CARD PROGRAM SERVICES. Terms and Conditions (Merchant Agreement)

Transcription

1 CARD PROGRAM SERVICES Terms and Conditions (Merchant Agreement) 1

2 Introduction This Card Program Services Terms and Conditions (the Merchant Agreement ) is for the provision of the Services to the Merchant offered by Processor, and is entered into among Merchant, Processor and Bank. The appendices, addenda, schedules, and exhibits that accompany or are incorporated by reference into this Merchant Agreement, as amended from time to time as provided herein, are part of the terms and conditions of this Merchant Agreement, as are the Application and the Operating Rules. All capitalized terms used in this Merchant Agreement are defined terms and the definitions of such terms appear in Section 28 to this Merchant Agreement. By completing and signing the Application, Merchant applies for the Services provided by Processor and covered by the Application and this Merchant Agreement (collectively, the Agreement ) and agrees to comply with all terms and conditions contained in the Merchant Agreement, the Operating Rules and such other procedures and rules as Processor or Bank may from time to time prescribe for the creation or transmission of Transaction Data. In its sole and absolute discretion, Processor or Bank may accept or reject Merchant's Application. IMPORTANT INFORMATION ABOUT BANK S RESPONSIBILITIES: Notwithstanding anything in the Agreement, Merchant understands and agrees (A) that Bank does not sponsor Processor into the Discover or American Express or Diner's Club or JCB or CUP Network, is not providing or agreeing to provide Merchant any services hereunder with respect to Discover or American Express or Diner's Club or JCB or CUP Network Card transactions, does not determine or approve or agree upon any fees, charges, pricing, or any other terms and conditions, relating to Discover or American Express or Diner's Club or JCB or CUP Network Card transactions, and has no responsibility or liability to Merchant for Discover or American Express or Diner's Club or JCB or CUP Network Card transactions; and (B) that Bank does not provide or agree to provide Merchant any services hereunder or have any responsibility or liability to Merchant with respect to any PIN-based debit or stored value or electronic benefit transfer transactions (except only to the extent, if any, required under Visa's or MasterCard's Operating Rules or under any mandatory provisions of applicable law), or any other Card type transactions (other than Visa and MasterCard credit and non-pin based debit/stored value Card transactions), or any other services specified in the Application as covered in whole or in part by this Agreement but as not being provided by Bank; and (C) that to the extent applicable to Discover or American Express or Diner's Club or JCB or CUP Network Cards or transactions, or to any of the other types of Cards, transactions or services referred to above or in the Application as not being provided by Bank, any reference herein or in any of the other documents constituting part of the Agreement to the term "Bank" (except only to the extent the reference constitutes a complete disclaimer of responsibility or liability on the part of Bank, or constitutes an obligation on the part of Merchant to indemnify, defend or hold harmless Bank from or against any responsibility or liability) means Processor only. 2

3 Table of Contents PART I: CARD PROGRAM SERVICES Georgia; Jurisdiction; Venue.. 11 A. CARD PROGRAM SERVICE PROCEDURES Attorney Fees Merchant s General Duties Arbitration Procedures for Transactions Continuing Guaranty Settlement Taxes Chargebacks Assignment Stored Value Card Transactions Entire Agreement Data Security Counterparts and Electronic Signature.. 11 B. GENERAL TERMS Merchant Taxpayer Certification and Processor s Reporting Obligations Services Definitions Operating Rules 7 9. Merchant s Representations and Warranties. 7 PART II: ADDENDA Processing Fees Information About Merchant and its Business... 8 CARD NOT PRESENT (CNP) ADDENDUM Confidentiality... 8 SPECIAL SERVICES ADDENDUM Term; Termination 9 MERCHANT RESTRICTIONS ADDENDUM Reserve Account... 9 DISCOVER CARD ACCEPTANCE ADDENDUM Security Interest. 10 VISA ACCOUNT UPDATER ADDENDUM Indemnification; Limitation of Liability; Warranty.. 10 MASTERCARD ACCOUNT BILLING UPDATER ADDENDUM Amendments; Waivers. 10 AMERICAN EXPRESS CARD ACCEPTANCE ADDENDUM Notices. 11 3

4 Part I: Card Program Services A. Card Program Service Procedures 1. Merchant s General Duties 1.1 Merchant is responsible for any advice from, acts of and omissions of Merchant's employees, consultants, advisors, contractors, agents, officers and directors. Merchant is responsible for the use, unauthorized use or misuse of Merchant's equipment or software. 1.2 Merchant shall examine each Card physically presented at the point of sale to determine that the Card presented is valid and has not expired. Merchant shall exercise reasonable diligence to determine that the authorized signature on any Card physically presented corresponds to the Cardholder s signature on the Charge Record. 1.3 With respect to any Transaction for which a Cardholder is not physically present at the point of sale, such as in any online, mail, telephone or recurring Transaction, Merchant must have notified Processor on the Application or otherwise obtained Processor's prior written approval of Merchant's intention to conduct such Transactions, have procedures in place to ensure that such Transaction is made to a purchaser who actually is the Cardholder and shall at all times comply with the terms of the CNP Addendum and the Operating Rules Merchant agrees to accept all categories of Visa and MasterCard Cards unless Merchant has notified Processor on the Application or otherwise in writing of its election to limit its acceptance of Cards. All such limitations must comply with the Operating Rules in all instances. 1.5 Merchant consents to receiving Documents electronically rather than in paper form. Processor will notify Merchant that a Document is available at Processor's web site with a link to that specific page of the web site containing the Document. Merchant agrees that such notification will be sent to Merchant at the address provided as part of the Application. Merchant understands and acknowledges that access to the Internet, e- mail and the worldwide web are required for Merchant to access a Document electronically and Merchant confirms that Merchant has such access. Merchant understands that there are costs related to access Documents electronically and Merchant agrees that Merchant is responsible for these related access costs. At any time and without giving Merchant advance notice, Bank and/or Processor may elect not to send a Document electronically, in which case a paper copy of the Document will be sent to Merchant or such Document shall otherwise be provided as provided for herein. 