← BACK TO HOME

The Aggregator — Provider Service Offer

Effective date: 23 July 2026 · Version: 2026-07-23-provider-v3

This Provider Service Offer ("Offer") constitutes a binding public offer by Xyro Gaming Limitada, cédula jurídica 3-102-930374, a company incorporated under the laws of the Republic of Costa Rica, with registered address at Puntarenas, Garabito, Jacó, Costado Este de la Municipalidad de Garabito (hereinafter "The Aggregator", "we", "us"), to any legal entity or authorised representative thereof ("Provider", "you") that registers for access to the Aggregator Service as a game content provider. By completing the Provider registration process and confirming acceptance of this Offer, the Provider enters into a binding agreement ("Agreement") with The Aggregator on the terms set forth below.

The Aggregator operates software-as-a-service (SaaS) computational infrastructure that purchases API-processing capacity from Providers and resells metered API-processing capacity on a pre-paid basis to online gaming operators that contract directly with The Aggregator and to Platform Partners that supply their own casino-management solutions to downstream online gaming operators. The Aggregator is the Provider's customer for Metered Successful API Calls and is independently the service provider to each Operator under either a separate Operator Service Offer or a separate Platform Partner Service Offer. For traffic transmitted under a Platform ID, the Platform Partner replaces the direct operator as The Aggregator's Operator-side contractual counterparty; the Platform Partner's downstream Platform Operators do not accept a Service Offer from The Aggregator. The Aggregator does not independently initiate a Real-Money Game Session or Game Round, determine a game outcome, accept a wager, maintain a Player wallet, or receive, hold, transmit, or settle Player funds. As at the Effective Date, The Aggregator does not hold a gaming licence and, based on the current design and operation of the Aggregator Service and the activities it presently performs, does not consider itself to operate or conduct gaming. Regulatory classification depends on the applicable jurisdiction and the activities actually performed; The Aggregator does not represent or warrant that no gaming-related licence, registration, approval, or other authorisation can ever be required. The Aggregator's intended role is that of a B2B technology provider and reseller of metered API-processing capacity, not a legacy GGR-share aggregator.

Nothing in this Agreement creates a joint venture, partnership, agency, employment, or fiduciary relationship between The Aggregator and the Provider, or between the Provider and any Operator. The limited technical rights and permissions in Section 7 do not transfer ownership of Provider Content. There is no separate game royalty, revenue share, GGR share, or content-licensing payment between the Provider and an Operator for access through the Aggregator Service; the per-Metered-Successful-API-Call payment under Section 8 is the Provider's contractual consideration from The Aggregator for that use.

---

1. Definitions

  • "Aggregator Service" — the B2B SaaS service supplied by The Aggregator under this Agreement, comprising the API-routing, authentication, observability, and metering functionality controlled by The Aggregator, together with its dashboard, integration workspaces, onboarding tools, certification record store, telemetry, metering ledger, and related technical support services. The Aggregator Service does not include any Provider RGS, Operator system, Player-Facing Casino Environment, or other third-party system.
  • "Effective Date" — the date on which this version becomes binding on the Provider following acceptance or continued use after any notice required by Section 17.1.
  • "Intellectual Property Rights" — all copyrights, database rights, trade marks, service marks, trade names, patents, design rights, trade secrets, know-how, and other intellectual property or proprietary rights, whether registered or unregistered.
  • "Operator Personal Data" — personal data that The Aggregator processes on behalf of an Operator, including through the processing chain applicable to a Platform Partner, and that the Provider processes as sub-processor or further sub-processor under Section 12.6 and Schedule D.
  • "Personal Data Breach" — a personal data breach within the meaning of GDPR Article 4(12) affecting Operator Personal Data.
  • "Provider Content" — the games, RNG outputs, live dealer feeds, game configurations, mathematical models, art assets, audio, metadata, and certification records made available by the Provider for delivery through the Aggregator Service.
  • "Provider RGS" — the Provider's remote game server or other Provider-controlled backend that hosts Provider Content, maintains authoritative game state, executes Game Rounds, and generates the related transaction and result communications.
  • "Operator" — for purposes of this Agreement, either (a) a third party that has accepted The Aggregator's Operator Service Offer and is provisioned to use the Aggregator Service directly, or (b) a Platform Partner that has accepted The Aggregator's Platform Partner Service Offer, solely in respect of API traffic transmitted under its Platform ID. A downstream Platform Operator is not itself an Operator, party, or beneficiary under this Agreement merely because its traffic is identified by an Operator ID.
  • "Platform Partner" — a third party that has accepted The Aggregator's Platform Partner Service Offer and is provisioned to transmit API traffic for its downstream Platform Operators under a Platform ID.
  • "Platform ID" — the unique identifier assigned by The Aggregator to a Platform Partner and used to attribute configuration, API traffic, metering, compliance, and Incident responsibility to that Platform Partner.
  • "Platform Operator" — a downstream online gaming operator using a Platform Partner's casino-management solution. A Platform Operator does not accept a Service Offer from The Aggregator and has no direct contractual relationship with The Aggregator or the Provider solely because its traffic is routed through the Aggregator Service.
  • "Operator ID" — the unique identifier assigned under a Platform ID to distinguish traffic, configuration, Provider availability, territories, metering, and Incidents attributable to a particular Platform Operator.
  • "Tested Acceptance Point" — the integration-specific endpoint, acknowledgement path, or other technical acceptance point controlled by or contractually attributable to a Platform Partner and approved through The Aggregator's integration testing for determining successful delivery of an eligible API Call under Schedule A.
  • "Real-Money Game Session" or "Game Session" — a production gameplay session created or activated by the Provider RGS only after an authenticated session-initiation request is submitted by an Operator or, for Platform traffic, through the Platform Partner's integration for a Platform Operator and routed through the Aggregator Service. The Aggregator cannot independently initiate a Game Session.
  • "Game Round" or "Round" — a Provider-controlled gameplay cycle within a Game Session. A Round may involve multiple API Calls, including wager, result, win, refund, rollback, acknowledgement, and other technical communications before it is completed.
  • "Spin" — a user-interface or commercial shorthand for a Game Round in slot-style Provider Content. A Spin is not, by itself, a separate metering unit. For a billable production Round, the single eligible successful bet transaction described in Schedule A gives rise to one Metered Successful API Call; the other API Calls relating to that Round are not separately payable.
  • "API Call" — a single discrete API request-and-response or callback-and-acknowledgement transaction routed through the Aggregator Service, as further described in Schedule A.
  • "Metered Successful API Call" — an API Call recorded as Successful in accordance with Schedule A clause A.4. Only Metered Successful API Calls are payable under this Agreement.
  • "Provider Workspace" — the Provider's isolated environment within the Aggregator Service, including API credentials, dashboard access, configuration, certification uploads, kill-switch controls, and integration settings.
  • "Latency Budget" — the target maximum server-side response time for the Provider RGS to return a complete response to an API Call routed to it, as published in the applicable API specification or Provider Workspace. A Latency Budget is an operational target and does not by itself determine whether an eligible bet transaction is commercially payable under Schedule A.
  • "Restricted Jurisdiction" — any jurisdiction (a) where online gambling is prohibited by law, (b) designated by FATF from time to time as a high-risk third country with strategic deficiencies, (c) subject to UN, EU, US (OFAC), UK or other applicable sanctions, or (d) where The Aggregator has determined that services cannot be provided due to regulatory, sanctions, or compliance constraints. The Aggregator maintains the current list on the Aggregator Service dashboard.
  • "Player-Facing Casino Environment" — the websites, applications, casino-management systems, wallets, user interfaces, and related systems used by or on behalf of an Operator to offer gaming services to Players. It excludes the Aggregator Service and each Provider RGS.
  • "Player" or "End User" — an individual end user of an Operator's Player-Facing Casino Environment.
  • "SLA" — the Service Level Agreement set out in Schedule B.
  • "DPA" — the Data Processing Agreement set out in Schedule D.
  • "Money-Path Loss" — any Player payout, deposit, withdrawal, wager, win, Gross Gaming Revenue, bonus cost, wallet balance, settlement amount, gaming tax, or gaming-regulatory fine arising downstream of the API-Call layer.
  • "Provider Activities" — the Provider's supply and operation of Provider Content and its Provider RGS; execution of Game Rounds; maintenance of game state, RNG, mathematics, and certifications; regulatory submissions; and use of the Aggregator Service.
  • "Affected Operator" — an Operator that suffers an indemnified loss directly arising from a Provider-attributable matter covered by Section 10.1 or Schedule C clause C.10(a). For Platform traffic, the Affected Operator is the Platform Partner, not its downstream Platform Operator.
  • "Working Day" — a day other than a Saturday, Sunday, or public holiday in Costa Rica.

2. Scope of Services

2.1 The Aggregator's role — infrastructure reseller

  • The Aggregator operates API-routing infrastructure that (i) authenticates and routes a session-initiation request submitted by an Operator or through a Platform Partner integration to the Provider RGS, (ii) routes transaction and result communications generated by the Provider RGS to the direct Operator's designated endpoint or the applicable Tested Acceptance Point and returns the corresponding acknowledgements, (iii) records relevant API Calls in an append-only, tamper-evident metering ledger, including the Platform ID and Operator ID where applicable, and (iv) settles the Provider for each Metered Successful API Call in accordance with Section 8.
  • Each Game Session is initiated solely by a direct Operator or, for Platform traffic, through the Platform Partner's integration on an authenticated request attributable to a Platform Operator. The Provider RGS creates or activates the Game Session, executes each Round, maintains authoritative game state, and generates the related transaction and result communications. The Aggregator does not independently initiate or execute a Game Session or Round.
  • The Aggregator sells API delivery capacity on a pre-paid basis to direct Operators under the Operator-facing rate card and to Platform Partners under confidential Commercial Terms. A future Credit Line may be made available only as a separately activated standard instrument under the applicable Operator-side Service Offer; it does not alter the current prepayment model unless activated in writing. The Aggregator's economic margin is the difference between the Operator-side price and the Provider payout rate. This margin is The Aggregator's sole revenue from the Provider relationship and is confidential. The Provider has no right of audit, set-off, or claim with respect to the Operator-side price or to The Aggregator's margin.
  • The Aggregator is the counterparty to the Operator for purposes of API delivery. For Platform traffic, the Platform Partner is that Operator-side counterparty and remains responsible to The Aggregator for all traffic under its Platform ID. Neither a direct Operator nor a Platform Partner has contractual privity with the Provider arising solely out of API delivery via the Aggregator Service, and no downstream Platform Operator has contractual privity with either The Aggregator or the Provider.

