing. The processing consists of: (i) issuing an Ag_token in the background on the originating site (prefetched during page load, with on-click generation as fallback); (ii) appending the Ag_token to the destination URL at the moment of the End User’s click; (iii) validating the Ag_token server-side on request from the destination site; and (iv) enforcing single-use and short expiry of the Ag_token.

11.3 Categories of Personal Data. The processing involves: the Ag_token; an identifier derived from the verified session on Site A but is a separate, newly signed credential with its own short expiry and one-time identifier (linked to the End User’s AgeGO Account, if any, and otherwise not linked to their Account); timestamps of the issuance and validation events; the identifiers of the originating and destination sites; and the outcome of the validation. The processing does not involve and shall not be used to process any Biometric Data, identity document, financial data, digital ID data or other Sensitive Personal Data. No content viewed by the End User on either site is processed.

11.4 Categories of Data Subjects. End Users of the Business Customer who have been age-verified through AgeGO on an AgeGO-enabled site.

11.5 Duration and retention. The Ag_token is valid for a very short period (typically no more than five (5) minutes from issuance) and is invalidated immediately upon validation. Application logs relating to token issuance and validation are retained by AgeGO for approximately seven (7) days and then deleted; these logs do not include any identifier of the End User, save for error logs and 5%-sampled timing telemetry retained for the same period for service-reliability purposes. Separately, AgeGO retains statistics events relating to the validation phase referenced in Clause 11.3 (issuance, validation, session and access outcomes), without a fixed deletion schedule. Where such an event is linked to an End User’s AgeGO Account, that link persists for as long as the Account remains active; upon deletion of the Account, the associated email address and/or the passkey’s public key and credential ID are deleted, and the retained events can no longer be attributed to the End User.

11.6 Documented instructions. The enablement of the Cross-Site Verification feature by the Business Customer, together with the acceptance of the Agreement and of this DPA, constitutes the Business Customer’s documented instructions to AgeGO under Article 28(3)(a) GDPR for the operations described in this Section 11.

11.7 Processor obligations. AgeGO shall:
(a) process the Personal Data described in Section 11.3 only for the purpose set out in Section 11.1 and only in accordance with the Business Customer’s documented instructions;
(b) not reuse the issuance, validation or destination-site information for AgeGO’s own purposes, including but not limited to aggregated analytics for AgeGO’s own benefit, product development, benchmarking or commercial exploitation, beyond what is strictly necessary to provide the Services;
(c) treat the information linking the originating and destination sites of each Ag_token as Confidential Information of both Business Customers and not disclose it except to the extent strictly necessary to provide the Services or as required by law;
(d) enforce single-use and short expiry (as set out in Section 11.5) technically at the server level;
(e) apply the technical and organisational measures described in Appendix 1 to the processing under this Section 11;
(f) notify the Business Customer of any personal data breach affecting the processing under this Section 11 in accordance with clause 5.2 of this DPA;
(g) suspend or disable the feature promptly upon the Business Customer’s reasonable request, or where required by applicable law or supervisory-authority instruction.

11.8 Business Customer obligations. The Business Customer shall:
(a) inform End Users in its own privacy notice of the use of the feature and of AgeGO’s role as data processor;
(b) maintain its own lawful basis for the underlying age verification on its site, typically compliance with a legal obligation to which it is subject;
(c) preserve the Verified Link (and the Ag_token it contains) through any intermediate redirects that the Business Customer controls, and apply reasonable technical measures to avoid logging, archiving or transmitting the Ag_token to third parties beyond what is strictly necessary to validate it and to take the access decision;
(d) cooperate with AgeGO in the handling of supervisory-authority inquiries, End User rights requests and personal data breach notifications relating to the processing under this Section 11.

11.9 International transfers. Where the processing under this Section 11 entails transfers of Personal Data outside the EEA or the United Kingdom, the parties shall rely on the appropriate transfer mechanism (Standard Contractual Clauses, adequacy decisions, UK IDTA or equivalent), as set out in clause 3.1.7 of this DPA.

11.10 Liability. Each party remains liable for the harm caused by its own processing under this Section 11. The liability caps of the Agreement apply in full to this Section 11.

APPENDIX 1 – TECHNICAL AND ORGANIZATIONAL MEASURES (TOMs)

AgeGO implements the following safeguards:

Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
Pseudonymization and anonymization of End User Data wherever possible.
Strict role-based access control and multi-factor authentication.
Segregation of environments (development, testing, production).
Regular penetration testing and vulnerability management.
Logging and monitoring of access to Personal Data.
Secure deletion and data wiping procedures.
Staff training on data protection and confidentiality.
Subprocessor due diligence and contractual safeguards.