VERIFONE (U.K.) LIMITED
CUSTOMER TERMS AND CONDITIONS FOR A BUNDLED PAYMENT SOLUTION
These Standard Customer Terms and Condition, together with the Order Form, constitute a legal agreement between VeriFone (U.K.) Limited (“Verifone”) and the customer entity set forth on the Order Form (“Customer”), with respect to Customer’s access to and use of any Verifone service, solution, software, payment terminals, peripherals, and other related products that may be provided by Verifone to Customer pursuant to the Order Form (the “Agreement”). By accepting these Terms and Conditions, the Customer agrees to be bound by this Agreement. If the person accepting these Terms and Conditions is acting on behalf of an employer, or other person, company or other entity, such person confirms that they have all requisite legal authority to bind such employer, person, company or other entity to the terms of this Agreement. This Agreement is the final, complete and exclusive agreement between the parties relating to its subject matter and supersedes all prior or contemporaneous communications relating to such subject matter. Any term or condition in any document furnished by Customer before or after the date of the Order Form, which is in any way inconsistent with or in addition to the terms and conditions set forth in the Agreement is hereby expressly rejected, and Verifone’s acceptance of the order placed by Customer is hereby expressly made in reliance on Customer's assent to all terms and conditions of the Agreement. Verifone’s failure to object to any term or condition in any written or oral communication from Customer, whether delivered before or after the date of the Order Form, shall not constitute an acceptance thereof or a waiver of any term or condition hereof.
TERMS AND CONDITIONS
1. DEFINITIONS AND INTERPRETATION
1.1 Each capitalised term will have the meaning set out in the Definitions section.
1.2 In the event of any conflict between the Order Form and any other provision of these Terms and Conditions, the Order Form shall prevail.
1.3 In this Agreement, except where otherwise stated or where the context otherwise requires, the rules of interpretation set out in Definitions section shall apply.
2. SOLUTION
2.1 Each Order Form shall specify the Products and/or Services and/or Software ordered by Customer and shall be deemed to be a separate offer by the Customer which Verifone shall be free to accept or decline at its absolute discretion. Verifone reserves the right to amend the specification of the Products, Software and/or Services if required by any applicable statutory or regulatory requirements. The Products, Services and Software provided by Verifone is collectively referred to herein as the “Solution”. Where the Order Form states that a Terminal or Service is provided for a minimum term or minimum period, the deactivation of a Terminal or other termination of a Service prior to the end of such minimum term or minimum period shall be subject to payment of an early termination fee as set forth in clause 20.3. The Term starts on delivery of the Products in accordance with clause 4.2 or activation of the Service by Verifone.
2.2 No order shall be deemed to be accepted by Verifone until a written acknowledgement of order is issued by Verifone or (if earlier) Verifone delivers the Products or Software to the address set out on the relevant Order Form or commences performance of the Services.
2.3 The Customer may not amend or cancel any order for Products, Services or Software prior to its delivery or performance without the prior written consent of Verifone, which shall be at Verifone' absolute discretion.
3. CUSTOMER EQUIPMENT REQUIREMENTS AND INTEGRATION TESTS
3.1 The Customer shall be responsible for ensuring that its equipment, systems and environment (“Customer Equipment”) meet Verifone’s Customer Equipment Requirements for the purpose of integration. Verifone’s Customer Equipment Requirements for a particular Solution is set forth in documentation available on request from Verifone. Verifone shall have no liability to the Customer, and makes no warranty, in relation to any use of the Solution with Customer Equipment which does not meet the Customer Equipment Requirements.
3.2 Verifone may at its option conduct integration tests or other tests on the Customer's Equipment to ensure that they meet the Customer Equipment Requirements. Verifone may charge the Customer on a time and materials basis for testing. If after testing Verifone considers that the Customer Equipment Requirements have been met for the purposes of integration, Verifone shall provide a notification to the Customer confirming this. The notification may specify ongoing requirements in order for the Customer Equipment Requirements to be met.
3.3 The Customer shall under no circumstances use the Solution with any equipment other than in compliance with Verifone’s Customer Equipment Requirements and in accordance with any notification provided by Verifone confirming that that such Customer Equipment is properly integrated with Verifone’s Solution.
3.4 Verifone may make such changes to the Customer Equipment Requirements if in their reasonable opinion such changes are required to comply with any changes in Law, requirements of the PCI Security Standards Council, requirements of any card payment schemes, requirements of the Customer Acquirer, or are required as a result of any External Element.
4. PERFORMANCE AND DELIVERY
4.1 Verifone shall use reasonable endeavours to perform any Services and deliver any Products and/or Software in accordance with the terms of this Agreement, and with all due skill, care and diligence.
4.2 Unless otherwise agreed in writing by Verifone, the location for delivery of any Products ordered under this Agreement ("Delivery Point") shall be the place of business specified on the Order Form. Delivery of any order shall be complete on completion of loading of the order at the Delivery Point or when Verifone places the order at the designated recipient’s disposal at the Delivery Point (as applicable).
4.3 Any dates specified by Verifone for delivery of the Products or performance of any Services are intended to be an estimate and time for delivery shall not be of the essence. Verifone shall use reasonable endeavours to deliver the Products in accordance with the dates specified in the applicable Order Form or otherwise communicated by Verifone to the Customer from time to time.
4.4 In respect of Software delivered pre-loaded on the Terminals, Delivery of the Software shall occur when the Terminals are delivered in accordance with this Agreement.
4.5 If for any reason the designated recipient fails to accept delivery of any of the Products when they are ready for delivery, or Verifone is unable to deliver the Products on time because the designated recipient has not provided appropriate instructions, documents, licences or authorisations:
4.5.1 risk in the Products shall pass to the Customer (excluding for loss or damage caused by Verifone’ negligence); and
4.5.2 Verifone may store the Products until delivery, and the Customer shall be liable for all related costs and expenses (including, but not limited to, storage and insurance).
4.6 The Customer undertakes to package the Products appropriately and sufficiently when returning Products to Verifone by post/courier and is liable to Verifone for any damage caused to the Products in transit as a result of any insufficient packaging.
4.7 The quantity of any consignment of Products as recorded by Verifone on despatch from Verifone’ place of business shall be conclusive evidence of the quantity received by the Customer on delivery unless the Customer can provide conclusive evidence proving the contrary.
4.8 Verifone shall be entitled to discontinue any Terminal or other Products at any time in its discretion.
5. OWNERSHIP, RISK AND INSURANCE OF PRODUCTS
5.1 Hired Products shall at all times remain the property of Verifone, and the Customer shall have no right, title or interest in or to the Products (except the right to possession and use of the Products subject to the terms and conditions of this Agreement).
5.2 The risk of loss, theft, damage or destruction of the Products shall pass to the Customer on delivery. Hired Products shall remain at the sole risk of the Customer until such time as such Products are redelivered to Verifone and Verifone has confirmed receipt of the hired Products ("Risk Period").