2.2 Limited technical permission; no GGR royalty

  • Nothing in this Agreement transfers or assigns ownership of Provider Content. Section 7 sets out the limited technical rights granted to The Aggregator and the limited permission The Aggregator may pass through to provisioned direct Operators or Platform Partners solely for access through the Aggregator Service and Provider RGS. A Platform Partner may enable technical access for its Platform Operators only within that permission and remains responsible for it; this does not grant a Platform Operator a direct right under this Agreement.
  • There is no game-use royalty, revenue-share, GGR-share, or content-licensing fee payable by any Operator to the Provider in connection with API Calls routed via the Aggregator Service. The per-API-Call payment in Section 8 is the entire monetisation the Provider receives.

2.3 Provider's affirmative API-handling obligation

The Provider undertakes that, for every API Call that The Aggregator routes to the Provider RGS on an authenticated request attributable to an Operator, and for every transaction or result communication the Provider RGS sends through the Aggregator Service, the Provider shall:

  • (a) accept the API Call, save where the Provider has previously instructed The Aggregator (via the Provider Workspace) to suspend delivery in respect of the originating Operator, the affected Provider Content, or the geography of the originating session;
  • (b) authenticate the API Call using the Aggregator-issued credentials and signing keys, and reject any call that fails authentication;
  • (c) process the API Call correctly, in accordance with the Provider's own published game logic, mathematical model, RNG, and applicable certification, and in accordance with the API specification published by The Aggregator;
  • (d) use commercially reasonable efforts to return a correct, signed, schema-compliant response within the Latency Budget for the relevant API Call category; and
  • (e) preserve idempotency: where The Aggregator retries an API Call within the documented idempotency window using the same idempotency key, the Provider shall return the same response and shall not double-process the underlying game state.

The Provider further undertakes that responses (i) reflect the Provider's own authoritative game state, (ii) do not depend on data, signals, or instructions originating outside the Provider's own systems other than those passed through the API Call payload, and (iii) include the integrity, correlation, and metering fields specified in the API specification.

2.4 Operator and Platform Partner onboarding disclaimer

  • Before enabling a direct Operator for production, The Aggregator shall conduct a proportionate, risk-based documentary onboarding review that includes corporate existence and authority, beneficial-ownership information, sanctions screening, declared operating territories, and evidence of the gaming licences or other lawful basis represented by the direct Operator as applicable to those territories.
  • Before enabling a Platform Partner for production, The Aggregator shall onboard and test the Platform Partner and its integration. The Platform Partner must notify The Aggregator before transmitting production traffic for a Platform Operator and provide that Platform Operator's legal identity, declared territories, represented licence or other lawful basis, and assigned Operator ID. Prior approval of each Platform Operator is not required. The Aggregator may subsequently veto, restrict, or suspend that Platform Operator's traffic, using its Operator ID under the Platform ID, on the same legal, licensing, sanctions, security, certification, regulatory, or other suspension grounds applicable under the Platform Partner Service Offer.
  • The Aggregator shall refresh its review of each direct Operator or Platform Partner periodically and following notice of a material change. The Provider Workspace shall identify the applicable Operator-side contractual counterparty, its verified legal identity, declared territories, licence identifiers and stated status, and the date and scope of the most recent review. For Platform traffic, it shall also identify the Platform ID and available Platform Operator notice information by Operator ID. On reasonable request and subject to confidentiality and data-minimisation requirements, The Aggregator shall provide a review summary or redacted supporting evidence.
  • The review and Platform Operator notice information are not a legal opinion, certification, endorsement, or guarantee of authenticity, continuing validity, legal sufficiency, financial standing, or business practices. The Aggregator warrants only that it performed the checks expressly assigned to it in good faith and accurately recorded information supplied under the applicable Service Offer. A Provider remains responsible for determining whether its own supply to an Operator or territory is lawful, but may rely on a materially accurate review summary or notice record supplied by The Aggregator.
  • Before production traffic begins, the Provider may allow, restrict, or block Provider Content by direct Operator, Platform Partner, Operator ID, or geography in the Provider Workspace. For an ordinary catalogue change, The Aggregator shall give effect to the rule as soon as reasonably practicable and within twenty-four (24) hours. For a substantiated legal, licensing, sanctions, security, certification, or competent-authority ground, the Provider may use the Kill-Switch or submit an emergency request and the restriction shall take effect in accordance with Sections 11.2 and Schedule C.

2.5 Integration Autopilot

  • The Aggregator may make available an AI-powered Integration Autopilot tool ("Autopilot") to assist with onboarding. The Autopilot is optional and supplied "as is" without warranty. The Provider is solely responsible for reviewing, testing, and validating all changes suggested or applied by the Autopilot before deploying them to production.

3. Provider Registration and Acceptance

  • This Offer is accepted when the Provider completes the registration form through the Aggregator Service and confirms acceptance by selecting the corresponding checkbox. Registration constitutes the Provider's unconditional acceptance of all terms.
  • The Aggregator reserves the right to request additional documentation, including corporate certificates, beneficial-ownership declarations, evidence of authority, B2B licences (where applicable), RNG and game certification reports, and recent security or financial audit reports.
  • The per-API-Call payout rate (Section 8) is universal and standardised; it is not subject to per-Provider negotiation save in exceptional circumstances during The Aggregator's bootstrap phase, in which case any departure from the universal rate will be documented in a written addendum signed by both parties.

4. Provider Representations and Warranties

4.1 Corporate standing and authority

The Provider is duly incorporated and validly existing, and the person completing registration has full authority to bind the Provider. All information supplied during registration is accurate, complete, and not misleading.

4.2 Content ownership and certification

The Provider is the sole and exclusive owner, or duly authorised licensee, of all Intellectual Property Rights in the Provider Content, including all rights necessary to grant the limited technical right in Section 7.2. All Provider Content has been independently certified by an accredited testing laboratory (e.g. GLI, BMM, iTech Labs, eCOGRA, or equivalent) to the extent required by the jurisdictions in which Operators offer it to Players. The Provider warrants the accuracy of the RTP, mathematical model, payout tables, RNG implementation, and certification status of each item of Provider Content. The Provider shall upload current certification reports and material technical specifications to the Provider Workspace and update them promptly on any material change.

4.3 Licensing and regulatory compliance

Where applicable, the Provider holds all B2B supplier licences, permits, and regulatory approvals required to make the Provider Content available in the jurisdictions where Operators offer it. The Provider shall notify The Aggregator within five (5) Working Days of any suspension, revocation, restriction, or material change in its regulatory status or in the certification status of any Provider Content.

4.4 AML/CTF and sanctions

The Provider maintains and enforces AML/CTF policies and procedures that comply with applicable laws. Neither the Provider nor any of its beneficial owners, directors, or officers is listed on any sanctions list maintained by the UN, EU, US (OFAC), UK, or any other applicable sanctions authority. The Provider shall cooperate fully with The Aggregator in any AML/CTF investigation or regulatory inquiry.

4.5 Lawful use

The Provider shall not engage in any activity that could damage the reputation, security, or operational integrity of the Aggregator Service, The Aggregator, or any Operator.

4.6 Compliance audit rights

The Aggregator may request, at any time, evidence of the Provider's ongoing compliance, including current certification reports, B2B supplier licences, AML/CTF policy documentation, information-security summaries, and insurance evidence. The Provider shall respond within ten (10) Working Days. The Aggregator may, on reasonable notice and at its own expense, conduct or commission a third-party audit to the extent it relates to the Provider's use of the Aggregator Service.

Providers are strongly recommended (but not contractually required) to maintain professional liability (E&O), cyber liability, and product/IP-infringement cover adequate to the scale of the Provider's content output. The Aggregator may request evidence of cover in connection with high-volume Provider Content or specific incident response.

4.8 Anti-corruption and anti-bribery

Each party warrants compliance with applicable anti-corruption and anti-bribery laws, including the UK Bribery Act 2010 and the US Foreign Corrupt Practices Act.

4.9 Fraud, Abuse, and Security Monitoring

The Provider shall, on a continuous basis and at its own expense:

  • (a) Backend integrity programme. Maintain a documented programme to detect and prevent (i) tampering with Provider Content (RNG, mathematical model, payout tables, certification), (ii) compromise of the Provider's backend infrastructure serving API Calls, (iii) signature forgery and replay attacks against API responses, (iv) fraudulent Large Win claims, and (v) insider abuse by Provider staff or contractors with access to game state.
  • (b) Certification freshness. Keep all certification records for Provider Content current and uploaded to the Provider Workspace; promptly notify The Aggregator of any suspension, revocation, or material change of certification.
  • (c) Security controls. Implement industry-standard security controls on backend systems integrating with the Aggregator Service, including TLS 1.2+, signed-response generation, signing-key rotation no less than every 365 days, multi-factor authentication on administrative access, role-based access control with documented entitlement reviews, and backend access-log retention for at least twelve (12) months.
  • (d) Personnel training and segregation. Train staff with backend access on phishing, social engineering, credential handling, and incident reporting at least annually; enforce duty segregation between game-state authority and finance/operations staff.
  • (e) Independent testing. Recommended (not required as a precondition to use of the Aggregator Service) but expected for Providers serving more than 10 million Metered Successful API Calls per month: subject backend systems to independent penetration testing or equivalent assurance at least annually.
  • (f) Notification. Notify The Aggregator without undue delay (and in any event within the windows set out in Schedule C clause C.6) of any actual or suspected fraud, abuse, security incident, credential compromise, breach of confidentiality, AML/CTF concern, certification anomaly, or sanctions hit.
  • (g) Cooperation. Cooperate with The Aggregator, any affected Operator, and any competent authority in the investigation, containment, and remediation in accordance with Schedule C.
  • (h) Responsibility. Bear sole responsibility for losses, regulatory fines, Player payouts, and remediation costs arising from fraud, abuse, certification failures, RNG anomalies, or security failures originating in the Provider's systems or attributable to the Provider's failure to comply with this Agreement, subject to Section 10 and Schedule C clause C.10.