2. Procedures for Transactions 2.1 Merchant agrees to properly obtain an authorization code for the total amount of the Transaction and shall record the authorization code on the Charge Record prior to completing the Transaction. If a Merchant completes a Transaction without an authorization code, Merchant will be responsible for any Chargeback of the Transaction and this Agreement shall be subject to immediate termination without notice. Obtaining an authorization code does not assure that the person using the Card is the Cardholder and will not prevent a Chargeback to Merchant. Processor reserves the right to refuse to process any Transaction presented by Merchant unless it includes a proper authorization. 2.2 Merchant agrees to maintain a written refund policy and to disclose such policy to Processor and all customers. Merchant will submit any changes to its refund policy to Processor in writing at least 30 days before the change and will not implement any change to which Processor reasonably objects. Merchant's policies will not override the Operating Rules and will not prevent Chargebacks to Merchant under those Operating Rules. To the extent that Merchant operates a website through which Transactions are generated, Merchant must include its refund policy on the website in accordance with the Operating Rules. Merchant will not make a refund or adjustment in cash (except when required or permitted by law or the Operating Rules), and will deliver to Processor Charge Record reflecting such refund or adjustment within 3 days of the refund or adjustment. The amount of the refund must not exceed the amount of the original Transaction except for any amount which Merchant agrees to reimburse the Cardholder for return postage. Merchant shall not accept any payment from a Cardholder as consideration for issuing a refund. 2.3 Except as otherwise permitted by the Operating Rules and as approved by Processor in advance, Merchant will not submit a Transaction for processing by Processor until Merchant has delivered or shipped the goods and/or performed all its services. 2.4 Merchant will not submit: (i) any Transaction previously submitted to Processor, (ii) any Transaction that Merchant knows or should have known to be fraudulent or not authorized by the Cardholder, (iii) any Transaction that results from a transaction outside of Merchant's normal course of business, as described on the Application, or (iv) any Transaction that results from a transaction not involving Merchant or not originated as the result of an act between Merchant and a Cardholder. 2.5 Merchant acknowledges that all payments and credits provided to Merchant are provisional and subject to suspension, Chargebacks and adjustments in accordance with this Agreement and the Operating Rules. 2.6 Merchant shall display Card Network marks, advertising and promotional materials in compliance with the Operating Rules and as expressly authorized in writing by Processor. Additionally, Merchant shall not use the Card Network marks other than to display decals, signage, advertising and other forms depicting the Card Network marks that are provided to Merchant by Processor. Merchant shall not use Card Network marks in such a way that Cardholders could believe that the products or services offered by Merchant are sponsored or guaranteed by the Card Networks. Merchant recognizes that it has no ownership rights in the Card Network marks and agrees not to assign to any third party any of the rights to use the Card Network marks. 3. Settlement 3.1 Failure to transmit Transactions to Processor within one business day following the day that such Transaction originated could result in higher interchange fees and other costs, as well as increased Chargebacks. Unless otherwise approved by Processor, Merchant shall not submit Transactions for processing until (i) the Transaction is completed; (ii) the goods are delivered or shipped; (iii) the services are performed; or (iv) Merchant has obtained the Cardholder's consent for a recurring Transaction. Processor reserves the right to refuse to process any Transaction presented by Merchant if Processor reasonably believes that the Transaction may be uncollectible from the Cardholder or was prepared in violation of any provision of this Merchant Agreement, applicable law, or the Operating Rules. 3.2 For Conveyed Transactions, Merchant shall have a valid agreement in effect with the applicable Card Network. If Merchant submits Conveyed Transactions to Processor and Merchant does not have a valid agreement with the applicable Card Network, Processor may, but shall not be obligated to, submit such Transaction to the applicable Card Network and to share with them information about Merchant (from the Application or otherwise) as may be required to approve Merchant's acceptance of the Card Network's Card. Payment of proceeds due Merchant for Conveyed Transactions shall be governed by the agreement Merchant has with the applicable Card Network, and neither Processor nor Bank bear any responsibility for their performance thereunder, including, without limitation, the funding and settlement of Merchant's Conveyed Transactions. 3.3 Except for Conveyed Transactions, Processor will submit Merchant's Transactions to the applicable Card Network. Promptly after Bank receives funds for settled Transactions from the Card Networks, Bank will provisionally fund the Settlement Account. The proceeds payable to Merchant shall be equal to the amounts submitted by Merchant in connection with its Transactions minus the sum of the following: (i) all Processing Fees, fees, charges, and other amounts described in this Agreement or that Merchant has otherwise agreed to pay; (ii) all refunds and Chargebacks; (iii) all Reserve Account amounts; (iv) all fees, charges, 4

5 fines, assessments, penalties, or other liabilities that may be imposed on Processor or Bank from time to time by the Card Networks and all related costs and expenses incurred by Processor or Bank. All Reserve Account funds and other funds held by Processor and Bank related to the settlement of Merchant's Transactions shall be owned by Processor and Bank. In the event Processor or Bank does not deduct such amounts from Merchant's proceeds when such amounts are due and payable, Merchant agrees to pay all such amounts to Processor and/or Bank immediately without any deduction or offset. Additionally, Processor and/or Bank may debit the Settlement Account or Merchant's Reserve Account for such amounts at any time. Merchant shall maintain sufficient funds in the Settlement Account to prevent the occurrence of a negative balance. 3.4 In the event that the proceeds from Merchant's settled Transactions or the balance of Merchant's Settlement Account are not sufficient to pay amounts due under this Merchant Agreement, in addition to any other rights and remedies Processor or Bank may have under this Merchant Agreement, Processor and Bank may pursue one or more of the following options: (i) demand and receive immediate payment for such amounts; (ii) debit the Settlement Account for the amount of the negative balance; (iii) apply funds held in the Reserve Account against the negative amount; and (iv) withhold all or some of Merchant's settlement funds and apply them against the negative amount. Furthermore, if the amount represented by Merchant's Transactions in any day is negative due to refunds or credits being submitted by Merchant in excess of its proceeds from Transactions, Merchant shall immediately provide Processor or Bank, as the case may be, with sufficient funds to prevent the occurrence of a negative balance. 