5.3 During the Risk Period, the Customer shall, at its own expense, obtain and maintain insurances for any hired Products to a value not less than their full replacement value comprehensively against all usual risks of loss, damage or destruction by fire, theft or accident, and such other risks as Verifone may from time to time nominate in writing.
5.4 Customer shall at its own expense, obtain and maintain insurances for all Products for such amounts as a prudent owner or operator of the Products would insure for, or such amount as Verifone may from time to time reasonably require, to cover any third party or public liability risks of whatever nature and however arising in connection with the Products.
5.5 The Customer shall give immediate written notice to Verifone in the event of any loss, accident or damage to the hired Products or arising out of or in connection with the Customer's possession or use of the hired Products.
5.6 The Customer shall, on demand, supply copies of the relevant insurance policies or other insurance confirmation acceptable to Verifone and proof of premium payment to Verifone to confirm the insurance arrangements.
5.7 On termination of this Agreement, howsoever caused, Verifone’ (but not the Customer’s) rights contained in this clause 5 shall remain in effect.
5.8 Except as may be separately agreed by the parties in writing, in the event that Customer or another party acting on Customer’s behalf purchases Products from Verifone, such purchase shall be governed by Verifone’s Standard Terms and Conditions for hardware, which are available at www.verifone.com/legal, and which are subject to change from time to time.
6. CUSTOMER'S RESPONSIBILITIES
6.1 During the Term the Customer shall (at its own expense), and shall procure that its Personnel shall:
6.1.1 provide Verifone, its agents, subcontractors, consultants and employees, in a timely manner, with access to the Customer's premises, office accommodation, data, information in respect of the Solution and shall ensure that any information supplied is accurate in all material respects;
6.1.2 obtain and maintain all necessary licences, authorisations and consents in relation to the Customer Equipment and the Customer Acquirer in all cases before the date on which the Solution is to be used by the Customer and throughout the Term;
6.1.3 use the Solution strictly in accordance with any operating instructions provided by Verifone (including but not limited to instructions on suitable environment, cleanliness and repair/maintenance), and ensure that all Customer Equipment complies with all applicable laws and with the Customer Equipment Requirements;
6.1.4 not, without the prior written consent of Verifone, part with control of (including for the purposes of repair or maintenance) any hired Products or allow the creation of any mortgage, charge, lien or other security interest in respect of them;
6.1.5 not do or permit to be done any act or thing which will or may jeopardise the right, title and/or interest of Verifone in the hired Products nor suffer or permit the hired Products to be confiscated, seized or taken out of its possession or control under any distress, execution or other legal process, but if the hired Products are so confiscated, seized or taken, the Customer shall notify Verifone and the Customer shall at its sole expense use its best endeavours to procure an immediate release of such Products and shall indemnify Verifone on demand against all losses, costs, charges, damages and expenses incurred as a result of such confiscation;
6.1.6 not use in conjunction with the Solution, any software accessory, attachment or additional equipment other than as stated in the Customer Equipment Requirements or that which has been supplied by or approved in writing by Verifone;
6.1.7 deliver up the hired Products at the end of this Agreement;
6.1.8 only use the Solution for the purpose for which it is provided and for the purposes of the Customer's business;
6.1.9 not use the Solution or any part of it for any unlawful purpose;
6.1.10 comply, at all times and in relation to all of their activities using the Solution, with all applicable laws, all rules imposed by the Customer Acquirer, all rules imposed by any other relevant bank or third party and all requirements of the PCI Security Standards Council;
6.1.11 run an appropriate data backup regime including backing up data including the date, store, value and card type for each transaction onto a separate medium which shall then be stored securely for twelve calendar months and keep (in a format accessible by Verifone) and supply such data to Verifone on request;
6.1.12 not resell, lease, hire or otherwise make available the Solution or any part of it to any third party or in any way use it on behalf of any third party;
6.1.13 be responsible for the health and safety of Verifone Personnel at any premises owned by, under the control of or otherwise used by the Customer, and ensure that such Personnel are informed of all relevant policies and procedures; and
6.1.14 undergo such training in relation to the Solution as Verifone may require from time to time.
6.2 The Customer shall install all maintenance releases of and updates to the Software as soon as reasonably practicable after receipt. Depending on the release or update, the Customer may not be able to use the Software until the Customer has downloaded and installed the latest version of the Software and accepted any new terms.
6.3 The Customer acknowledges that Verifone is not responsible for ensuring that funds are transferred to the Customer. The Customer shall regularly (and at least once in every Business Day) check that all transactions have been processed successfully and credited to (or debited from) the Customer’s nominated bank account. To the extent that such checks reveal any errors or issues the Customer shall immediately notify Verifone. Verifone may assist the Customer in relation to such error or issue, provided that Verifone shall be entitled to charge the Customer for such assistance on a time and materials basis unless such error or issue arose as a result of any breach by Verifone of any term of this Agreement.
6.4 If the Customer makes any use of the Terminals in offline mode, they must ensure that all transactions are uploaded when the Terminal is online again. Any failure to upload such transactions is entirely the responsibility of the Customer and Verifone shall have no liability whatsoever in relation to such failure. For the avoidance of doubt, the Customer acknowledges that if any Terminal is lost, suffers any Defect or is returned to Verifone before such transactions are uploaded then such transactions are likely to be lost and not capable of reinstatement, and Verifone shall have no liability in relation to such loss.
6.5 Any SIM card provided with any Terminal is subject to data usage caps and shall only be used by Customer for the purpose of the operation of such Terminal in accordance with the terms of this Agreement.
6.6 The Customer acknowledges that Verifone shall not be responsible for any loss of or damage to the Products arising out of or in connection with any negligence, misuse, mishandling of the Products or otherwise caused by the Customer or its Personnel.
7. VERIFONE’S RESPONSIBILITIES
7.1 Verifone will be excused from failures to perform its obligations under this Agreement, to the extent that such failures are attributable to any failure of the Customer, its Affiliates or its Personnel to perform the Customer Responsibilities.
7.2 Notwithstanding that Verifone may be impeded from the provision of any element of the Solution as a result of any failure of the Customer, its Affiliates or its Personnel to perform the Customer Responsibilities, Verifone will be entitled to:
7.2.1 continue to invoice the fees; and
7.2.2 charge for additional resources used, as a result of any such failure, and the Customer shall pay Verifone’ time and materials rates for any additional resources or level of effort expended by Verifone.
7.3 At the Customer’s written request, Verifone shall at its own cost and expense provide the Customer with evidence of a current and valid Attestation of Compliance, prepared by a Qualified Security Assessor.
7.4 Subject to the terms of this Agreement, as specified in the Attestation of Compliance referred to in clause 7.3, Verifone agrees that Verifone is responsible for the security of cardholder data that Verifone possesses or otherwise stores, processes, or transmits on behalf of Customer in its Cardholder Data Environment, or to the extent that Verifone could impact the security of the Customer’s cardholder data environment.