5. Access, Onboarding, Certification Records, and Provider-Side Availability

5.1 Environment stages

Access is granted in stages: sandbox, staging, and production. The Aggregator determines timing and conditions. Sandbox and staging API Calls are non-billable to Operators and non-payable to the Provider.

5.2 Certification record store

The Provider shall upload to the Provider Workspace, and keep current, copies of all valid testing-laboratory certificates and material technical specifications for each item of Provider Content. The Aggregator stores such records for the Provider's and Operators' regulatory-evidence purposes; The Aggregator does not validate, audit, or warrant the substance of such records.

5.3 Provider-side availability rules (quiet opt-out)

The Provider may configure availability rules that suspend specific Provider Content for specific Operators or geographies. Ordinary catalogue changes take effect as soon as reasonably practicable and within twenty-four (24) hours. Emergency or legally required restrictions take effect under Section 11.2 and Schedule C. The affected Provider Content will appear as unavailable in the Operator's catalogue; The Aggregator may withhold confidential reasoning from the Operator but may disclose that the restriction originated with the Provider where required by law, a competent authority, the Operator Service Offer, or fair incident handling.

5.4 Discretion to refuse or restrict access

The Aggregator reserves sole discretion to approve, delay, condition, or deny Provider access where (a) certification appears expired, withdrawn, or jurisdictionally inadequate, (b) the content carries unmitigated regulatory risk, (c) a credible third-party IP claim has been raised, or (d) the Provider RGS chronically fails to meet Section 2.3 and Schedule B (Section 11.5 also applies).

6. Credentials, Security, and Workspace Integrity

  • The Provider is solely responsible for safeguarding credentials, API keys, signing secrets, callback signing keys, and authentication mechanisms.
  • The Provider shall implement reasonable security measures, including IP allow-listing, mutual TLS where supported, signing-key rotation no less than every 365 days, access logging, and role-based access control.
  • The Provider is fully responsible and liable for all activity conducted under its credentials.
  • The Provider shall notify The Aggregator within the windows in Schedule C clause C.6 of any actual or suspected unauthorised access, credential compromise, fraud, or security breach. Each party shall apply an evidence-preservation hold for not less than twelve (12) months.

7. Intellectual Property and Limited Technical Rights

7.1 Provider retains all IP

All Intellectual Property Rights in Provider Content remain the sole and exclusive property of the Provider or its upstream licensors. Except for the limited technical rights and Operator permission in Section 7.2, nothing grants The Aggregator, an Operator, or a Platform Operator a standalone content or distribution licence, or any right to modify, decompile, reverse-engineer, create derivative works of, or exploit Provider Content outside the Aggregator Service and Provider RGS.

7.2 Limited technical right to route, cache, and display metadata

The Provider grants The Aggregator a limited, non-exclusive, worldwide, royalty-free, revocable right, for the term, to: (a) receive, decode, route, cache to the extent technically necessary, authenticate, and transmit Provider Content API payloads; (b) reproduce Provider Content thumbnails, names, and metadata strictly for listing in the Operator dashboard and, subject to Section 7.4, on the "Supported Providers" page; (c) store certification records and integration artefacts uploaded by the Provider; (d) generate, retain, and audit metering-ledger entries describing API Calls; and (e) permit provisioned Operators to access, display, and use Provider-hosted Provider Content solely through the Aggregator Service and Provider RGS for Player-facing gaming in territories the Provider has made available. Where the Operator is a Platform Partner, paragraph (e) includes the minimum technical permission necessary for that Platform Partner to make Provider-hosted Provider Content accessible through its tested integration to its Platform Operators under assigned Operator IDs, subject to Provider availability rules and the Platform Partner remaining responsible to The Aggregator for all such access. The Aggregator may sublicense the minimum technical rights necessary to its listed infrastructure sub-processors and pass through the permission in paragraph (e) to provisioned Operators, but may not grant any broader right. No Platform Operator receives a direct licence or enforcement right from the Provider under this Agreement.

These rights are strictly limited to operation of the Aggregator Service and the authorised Operator access described above. The Aggregator shall not train any machine-learning model on Provider Content, use Provider Content for a product unrelated to the Aggregator Service, or use Provider Content in marketing or sales material beyond the consent granted under Section 7.4.

7.3 The Aggregator's IP

All Intellectual Property Rights in the software and technology comprising the Aggregator Service remain the exclusive property of The Aggregator. The Provider receives a limited, non-exclusive, non-transferable, revocable licence to use that software, technology, and related documentation solely for integration purposes.

7.4 Mutual marks use

Each party grants the other a limited, non-exclusive, royalty-free right to use the other's name and logo to identify the relationship. Marketing campaigns, press releases, and pitch decks require prior written consent (not unreasonably withheld).

7.5 IP claims and takedown

The Provider warrants that the Provider Content does not infringe any third-party right, and shall defend, indemnify, and hold The Aggregator harmless per Section 10. The Aggregator may, on receipt of a credible third-party infringement notice, suspend delivery in accordance with Schedule C clause C.11.

8. Provider Payout Terms (Pay-Per-Metered-Successful-API-Call)

8.1 What is paid, and what an API Call is

For each Metered Successful API Call originating from the Provider RGS, routed through the Aggregator Service to a direct Operator's designated wallet or callback endpoint or, for Platform traffic, to the applicable Tested Acceptance Point, accepted there, and recorded in the metering ledger in accordance with Schedule A, The Aggregator shall pay the Provider the rate in clause 8.2.

An "API Call" is one discrete request-and-response or callback-and-acknowledgement transaction routed through the Aggregator Service. A Game Round may involve several API Calls. Only the single eligible production bet or equivalent wager/debit transaction that satisfies every condition in Schedule A clause A.2 is a Metered Successful API Call. Session launch, balance, result, win, refund, rollback, acknowledgement, retry, and other technical communications relating to the Round are not separately payable.

For the avoidance of doubt, the Metered Successful API Call is the contractual metering unit evidenced by one successfully accepted eligible transaction uniquely mapped to one billable Round. Absent a signed provider-specific addendum expressly defining a multi-wager Round, no Round may produce more than one Metered Successful API Call. Payment is compensation for the Provider RGS processing and related technical permission under this Agreement, not a share of any gaming revenue, wager value, bet amount, win, GGR, NGR, or other Money-Path metric.

8.2 Universal rate

  • The per-API-Call payout rate is USD $0.0012 per Metered Successful API Call. This rate is universal and applies to all Providers.
  • The Aggregator may, in good faith, propose a change by giving the Provider not less than ninety (90) calendar days' prior written notice via the Provider Workspace and registered email. If the Provider disagrees with the change, the Provider may terminate this Agreement under §11.3 by written notice within the notice period; otherwise continued use constitutes acceptance.
  • Departures from the universal rate are permitted only by separate written addendum signed by both parties.

8.3 Non-payable categories

  • Test, sandbox, staging, and integration-validation calls are non-payable.
  • Failed API Calls (Schedule A clause A.4) are non-payable. Where an API Call fails, neither the applicable Operator-side pre-paid balance is deducted nor is the Provider paid — symmetric refund.
  • Session launch, resume, and end requests; balance queries; win, payout, result, refund, rollback, and void communications; free or promotional transactions identified as non-billable; health checks; retries within the documented retry window; idempotent duplicates; monitoring traffic; and calls rejected before reaching the intended endpoint are non-payable (Schedule A clause A.3).

8.4 Self-billing (Recipient-Created Tax Invoice)

  • Each calendar month, The Aggregator shall, in respect of the preceding month, generate a Self-Billing Statement (operating as a Recipient-Created Tax Invoice, "RCTI") covering all Metered Successful API Calls attributable to the Provider during that month, and make it available via the Provider Workspace.
  • By accepting this Offer, the Provider authorises The Aggregator to issue RCTIs and undertakes not to issue its own invoice for the same calls.
  • The Provider shall, within five (5) Working Days, either (a) confirm the Statement or (b) raise a written dispute identifying the specific line items and the basis. The Aggregator shall investigate any dispute in good faith and reconcile on the following month's Statement.
  • The RCTI shall identify both parties, the period covered, the number of Metered Successful API Calls (in aggregate and by category), the applicable rate, the total amount payable, and the tax position adopted.

8.5 Payment timing and method

  • The Aggregator shall pay the amount stated on the RCTI on net-15 terms — payment due within fifteen (15) calendar days after the RCTI is made available — subject to the Provider's confirmation or resolution of any dispute.
  • Payment is in United States Dollars (USD). During the bootstrap phase, The Aggregator may settle in USDT (Tether) on the Tron (TRC-20) or Ethereum (ERC-20) network, or such other blockchain as the parties may agree, at par 1 USD = 1 USDT.
  • The Provider shall designate, and maintain current, valid payout instructions via the Provider Workspace. The Aggregator is not liable for delays or losses arising from incorrect, outdated, or fraudulent payout instructions supplied by the Provider.
  • The Provider warrants lawful source of any blockchain wallet used for payout. The Aggregator may refuse to settle to a wallet that fails sanctions/AML screening.

8.6 Taxes

  • The RCTI amount is the gross amount due to the Provider. All taxes, duties, levies, VAT, withholding obligations, customs duties, and tariffs in the Provider's jurisdiction or otherwise attributable to the Provider's receipt of the payment are the sole responsibility of the Provider. No gross-up is paid. The Provider may submit a tax-treaty residency certificate to reduce or eliminate withholding to the extent permitted by law.
  • Where applicable law requires The Aggregator to withhold tax on the payout, The Aggregator shall make the withholding, remit it to the relevant authority, and deliver the net amount with documentation of the withholding.

8.7 Late payment by The Aggregator

  • If The Aggregator fails to pay an undisputed amount within thirty (30) calendar days after its applicable due date, the Provider may, on written notice, claim simple interest at 1.0% per month (or the maximum rate permitted by law, whichever is lower), accruing daily from the thirty-first (31st) calendar day after that due date. A shortfall agreed or finally determined under clause 8.8 becomes an undisputed amount on the date of that reconciliation result, and interest on that shortfall begins to accrue if it remains unpaid for more than thirty (30) calendar days after that date. Persistent failure, meaning more than two undisputed late payments in any rolling twelve-month period or one undisputed amount outstanding for more than thirty (30) calendar days, gives the Provider the suspension and termination rights in Sections 11.2 and 11.3.

