Data Processing and Security Terms

These Supplemental Data Processing and Security Terms ("Supplemental Terms") apply to Verifone's processing of Personal Data on behalf of Customer in connection with the Products and Services and form part of Verifone's Standard Terms and Conditions (the "Agreement"). If these Supplemental Terms conflict with the Agreement, these Supplemental Terms govern on data processing and security matters. To the extent Applicable Data Protection Laws require additional or more protective terms, those laws govern. Jurisdiction-specific terms required by European Data Protection Law and by the California Consumer Privacy Act are set out in Section A (European Data Protection Law) and Section B (CCPA/CPRA), respectively, which supplement and, where they conflict with the general terms of these Supplemental Terms, prevail.

1. Definitions

• Applicable Data Protection Laws: means all data protection and privacy laws applicable to the processing of Customer Personal Data under this Agreement, including, as applicable, European Data Protection Law and the CCPA.
• CCPA: means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, together with all implementing regulations.
• Customer Personal Data: means Personal Data that Verifone processes on behalf of Customer pursuant to this Agreement.
• European Data Protection Law: means, as applicable, the EU GDPR, the UK GDPR, and the Swiss FADP.
• EU GDPR: means Regulation (EU) 2016/679.
• GDPR: means, as applicable, the EU GDPR or the UK GDPR.
• Personal Data: has the meaning given under Applicable Data Protection Laws.
• SCCs: means the standard contractual clauses adopted by the European Commission under Implementing Decision (EU) 2021/914, as amended, replaced, or superseded from time to time.
• Security Incident: means any confirmed accidental or unauthorized access to, disclosure of, loss, alteration, or destruction of Customer Personal Data.
• Sub-processor: means any third party (including Verifone affiliates) engaged by Verifone to process Customer Personal Data.
• Supervisory Authority: means the competent data protection authority for the relevant jurisdiction.
• Swiss FADP: means the Swiss Federal Act on Data Protection.
• UK Addendum: means the International Data Transfer Addendum issued by the UK Information Commissioner's Office.
• UK GDPR: means the EU GDPR as retained in UK law under the European Union (Withdrawal) Act 2018.

2. Data Roles

The data controller and processor roles vary by service as follows:

• Back-End and Cloud Services: Verifone acts as data processor on behalf of Customer (as controller) in respect of cardholder and transaction data processed for authorization and settlement. To the extent Verifone processes transaction data for its own fraud prevention and risk management purposes, Verifone acts as an independent controller, as further described in Section 8 (Verifone as Controller) of these Supplemental Terms.
• Payment Gateway: Verifone acts as data processor on behalf of Customer (as controller) in respect of cardholder and transaction data processed for authorization and settlement. To the extent Verifone processes transaction data for its own fraud prevention and risk management purposes, Verifone acts as an independent controller, as further described in Section 8 (Verifone as Controller) of these Supplemental Terms.
• Estate Manager: Verifone acts as data processor on behalf of Customer (as controller) in respect of administrator account data (names and contact details of Customer's users). Device operational data (serial numbers, telemetry, firmware versions) that does not constitute Personal Data is processed by Verifone as an independent controller for service provision and improvement purposes.
• Software: Verifone processes contact details of Customer representatives as an independent controller for account management and contractual purposes.

3. Verifone's Obligations

• Purpose Limitation: Verifone will process Customer Personal Data only for purposes of performing under this Agreement or on Customer's documented instructions and will not process it for any other purpose, except as required by applicable law.
• Confidentiality: Verifone will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.
• Security: Verifone will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against unauthorized access, disclosure, loss, or destruction, taking into account the nature, scope, context, and purposes of processing and the risks to data subjects, including the measures described in Exhibit A.
• Sub-processors: Verifone will ensure each Sub-processor is bound by data protection obligations at least as protective as those set out in these Supplemental Terms and will remain liable for its Sub-processors' performance of such obligations as required by applicable law.
• Data Subject Rights: Verifone will provide reasonable assistance to Customer in responding to data subject rights requests under Applicable Data Protection Laws. If Verifone receives such a request directly, it will promptly redirect it to Customer.
• Security Incidents: Verifone will notify Customer of a Security Incident without undue delay and in any event within 72 hours of becoming aware of it. The notification will describe, to the extent then known: (i) the nature of the Security Incident, including the categories and approximate number of data subjects and Customer Personal Data records affected; (ii) the likely consequences of the Security Incident; (iii) the measures Verifone has taken or proposes to take to address the Security Incident and mitigate its potential effects; and (iv) contact details for further information. Where complete information is not available within 72 hours, Verifone will provide an initial notification with information then available and supplement it without undue delay. The Parties will cooperate in meeting their respective obligations arising from the Security Incident, including notifications to Supervisory Authorities or data subjects, and including coordinating the content and timing of any notification that references Verifone or its licensors, consistent with Section 17.2 of the Agreement. Notification does not constitute an acknowledgment of fault or liability.
• Compliance: Upon reasonable written request, Verifone will provide information reasonably necessary to demonstrate compliance with these Supplemental Terms, including its most recent third-party audit reports or certifications where available.

4. Data Use

Verifone may collect and use technical, operational, and usage data generated by or derived from the Products and Services. Verifone may use such data to provide, operate, maintain, secure, and improve the Products and Services, detect and prevent fraud or misuse, comply with applicable laws and regulations, and develop and enhance its products, services, and technologies. Verifone may not use data derived from Customer Personal Data for training artificial intelligence and machine learning models or provide such Customer Personal Data to public artificial intelligence systems, except if that data has been irreversibly anonymized such that no individual can be identified, directly or indirectly, by any means reasonably likely to be used.