8. PRICE
8.1 The fees shall be the prices set out in the relevant Order Form or, if not set forth in the relevant Order Form, Verifone’s standard fees from time to time. All prices quoted shall be exclusive of VAT.
8.2 If any hired Terminal is lost or stolen the Customer shall be liable to pay, and Verifone may immediately invoice the Customer for, its then-current Terminal Replacement Fee.
8.3 If on inspection of any Terminal returned by the Customer or reported by the Customer to be Defective, Verifone reasonably determines that the Terminal is damaged due to misuse, intentional act or malicious damage, accidental damage, failure of the Customer to perform its obligations under clause 6, improper use or operation, improper maintenance or repair, improper installation or testing or use, any failure of electrical power, air conditioning or humidity control, exposure to liquids, improper battery conditioning and tamper or security breach or repairs carried out by parties other than Verifone Customer shall be liable to pay, and Verifone may immediately invoice the Customer for, its then-current customer damage fee.
8.4 In the event that Verifone determines that any Terminal returned by Merchant is not defective in workmanship or materials (i.e., there is “no fault found”), Verifone reserves the right to charge its then-current no fault found fee.
8.5 Verifone may increase the fees by one (1) months' written notice:
8.5.1 at any time during the Term but no more regularly than once each year, provided that such increase (measured as a percentage) shall not exceed that of the RPIX measure of inflation published by the Office for National Statistics or its successor from time to time during the previous twelve (12) months; or
8.5.2 in order to reflect any change imposed by the Customer Acquirer, any card payment scheme, the PCI Security Standard Council or under applicable Law in relation to the Solution.
9. PAYMENT
9.1 Verifone shall be entitled to invoice the Customer for the fees in accordance with the relevant Order Form. The fees shall be payable even when any Products have been returned to Verifone for repair or replacement or, for whatever reason, the Products are not performing in accordance with applicable specifications. Unless the Agreement is terminated at the end of the Minimum Period or Extension Period, Verifone shall continue to invoice the Customer monthly in advance for the fees.
9.2 The Customer shall pay all invoices in full and in cleared funds within thirty (30) days of the date of the invoice. Payment shall be made by direct debit to the bank account nominated in writing by Verifone or, if agreed in writing by Verifone, by BACS or such other method as Verifone may agree from time to time.
9.3 Payment shall be made in the currency of the invoice. No payment shall be deemed to have been received until Verifone has received cleared funds.
9.4 All sums payable to Verifone under this Agreement shall become due immediately on its termination notwithstanding any other provision.
9.5 The Customer shall make all payments due under this Agreement in full without any deduction or set-off whether by way of counterclaim or otherwise, unless otherwise agreed in writing by Verifone or unless the Customer has a valid court order requiring an amount equal to such deduction to be paid by Verifone to the Customer. Verifone may, without limit to any other rights it may have, set off any liability of the Customer to Verifone against any liability of Verifone to the Customer.
9.6 If the Customer fails to pay Verifone any sum due under this Agreement:
9.6.1 Verifone may suspend the provision of any element of the Solution until such sum is paid; and
9.6.2 the Customer shall be liable to pay interest to Verifone on such sum from the due date for payment at the annual rate of 8% above the base lending rate from time to time of Barclay’s Bank, accruing on a daily basis until payment is made, whether before or after any judgment.
10. REPRESENTATIONS AND WARRANTIES
10.1 Each party warrants and represents that:
10.1.1 it has full capacity and authority to enter into and perform its obligations under this Agreement;
10.1.2 there are no actions, suits or proceedings or regulatory investigations pending or, to that party’s knowledge, threatened against or affecting that party before any court or administrative body or arbitration tribunal that might affect the ability of that party to meet and carry out its obligations under this Agreement.
10.2 Unless expressly agreed by Verifone in writing all Products and Software shall be Verifone’ standard “off the shelf” items and no special or customised version of any Product or Software shall be provided by Verifone; and Verifone shall have no obligation to ensure, and shall give no warranty that, the Products or Software will operate in conjunction with the Customer’s equipment, software or other products or systems.
10.3 The Customer acknowledges that the Software may not be free of bugs and agrees that the existence of minor errors will not constitute a breach of this Agreement.
10.4 All warranties, conditions and other terms not expressly set out in these conditions in relation to the Solution including any warranty as to non-infringement of third party rights, or those implied by statute or common law and warranties in relation to satisfactory quality and fitness for purpose, are excluded to the fullest extent permitted by law. In particular, Verifone does not warrant that the Customer’s use of the Solution will be uninterrupted or error-free and is not responsible for any delays, delivery failures, or any other loss or damage resulting from the occurrence, unavailability or failure of any External Element.
11. LIMITATION OF LIABILITY
11.1 This clause sets out the entire liability of the parties (including any liability for the acts or omissions of their respective Personnel) to each other in respect of:
11.1.1 any breach of this Agreement however arising;
11.1.2 any indemnity obligation under this Agreement;
11.1.3 any use made of the Products, Services or Software by the Customer; and
11.1.4 any representation, statement or tortious act or omission (including negligence) arising under or in connection with this Agreement.
11.2 Nothing in this Agreement shall limit or exclude the liability of either party for:
11.2.1 death or personal injury resulting from negligence; or
11.2.2 fraud or fraudulent misrepresentation; or
11.2.3 any other liability which cannot be limited or excluded by law.
11.3 Subject to clause 11.2, Verifone shall not in any circumstances have any liability to the Customer for:
11.3.1 any losses or damages (whether direct or indirect) which may be suffered by the Customer which fall within any of the following categories:
(i) loss of profits;
(ii) loss of revenue;
(iii) loss of transaction;
(iv) loss of anticipated savings;
(v) loss of business opportunity;
(vi) loss of or goodwill;
(vii) loss of or damage to (including corruption of) data; or
11.3.2 indirect, consequential or special loss or damages, regardless of the form of action, whether in contract, strict liability or tort (including negligence), and regardless of whether Verifone knew or had reason to know of the possibility of the loss, injury, or damage in question.
11.4 Subject to clauses 11.2 and 11.3, Verifone’ total aggregate liability to the Customer in respect of all Losses suffered by the Customer arising under or in connection with this Agreement, whether arising in contract, tort (including negligence) or restitution, or for breach of statutory duty or misrepresentation, or otherwise, shall in all circumstances be limited to the total fees paid by the Customer to Verifone under the applicable Order Form during the period of six (6) months prior to the date of any such claim, or, if the claim arises within a period of six (6) months from the date of such Order Form, the total amount paid by the Customer to Verifone under the date of the applicable Order Form to the date of such claim.
11.5 Each party agrees that the limitations of liability contained in this clause 11 are agreed between the parties in the context of the other provisions of this Agreement, including the level of the fees set forth in the Order Form, and that such terms satisfy the requirement of reasonableness within the meaning of the Unfair Contract Terms Act 1977.