3.5 Merchant must maintain a Settlement Account in Merchant's name in satisfactory condition at a depository institution under arrangements acceptable to Processor and Bank. Merchant agrees that Processor or Bank may charge the Settlement Account for the amount of any Transaction processed under this Agreement or for any return, refund, adjustment, Chargeback, fine, penalty, charge, Processing Fee or fee set forth in this Agreement or any other amounts to which Processor or Bank may be entitled. Merchant may change or close the Settlement Account only upon prior written approval by Processor. Merchant is solely liable for all fees, costs, and overdrafts associated with the Settlement Account. 3.6 Processor will supply a statement reflecting Merchant's processing activity by online access (or otherwise if agreed to by both parties) and Merchant shall ensure that any online access to such statements is secure. Processor shall presume that any amounts Processor or Bank pays to or debits from Merchant are correct unless Merchant disputes these by sending Processor written notice within 30 days of the date of the applicable statement containing any disputed payments or debits. 3.7 If Merchant chooses to purchase, rent or lease processing equipment from Processor or utilizes software provided by Processor for use in processing Transactions, Merchant agrees to pay Processor the purchase, rental or lease amounts, any initial upfront costs as required, and all applicable taxes for such processing equipment or software utilization. Processor makes no representations or warranties of any kind or nature, directly or indirectly, expressed or implied, as to any matter whatsoever concerning any software, equipment, or services provided or procured by Processor, and such software, equipment, and services are provided AS-IS to Merchant. Processor also disclaims any warranty of merchantability or fitness for use or purpose whether arising by operation or law or otherwise. Processor will, at Merchant's expense, use reasonable commercial efforts to assist Merchant in enforcing any warranty offered by the third party supplier of such software, equipment or services. 3.8 Merchant authorizes Processor and Bank (or their agents or designated representatives) to initiate debit and credit entries to the Settlement Account through the ACH settlement process for amounts due under this Agreement. This authorization will remain in full force and effect until termination of the Agreement and the full and final payment of all obligations of Merchant due under this Merchant Agreement. Merchant acknowledges and agrees that Processor and Bank will not be liable for any delays in receipt of funds, any failure by Merchant to receive funds, or errors in debit or credit entries caused by Merchant, or third parties, including but not limited to any Card Network or any financial institution. 4. Chargebacks 4.1 Merchant has full liability and responsibility for all Chargebacks. Some of the most common reasons for a Chargeback are (i) the Charge Record was prepared incorrectly or fraudulently (ii) Merchant did not obtain proper authorization, or did not provide a correct and legible authorization code on the Charge Record, (iii) the Cardholder disputes participating in or approving the Transaction, (iv) the Cardholder alleges that return of goods was improperly refused or that a refund was not processed for the Cardholder, (v) the Cardholder has asserted what the Cardholder believes is a good faith claim or defense against the Transaction, or (vi) the Card was not actually presented at the time of the Transaction and the Cardholder denies making the purchase. 4.2 If Merchant has a reason to dispute or respond to a Chargeback, then Merchant must do so by the date provided on the applicable Chargeback Notice. Processor will not investigate or attempt to obtain a reversal or other adjustment to any Chargeback if Merchant has not timely responded to the notice. 4.3 If Processor or Bank determines that Merchant is receiving excessive Chargebacks (as determined by reference to applicable Operating Rules and/or Bank policy, which may be modified from time to time), Processor or Bank may, but are not obligated to, (i) notify Merchant of new procedures it should adopt, (ii) increase or add additional Processing Fees imposed for processing Chargebacks, (iii) establish or increase the amount held in any Reserve Account, and/or (iv) terminate this Merchant Agreement, at Processor's or Bank's' discretion, without advance notice. Merchant must immediately pay any fines or fees imposed by a Card Network or Processor or Bank relating to Chargebacks to Merchant. 4.4 Each Chargeback to Merchant is immediately due and payable by Merchant. Without limiting Processor's or Bank's other remedies or Processor's or Bank's security interest described in this Merchant Agreement, Processor or Bank may deduct, debit and withhold the amount of a Chargeback or anticipated Chargeback from the Settlement Account, Reserve Account, or any Merchant account at Bank. 4.5 In order to comply with Retrieval Requests, Merchant shall store and retain Charge Record in compliance with the Operating Rules, including any time frames set forth therein. Within 7 days (or such shorter time as the Operating Rules may require) of Processor sending Merchant a Retrieval Request, Merchant must provide to Processor (i) written resolution of Merchant's investigation of such Retrieval Request, and (ii) legible copies of any supporting documentation requested or required by the Retrieval Request. Merchant acknowledges that failure to fulfill a Retrieval Request timely and in accordance with the Operating Rules may result in an irreversible Chargeback. 4.6 To the extent that Processor or Bank has provisionally paid or may pay a Chargeback or return, Merchant will be obligated to reimburse Processor and Bank for any sums Processor or Bank pay. If Merchant does not reimburse Processor or Bank, Processor and Bank will have all of the rights and remedies of Cardholders under law and may assert any claim on behalf of a Cardholder individually or on behalf of all Cardholders as a class. 5. Stored Value Card Transactions As to all Stored Value Card Transactions, if any, in addition to any representations and warranties previously made, Merchant agrees to: (i) comply with all applicable laws relating to Stored Value Card Transactions, and indemnify and hold Processor and Bank harmless from any loss, damage, or claim relating to or arising out of any failure to comply with applicable laws in connection therewith; (ii) be responsible for ensuring that all Stored Value Cards require activation at the point of sale; (iii) provide immediate written notification to Processor of any Stored Value Card fraud losses immediately; (iv) be solely responsible for any and all value adding and fraud losses and expenses relating to or arising from Merchant's Stored Value Card Transactions; (v) discourage transportation of groups of sequentially numbered gift cards; (vi) deactivate or otherwise remove all value from Stored Value Cards that have been compromised; and (vii) be responsible for any fraudulent transactions involving Merchant's Stored Value Cards, including, without limitation, the unauthorized activation of Stored Value Cards, reloading of existing Stored Value Cards (whether pursuant to a manual telephone order or otherwise) with additional value, 5