8.8 Joint reconciliation of the metering ledger

  • If either party identifies a reasoned discrepancy in the metering ledger or an RCTI, the parties shall conduct a joint reconciliation in good faith using the relevant metering records and other reasonably necessary supporting information. Following agreement of the reconciliation result, or its final determination under Section 16, The Aggregator shall promptly issue a corrected RCTI or other corrected invoice document. If the reconciliation shows a shortfall in the Provider's favour, The Aggregator shall pay the undisputed shortfall in accordance with the corrected payment document. If the reconciliation shows that The Aggregator issued an RCTI for and paid more than was due, The Aggregator shall issue a corresponding credit note and may apply the overpayment to reduce the next payout to the Provider; if no further payout becomes due within a reasonable period, the Provider shall repay the undisputed overpayment. No independent audit or audit-cost reimbursement is required under this clause. Clause 8.7 applies if an undisputed reconciliation amount remains unpaid for more than thirty (30) calendar days after the applicable original due date under the standard payment process or, where the amount becomes ascertainable only through reconciliation, after the date of the agreed or finally determined reconciliation result.

8.9 No minimum guarantee; no signing payment

  • The Aggregator does not guarantee any minimum volume. Payment is strictly usage-based. There is no setup fee, signing payment, advance, integration credit, or minimum monthly commitment.

8.10 The Aggregator never handles Provider–Operator settlement other than its own infrastructure economics

  • The Aggregator never accepts, holds, routes, escrows, or transmits any payment, deposit, withdrawal, win, payout, royalty, or other amount between an Operator and a Player. The only payment flows are (i) The Aggregator's payout to the Provider under this Section (post-paid), and (ii) the applicable Operator's prepayment to The Aggregator under the Operator Service Offer or Platform Partner Service Offer, unless a separate Credit Line is later activated under that offer.

9. Limitation of Liability and Disclaimer

9.1 Role of The Aggregator

The Aggregator Service is designed and operated as SaaS API-routing and metering infrastructure, and The Aggregator acts as a reseller of metered API-processing capacity. The Aggregator does not independently initiate Game Sessions or Rounds, determine game outcomes, accept wagers, maintain Player wallets, or accept, hold, route, escrow, transmit, or settle Player or Operator gaming funds. Its functions for the Provider are limited to onboarding and compliance coordination, API routing and observability, metering, Operator pre-payment administration, and settlement of the Provider on a per-Metered-Successful-API-Call basis. Fees are independent of wager value, Player win or loss, GGR, NGR, revenue share, or any other Money-Path metric.

9.2 Service availability — Aggregator infrastructure only; game content availability is Provider's sole responsibility

  • Service availability of The Aggregator's own API routing infrastructure is governed by Schedule B.
  • The availability and correct functioning of Provider Content (game logic, RNG, mathematical model, certification, and Provider RGS) remain the Provider's responsibility under the operational target in Schedule B clause B.4. Failures attributable to the Provider RGS do not count against the Aggregator Routing Layer target.
  • No cash or in-kind service credit, payout uplift, token, refund, liquidated damages, or penalty accrues solely because a target in Schedule B is missed. This does not prevent correction of a metering or RCTI discrepancy, termination for a separate uncured material breach, or liability that cannot lawfully be excluded.

9.3 Limitation of liability — API-Call cost ceiling; no Money-Path Loss save sole-fault

  • (a) Aggregate cap. To the maximum extent permitted by applicable law, The Aggregator's total aggregate liability under or in connection with this Agreement, whether in contract, tort, strict liability, or otherwise, shall not exceed the greater of (i) USD 250,000 and (ii) the total amounts paid by The Aggregator to the Provider during the six (6) months immediately preceding the event giving rise to the claim.
  • (b) Money-Path Loss limitation, with a sole-fault exception. Notwithstanding any other provision of this Agreement, The Aggregator's financial liability arising out of or in connection with an Incident, fraud, abuse, or security event shall be limited to correction of the affected metering entries and payment of any amount shown by the corrected ledger to be due and shall not extend to Money-Path Loss, except where the multi-source root-cause analysis under Schedule C establishes that the Money-Path Loss was directly and solely caused by a verified routing or metering fault of The Aggregator's own infrastructure. In that case, The Aggregator shall bear the Money-Path Loss so caused, subject to the aggregate liability cap in clause 9.3(a). Where the Money-Path Loss arises from mixed causes or any act or omission of an Operator, a Platform Operator whose activity is attributable to a Platform Partner under the Platform Partner Service Offer, the Provider, a Player, or a third party, the sole-fault exception does not apply and allocation under Schedule C clause C.10 governs.
  • (c) Participation preserved. The limitation in clause 9.3(b) does not relieve The Aggregator of its obligation to participate fully in incident detection, support handling, the joint investigation, the Incident Report (including contribution of its API-Call metering ledger), the RCA, and the damage-allocation Sync-Up under Schedule C, nor of its obligation to implement the API-Call-cost remediation and the security improvements attributed to it.
  • (d) No consequential damages. Except for direct Money-Path Loss covered by clause 9.3(b), an express indemnity under Section 10, or liability that cannot lawfully be excluded, The Aggregator shall not be liable for indirect, incidental, special, consequential, or punitive damages, including indirect loss of profits, revenue, data, goodwill, business opportunity, or reputation.
  • (e) Carve-out. Clauses 9.3(a)–(d) do not apply to liability that cannot be excluded or limited by applicable law, including liability for The Aggregator's own gross negligence, wilful misconduct, or fraud.

9.4 Limited third-party-beneficiary rights

Except as expressly stated in this clause, this Agreement is solely for the benefit of its parties. Each Affected Operator, including a Platform Partner for affected traffic under its Platform ID, is an intended third-party beneficiary solely of the Provider's indemnity obligations under Section 10.1 and Schedule C clause C.10(a) and may enforce those obligations directly. An Affected Operator takes that limited benefit subject to the same notice, defence-control, causation, mitigation, no-double-recovery, limitation, governing-law, and dispute-resolution provisions that would apply if The Aggregator enforced the obligation. No Platform Operator, Player, end user, regulatory authority, or other third party receives any right, and no broader contractual privity between the Provider and an Operator is created. Any Platform Operator loss or claim must be addressed through its Platform Partner under their separate relationship.

The Provider is, correspondingly, an intended third-party beneficiary solely of an Operator's indemnity for Operator-attributable Incidents to the extent expressly granted in the applicable Operator Service Offer or Platform Partner Service Offer. The Aggregator shall, following a substantiated claim and subject to confidentiality and applicable law, provide the affected parties with the identity and relevant contractual extract reasonably necessary to exercise the limited beneficiary right. The Aggregator does not guarantee an Operator's performance or solvency and is not a surety for an Operator's indemnity.

An Affected Operator accepts the limited benefit by giving written claim notice to The Aggregator at legal@aggregator.gg and to the Provider at the notice address The Aggregator supplies for that claim. By enforcing the benefit, the Affected Operator accepts Section 16 and may commence or be joined to an arbitration solely for the covered claim. Before such acceptance, the parties may amend or revoke the benefit; after acceptance, they may not revoke an accrued claim without the Affected Operator's consent.

9.5 Regulatory classification shield

The parties acknowledge that regulatory classification depends on the applicable jurisdiction and the activities actually performed. The Provider shall not make a materially false or misleading statement to an authority concerning The Aggregator's activities. The Provider shall indemnify The Aggregator under Section 10 only to the extent a regulatory claim, investigation, requirement, or classification is directly caused by (a) the Provider's material breach of this Agreement or applicable law; (b) unlawful, unlicensed, uncertified, or non-compliant Provider Activities; or (c) a materially false or misleading statement made by or on behalf of the Provider concerning The Aggregator. The Provider has no liability under this clause to the extent the matter results from The Aggregator's own services, conduct, documentation, representations, or failure to obtain an authorisation legally required for The Aggregator's own activities.

10. Indemnification

10.1 By the Provider

The Provider shall indemnify, defend, and hold harmless The Aggregator and each Affected Operator from and against third-party claims and documented direct losses, damages, liabilities, regulatory fines to the extent legally indemnifiable, and reasonable external legal and remediation costs, in each case to the extent directly caused by: (a) the Provider's material breach of this Agreement, including Section 2.3, provided that an operational target miss alone is not a breach or indemnity trigger; (b) a claim that Provider Content infringes a third-party Intellectual Property Right; (c) unlawful, unlicensed, uncertified, or non-compliant Provider Activities; (d) a claim concerning fairness, RNG integrity, RTP, game mathematics, certification status, or authoritative game state of Provider Content; (e) a Provider-attributable Incident under Schedule C clause C.10(a); (f) fraud, money laundering, sanctions evasion, or illegal activity originating in systems controlled by the Provider; or (g) the regulatory-classification circumstances described in Section 9.5. The indemnity includes amounts that The Aggregator is legally required to pay an Affected Operator under the Operator Service Offer for the same Provider-attributable matter.

10.2 By The Aggregator

The Aggregator shall indemnify, defend, and hold harmless the Provider from third-party claims and documented direct losses to the extent directly caused by: (a) The Aggregator's gross negligence or wilful misconduct; (b) infringement of third-party Intellectual Property Rights by the software and technology comprising the Aggregator Service, excluding Provider Content; (c) The Aggregator's material breach of Section 12 or Schedule D; (d) The Aggregator's material failure to perform the direct Operator or Platform Partner onboarding checks expressly required by Section 2.4 in good faith; (e) a materially false review summary, Platform Operator notice record, or other materially false statement supplied by The Aggregator concerning an Operator or the Provider; or (f) a claim or regulatory process alleging that The Aggregator failed to obtain a licence, registration, approval, or authorisation legally required for The Aggregator's own activities. For paragraph (f), the duty to defend and bear reasonable covered defence costs begins when a substantiated allegation is made; the duty to indemnify a final liability applies only to the extent the required authorisation and The Aggregator's failure to obtain it are established by a final decision or a settlement approved under Section 10.3. This indemnity is subject to the liability cap in Section 9.3(a), except to the extent Section 9.3(e) applies. It does not make The Aggregator a guarantor of an Operator's information, conduct, indemnity, or solvency.