12. INSURANCE
During the Term, Verifone shall maintain in force public liability, professional indemnity and product liability insurance policies with reputable insurance companies.
13. INTELLECTUAL PROPERTY RIGHTS
13.1 All Intellectual Property Rights in any and all works and materials developed, written or prepared by Verifone in connection with providing the Solution to the Customer (whether individually, collectively or jointly with the Customer, regardless of the media on which recorded or stored, and whether before, on or after the date of the Agreement) including all Software and Documentation, or otherwise provided to the Customer in the course of the Solution, together with all Software and Documentation, will belong to Verifone. The Customer may only use such materials for the purposes of this Agreement.
13.2 Each party agrees, at the other party's request, to execute such documents and give such assistance that the other party may require from time to time, including after termination, to vest and confirm the rights referred to in clause 13.1 in and to the relevant party.
13.3 Verifone grants to the Customer a non-transferable, non-exclusive licence, which shall not be capable of sub-licence (other than to the Customer's Personnel), to download, install and use the Software subject to the terms of this Agreement and to receive and use any free supplementary software code or update of the Software incorporating "patches" and corrections of errors as may be provided by Verifone from time to time, and to download, view and use the Documentation.
13.4 The use of the Software shall be restricted to the use of the Software in object code form and loading the Software into temporary memory or permanent storage on the relevant Terminal and not installation on a network server for distribution to other Terminals. Software may be restricted to a limited number of users (total or concurrent), servers, sites or Terminals (in each case as set out in the relevant Order Form or otherwise). The Customer may not use the Software other than as specified in this clause 13 without the prior written consent of Verifone, and the Customer acknowledges that additional fees may be payable on any change of use approved by Verifone.
13.5 Neither party will have any right or licence in respect of the other's Intellectual Property Rights other than as expressly set out in this Agreement and on termination of the Agreement (or on cancellation or discontinuance of any Services to which those Intellectual Property Rights relate) all such rights or licences shall terminate.
13.6 The Customer shall not:
13.6.1 copy any Software or Documentation except where such copying is incidental to normal use of the Software, provided that the Customer may make a back-up copy of the Software where it is necessary for the purposes of back-up or operational security. The Customer shall record the number and location of all copies of the Software and take steps to prevent unauthorised copying;
13.6.2 adapt, vary, modify or translate all or any portion of the Software or Documentation for any purpose including for error correction;
13.6.3 combine or incorporate the Software in any other programs; reverse engineer, decompile or disassemble all or any portion of the Software or study the operation of the Software to determine its structure, sequence, operation or underlying logic except and solely to the extent that (by virtue of section 296A of the Copyright, Designs and Patents Act 1988 or any local law having equivalent effect) such actions cannot be prohibited because they are essential for the purpose of achieving inter-operability of the Software with another software program; or
13.6.4 remove or circumvent any technical protection measures incorporated to protect the integrity of any Software;
13.6.5 remove, suppress or modify any proprietary marking, including any copyright or trademark notice, on or in the Products, Software Documentation or their packaging.
13.7 The Customer acknowledges that the provision of the Software by Verifone, and / or the use by the Customer of the Software on any Terminal, may be subject to terms and conditions imposed by third parties including network, device and operating system providers ("Third Party Terms"). The Customer will comply with any Third Party Terms applicable to its use of the Software or any Terminal.
13.8 The Customer acknowledges that it has no right to have access to the Software in source-code form.
13.9 The Customer shall immediately notify Verifone if it becomes aware of any infringement or likely infringement of Verifone’s Intellectual Property Rights in any part of the Solution.
14. EXPORT CONTROLS
The Customer understands that the Products are subject to United States export control laws and regulations and may be subject to export control regulations in other countries (“Export Controls”). The Customer agrees to comply with all applicable provisions and requirements of Export Controls, including obtaining any required license or other authorization. Customer further agrees not export, re-export, transfer, divert or disclose the Products to, or for use in: (i) any U.S. sanctioned or embargoed country, or to nationals or residents of such countries; or (ii) any person, entity, organization or other party identified on a U.S. Government restricted party list (e.g., Denied Persons List, Entity List, Blocked Persons List, Debarred Parties List), as published and revised from time to time; or (iii) any party engaged in nuclear, chemical/biological weapons or missile proliferation activities. Customer agrees to include similar Export Control provisions in terms of sale.
15. ANTI-BRIBERY/FCPA:
The Customer agrees to comply with the UK Bribery Act 2010 (the “Bribery Act”). Customer further agrees that it shall not make, authorise, offer or promise to make or give any money or any other thing of value, directly or indirectly, to any government official or employee, political party or candidate for political office, or any other person for the purpose of securing any improper or unfair advantage or obtaining or retaining business in connection with the activities contemplated hereunder. Any breach or violation of any provision contained in this clause 15 by the any party shall entitle the other party to terminate this Agreement by written notice with immediate effect. Each party represents and warrants that it has not committed and it has no information, reason to believe, or knowledge of any Related Entities having committed or intending to commit, any violation of the Bribery Act or any act or omission which could cause any party to be in violation of the Bribery Act with respect to any activities related to this Agreement or its business.
16. CONFIDENTIAL INFORMATION
16.1 The receiving party agrees during the Term and thereafter:
16.1.1 not to use Confidential Information for any purpose other than the purpose for which it is supplied under this Agreement;
16.1.2 not to divulge Confidential Information received from the other party to any of its Personnel who do not need to know it; and
16.1.3 to prevent the disclosure of the Confidential Information to any third party without the prior written consent of the disclosing party, other than to the receiving party's professional advisers or as may be required by Law.
16.2 The receiving party will use a reasonable degree of care, which in any event will not be less than the same degree of care which the receiving party uses to protect its own confidential information, to keep and ensure its Personnel keep all Confidential Information confidential.
16.3 The obligations of confidence and non-use set out in this clause 16 will not apply to any Confidential Information which was at the time of disclosure or other becomes published, known publicly or otherwise in the public domain or known to and at the free disposal of the receiving party in circumstances in which the receiving party has no reason to believe that there has been a breach of an obligation of confidence owed to the disclosing party.
16.4 On termination of this Agreement, each party will return to the other party all of that party's Confidential Information which is in its possession or under its control (including all copies). As an exception to this obligation, each party may retain one copy of the other party's Confidential Information in paper form in its legal files solely for the purpose of ensuring compliance with its obligations under this Agreement or any applicable Law.
17. PUBLICITY
Neither party shall use the name and/or logo of the other party without the other party's prior written consent; nor make any announcement relating to this Agreement or its subject matter without the prior written approval of the other party except as required by any Law.
18. DATA PROTECTION
18.1 To the extent that any part of the Solution provided to Customer by Verifone involves Verifone processing any personal data falling within the scope of the GDPR (as defined in Exhibit C) on behalf of Customer, then the parties hereby record their intention that Customer shall be the data controller and Verifone shall be the data processor. The terms for data processing are set forth in Exhibit C.