6 or the unauthorized replication of Stored Value Cards or Stored Value Card data for fraudulent Transactions. 6. Data Security 6.1 Merchant will retain in a secure and confidential manner original, complete and legible copies of each Charge Record for at least 2 years or longer if required by law or the Operating Rules. Merchant shall render all materials containing Card Information unreadable prior to discarding. Merchant will store Charge Records in an area limited to selected personnel, and when record-retention requirements have been met, Merchant will destroy the Charge Records so that Transaction data is rendered unreadable. 6.2 Merchant agrees to comply with the Security Standards. Merchant acknowledges and understands that its use of any fraud mitigation or security enhancement solution (e.g. an encryption product or service), whether provided to Merchant by Processor or a third party, in no way limits Merchant's obligation to comply with the Security Standards or Merchant's liabilities set forth in this Merchant Agreement. Merchant will have in place and comply with at all times during the Term of this Agreement a comprehensive written information security program that is designed to ensure the security, confidentiality and integrity of Transaction and Cardholder information, and includes a procedure (i) for periodic review to identify new and emerging threats and vulnerabilities and (ii) to take appropriate measures to remediate and remove such threats and vulnerabilities, all in accordance with the Security Standards. Without limiting the generality of the foregoing, Merchant understands that the payment card industry has required all merchants to be PCI DSS compliant. Processor and Bank, in compliance with Card Network mandates, will not board merchants for the Card Program Services provided for in this Agreement that are not PCI DSS compliant. Merchant and Merchant's principals hereby covenant that they are, and will continue for the duration of the Term to be, PCI DSS compliant. Processor and Bank also require compliance with the PA-DSS requirements in accordance with industry mandates, and with all applicable Card Network mandates relating to PIN and PIN entry device (PED) security, including without limitation, and as applicable, the applicable Payment Card Industry PCI PIN Security Requirements, PCI PIN-Entry Device Security Requirements, and PCI Encrypting PIN Pad Security Requirements. Merchant covenants that all point-of-sale (POS) and/or terminal hardware and software (make and version) that Merchant will use to submit Transactions during the Term is PA-DSS compliant, and compliant with all applicable PIN and PED security requirements, and that any future changes in Merchant s POS hardware or software will be in compliance with the PA-DSS and all applicable PIN and PED security requirements. 6.3 If at any time Merchant determines or suspects that Card Information has been compromised Merchant must notify Processor immediately and assist in providing notification to such parties as may be required by law or the Operating Rules, or as Processor or Bank otherwise reasonably deem necessary. Merchant information may be shared by Processor or Bank with its affiliates and with the Card Networks subject to the provisions of this Agreement and the Operating Rules. 6.4 Without limitation as to Merchant's obligations or liabilities under other provisions hereof, (i) Merchant hereby agrees to indemnify Processor and Bank, including their officers, directors, employees, and agents, and to hold them harmless from any fines and penalties that may be assessed by the Card Networks or any governmental agency in regards to PCI-DSS or PA-DSS or otherwise in regards to any actual or suspected Data Compromise Event that may occur, as well as all costs of forensic exam/audit, card replacement fees, all claims and demands of Cardholders, Card Issuers, Card Networks, governmental agencies, or other third parties, and all litigation costs and expenses including reasonable attorney's fees, and all other costs of any kind, associated with any actual or suspected Data Compromise Event or noncompliance with the Security Standards or data security requirements of applicable law; and (ii) in the event of a computer or other Data Compromise Event, or suspected computer or other Data Compromise Event, Merchant agrees to abide by Card Network requirements which may include without limitation a forensic network exam by a Qualified Incident Response Assessor (QIRA), and (iii) Merchant agrees to cooperate with Processor and Bank in order to effectively manage breach response. 6.5 Merchant agrees to provide Processor and Bank, within two (2) days upon its request, with such tests, scans, and assessments of Merchant's compliance with Security Standards as may from time to time be required by the Card Networks. Merchant also acknowledges that it may be subject to ongoing validation of compliance with Security Standards. 6.6 Merchant must notify Processor and receive Processor s prior approval of its use of any Service Provider and, to the extent required by each Card Network, all Service Providers must be (i) compliant with all Security Standards applicable to Service Providers; and (ii) registered with and/or recognized by such Card Network(s) as being so compliant. Merchant agrees to exercise due diligence to ensure that all Service Providers, and any other agents, business partners, contractors, or subcontractors with access to Card Information, maintain compliance with the Security Standards. To the extent required by each Card Network, all Payment Applications or software utilized by Merchant in processing, storing, receiving, or transmitting of Card Information, shall be (a) compliant with all Security Standards applicable to such Payment Applications or software; and (b) registered with and/or recognized by such Card Network(s) as being so compliant. Merchant will be bound to the acts and omissions of its Service Providers and will be responsible for the compliance of such Service Providers with all applicable laws, regulations, Security Standards and Operating Rules. Neither Processor nor Bank shall in any event be liable to Merchant or any third party for any actions or inactions of any Service Provider used by Merchant, and Merchant hereby expressly assumes all such liability. 