10.3 Indemnity procedure

An indemnified person shall give prompt written notice of a claim, provide reasonable supporting evidence, mitigate avoidable loss, and provide reasonable cooperation at the indemnifying party's expense. Delay in notice reduces liability only to the extent it materially prejudices the defence. The indemnifying party may control the defence with qualified counsel reasonably acceptable to the indemnified person, but may not settle a claim in a manner that admits fault by, imposes a non-monetary obligation on, or fails to give a full release to the indemnified person without that person's prior written consent, not to be unreasonably withheld. No person may recover more than once for the same loss. For an Incident, the final RCA, agreed allocation, settlement, or arbitral award shall determine causation and allocation; participation in a Sync-Up is not an admission of liability.

11. Suspension, Deprioritisation, and Termination

11.1 Suspension by The Aggregator

The Aggregator may immediately suspend the Provider's access, in whole or for specific Provider Content or Operator routes, without prior notice, if: (a) fraud, AML, or illegal activity is reasonably suspected; (b) a B2B licence is suspended, revoked, or expires; (c) certification underpinning Provider Content is suspended, revoked, expires, or is materially impugned; (d) an IP notice is accompanied by a court order or creates imminent regulatory or infringement harm, while any other credible IP notice is handled under Schedule C clause C.11; (e) the Provider breaches a material term, provided that an operational target miss alone is handled under Schedule B; (f) continued service exposes The Aggregator to regulatory, legal, or reputational risk; (g) a competent authority requests suspension; or (h) the Kill-Switch under Schedule C is activated.

Suspension does not release The Aggregator from payment obligations for Metered Successful API Calls completed prior to suspension.

11.2 Suspension by the Provider

The Provider may immediately suspend affected Provider Content, Operators, geographies, or routes, without liability for an availability-target miss, where the Provider reasonably determines that suspension is necessary to address (a) an actual or suspected security Incident; (b) unlawful use; (c) a sanctions, licensing, certification, or regulatory concern; (d) a competent-authority direction; (e) a credible IP-infringement risk; or (f) imminent material harm to Provider Content, the Provider RGS, Players, an Operator, or the Aggregator Service. Emergency action may be taken without prior notice, provided the Provider notifies The Aggregator as soon as reasonably practicable and supplies the factual basis to the extent legally permitted.

If an undisputed amount remains unpaid for more than thirty (30) calendar days after its due date, the Provider may suspend new Game Sessions and new Rounds on written notice until full payment, without waiting a further remediation period. For another material Aggregator breach that does not create an emergency, suspension may occur if the breach remains uncured thirty (30) calendar days after written notice.

Unless the Provider elects to suspend immediately under this Section, the thirty (30)-calendar-day period is intended to allow The Aggregator to notify affected Operators and, where practicable, to complete or wind down active promotions in an orderly manner. The purpose of that process is to reduce avoidable disruption to Operators and Players and to protect the Provider's reputation and continuing commercial relationships with Operators. The Provider nevertheless retains the right, at its sole discretion, to disable or suspend its API, Provider Content, Operators, geographies, or routes at any time. Where technically safe and legally permissible, the Provider shall use reasonable efforts to allow an already accepted Round to reach a consistent final state. Every suspension shall be proportionate in scope and, where based on a remediable ground, lifted promptly when that ground is remedied, unless the Provider elects otherwise in its sole discretion.

11.3 Termination

  • Either party may terminate with thirty (30) calendar days' written notice.
  • The Aggregator may terminate immediately on any Section 11.1 event.
  • The Provider may terminate for a material Aggregator breach that remains uncured ten (10) Working Days after The Aggregator receives written notice describing the breach in reasonable detail. No cure period applies where the breach is incapable of cure, an undisputed amount remains unpaid for more than thirty (30) calendar days after its due date, or applicable law requires immediate termination.

11.4 Effects of termination

  • Access ceases; outstanding payouts to the Provider in respect of completed Metered Successful API Calls are paid on the next RCTI cycle; each party deletes or returns confidential information; provisions surviving termination include §§4.6, 4.8, 7, 8.4–8.8, 9, 10, 12, 13, 16, and Schedules A, C, D.
  • The Aggregator shall, on request and at the Provider's expense, provide a final metering reconciliation and reasonable cooperation to assist direct Operators and Platform Partners in migrating away from the Provider Content in an orderly manner.

11.5 Deprioritisation for chronic underperformance

Where the Provider RGS materially and repeatedly misses the operational target in Schedule B clause B.4 and the Provider fails to implement an agreed remediation plan, The Aggregator may, at its discretion and without breach: (a) deprioritise routing, (b) cap the rate of API Calls routed, (c) suspend specific Provider Content, or (d) initiate termination. Before exercising (a)–(c), The Aggregator shall use commercially reasonable efforts to notify the Provider via the Provider Workspace and allow proportionate remediation, unless immediate action is required under Section 11.1. Deprioritisation does not entitle the Provider to compensation; payment for Metered Successful API Calls completed during deprioritisation remains due.

12. Data Protection and Privacy

12.1 Roles

The Aggregator processes Provider registration, account, billing, and business-contact data as controller. For Player-adjacent personal data transmitted by a direct Operator, the direct Operator is controller, The Aggregator is processor, and the Provider is The Aggregator's sub-processor to the extent it processes that data solely to execute Provider Content and return transaction or result communications. For Platform traffic, the intended chain is Platform Operator as controller, Platform Partner as processor, The Aggregator as sub-processor, and the Provider as further sub-processor, subject always to the functions actually performed and applicable law. If any party independently determines a distinct purpose and essential means for processing, it acts as an independent controller for that processing and is responsible for the corresponding notice, legal basis, and compliance obligations. Schedule D governs the Provider's sub-processing or further-sub-processing relationship with The Aggregator.

12.2 Data retention

Provider registration, contract, billing, and non-payload metering records processed by The Aggregator as controller are retained in accordance with the Privacy Policy and for any longer period required by applicable law. Operator Personal Data, including Platform traffic data, is subject to Schedule D and shall not be retained under this clause merely because the Provider Agreement remains active.

12.3 Data subject rights

For Provider business-contact and account data processed by The Aggregator as controller, individuals may exercise applicable rights by contacting legal@aggregator.gg. A request concerning Operator Personal Data shall be forwarded through the applicable contractual chain to the direct Operator or Platform Partner, and The Aggregator and the Provider shall act only on documented instructions unless applicable law requires otherwise.

12.4 Security measures

TLS 1.2+ in transit; encryption at rest; access controls; key rotation; append-only audit logging; continuous monitoring.

12.5 Regulatory cooperation

If The Aggregator receives a regulatory request relating to the Provider, it shall (a) notify the Provider promptly unless prohibited, (b) provide reasonable cooperation as required by law, (c) disclose Provider data as legally required.

12.6 Data Processing Agreement (Inline DPA)

Schedule D applies where the Provider processes Operator Personal Data as The Aggregator's sub-processor or further sub-processor and is intended to satisfy the flow-down requirements of GDPR Article 28(4).

13. Confidentiality

Each party shall maintain the confidentiality of the other party's confidential information, including pricing (in particular Operator-paid package rates and Aggregator margin), certification reports, technical specifications, API documentation, business strategies, and proprietary systems. Obligations survive termination for five (5) years; trade-secret status survives indefinitely.

14. Non-Solicitation

During the term and for twelve (12) months thereafter, neither party shall solicit or induce any employee, contractor, or agent of the other party to terminate their relationship, save in response to a general non-targeted job advertisement.

15. Marketing Communications

If the Provider opts in during registration, The Aggregator may send product updates, release announcements, and commercial communications.

16. Governing Law and Dispute Resolution

16.1 Governing law

This Agreement shall be governed by the laws of the Republic of Costa Rica, without regard to conflict-of-law provisions.

16.2 Dispute resolution

Good-faith negotiation for thirty (30) calendar days. Failing resolution, binding arbitration under the ICC rules, conducted in English, seat in San José, Costa Rica, sole arbitrator. Either party may seek injunctive relief from a court of competent jurisdiction.

17. General Provisions

17.1 Amendments

  • Non-material changes take effect upon publication with dashboard notification.
  • Material changes require at least thirty (30) calendar days' prior written notice — except a change to the per-API-Call payout rate (§8.2) which requires at least ninety (90) calendar days.
  • The Provider may terminate without penalty within the notice period if it does not agree.

17.2 Assignment

The Provider may not assign without The Aggregator's prior written consent. The Aggregator may assign to an affiliate or in connection with a merger, acquisition, or sale of substantially all of its assets.

17.3 Severability

If any provision is invalid or unenforceable, the remaining provisions continue.

17.4 Entire agreement

This Offer, together with all Schedules and any written addenda signed or accepted in accordance with this Offer, constitutes the entire agreement between The Aggregator and the Provider. The Operator-facing rate card, Platform Partner Commercial Terms, and The Aggregator's margin are not part of this Agreement.

17.5 No waiver

No failure or delay constitutes a waiver.

17.6 Force majeure

Events beyond reasonable control, including natural disasters, war, terrorism, sanctions, pandemics, cyberattacks beyond commercially reasonable security measures, or third-party infrastructure failure not caused by the affected party's negligence.

17.7 Notices

Sent to the contact details on registration (Provider) or the address in §17.11 (Aggregator).

17.8 Language

English. The English version prevails in any translation.

17.9 Electronic records

Electronic communications, signatures, and records (including acceptance via the registration checkbox) satisfy any legal writing or signature requirement.

17.10 Independent contractors

The parties are independent contractors. No agency, partnership, joint venture, employment, or fiduciary relationship.

17.11 Contact

  • Legal entity: Xyro Gaming Limitada, cédula jurídica 3-102-930374
  • Address: Puntarenas, Garabito, Jacó, Costado Este de la Municipalidad de Garabito, Costa Rica
  • Email: legal@aggregator.gg
  • Website: https://aggregator.gg

---

Schedule A — API Call Specification & Metering

A.1 API traffic and Game Rounds. A Game Session begins only when an authenticated session-initiation request attributable to a provisioned Operator is routed to the Provider RGS. For Platform traffic, the request is transmitted through the tested Platform Partner integration and identified by Platform ID and Operator ID. The Provider RGS executes each Game Round and may generate multiple API Calls, including bet, win, refund, result, acknowledgement, balance, rollback, or other technical communications. These communications do not each become payable merely because they are successfully routed. The category labels describe the purpose of routed messages; they do not mean that The Aggregator authorises a wager, determines an outcome, maintains a wallet, or effects a gaming settlement.