18.2 Information regarding the processing of personal data carried out by Verifone as Data Controller. Verifone also processes personal data of Customer, acting as data controller, and especially those relating to Customer’s employees (in particular identification data), for the purposes of managing the business relationship (invoicing, order process, etc.), complying with legal obligations, security and business continuity, optimization of the services and management/creation of access accounts. Further, notwithstanding the provisions of Exhibit C, Verifone processes personal data relating to customer data subjects of Customer, acting as data controller, for security and fraud screening purposes. These processing are carried out for the performance of the Agreement and/or are based on Verifone’s legitimate interest. These personal data are necessary to enable Verifone to fulfil its obligations under the Agreement. If Customer does not provide to Verifone the personal data, Verifone will not be able to fulfil its obligations under the Agreement. Such personal data may be disclosed to Verifone’s internal services, Affiliates and Verifone’s Sub-processor(s). Personal data may be transferred outside the EEA and/or the UK, in particular to the United States, to Verifone affiliates and Sub-Processors on the basis of the EU Model Standard Contractual Clauses executed with those parties. Such personal data will be retained for the duration of the Agreement and longer, if necessary, to fulfil the purposes for which such personal data is collected or to exercise, established or defend legal claims, and may be archived for administrative and/or probative purposes. In accordance with applicable data protection laws, the data subject has the right to access, rectify, erase, restrict, object, request the portability or their personal data and the right to set guidelines on their personal data in case of death, together with the right to lodge a complaint before the competent supervisory authority. Data subjects may exercise its rights by writing to: privacy@verifone.com. For more information regarding the processing of personal data carried out by Verifone, please click on this link: www.verifone.com/us/gdpr-privacy-policy. Insofar as Verifone is not in a direct relationship with the data subject whose personal data is collected, Customer undertakes to provide its employees concerned by the processing operations with all information relating to the processing of their personal data for the purposes described in this clause 18.
19. WEEE COMPLIANCE
19.1 Verifone shall be responsible for financing the treatment, recovery and environmentally sound disposal of all waste electrical and electronic equipment (“WEEE”) pursuant to the term of the Waste Electrical and Electronic Equipment Regulations 2006 (SI 2006/3289) (the "WEEE Regulations").
19.2 The Customer shall either return the Product to Verifone for environmental disposal or dispose of the Product at their cost via a certified WEEE disposal company and provide Verifone with a certificate of disposal.
19.3 Verifone shall be responsible for all transport and/or postage costs and expenses arising from and relating to the Customer’s obligations in clause 19.2.
19.4 The Customer shall not incur any costs under this clause 19 without first informing Verifone of the amount.
19.5 The Customer shall not dispose of any WEEE through municipal waste streams. The Customer shall indemnify and hold harmless Verifone for any losses, claims or damages directly or indirectly suffered by Verifone as a result of a Customer’s disposal of WEEE in municipal waste streams. Verifone can advise customers of its approved recycling partners on request.
20. TERM AND TERMINATION; EARLY SETTLEMENT FEES
20.1 This term of the Order Form will commence on the Effective date and will continue until the end of the Minimum Period and thereafter the term of such Order Form shall automatically renew for further successive periods of twelve (12) months (“each an “Extension Period”), unless Customer shall notify Verifone prior to the end of such Minimum Period (or an Extension Period) that it wishes to cancel or terminate such Order Form.
20.2 Verifone may terminate the Term of the Order Form by giving not less than three (3) months' written notice to the Customer, such notice not to take effect before the end of the Minimum Period or any Extension Period.
20.3 The Customer may terminate an Order Form prior to the end of the Minimum Period or any Extension Period by giving three (3) months' written notice to Verifone, provided that the Customer shall pay the fees relevant to that Order Form in relation to the unexpired portion of the Minimum Period or Extension Period (as the case may be) as follows:
20.3.1 if termination occurs within the first twelve (12) months of the Minimum Period or during an Extension Period the Customer shall, in relation to the remainder of such twelve (12) month period, pay 100% of the fees that would have been payable had the Order Form not been terminated and in addition the Customer shall pay 62.5% of the fees that would have been paid following the first twelve (12) months for the remainder of the Minimum Period had the Order Form not been terminated;
20.3.2 if termination occurs after the first twelve (12) months of the Minimum Period the Customer shall pay 62.5% of the fees for the remainder of the Minimum Period that would have been paid had the Order Form not been terminated.
20.4 Either party may at any time terminate the Order Form with immediate effect by giving written notice to the other party if:
20.4.1 the other party commits a material breach of any term of this Agreement (other than failure to pay any amounts due under this Agreement) and (if such breach is remediable) fails to remedy that breach within a period of thirty (30) days after being notified in writing to do so;
20.4.2 a Force Majeure Event occurs affecting the performance of this Agreement which continues for more than ninety (90) days.
20.4.3 the other party or any of its holding companies ceases or threatens to cease to carry on its business, becomes insolvent or has a receiver, administrative receiver, administrator or similar officer appointed over its assets or applies for or has called a meeting of creditors or resolves to go into liquidation (except for a bona fide amalgamation or reconstruction while solvent where the resulting entity agrees to be bound by and assumes that party's obligations under this Agreement) or (if a partnership) is dissolved;
20.5 Verifone may, without limit to its other rights or remedies, terminate the Order Form immediately by notice to the Customer if the Customer:
20.5.1 undergoes a change of Control;
20.5.2 the Customer fails to pay any amount due under this Agreement on the due date for payment and remains in default not less than fourteen (14) days after being notified in writing to make such payment;
20.5.3 sells all of its assets or is merged or re-organised in circumstances where it is not the surviving entity; or
20.5.4 disputes the ownership or validity of Verifone’ Intellectual Property Rights.
20.6 On termination of the Order Form for any reason:
20.6.1 the Customer shall immediately pay to Verifone all outstanding unpaid invoices and interest, any applicable termination fees and, in respect of Products, Software and Services supplied but for which no invoice has yet been submitted, Verifone shall submit and invoice, which shall be payable by the Customer immediately on receipt;
20.6.2 all licences granted under this Agreement shall terminate immediately;
20.6.3 the Customer shall return all Software and where the customer has hired Products the Customer shall return all of such Products. If the Customer fails to do so, then Verifone may enter the Customer’s premises and take possession of them. Until they have been returned, the Customer shall be solely responsible for their safe keeping and will not use them for any purpose not connected with this Agreement;
20.6.4 clauses which expressly or by implication have effect after termination shall continue in full force and effect.
21. NOTICES
Any notice to be given under this Agreement must be in writing and may be delivered to the other party by hand, courier or first class post at that party's address set out on the Order Form, or as communicated by Verifone from time to time by email or as otherwise prescribed in these Terms and Conditions.
22. DISPUTE RESOLUTION
If a Customer wishes to raise a complaint in connection with the Agreement or the performance, validity or enforceability of it, a “How to raise an issue of concern” leaflet can be requested Verifone and a full copy of Verifone’ complaints policy and dispute resolution procedure can be requested from the Customer Services Department.