6.7 Merchant understands that failure to comply with the Operating Rules, including the Security Standards, or the compromise of any Card Information, may result in assessments, fines, and/or penalties by the Card Networks, and Merchant agrees to indemnify and reimburse Processor and Bank immediately for any such assessment, fine, or penalty imposed on Processor or Bank and any related loss, cost, or expense incurred by Processor or Bank. If any Card Network requires a forensic examination of Merchant or any of Merchant's Service Providers, agents, business partners, contractors, or subcontractors due to a Data Compromise Event or suspected event, Merchant agrees to cooperate with such forensic examination until it is completed, including, without limitation, the engagement of an examiner acceptable to the relevant Card Network. Notwithstanding the foregoing, the Card Networks may directly, or demand that Processor or Bank, engage an examiner on behalf of the Merchant in order to expedite the investigation of the Data Compromise Event or suspected event. In either scenario, Merchant agrees to pay for all costs and expenses related to such forensic examination, including all of Processor's or Bank's reasonable attorneys' fees and other costs relating to such forensic examination. 6.8 To the extent that Merchant operates an electronic commerce website through which Charge Record is generated, in addition to any requirements otherwise set forth in this Merchant Agreement, Merchant shall display the following on its website: (i) its Cardholder data privacy policy, (ii) a description of its security capabilities and policy for transmission of Card information, and (iii) the address of Merchant s fixed place of business. Furthermore, Merchant must offer its Cardholders a data protection method such as 3-D Secure or Secure Sockets Layer (SSL). 6.9 If Merchant receives any password from Processor to access any of Processor s systems or otherwise utilize any of Processor s services, Merchant shall (i) keep the password confidential; (ii) not allow any other entity or person to use the password; (iii) be liable for all action taken by any user of the password; and (iv) promptly notify Processor if Merchant believes that any of Processor s systems have been accessed or compromised by the use of the password by anyone other than the Merchant Merchant has and will maintain a comprehensive privacy program that is reasonably designed to address privacy risks related to Merchant and Merchant customer information, including personally identifiable information ( PII ), and to protect the privacy of PII. This program includes and will include appropriate privacy controls and procedures, including but not limited to: the designation of an employee or employees to coordinate and be responsible for the privacy program; 6

7 the identification of reasonably foreseeable, material risks, both internal and external, that could result in Merchant s unauthorized collection, use, or disclosure of PII, and an assessment of the sufficiency of any safeguards in place to control these risks. At a minimum, this privacy risk assessment should include consideration of risks in each area of relevant operation, including, but not limited to employee training and management; the design and implementation of reasonable privacy controls and procedures to address the risks identified through the privacy risk assessment, and regular testing or monitoring of the effectiveness of those privacy controls and procedures; and the evaluation and adjustment of Merchant s privacy program in light of any circumstances that Merchant knows or has reason to know may have a material impact on the effectiveness of its privacy program Processor acknowledges that it is responsible for the security of Card Information that it transmits on behalf of Merchant in connection with the Services while such Card Information is in Processor s possession. B. General Terms 7. Services Subject to the Operating Rules, the Services may be performed by Processor, its affiliates, its agents or other third parties that Processor may designate from time to time in connection with this Agreement. During the term of this Merchant Agreement, Processor will be Merchant's exclusive provider of all Services and Merchant will not use the services of any other entity other than Processor for the Services. Merchant agrees to submit all Transactions to Processor via electronic data transmissions in accordance with Processor's formats and procedures. Merchant will comply with all laws, rules and regulations, including but not limited to laws and regulations regarding anti-money laundering compliance, and Office of Foreign Asset Control compliance, in completing Transactions, submitting them to Provider, performing its obligations under this Agreement, and otherwise conducting its business. 8. Operating Rules 8.1 Merchant must comply with the Operating Rules, as amended from time to time. The Operating Rules may change with little or no advance notice to Merchant and Merchant will be bound by all such changes. If Merchant objects to any change in the Operating Rules, it must immediately stop accepting Cards governed by the change. The Operating Rules will govern in the event that there is any inconsistency between this Agreement and the Operating Rules. However, nothing in this Agreement shall be construed to impose on Merchant a requirement (including a requirement under the Operating Rules) the imposition of which on Merchant is prohibited by mandatory provisions of applicable law (i.e., where the applicability of such provisions of law to this Agreement, and of the law's prohibition to the particular requirement which otherwise would be imposed on Merchant hereunder, cannot lawfully be waived by agreement), but the requirement hereunder shall be construed to continue in effect and to be imposed on Merchant in all respects and at all times to the fullest extent possible without violating the law's prohibition, with only those particular applications of the requirement which would violate the law's prohibition deemed severed from the provisions hereof. 8.2 Operating Rules of the Debit Networks may differ among them with respect to the Card Transactions they allow. Processor or Bank, at their discretion, may require that the most restrictive requirements of one Debit Network apply to all of Merchant's On-line Debit Card Transactions, regardless of Card type. 8.3 If Merchant selects, and Processor provides Services for, any one or more of Discover Network, JCB Card or Diners Club as payment options and Merchant's selection is approved by Processor, Merchant understands that (i) Merchant's acceptance of any of those payment options may require execution of a separate merchant card acceptance agreement with those individual Card Networks, as applicable, and that agreement will govern the completion, processing, transactions, and (ii) Merchant will be obligated to contact the appropriate service provider(s) for service. 