A.2 Eligible billable API Call. One Metered Successful API Call is recorded for one unique production bet or equivalent wager/debit transaction representing a billable Game Round where all of the following occur: (a) the Provider RGS sends an authenticated, schema-compliant transaction bearing a unique Provider transaction identifier and a Round identifier, or another documented identifier that uniquely maps that transaction to one Round; (b) the Aggregator Service routes it to the direct Operator's designated wallet or callback endpoint or, for Platform traffic, the integration-specific Tested Acceptance Point; (c) that endpoint or Tested Acceptance Point accepts it with the success status specified in the API documentation and integration test record; and (d) the Aggregator Service records the request and corresponding acknowledgement within the same trace context, including Platform ID and Operator ID where applicable. Each eligible transaction carries an Aggregator correlation ID (x-aggregator-call-id). Absent a signed provider-specific addendum expressly defining a multi-wager Round, neither the same Provider transaction nor the same Round may produce more than one Metered Successful API Call.

A.3 Non-billable / non-payable categories. The following are not Metered Successful API Calls and are not payable: Game Session launch, resume, or end requests; balance queries; win, payout, result, settlement-status, refund, rollback, or void communications; free-round or promotional transactions identified as non-billable under the API specification; health checks and Aggregator Service monitoring; retries within the documented retry window; idempotent duplicates; calls rejected before reaching the intended endpoint; and sandbox, staging, or integration-validation traffic. These communications may still be logged as technical API traffic for security, support, and incident reconstruction.

A.4 Successful versus Failed eligible API Call. An eligible API Call is Successful only if it satisfies every condition in clause A.2, including acceptance by the direct Operator's designated endpoint or the applicable Tested Acceptance Point. It is Failed if it times out, fails authentication or schema validation, receives a non-success or malformed acknowledgement, cannot be routed to the applicable acceptance point, or is subsequently identified as an idempotent duplicate. A Failed eligible API Call produces no Operator-side balance deduction and no Provider payout. A verified reversal or refund of a previously recorded eligible transaction is handled as a metering and RCTI correction under Sections 8.8 and A.6, not as an SLA service credit.

A.5 Metering ledger. Append-only, tamper-evident, stored with periodic integrity checks. Each entry records: correlation ID, Operator ID, Platform ID where applicable, Provider ID, Provider Content identifier, category, request timestamp, response timestamp, success/failure classification, and idempotency key. It is the authoritative source for the count of Metered Successful API Calls and Provider payout/RCTI calculation. For Incident attribution, money-path questions, and game-outcome questions, the multi-source reconstruction rule in Schedule C applies.

A.6 Audit and correction. The Provider may audit a disputed period and obtain correction of every verified discrepancy in accordance with Section 8.8.

A.7 Outage exclusion. Periods during which the metering layer is itself unavailable, flagged in the Schedule B SLA report, are reconciled retrospectively with adjustments processed on the next RCTI cycle.

---

Schedule B — Service Level Agreement

B.0 Scope and nature of SLA. This Schedule sets operational service-level objectives for The Aggregator's API Routing Layer and the Provider RGS. It does not guarantee the availability, correctness, RTP, fairness, or playability of Provider Content. A Provider-RGS failure does not count against the Routing Layer target, and an Aggregator Routing Layer failure does not count against the Provider target. All availability, success-rate, response, and resolution figures in this Schedule are targets to which the relevant party shall use commercially reasonable efforts to aspire; they are not warranties or guaranteed minimums unless a signed addendum expressly states otherwise.

B.0.1 Measurement definitions. "Routing Layer" means the authentication, routing, metering, and observability components controlled by The Aggregator that form the API-facing boundary of the Aggregator Service. "Total Routing Minutes" means the total clock minutes in the relevant calendar month. "Unavailable Minutes" means whole minutes during which the Routing Layer is materially unable to authenticate and route eligible production API traffic at the Routing Layer, excluding the circumstances in clause B.2.

B.1 Routing Layer availability target — 99.9%. The Aggregator shall use commercially reasonable efforts to achieve monthly availability of at least 99.9%, measured at the Routing Layer.

> Availability% = (Total Routing Minutes − Unavailable Minutes) ÷ Total Routing Minutes × 100

For the avoidance of doubt, this target applies only to The Aggregator's own Routing Layer infrastructure. It is not a guarantee of overall game availability or the end-to-end Operator experience, both of which also depend on the Provider RGS and Operator systems.

B.2 Exclusions from Routing Layer SLA. Unavailable Minutes do not include time attributable to:

  • Aggregator-scheduled maintenance announced ≥ 72 hours in advance, ≤ 6 hours/week and ≤ 24 maintenance windows/year;
  • Aggregator emergency maintenance, announced as soon as reasonably practicable;
  • Failure of the Provider's backend — addressed under clause B.4;
  • Failure of an Operator's systems;
  • Force majeure (§17.6);
  • Failure of named sub-processors listed at https://aggregator.gg/legal/sub-processors that propagates beyond The Aggregator's reasonable control.

B.3 Nature of targets; no SLA credits. No cash or in-kind service credit, token, payout uplift, refund, liquidated damages, or penalty accrues solely because a target in this Schedule is missed. The parties shall cooperate in good faith on incident review and a proportionate remediation plan where a target is materially or repeatedly missed. This clause does not prevent correction of an erroneous metering or RCTI entry, termination for a separate uncured material breach, or liability for fraud, wilful misconduct, gross negligence, or any matter that cannot lawfully be excluded.

B.4 Provider-RGS performance target — 99.9%. The Provider shall use commercially reasonable efforts to achieve, in each calendar month, a successful processing and schema-compliant response rate of at least 99.9% for applicable API Calls that reach the Provider RGS. This operational target is measured separately from the commercial Metered Successful API Call classification in Schedule A.

B.4.1 Exclusions from the Provider target. Failures during the following intervals do not count against the Provider target:

  • Provider-side scheduled maintenance announced via the Provider Workspace at least 72 hours in advance, ≤ 4 hours/week and ≤ 24 maintenance windows/year;
  • Provider-side emergency maintenance, announced as soon as reasonably practicable;
  • Force majeure events (§17.6);
  • Failure of third-party infrastructure beyond the Provider's reasonable control;
  • Failures caused by The Aggregator's Routing Layer (e.g. authentication failures, metering downtime, routing misdelivery), as flagged in the Schedule B SLA report;
  • Kill-Switch activation under Schedule C in respect of the affected Provider Content during the activation window.

B.4.2 Remediation of repeated target misses. Failure to meet a target does not, by itself, create a payment, refund, credit, damages, or termination entitlement. If the Provider materially misses the target for two consecutive calendar months, the parties shall agree a reasonable remediation plan. Failure to implement that plan, or continued material underperformance affecting service, may engage Section 11.5 and, if it becomes a separate material breach, Section 11.3. The Aggregator shall make relevant performance telemetry available in the Provider Workspace.

B.4.3 No double-counting. A technical failure shall be attributed to either the Routing Layer for clause B.1 or the Provider RGS for clause B.4, but not both. The metering ledger is authoritative for commercial counts only; technical attribution for a disputed incident is determined from all available evidence under Schedule C.

B.5 Support tiers.

  • Sandbox & integration — email + ticketing, business hours (Mon–Fri 09:00–19:00 UTC), first response within one (1) Working Day.
  • Production non-emergency — ticketing, business hours, first response within four (4) hours.
  • Production emergency — 24/7 on-call, severity-driven, channel published on the Provider Workspace.

B.6 Severity levels.

SeverityDefinitionFirst responseResolution target
Critical / P0Routing Layer down, metering ledger unavailable, active money-path safety event30 minutes4 hours
High / P1Significant degradation, partial outage, fraud incident2 hours8 hours
Medium / P2Non-blocking integration issue, documentation gap, performance regression8 hours5 Working Days
Low / P3Cosmetic, low-impact feature request2 Working DaysBest efforts

B.7 Required ticket information. Correlation ID(s), UTC timestamps to the minute, expected vs. observed behaviour, severity classification, reproduction steps.

B.8 Reporting. Monthly SLA report via the Provider Workspace showing availability percentage, P0/P1 incidents, scheduled maintenance, Provider-RGS performance telemetry, and remediation status for material target misses.

---

Schedule C — Fraud, Abuse, and Incident Response

C.1 Purpose and scope. This Schedule sets out the parties' obligations to monitor, prevent, detect, contain, investigate, and remediate fraud, abuse, and security incidents. It supplements §4.9, §6, §10, and §11.1. In conflict with another provision, this Schedule prevails for incident-handling procedures only.

C.2 Definitions.

  • "Incident" — any event involving (a) actual or suspected unauthorised access, modification, exfiltration, or destruction of data on any party's systems related to the Aggregator Service; (b) actual or suspected fraud, AML violation, sanctions evasion, or unlawful activity routed through the Aggregator Service; (c) actual or suspected exploitation of a Software Defect, RNG anomaly, or game-state corruption; (d) credential compromise, replay, or signature forgery affecting API Calls.
  • "Money-Path Incident" — an Incident causing or likely to cause actual or threatened loss greater than USD 100,000 in a single event or USD 500,000 in aggregate across a 30-day rolling window in Player payouts, Operator wallet balances, or other monetary outcomes downstream of the Aggregator Service.
  • "Money-Path Loss" — as defined in Section 1.
  • "Forensic Window" — the 90-day period following confirmed detection.
  • "Incident Commander" — the natural person designated under clause C.7.
  • "RCA" — root-cause analysis report under clause C.9.
  • "Kill-Switch" — mechanism to immediately halt delivery of specified Provider Content, in whole or for specified Operators or geographies.
  • "Large Win" — a single Player win on Provider Content exceeding USD 100,000 (or currency equivalent).
  • "Software Defect" — a defect or error in Provider Content that materially affects RTP, fairness, or settlement integrity.