23. ASSIGNMENT AND SUBCONTRACTING
The Customer may not sub-contract, assign, novate, transfer, charge, sublicense or otherwise deal in or dispose of any of its rights and obligations under this Agreement, in whole or in part, without the prior written consent of Verifone. Subject to the preceding sentence, this Agreement shall bind Customer and its permitted successors and assigns. Verifone may assign this Agreement, or any of its rights or obligations hereunder, in its sole discretion. Verifone may delegate or subcontract all or any portion of its obligations hereunder to a third party; provided that in such event, Verifone shall at all times remain responsible for the performance of such obligations by any such third party.
24. THIRD PARTY RIGHTS
No term of this Agreement is intended to confer a benefit on, or be enforceable by, any person who is not a party to this Agreement (whether under the Contracts (Rights of Third Parties) Act 1999 or otherwise).
25. FORCE MAJEURE
25.1 For the purposes of this Agreement, "Force Majeure Event" means an event beyond the reasonable control of the relevant party including strikes, lock-outs or other industrial disputes (whether involving the workforce of Verifone or any other party), failure of a utility service, communications network or transport network, acts of God, war, riot, civil commotion, malicious damage, compliance with any law or governmental order, rule, regulation or direction, accident, breakdown of plant or machinery, fire, flood, storm, adverse weather conditions, or default of suppliers or subcontractors.
25.2 Neither party shall be liable to the other as a result of any delay or failure to perform its obligations under this Agreement (other than a party’s payment obligations) as a result of a Force Majeure Event.
26. AUDIT
At any time and from time to time during the term of this Agreement and for a period of eighteen (18) months following termination or expiration of this Agreement, Verifone shall have the right to conduct an audit of the Customer’s activities under this Agreement to determine whether the Customer is in compliance with the requirements of the Agreement.
27. GENERAL
27.1 If any provision of this Agreement (or part of a provision) is found by any court or administrative body of competent jurisdiction to be invalid, unenforceable or illegal, the other provisions shall remain in force. If any invalid, unenforceable or illegal provision would be valid, enforceable or legal if some part of it were deleted, the provision shall apply with the minimum modification necessary to make it legal, valid and enforceable.
27.2 Verifone reserves the right, at its sole discretion, to make revisions to these Terms and Conditions by publishing modified versions to its web pages or by such other means as Verifone may determine in its discretion. Any modified versions of these Terms and Conditions shall take effect from the time that such modifications were first published or otherwise made available. Customer shall be responsible for regularly checking for notice of any such modifications. Customer agrees that its continued use of Verifone’s Solution constitutes Customer’s agreement to these Terms and Conditions as so modified. Save as otherwise set out in these Terms and Conditions, no variation of this Agreement shall be effective unless it is in writing and signed by the parties (or their authorised representatives).
27.3 Any waiver of any right under this Agreement is only effective if it is in writing and it applies only to the party to whom the waiver is addressed and to the circumstances for which it is given. No failure to exercise or delay in exercising any right or remedy provided under this Agreement or by law constitutes a waiver of such right or remedy, nor shall it prevent or restrict any future exercise or enforcement of such right or remedy. No single or partial exercise of any right or remedy under this Agreement shall prevent or restrict the further exercise of that or any other right or remedy.
27.4 Nothing in this Agreement will be construed as constituting or evidencing any partnership, contract of employment or joint venture of any kind between either of the parties or as authorising either party to act as agent for the other. Neither party will have authority to make representations for, act in the name or on behalf of or otherwise bind the other party in any way.
27.5 The Customer acknowledges that in entering into this Agreement it did not rely on any representations (whether written or oral) of any kind or of any person other than those expressly set out in this Agreement.
28. GOVERNING LAW AND JURISDICTION
28.1 This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with English law.
28.2 Subject to clause 22, the parties irrevocably agree that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim that arises out of or in connection with this Agreement or its subject matter or formation (including non-contractual disputes or claims).
EXHIBIT A
DEFINITIONS
In this Agreement the following words and expressions have the following meanings:
"Affiliate" of a company means any company or other entity which directly or indirectly Controls, is Controlled by or is under common Control with that entity;
"Business Day" means Monday to Friday (inclusive) except bank or public holidays in the United Kingdom;
“Cardholder Data” means the Primary Account Number (PAN) together with any or all of the following items which may be retained with the PAN: Cardholder Name, Service Code and Expiration Date (as those terms are commonly understood in the payment card industry);
“Cardholder Data Environment” means that part of Verifone’s network or business operations that possess Cardholder Data or Sensitive Authentication Data;
"Claim" means any claim, demand, action, cause of action, proceeding or complaint of any nature or kind brought by any third party against a party to this Agreement;
"Customer Data” means any information provided by the Customer to Verifone in connection with the performance of this Agreement:
"Confidential Information" means: (i) all technical, scientific, or commercial information (in any form or medium and including all copies of the same) concerning past, present, and/or future transactions, dealings, projects, plans, proposals, staff and other business affairs that are disclosed directly or indirectly by one party (the "disclosing party") to the other (the "receiving party") at any time in contemplation of or in connection with this Agreement (whether or not it is stated to be confidential at the time of disclosure), including the contents and workings of any services or solution provided by Verifone to the Customer; and (ii) the existence and terms of this Agreement, in respect of which the Customer shall be the receiving party;
"Control" means the ownership of more than 50% of the issued share capital or other equity interest or the legal power to direct or cause the direction of the general management and policies of an entity;
"Customer Acquirer" means an acquiring bank supported by Verifone and used by the Customer to enable the processing of card transactions on its behalf;
"Defect" means a material failure of any Product to operate in accordance with the applicable specification or where any part of the outer body of any Product is cracked or disfigured (and "Defective") shall be construed accordingly;
"Documentation" means the documentation provided to the Customer in relation to any Software, in either printed text or machine-readable form, including the technical documentation, program specification and operations manual;
"Effective Date" means the term start date specified on the Order Form;
“Extension Period” means each successive period of twelve (12) months following the automatic renewal of the term of any Order Form as described in clause 20.1;
"External Element" means any external element, factor or part outside of Verifone’ reasonable control, including the Internet, the Customer's equipment, any third party equipment, telecommunications infrastructure and networks, SIM card performance, the Customer Acquirer changes in Law, and the Customer's, the Customer Personnel's and any third party's acts or omissions;
"Intellectual Property Rights" means patents, rights to inventions, copyright and related rights, trademarks, trade names and domain names, rights in designs, rights in computer software, database rights, rights in confidential information (including know-how) and any other intellectual property rights, in each case whether registered or unregistered and including all applications (or rights to apply) for, and renewals or extensions of, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world;
"Losses" means all losses, liabilities, damages, costs, and expenses howsoever arising (including reasonable legal fees on a solicitor and own client basis and other professional advisors' fees, and disbursements and costs of investigation, litigation, settlement, judgment, interest, penalties and remedial actions);
"Minimum Period" means the minimum term of each Order Form expressed on a line by line basis (and which may be expressed on such Order Form as the quantity of monthly payments to be billed);
“PCI DSS” means the Payment Card Industry Data Security Standards issued by the PCI Security Standards Council from time to time and set out at https://www.pcisecuritystandards.org;
"Personnel" means, in relation to a party, that party's employees, agents, consultants and subcontractors;
"Products" means the Terminals and other products provided to the Customer by Verifone under this Agreement, as described in the applicable Order Form and/or Exhibit, including all substitutions, replacements or renewals of such products and all related accessories, manuals and instructions provided for them;
“Sensitive Authentication Data” means the following: - Full Magnetic Stripe Data, or CAV2/CVC2/CVV2/CID, or PIN/PIN Block (as those terms are commonly understood in the payment card industry);
"Services" means the services to be provided by Verifone to the Customer under this Agreement, as more particularly described in the applicable Order Form and/or Exhibit;
“Solution" means the Products, Services and Software provided by Verifone to the Customer as set forth on an Order Form which enables card acceptance. The Customer is able to request authorisation of a transaction by the routing of such transaction using Verifone’s payment gateway services either from a supported Verifone Terminal (directly via a payment application Software loaded onto the Terminal, or indirectly via certain POS Client Software loaded onto Customer’s point of sale system), to the Customer Acquirer or, in the case of the E-Commerce Services, by routing such transaction by a supported integration method to the Customer Acquirer. The Solution will perform card payment processing functions securely in accordance with payment card industry standards utilising EMV Chip & Pin technology, contactless or (where supported) magnetic swipe; and for E-Commerce Services using 3-D Secure authentication and (where selected) fraud screening. Additional information in respect of each Solution is available in documentation provided by Verifone.