9. Merchant s Representations and Warranties Upon signing the Application, and each time Merchant submits a Transaction, Merchant represents and warrants that: 9.1 Merchant has abided by this Agreement and all applicable Operating Rules with regard to the Transaction; 9.2 Each statement made on the Application was true as of the date Merchant signed the Application agreeing to be bound by this Merchant Agreement; 9.3 There have been no materially adverse changes in information provided in the Application or in Merchant's financial condition, or management; 9.4 Merchant does not do business under a trade name or style not previously disclosed in writing, and there has been no change in the nature of Merchant's business or the product lines that Merchant sells not previously disclosed; 9.5 The Transaction is genuine and arises from a bona fide sale of merchandise or services by Merchant, the merchandise or services have been fully delivered or performed, and the Transaction represents a valid obligation for the amount shown on the Charge Record and does not involve the use of the Card for any other purpose; 9.6 There are no liens or other encumbrances on the Transaction, and Merchant has the authority to convey the Transaction for processing; 9.7 The Transaction is not subject to any dispute, set-off or counterclaim; 9.8 The Transaction has not been previously presented for processing unless allowed by the Operating Rules; 9.9 Each statement on the Charge Record is true, and Merchant has no knowledge of facts that would impair the validity or collectability of the amount of the Transaction; 9.10 The person who executes the Application on behalf of the Merchant has the full power and authority to execute the Application and to enter into this Merchant Agreement; 9.11 The Charge Record is free from any material alteration not authorized by the Cardholder; 9.12 Merchant has not disbursed or advance any cash to the Cardholder (except as authorized by the Operating Rules) or itself or to any of its representatives, agents, or employees in connection with the Transaction, nor has Merchant accepted payment for effecting credits to a Cardholder; 9.13 The goods or services related to each Transaction are Merchant's property or Merchant has the legal right to sell them; 9.14 Merchant has made no representation or agreement for the issuance of refunds except as stated in Merchant's refund policy, which has been previously submitted to Processor in writing and which is available to the Cardholder; 9.15 Any Transaction submitted to Processor to credit a Cardholder's Settlement Account represents a refund for a Transaction previously submitted to Processor; and 9.16 Unless specifically stated in its Application or otherwise approved in writing by Processor in advance, Merchant has not accepted Cards in connection with installment plans or recurring transactions, and if such approved Transactions have been submitted, Charge Record has been prepared separately for each installment transaction or recurring transaction on the dates the Cardholder agreed to be charged, and all such Transactions comply in all respects with the Operating Rules. 10. Processing Fees 10.1 Merchant will pay Processing Fees in the amount specified in the fee schedule attached to the Application or as otherwise provided for in this Agreement as amended from time to time. Processor may revise the Processing Fees by giving Merchant 30 days advance written notice. Processor will not be required to provide the Merchant with 30 days notice of any changes in Processing Fees in the event that any Card Network or any other entity having such authority changes the Processing Fees and the effective date for implementation of the change in the Processing Fees is 7

8 less than 30 days. Upon Merchant s request, Processor will provide Merchant access to the Processing Fees associated with the applicable selected Pass Through Plan on the Application Merchant understands that the fees stated in the fee schedule are based upon the assumption that Merchant's Transactions will qualify for certain interchange rates as determined by the applicable Card Network and that the volume and character of Merchant's Transactions will be substantially similar to the volume and character of transactions described in the Application. If any of Merchant's Transactions fail to qualify for such interchange rates, Processor shall process each such Transaction at the applicable interchange rate determined by the applicable Card Network Unless otherwise indicated on the fee schedule, Merchant shall be solely responsible for all communication expenses required to facilitate the transmission of all Transactions to Processor Processing Fees and other service charges owed by Merchant to Processor or Bank may be deducted by Processor or Bank from amounts due Merchant, or from the Settlement Account or from the Reserve Account. Merchant will pay the amounts due by the next business day if sufficient funds are not available in the Settlement Account. 11. Information About Merchant and its Business 11.1 Upon 5 days' written notice at any time, Merchant agrees to furnish to Processor its most recently prepared financial statements and credit information and, if applicable, its three most recent filings with the SEC With prior notice and during Merchant's normal business hours, Processor's or Bank's duly authorized representatives may visit Merchant's business premises and may examine Merchant's operations, activities, books and records that pertain to Merchant's Transactions or Merchant's compliance with this Merchant Agreement Merchant agrees to provide Processor at least 30 days' prior written notice of its intent to change current product lines or services, Merchant's trade name, or the manner in which Merchant accepts Cards. If Processor determines such a change is material to its relationship with Merchant, Processor may refuse to process Transactions made subsequent to the change or terminate this Merchant Agreement. Merchant agrees to provide Processor with prompt written notice if Merchant is the subject of any voluntary or involuntary bankruptcy or insolvency petition or proceeding. Merchant's signature on this Agreement authorizes Processor and Bank to perform any credit check deemed necessary with respect to Merchant. Merchant will also provide Processor with prompt written notice of (i) any adverse change in Merchant's financial condition, (ii) any planned or anticipated liquidation or substantial change in the nature of Merchant's business, or (iii) any transfer or sale of any material part of Merchant's total assets or securities. Merchant will also notify Processor of any judgment, writ, warrant of attachment, execution or levy against any material part of Merchant's total assets not later than 3 days after Merchant obtains knowledge of any such judgment, writ, warrant of attachment, execution or levy Federal regulations enacted pursuant to the USA Patriot Act and other applicable laws require financial institutions to verify the identity of every person who seeks to open an account with a financial institution. As a result of Merchant's application of Services, Merchant shall provide documentary verification of Merchant's identity, such as a driver's license or passport for an individual and certified copy of organization documents for an entity in manner acceptable to Bank. Processor and Bank reserve the right to verify Merchant's identity through other non-documentary methods as Processor or Bank deem appropriate in their sole discretion. Processor and Bank may retain a copy of any document it obtains to verify Merchant's identity. 