C.2.1 Multi-source incident reconstruction; no single authoritative end-to-end record. The Aggregator operates at the API-routing and metering layer. It may transiently process wager, win, refund, balance, or result fields carried in routed API payloads, but it does not maintain the authoritative Player-wallet, GGR, settlement, RNG, or game-state ledger; calculate GGR; determine game outcomes; or control Player funds. Accordingly, no single party holds an authoritative end-to-end record of an Incident. Each party to this Agreement shall contribute its own records. The Aggregator shall use its contractual rights under the applicable Operator Service Offer or Platform Partner Service Offer to request corresponding records from the affected Operator. For Platform traffic, the Platform Partner shall obtain reasonably necessary records from its Platform Operator under their separate relationship and contribute them under the Platform Partner Service Offer. The Aggregator shall assemble the RCA from all records reasonably available. The Platform Operator does not become a fourth contractual party merely because its evidence is included.

The scope of authoritativeness is split:

  • API-Call billing disputes (the count and classification of Metered Successful API Calls) — the Aggregator's metering ledger remains authoritative as set out in Schedule A clause A.5;
  • Incident attribution, money-path, GGR, game-outcome, and Player-harm questions — the multi-source reconstruction in this clause applies, and no party's ledger is solely authoritative.

C.3 Continuous monitoring obligations of The Aggregator. The Aggregator shall, at its own expense and on a continuous basis:

  • (a) operate anomaly-detection telemetry on API-Call traffic, including abnormal request rates, geographic clustering, IP-address concentration, signature-failure rates, duplicate or replay patterns, and, only where the relevant fields are present in routed traffic, statistical anomalies in transaction or result metadata;
  • (b) maintain its API-Call metering ledger in an append-only, tamper-evident store, with periodic integrity checks;
  • (c) maintain a 24/7 security incident-response capability reachable through the published support channels;
  • (d) conduct independent penetration testing of the Aggregator Service at least annually and share executive-summary findings with the Provider on reasonable request under confidentiality;
  • (e) share known vulnerabilities and threat intelligence arising from the partner ecosystem (direct Operators, Platform Partners, and Providers) with the affected parties, to contribute to collective security improvement, save where such sharing would itself create a security risk or breach confidentiality or law;
  • (f) operate a Vulnerability Disclosure Policy and a /.well-known/security.txt endpoint, accept responsible-disclosure submissions, and acknowledge credible reports within five (5) Working Days.

C.4 Continuous monitoring obligations of the Provider. In addition to §4.9, the Provider shall:

  • (a) operate game-outcome anomaly detection including RTP-deviation monitoring, payout-distribution surveillance, RNG output statistical testing, and detection of bot/automation Players;
  • (b) operate backend integrity monitoring including signed-response verification, replay detection at the response-signing layer, and detection of unauthorised modification of game configuration, mathematical models, or RNG;
  • (c) operate sanctions screening on the Provider's own counterparties, refreshed at the cadence required by applicable law; the Provider acknowledges that The Aggregator does not perform proactive sanctions screening of API-Call traffic;
  • (d) maintain its own game-state, RNG, and settlement ledger and preserve such records for the period required by applicable certification (statutory retention prevails over the contractual twelve-month floor), and make the relevant excerpts available for multi-source incident reconstruction under clause C.2.1;
  • (e) maintain a 24/7 on-call backend response capability for Critical and High Incidents as defined in clause C.6;
  • (f) maintain information-security controls aligned with ISO 27001 / SOC 2 or an equivalent recognised framework (recommended, not a precondition);
  • (g) participate in The Aggregator-convened periodic anomaly-pattern sharing where the parties jointly review aggregate, anonymised fraud signals for common-good prevention.

C.5 Kill-Switch. The Aggregator maintains, and the Provider may operate from the Provider Workspace, a Kill-Switch capable of (a) globally pausing delivery of Provider Content, (b) selectively pausing a specific item of Provider Content, and (c) selectively pausing delivery to a specific direct Operator, Platform Partner, Operator ID, or geography. The parties shall use commercially reasonable efforts to make an authenticated Kill-Switch instruction effective within sixty (60) seconds, subject to network and dependency conditions, and shall log each invocation. The Aggregator may activate the Kill-Switch in a Section 11.1 circumstance or under Section 11.5; the Provider may do so under Section 11.2.

C.6 Detection and notification matrix. On the earlier of (i) confirmed detection or (ii) the time a reasonable security-operations function would have had grounds for suspicion, the detecting party shall raise the Incident through the published support channels and notify all materially affected parties within:

SeverityTrigger examplesNotice windowChannel
Critical / P0Money-Path Incident; confirmed Personal Data Breach affecting Operator Personal Data; confirmed credential compromise with active exploitation; Kill-Switch event1 hourEmergency phone + Telegram + email + dashboard
High / P1Suspected compromise; fraud-pattern detection; failed sanctions screen; sub-processor breach notification8 hoursTelegram + email + dashboard
Medium / P2Single-event anomaly under investigation; loss of authenticator by privileged user24 hoursEmail + dashboard
Low / P3Routine vulnerability disclosure; threat-intelligence sharing; post-incident reports5 Working DaysDashboard

Notifications are mutual, parallel, and do not depend on conclusive attribution of fault.

C.7 Support handling and containment. Following detection, the Incident is handled by each party's support/security function according to its role and the SLAs in clause C.6 and Schedule B. (a) Each party may, without breach, immediately isolate its own systems. (b) The Aggregator may, without breach, exercise the Kill-Switch unilaterally per clause C.5. (c) The Provider may request emergency suspension via the incident channel; The Aggregator shall act within sixty (60) minutes of a verified request. (d) Within four (4) hours of Critical/High notification the parties shall designate an Incident Commander; failing agreement, The Aggregator acts as Incident Commander pro tem. (e) Containment durations are excluded from Schedule B availability calculations during the Forensic Window. (f) Each party shall apply an evidence-preservation hold for not less than twelve (12) months, or such longer period as required by law or by written request of the Incident Commander.

C.8 Incident Reports. Within seventy-two (72) hours of Critical/High containment (and within five (5) Working Days for Medium), each party to this Agreement that is materially involved shall submit a written Incident Report to the Incident Commander. The Aggregator shall use its contractual rights under the applicable Operator Service Offer or Platform Partner Service Offer to request a corresponding report from an affected Operator. For Platform traffic, the Platform Partner shall obtain and include reasonably available supporting evidence from the affected Platform Operator. Each Incident Report shall contain, at minimum:

Common contents (all parties): Incident reference ID + reporting party's internal reference; reporting party, named incident contact, and 24/7-reachable channel; detection (timestamp UTC to the minute, method, detecting system); incident category and severity with justification; chronological timeline; affected scope (counterparties, games, routes, pseudonymised Player/session IDs, API-Call correlation IDs, estimated monetary exposure); the reporting party's own ledger/log excerpt; containment actions with timestamps; preliminary cause hypothesis and confidence level; evidence-preservation confirmation (location and retention-end date); regulatory-notification status; known impact on other parties; remediation actions taken and planned; open questions.

The Aggregator's additional contents: API-Call metering-ledger excerpt; Routing-Layer health; Kill-Switch invocation log; relevant sub-processor status.

The Operator-side additional contents: for a direct Operator, its Player wallet/transaction/GGR ledger excerpt, pseudonymised KYC status of affected accounts, geolocation and sanctions-screening results, bonus/promotion context, chargeback and AML flags, and estimated Player-payout exposure; for a Platform Partner, its Platform ID, affected Operator IDs, integration-layer and tenant-isolation logs, Tested Acceptance Point evidence, and the corresponding downstream evidence it can reasonably obtain under its Platform Operator agreement.

The Provider's additional contents: game-state and RNG audit excerpt; certification status of affected Provider Content; settlement ledger excerpt; backend health during the window; any Software Defect linkage; mathematical-model integrity attestation.

Omissions are weighed against the omitting party at the Sync-Up.

C.9 RCA and Sync-Up. Within thirty (30) days of containment, The Aggregator shall use commercially reasonable efforts to assemble the available Incident Reports into one written RCA covering timeline, cause, scope, contributing factors, mitigation, and recommended remediations. Within ten (10) Working Days after circulation, The Aggregator shall convene a damage-allocation Sync-Up among the parties bound to participate under their respective Service Offers. The Provider shall participate; The Aggregator shall use its rights under the applicable Operator Service Offer or Platform Partner Service Offer to procure the affected Operator's participation. For Platform traffic, the participating Operator-side party is the Platform Partner, which shall obtain downstream evidence and cooperation under its own Platform Operator relationship. Minority statements may be annexed. No Platform Operator or other non-party becomes bound to this Agreement merely by supplying evidence or participating.

C.10 Damage allocation framework. Determined at the Sync-Up on the basis of the multi-source reconstruction, not on any single party's ledger. The Aggregator's liability remains subject to Section 9.3; the Provider's and any Operator's obligations are governed by Section 10 of the respective Service Offer:

  • (a) Provider-attributable Incidents — Software Defect, RNG anomaly, certification breach, Provider-RGS compromise caused by Provider-side fault, or fraud via systems controlled by the Provider: the Provider bears the Money-Path Loss and costs to the extent caused by that matter and indemnifies The Aggregator and each Affected Operator under Section 10.1. An Affected Operator may enforce only the limited beneficiary right in Section 9.4.
  • (b) Operator-attributable Incidents — addressed under the applicable Operator Service Offer or Platform Partner Service Offer. For Platform traffic, conduct or failures within the Platform Partner integration or attributable to a Platform Operator are allocated to the Platform Partner as the Operator-side contractual party, subject to the Platform Partner Service Offer. The Provider may enforce the limited third-party-beneficiary indemnity expressly granted in that applicable offer, subject to its terms; The Aggregator does not guarantee the Operator's performance or solvency.
  • (c) Aggregator-attributable Incidents — where the RCA establishes that Money-Path Loss was directly and solely caused by a verified routing or metering fault of The Aggregator's infrastructure, The Aggregator bears that Money-Path Loss subject to the Section 9.3(a) aggregate cap, except where Section 9.3(e) applies. In every other Aggregator-related scenario, including mixed or partial cause, The Aggregator's exposure is limited to correction of affected metering entries and payment of any amount shown by the corrected ledger to be due, and the remaining loss is allocated according to proven causation. The Aggregator participates fully in the investigation, RCA, and Sync-Up under Section 9.3(c).
  • (d) External-attack Incidents, all parties compliant with C.3/C.4 — each party bears its own loss; The Aggregator's exposure remains limited under §9.3(b).
  • (e) External-attack Incidents, one party non-compliant with C.3/C.4 — that party bears the proportion of Money-Path Loss reasonably attributable to its non-compliance.
  • (f) Mixed-cause / unattributable Incidents — the Sync-Up shall attempt a good-faith allocation for thirty (30) calendar days. The Sync-Up does not create a contract between an Operator and a Provider, or between a Platform Operator and The Aggregator or the Provider. Any unresolved claim shall be brought by or against The Aggregator, or by an express limited third-party beneficiary, under the dispute-resolution clause of the agreement that grants the relevant right.