"Software" means the software products provided by Verifone to the Customer under this Agreement, as more particularly described in the applicable Order Form, and which will include any software embedded into the Terminals; and
"Term" means the term of this Agreement determined in accordance with clause 20;
"Terminals" means the payment devices provided to the Customer by Verifone under this Agreement, as identified in the Order Form;
In this Agreement the following rules of interpretation shall apply:
1. clause headings are included for convenience only and will not affect the construction or interpretation of this Agreement;
2. any phrase introduced by the words "including", "includes", "in particular", "for example" or similar shall the phrases "other", "including" and "in particular" shall not limit the generality of any preceding words or be construed as being limited to the same class as any preceding words where a wider construction is possible;
3. any obligation on a party not to do something shall include an obligation on that party not to permit a third party to do that thing;
4. use of the singular includes the plural and vice versa;
5. any reference to "persons" includes natural persons, firms, partnerships, bodies corporate, corporations, associations, organisations, governments, government bodies, states, foundations and trusts (in each case whether or not incorporated and whether or not having separate legal personality);
6. the words "in writing" and "written" mean "in documented form" whether electronic or hard copy and include email;
7. any reference to a statute or provision of a statute includes references to:
(a) that statute or provision as amended, extended or applied by any other provision regardless of whether the other provision became law before or after this Agreement;
(b) any re-enactment of that statute or provision (with or without change); and
(c) any regulation, order, code of practice or similar thing having the force of law made (before or after this Agreement) under that statute or provision or any provision falling within clauses (a) or (b); and
8. references to "indemnifying" any person against or with respect to any circumstance shall include indemnifying and keeping it harmless, on an after tax basis, from all Claims from time to time made against it and all Losses suffered, made or incurred by it arising from or in relation to such circumstance.
EXHIBIT B
SOLUTION SUPPORT
HELPDESK SUPPORT. Verifone provides a Helpdesk Support Service during Support Hours. Support Hours are between 8am – 8pm Monday to Friday; between 9am – 8pm on Saturdays; between 10am and 5pm on Sundays; in each case including bank holidays but excluding Christmas day. Verifone supports the latest version of the Software and the immediately preceding version only.
TERMINAL EXCHANGE SERVICES. Verifone provides a standard Terminal Exchange Service (Customer Return by Mail) for hired Terminals and additional chargeable services at such fees as set forth on the Order Form or, if not set forth therein, at Verifone’s then current fees. The details for all such services are provided in documentation available upon request.
EXHIBIT C
DATA PROCESSING TERMS
1. In this Exhibit C, the terms "data controller", "data processor", "personal data", and "processing" bear the respective meanings given them in Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”).
2. In the event that any part of the Solution provided to Customer by Verifone involves Verifone processing any personal data falling within the scope of the GDPR on behalf of Customer, then the parties hereby record their intention that Customer shall be the data controller and Verifone shall be the data processor and, in any such case, the parties further agree as follows:
(i) Customer shall ensure that Customer is entitled to transfer the relevant personal data to Verifone or the relevant Verifone Affiliate so that Verifone or such Verifone Affiliate may lawfully use, process and transfer the personal data on behalf of Customer in accordance with applicable law and this Agreement.
(ii) Notwithstanding anything contained in this Clause 19, Customer understands and acknowledges that Customer is solely responsible for implementing and maintaining appropriate security measures for all systems within Customer’s control.
(iii) Customer represents and warrants that by transferring or providing personal data to Verifone and by allowing Verifone to process personal data for the purposes of this Agreement, Customer will not be in breach, and will not cause Verifone or any Verifone Affiliate to be in breach, of the GDPR or any other applicable data protection laws.
(iv) Verifone shall only process the personal data in accordance with Customer’s lawful and documented instructions, including as set out in this Agreement and any other agreement that may be executed between Customer and Verifone, unless otherwise required by applicable law. In such case, Verifone shall inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. If Verifone considers that an instruction infringes the GDPR or any other provision of Union law or Member States laws and regulations relating to data protection, it shall immediately notify Customer in writing.
(v) Verifone shall take appropriate technical and organizational measures to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (a “Security Incident”).
(vi) Upon becoming aware of a Security Incident affecting personal data processed on behalf of Customer, Verifone shall notify Customer without undue delay and shall provide reasonable cooperation as Customer may require to fulfil any data breach reporting obligations it may have under the GDPR. Verifone shall further take such reasonably necessary measures or actions to remedy or mitigate the effects of the Security Incident and shall keep Customer informed of all material developments in connection with the Security Incident.
(vii) In the event of a Security Incident, Verifone will (i) investigate the Security Incident, (ii) provide Customer with a remediation plan to address the Security Incident and to mitigate the incident and reasonably prevent any further incidents, (iii) remediate the effects of the Security Incident in accordance with such remediation plan, and (iv) reasonably cooperate with Customer (including, but not limited to, providing audit logs) and any law enforcement or regulatory official investigating such Security Incident.