12. Confidentiality 12.1 Merchant will not provide Card Information to anyone except Processor or Bank, Card Networks, or Merchant's agents that have been approved by Processor as required under this Agreement and are properly registered with the Card Networks for the purpose of assisting Merchant in completing Transactions, or as specifically required by law. Merchant will not retain or store Card magnetic stripe, CVV, CVV2, CVC2, CID or any other data classified by PCI-DSS as Sensitive Authentication Data subsequent to authorization for a Transaction or sell, purchase, provide or exchange Card Information to any third party, or to any entity other than the Processor or Bank, the Card Networks, or in response to valid legal process or subpoena Merchant may not, in the event of its failure, including bankruptcy, insolvency, or other suspension of business operations, sell, transfer, or disclose any materials that contain Transaction data or Card Information to third parties. Upon request, Merchant must return such information to Processor or provide Processor with acceptable proof of its destruction Merchant agrees to keep confidential and not disclose the terms and conditions of this Merchant Agreement. Merchant also agrees to keep confidential and not disclose or use any information supplied or otherwise made accessible by Processor or Bank or their agents, including without limitation Processor s and Bank s Confidential Information. Notwithstanding the foregoing, Merchant may use Processor s or Bank s Confidential Information only to exercise its rights and to perform your obligations under this Agreement. Merchant will protect Processor s and Bank s Confidential Information from unauthorized disclosure, publication, or dissemination by employing at least those precautions that Merchant employs to protect its own confidential information, but in no event less than reasonable care, and shall not use, reproduce, distribute, disclose, or otherwise disseminate Processor s or Bank s Confidential Information, except in connection with the performance of its obligations under this Agreement. Upon request by Processor or Bank or upon termination of this Agreement, Merchant shall return to us or destroy all of Processor s or Bank s Confidential Information, as applicable, in Merchant s possession or control Except as expressly provided for in this Agreement, this Section does not confer any right, license, interest or title in, to or under Processor s or Bank s confidential information to Merchant. Except as expressly provided for herein, no license is hereby granted to Merchant under any patent, trademark, copyright, trade secret or other proprietary rights of Processor or Bank. All rights, title, and interest in and to all intellectual property related to the Services provided by Processor hereunder (including, without limitation, the content of any materials, web screens, layouts, processing techniques, procedures, algorithms, and methods), owned, developed or licensed by us prior to, during the term of, or after this Merchant Agreement, or employed by Processor in connection with the Services and any updates, changes, alterations, or modifications to or derivative works from such intellectual property, shall be and remain, as among the parties, Processor s exclusive property Merchant authorizes Processor and Bank to release its name and address to any third party whom the Processor or Bank determines needs to know such information in order for Processor or Bank to perform the Services under this Agreement and who has requested such information. Without limitation as to the authority granted to Bank and Processor in Section 10 of the Application, Merchant authorizes Processor and Bank to disclose Transaction data and other information relating to the Merchant, Guarantor and each of their principals, to the Card Networks, current and prospective Card issuers, current and prospective acquirers, regulatory authorities, and other entities to whom Processor or Bank or any such entity may be required to provide such information and to Processor's, Bank s and each such entity's affiliates, agents, subcontractors and employees, for purposes Processor or Bank or such other entities deem necessary in Processor's, Bank s or their reasonable discretion, including without limitation, in connection with the performance of their various obligations hereunder or under their other applicable agreements or under the Operating Rules or applicable law Merchant is responsible for ensuring its Merchant Identification Number ( MID ) is kept confidential. When a change to a Merchant account is required, Merchant shall disclose its MID to the Processor representative as confirmation that the person requesting the change has authority. If the person requesting the change discloses the proper MID, Processor shall assume that person has the proper authority to make the change. Merchant shall be fully liable for any changes to its account after disclosure of the MID. Processor may request from Merchant additional information to further verify Merchant's identity. 8

9 13. Term; Termination 13.1 This Agreement will be effective during the three (3) year period commencing on the date this Agreement is executed by Bank and Processor (by signature or otherwise) ( Initial Term ) and will automatically renew for successive one (1) year periods (each, a Renewal Term ) thereafter unless a party provides the other parties with notice of its intent not to renew this Agreement at least ninety (90) days prior to the expiration of the then current Term. The Initial Term and Renewal Term shall together be referred to herein as the Term Either Bank or Processor may terminate this Agreement as to all Card types or individually specified Card types, without cause, upon 30 days advance written notice. Bank or Processor may terminate this Agreement in either's sole and absolute discretion, effective immediately, upon written, electronic or oral notice to Merchant if Processor or Bank in its sole discretion, determines that any of the following conditions exists: (i) Merchant has violated any provision of this Agreement or the Operating Rules or any Card Network requires Processor or Bank to terminate this Merchant Agreement, (ii) there is a material adverse change in Merchant's financial condition or change in Merchant's Card acceptance policy which increases Processor's or Bank's risks; (iii) a petition in bankruptcy has been filed by or against Merchant, the Merchant is generally unable to pay its debts as they become due, a receiver, custodian, trustee, liquidator or similar official is appointed for a substantial portion of Merchant's business, there is a general assignment for the benefit creditors, or the business terminates, (iv) any information which Merchant provided to Processor was false, incomplete or misleading when received, (v) irregular Transactions by Merchant, excessive Chargebacks, or any other circumstances which, in Processor's or Bank's discretion, may increase Processor's or Bank's risks, (vi) fraudulent or otherwise unauthorized Transactions have been submitted to Processor for processing, (vii) Merchant is or will be unable or unwilling to perform its obligations under this Agreement or any applicable laws, (viii) Merchant has failed to pay Processor any amount when due, (ix) the Operating Rules are amended in any way so that the continued existence of this