C.11 Money-Path-specific procedures (Large Win, Software Defect).

  • Large Win. The Provider undertakes to notify The Aggregator within twelve (12) hours of becoming aware of any Large Win, by opening a P0 ticket per Schedule B. The Aggregator shall, within forty-eight (48) hours, complete its own investigation and provide signed metering-ledger evidence. The Aggregator shall not be liable for the Large Win save where the multi-source RCA establishes it was directly and solely caused by a verified malfunction of The Aggregator's own routing or metering layer (see §9.3(b)).
  • Software Defect. The Provider shall notify The Aggregator within twelve (12) hours of becoming aware of any Software Defect, ship a fix or activate the Kill-Switch with reasonable urgency, and authorise The Aggregator to halt delivery of the affected Provider Content pending the fix.
  • Player payouts subject to investigation. The person that actually controls the Player wallet and Player relationship determines whether it may suspend a Player payout under applicable law, applicable licence conditions, and end-user terms. Neither The Aggregator nor the Provider has authority under this Agreement to suspend or release Player funds.
  • IP infringement takedown. On receipt of a credible third-party IP infringement notice in respect of Provider Content, The Aggregator may suspend delivery on not less than two (2) Working Days' prior notice — or immediately where the notice is accompanied by a court order or carries imminent regulatory risk. The Provider shall respond within ten (10) Working Days.

C.12 Sanctions and AML escalation. The Aggregator is an API-routing infrastructure provider and does not operate proactive sanctions or AML screening of all API-Call traffic and is not the ecosystem sanctions or AML gatekeeper. Sanctions and AML compliance on the underlying gaming activity is the Provider's responsibility under Section 4.4 and clause C.4 of this Offer and the applicable Operator's responsibility under the Operator Service Offer or Platform Partner Service Offer. For Platform traffic, the allocation between a Platform Partner and its Platform Operator depends on their actual functions and separate agreement, without reducing the Platform Partner's obligations to The Aggregator.

Where The Aggregator becomes aware — through a binding legal order, sanctions designation, competent-authority instruction, or its own anomaly telemetry — that specific API-Call traffic is associated with a sanctioned party, a Restricted Jurisdiction, or unlawful activity, The Aggregator may block or suspend the affected traffic; such blocked calls are Failed under Schedule A clause A.4 (symmetric refund).

C.13 Regulatory notification. Each party is solely responsible for identifying and making the regulatory, supervisory, data-protection, financial-intelligence, sanctions, and law-enforcement notifications that apply to it under the laws of the jurisdictions in which it operates and under the licences and authorisations it holds. No party is responsible for, or warrants the sufficiency of, another party's regulatory analysis or filings. The parties shall cooperate in good faith to provide one another with the factual information reasonably necessary for each to meet its own notification obligations within the applicable statutory windows (including the 72-hour personal-data-breach window under GDPR Article 33). No party shall make a public statement about an Incident that identifies another party without that party's prior written consent (not to be unreasonably withheld), except where disclosure is required by law, court order, or a competent authority.

C.14 Records retention and continuous improvement.

  • (a) Each party shall retain Incident-related records — including its own ledger segment, Kill-Switch logs, anomaly-detection alerts, Incident Reports, and the RCA — for not less than twelve (12) months from Incident closure.
  • (b) Each party shall apply a per-Incident evidence-preservation hold for not less than twelve (12) months, or longer if required by law or by written request of the Incident Commander.
  • (c) Statutory retention prevails. Where a record type carries an independent statutory or licence-condition retention obligation on a party (for example, AML/KYC and transaction records a direct Operator, Platform Partner to the extent applicable to its actual functions, or Provider must retain under AMLD5/AMLD6 or gaming-licence conditions, which commonly require five (5) years or more), that statutory period prevails over the contractual twelve-month floor.
  • (d) The Aggregator is not required to retain the full per-call metering ledger beyond the twelve-month floor; low-volume aggregated billing summaries may be retained longer for tax and audit purposes.
  • (e) Each material RCA shall produce a remediation plan with measurable milestones, owners, and target dates. The Aggregator shall publish an aggregated quarterly Incident report (anonymised) covering Incident frequency by category, mean-time-to-detect, mean-time-to-contain, and remediation status.

---

Schedule D — Inline DPA (Provider Side)

To the extent the Provider processes Operator Personal Data routed to the Provider RGS, the Provider acts as The Aggregator's sub-processor or further sub-processor under GDPR Article 28(4). For direct Operator traffic, the intended chain is direct Operator as controller, The Aggregator as processor, and Provider as sub-processor. For Platform traffic, the intended chain is Platform Operator as controller, Platform Partner as processor, The Aggregator as sub-processor, and Provider as further sub-processor. These descriptions depend on the functions actually performed and do not override applicable law.

  • Processing chain, authority, and instructions. For direct Operator traffic, the Operator Service Offer, the direct Operator's selection of the Provider, this Agreement, the API specification, and lawful written instructions transmitted by The Aggregator constitute the Provider's documented instructions. For Platform traffic, the Platform Partner warrants under the Platform Partner Service Offer that it has the controller's instructions and authority necessary to appoint The Aggregator and permit appointment of the Provider; that offer, the Platform Partner's selection of the Provider, this Agreement, the API specification, and lawful written instructions transmitted by The Aggregator constitute the Provider's documented instructions. The Provider shall not accept a conflicting instruction directly from a direct Operator, Platform Partner, or Platform Operator; it shall refer the instruction to The Aggregator.
  • Subject matter and duration. Receipt, use, storage to the extent technically necessary, and return of technical Game Session and transaction data through the Provider RGS for the term of this Agreement and any limited lawful retention period.
  • Nature and purpose. Authentication, execution of Provider Content and Game Rounds, maintenance of authoritative game state, generation of transaction and result communications, security, support, incident response, and legally required certification records. No unrelated marketing or sale of Operator Personal Data.
  • Types of personal data. Pseudonymised Player, session, Round, and transaction identifiers; Platform ID and Operator ID where applicable; IP address and device or security metadata if included; wager, win, refund, balance, currency, jurisdiction, and result fields required by the Provider API; and related timestamps and correlation identifiers. The Provider shall not require Player names, personal email addresses, or payment-instrument credentials unless separately approved in writing through the applicable contractual chain and supported by a lawful basis.
  • Categories of data subjects. Players and authorised test users of Operators, to the extent their data is included in API Calls.
  • Provider obligations as sub-processor or further sub-processor. The Provider shall: (a) process Operator Personal Data only on documented instructions and promptly inform The Aggregator if an instruction appears unlawful, unless prohibited by law; (b) ensure authorised persons are bound by confidentiality; (c) implement appropriate Article 32 technical and organisational measures; (d) assist The Aggregator with data-subject requests, Personal Data Breach response, DPIAs, prior consultation, and evidence of compliance; (e) not appoint or replace another processor unless it gives The Aggregator at least thirty (30) calendar days' prior notice identifying the entity, countries, processing, safeguards, and transfer mechanism, The Aggregator confirms that the appointment is within the authorisation conveyed through the applicable direct Operator or Platform Partner chain, and the applicable objection period expires without unresolved objection; (f) impose the same data-protection obligations required by Article 28(4) on each authorised onward processor and remain responsible for its performance; (g) on The Aggregator's instruction reflecting the choice conveyed through the applicable chain, delete or return Operator Personal Data within thirty (30) calendar days after the Provider is disabled or deselected for that Operator or Operator ID, the relevant processing service ends, or this Agreement terminates, including from active copies and, at the end of the ordinary backup cycle, backups, and certify deletion on request; if a law binding on the Provider requires specified retention, the Provider shall identify that law, isolate the retained data, and not otherwise process it; and (h) make available information reasonably necessary to demonstrate Article 28 compliance.
  • Personal data breach. "Personal Data Breach" has the meaning in GDPR Article 4(12). The Provider shall notify The Aggregator without undue delay and, in any event, within twenty-four (24) hours after becoming aware of a Personal Data Breach affecting Operator Personal Data, and shall provide information and cooperation reasonably required for The Aggregator to notify the direct Operator or Platform Partner through the applicable contractual chain and meet any statutory deadline. If Schedule C requires a shorter notice for the same event, the shorter deadline prevails.
  • Independent-controller processing. Nothing in this Schedule authorises the Provider to repurpose routed data. The Provider may process it for a distinct purpose as independent controller only where a law binding on the Provider requires that processing or a separate documented instruction is lawfully conveyed through the applicable contractual chain and applicable law permits it. The Provider shall identify the purpose, legal basis, privacy information, data, recipients, and retention separately from its sub-processor activities.
  • International transfers. The Provider shall not transfer Operator Personal Data outside the location disclosed in the Provider Workspace without prior notice and a lawful GDPR Chapter V mechanism. Where no adequacy decision or other lawful mechanism applies, the relevant modules of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference, supplemented by the parties' transfer details and required supplementary measures.
  • Audit rights. The Aggregator may audit compliance once per calendar year on thirty (30) calendar days' notice, at its or the requesting Operator's expense, unless a Personal Data Breach or reasonable evidence of material non-compliance justifies an additional audit. At a direct Operator's or Platform Partner's documented request, The Aggregator shall exercise this right on that party's behalf and may permit it or its independent auditor to participate as The Aggregator's representative under confidentiality. A Platform Operator may act only through its Platform Partner and receives no direct audit or third-party right under this Agreement. Audits shall protect other customers' confidentiality and Provider-RGS security.

---

End of Provider Service Offer (v3 — effective 23 July 2026).

This document is available in English only. The English version is the legally binding version.