(viii) Customer agrees that Verifone may subcontract the processing of the personal data to Verifone Affiliates and unaffiliated third-party sub-processors ("Sub-processor(s)") to process personal data under the Agreement. Additional information on Verifone Affiliates and sub-Processors is available at http://www.verifone.com/en/us/general-data-protection-regulation-gdpr. Notwithstanding Customer's consent to the Sub-processors, Verifone shall provide reasonable notice to Customer of the engagement of any new Sub-processor and, if Customer objects in writing to the new Sub-processor on reasonable grounds relating to data protection within fifteen (15) calendar days of receiving such notice, then Verifone shall either not engage that Sub-processor to process the personal data under this Agreement or will discuss such concerns in good faith with Customer with a view to achieving resolution in accordance with the dispute resolution procedures of this Agreement (if applicable). If resolution cannot be reached, Customer may suspend or terminate the affected processing operations (without prejudice to any fees or charges incurred by Customer prior to the suspension or termination).
(ix) Notwithstanding the foregoing Section 2(viii), Verifone’s contract with any Sub-processor shall require the Sub-processor to protect the personal data to the standards required by applicable data protection laws. Verifone shall remain responsible for any breach of this Clause 18 caused by a Sub-processor to the same extent it is liable under this Agreement.
(x) Customer acknowledges that Verifone’s performance of its obligations under this Agreement may involve the transfer of Customer’s and its end user cardholder’s data (“Merchant Data”) outside of the European Economic Area and/or the United Kingdom, including to portions of Verifone’s cloud services environment located outside of the European Economic Area and/or outside the United Kingdom. Verifone shall not process (or cause to be processed) any Merchant Data originating from an EEA/UK Territory in a country that has not been designated by the European Commission (or, in the case of Merchant Data originating from the UK after the Brexit transition period, the competent UK authority) as providing an adequate level of data protection unless it has put in place such measures (including appropriate safeguards) as are necessary to ensure such transfer is in compliance with the GDPR and UK data protection laws, except where otherwise required by applicable law. Customer authorises transfers of Merchant Data to Verifone Affiliates located in such destinations outside of the European Economic Area and the UK subject to such appropriate safeguards having been put in place. Additional information on Verifone Affiliates is available as http://www.verifone.com/en/us/general-data-protection-regulation-gdpr. Customer appoints and authorises Verifone as its agent to sign Standard Contractual Clauses on behalf of Customer with any non-EEA Verifone Affiliate and Sub-processors.
(xi) From time to time, Customer may need to respond to a request from a data subject seeking to exercise its rights under the GDPR. In such an instance, Verifone, if requested by Customer and insofar as it is commercially reasonable, shall provide assistance to Customer as reasonably necessary to enable Customer to respond to such request. In the event such a request is made directly to Verifone, Verifone shall promptly inform Customer of the same.
(xii) To the extent that, with respect to personal data processed or to be processed by Verifone under this Agreement, Customer is obligated to carry out data protection impact assessments and prior consultations with supervisory authorities as required under the GDPR, Verifone shall, at Customer’s cost and taking into account the nature of the processing and the information available to Verifone, provide reasonable assistance to Customer as needed.
3 Verifone shall maintain adequate documentation verifying its compliance with this this Exhibit C. Customer acknowledges that Verifone’s cloud services environment is regularly audited against Payment Card Industry Data Security Standards (“PCI-DSS”) by independent, third-party auditors and, upon request, Verifone shall provide a copy of its most recent Attestation of Compliance (AOC) to Customer. Further, Verifone shall provide Customer with written responses or documentation (at reasonable intervals and on a confidential basis) to reasonable requests for information that are necessary to confirm Verifone’s compliance with this Exhibit C.
4. Verifone shall ensure that any personnel that it authorises to process the personal data shall be subject to a duty of confidentiality.
5. Upon expiry or termination of this Agreement, Verifone shall delete or return to Customer the personal data (including copies) in Verifone’s possession in accordance with the terms of this Agreement. This requirement shall not apply to the extent that Verifone is required by applicable law or PCI-DSS to retain some or all of the personal data or to personal data archived on backup systems.
6. A description of the nature and purposes of the processing, the types of personal data, categories of data subjects and the duration of the processing that Verifone or Verifone Affiliate may carry out on behalf of Customer are set out further below:
(i) Nature and purposes of the processing: The processing of personal data carried out are those necessary to enable Verifone to provide any product or service under the Agreement;
(ii) Type(s) of personal data processed: In providing products or services under the Agreement and any additional instructions provided by Customer, they types of personal data collected and processed may include:
• Customer’s and its end user and cardholder’s identification data (e.g., name, email, etc.),
• payment information (e.g., credit card number, expiry date, CVV, etc.),
• payment device and connectivity information (e.g., UID, IP addresses, etc.)
• transaction data (e.g., order reference, transaction time, amount, authorization) and
• similar data directly related to the processing of personal data on behalf of Customer;
(iii) Categories of data subjects: The personal data to be processed on-behalf of Customer may include, but is not limited to, the following categories of data subjects: Customer’s and its end user and shoppers (e.g., cardholder, payer, consumer); and Customer’s employees, agents, consultants, service providers if applicable vendors;
(iv) Duration of processing: The personal data will be processed for the duration of the term of this Agreement unless otherwise agreed between the Parties or required by applicable law or regulation.
7. Information regarding the processing of personal data carried out by Verifone as Data Controller. Verifone processes personal data of Customer, acting as data controller, and especially those relating to Customer’s employees (in particular identification data), for the purposes of managing the business relationship (invoicing, order process, etc.), complying with legal obligations, security and business continuity, optimization of the services and management/creation of access accounts. Further, notwithstanding the other provisions in this Exhibit C, Verifone processes personal data relating to end user cardholder data subjects, acting as data controller, for security and fraud screening purposes. These processing are carried out for the performance of the Agreement and/or are based on Verifone’s legitimate interest. These personal data are necessary to enable Verifone to fulfil its obligations under the Agreement. If Customer does not provide to Verifone the personal data, Verifone will not be able to fulfil its obligations under the Agreement. These personal data may be disclosed to Verifone’s internal services, Affiliates and Verifone’s Data Processor(s). In addition, the personal data may be transferred outside the EEA and/or the UK, in particular to the United States, to Verifone Affiliates and data processors on the basis of the Standard Contractual Clauses executed with those parties. These personal data will be retained for the duration of the Agreement and longer, if necessary to fulfil the purposes for which they are collected or to exercise, established or defend legal claims, and may be archived for administrative and/or probative purposes. In accordance with applicable data protection laws, a data subject has the right to access, rectify, erase, restrict, object, request the portability or their personal data and the right to set guidelines on their personal data in case of death, together with the right to lodge a complaint before the competent supervisory authority. Data subject may exercise its rights by writing to: privacy@verifone.com. For more information regarding the processing of personal data carried out by Verifone, please click on this link: www.verifone.com/us/gdpr-privacy-policy. Insofar as Verifone is not in a direct relationship with the data subject whose personal data are collected, Customer undertakes to provide its employees concerned by the processing operations with all information relating to the processing of their personal data for the purposes described above.