Agreement would cause Processor or Bank to be in breach of such Operating Rules, (x) Merchant fails to fund or establish a Reserve Account as requested by Processor or Bank, (xi) Merchant assigns or attempts to assign the Agreement or any portion thereof without the prior written consent of Processor and Bank, (xii) Processor or Bank, in its sole discretion, deems Merchant to be financially insecure, (xiii) Merchant or any person owning or controlling Merchant's business is listed in one or more databases of terminated or high risk merchants maintained by the Card Networks, (xiv) Merchant engages in conduct that creates or could tend to create harm or loss to the goodwill of any Card Network or Processor or Bank, (xv) for a period of more than 60 consecutive days, Merchant does not submit Transactions to Processor, (xvi) Merchant appears on any Card Network s security reporting; (xvii) a judgment in excess of $1,000 is entered against Merchant or any Guarantor and not discharged or bonded off within fifteen (15) days after the entry of the judgment; (xviii) if Merchant submits for processing Charges that were not originated as a result of a direct Charge transaction between a Cardholder and Merchant in the normal course of business; or (xix) the circumstances otherwise warrant immediate termination. Merchant further acknowledges and agrees that any Card Network may limit or terminate this agreement as to Merchant s acceptance of such Payment Network s Cards, with or without cause, at any time and with immediate effect Merchant may terminate this Agreement in the event of a material breach of the terms of this Agreement by Processor, provided Merchant gives Processor written notice of any alleged breach and such breach remains uncured for a period of 30 days following receipt of written notice by Processor The parties further agree and acknowledge that if (i) Merchant breaches this Agreement by improperly terminating it prior to expiration of the Initial Term or any Renewal Term, or (ii) this Agreement is terminated prior to the expiration of the initial Term or any Renewal Term in accordance with this Section 13.2, then Processor will suffer a substantial injury that is difficult or impossible to accurately estimate. Accordingly, in an effort to assess in advance the sum that should represent the damages which would actually be sustained by Processor, the parties have agreed that the amount calculated in the manner specified below is a reasonable estimate of Processor's probable loss for which Merchant shall pay to Processor as damages (the Early Termination Fee ). Any recovery pursuant to this section shall in no way limit Merchant's financial obligations under this Merchant Agreement, including, without limitation, Merchant's obligation with respect to Processing Fees, fees, fines, penalties, returns, refunds, assessments, Chargebacks, and Reserve Account. The Early Termination Fee amount shall be: $500 if Merchant s annual processing volume is less than $2,000,000 or the sum of the number of months remaining from the date of termination to the end of the then current Initial Term or Renewal Term multiplied by the average monthly Processing Fees paid by Merchant during the most recent six (6) months plus the costs and attorneys' fees Processor and Bank incurs as a result of Merchant s termination if Merchant s annual processing volume is greater than $2,000,000. If this Agreement has been in place less than 6 months, the average monthly Processing Fees shall equal the average monthly fees (net of interchange and assessments) that Processor would have received based upon Merchant's representations on the Application. If this Agreement has been in place less than 1 year, the determination of Merchant s annual processing volume shall be as the Merchant represented on the Application. Early Termination Fees shall be paid, to the extent possible, according to the same methods for collecting amounts otherwise due under this Merchant Agreement. All amounts payable hereunder by Merchant to Processor shall be immediately due and payable in full without demand or other notice of any kind, all of which are expressly waived by Merchant It is understood that a file for terminated merchants is maintained by Card Networks containing the names of any business (and its principals) which have been terminated for certain reasons. Merchant acknowledges that Processor and Bank are required to report Merchant to the terminated merchant file if this Agreement is terminated for any of the reasons set forth in the Operating Rules and consents to such reporting in the event of the termination of this Agreement for any of those reasons The provisions governing processing and settlement of Transactions, all related adjustments, fees and other amounts due from Merchant, and the resolution of any related Chargebacks, disputes, or other issues involving Transactions, will continue to apply even after termination of this Merchant Agreement, with respect to all Transactions made prior to such termination or after such termination. After termination of this Agreement for any reason, Merchant shall continue to bear total responsibility for all Chargebacks, Processing Fees, fees, fines, assessments, credits, and adjustments resulting from Transactions processed pursuant to this Agreement and all other amounts then due or which thereafter may become due to Processor or Bank under this Agreement or which may be due to Processor or Bank before or after such termination. If Merchant submits Transactions to Processor after the date of termination, Processor may, at its sole discretion and without waiving any of its rights or remedies under this Merchant Agreement, process such Transactions in accordance with and subject to all of the terms of this Merchant Agreement Sections 3.4, 3.5, 3.7, 3.8, 4, 6, 9, 10, 12, 11.2, 13.4, 13.5, 13.6, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 25 and 27 will survive termination of this Merchant Agreement. 14. Reserve Account 14.1 Merchant may be required to deposit, or authorize Bank to deposit, by deducting from any payment due to Merchant or from any funds in the Settlement Account or any other deposit account of Merchant, into an account maintained and controlled by Bank (the Reserve Account ), initially or at any time in the future as requested by Processor or Bank, sums sufficient to satisfy Merchant's current and/or future obligations as determined by Processor or Bank in its sole and absolute discretion. The Reserve Account will be separate from the Settlement Account. Merchant shall have no right of withdrawal from the Reserve Account. Funds in the Reserve Account will be held and, owned and controlled by Bank, will not bear interest, and may be commingled with other funds At any time in Processor's or Bank s sole and absolute discretion, Processor or Bank may (i) designate the minimum balance required to be deposited in the Reserve Account, (ii) require that the amount on deposit in the Reserve Account be increased, (iii) require that the Merchant deposit, or Bank may deposit for Merchant into the Reserve Account a percentage of, or a fixed amount from each Charge processed, or (iv) otherwise determine 9