5. Sub-processors

Customer consents to Verifone's use of Sub-processors. A current list is available at the location identified by Verifone in the Documentation or on its Privacy Trust Center. Verifone will give at least 14 days' prior written notice of the engagement of any new Sub-processor. If Customer objects in writing within 14 days of such notice, identifying a specific and documented material risk to the processing of Customer Personal Data on reasonable data-protection grounds, the Parties will discuss the objection in good faith with a view to resolving it, including by identifying an alternative Sub-processor or adjusted processing arrangement. If the Parties cannot resolve the objection within 90 days of Customer's written objection, Customer may terminate only the directly affected Service on 30 days' written notice, subject to the payment of all Fees accrued to the termination date.

6. Cross-Border Data Transfers

Verifone operates globally and Customer Personal Data may be transferred to and processed in countries outside the country in which it was collected. Verifone will ensure that any such transfer is made subject to appropriate safeguards as required by Applicable Data Protection Laws. Where a transfer of Customer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country not recognized as providing an adequate level of protection under the applicable European Data Protection Law requires execution of SCCs or equivalent instruments, the applicable module of the SCCs (Module 2 where Customer is a controller and Verifone is a processor, or Module 3 where Customer is itself a processor) will apply and, for transfers involving UK personal data, will be supplemented by the UK Addendum. The Parties' execution of this Agreement constitutes execution of the applicable SCCs and UK Addendum, which are incorporated by reference. Verifone will apply equivalent transfer safeguards for transfers to Sub-processors. Customer may request copies of the applicable SCCs or UK Addendum by contacting privacy@verifone.com.

7. Customer's Obligations

Customer will: (a) comply with Applicable Data Protection Laws in respect of Customer Personal Data, including providing required notices and obtaining required consents before providing Personal Data to Verifone; (b) cooperate with Verifone in responding to data subject rights requests; and (c) ensure that Customer Personal Data provided to Verifone is accurate and limited to what is necessary for the applicable Service.

8. Verifone as Controller

To the extent Verifone processes Personal Data as an independent controller for its own business purposes (including fraud prevention, risk management, account management, and invoicing), Verifone will do so in accordance with its privacy notice as published on verifone.com from time to time and Applicable Data Protection Laws.

9. Data Retention and Deletion

Upon expiry or termination of this Agreement, Verifone will delete or return all Customer Personal Data at Customer's election within 90 days, unless retention is required by applicable law or for data held in standard backup systems, in which case Verifone will continue to protect such data in accordance with these Supplemental Terms until deleted in the ordinary course.

10. Audit

Verifone will make available to Customer, upon reasonable written request, information reasonably necessary to demonstrate compliance with these Supplemental Terms, including its most recent relevant third-party audit reports and certifications and written responses to reasonable compliance questions. If Customer reasonably determines that the information provided is insufficient to verify compliance with a specific provision of these Supplemental Terms or a specific requirement of Applicable Data Protection Laws and such Applicable Data Protection Law grants Customer the right to perform an audit, Customer may request a targeted audit limited to that specific concern on at least 60 days' prior written notice, no more than once per year, and at Customer's cost. Verifone may elect to satisfy any such audit request by commissioning an independent third-party auditor to conduct the audit on Customer's behalf in lieu of providing Customer with direct access to Verifone's systems or facilities. Any audit conducted under this Section is subject to Verifone's reasonable confidentiality and security requirements.

11. Processing Details

• Nature and purpose: Processing necessary to provide the Products and Services under this Agreement.
• Types of Personal Data: Identification data; payment and transaction data; device and connectivity data; and such other data as Customer configures in the applicable Service, provided that Customer is responsible for ensuring that any such additional Personal Data is within the scope of Customer's legal basis for processing.
• Categories of data subjects: Customer's employees and administrators; end users; and cardholders and consumers whose data is processed through the Services.
• Duration: For the Term and until deletion or return of Customer Personal Data.

SECTION A - EUROPEAN DATA PROTECTION LAW

This Section A applies where European Data Protection Law applies to the processing of Customer Personal Data. The terms in this Section A supplement the general terms of these Supplemental Terms and, to the extent of any conflict, prevail. Defined terms used in this Section A are set out in Section 1 (Definitions) of these Supplemental Terms.

A.1 Article 28(3) GDPR

The general obligations set out in Sections 3, 5, 9, and 10 of these Supplemental Terms are intended to, and the Parties agree they do, satisfy the matters required to be addressed by Article 28(3) of the GDPR. Where required by GDPR, Verifone will notify Customer without undue delay if, in Verifone's reasonable opinion, an instruction from Customer infringes European Data Protection Law, unless such notification is prohibited by applicable law.

A.2 International Transfers

Transfer mechanisms applicable under European Data Protection Law, including the SCCs and UK Addendum, are set out in Section 6 (Cross-Border Data Transfers) of these Supplemental Terms.

A.3 Data Protection Impact Assessments and Prior Consultation

Where required under European Data Protection Law, Verifone will assist Customer in carrying out data protection impact assessments and, where applicable, prior consultation with the competent Supervisory Authority, taking into account the nature of processing and the information available to Verifone.

A.4 UK GDPR

Where the UK GDPR applies, references in these Supplemental Terms to EU Member State law and to competent Supervisory Authorities will be read to include, as applicable, the corresponding law of the United Kingdom and the UK Information Commissioner's Office.

A.5 Swiss FADP

Where the Swiss FADP applies, references in these Supplemental Terms to the GDPR, EU Member State law, and competent Supervisory Authorities will be read to include, as applicable, the Swiss FADP, Swiss law, and the Swiss Federal Data Protection and Information Commissioner, so that data subjects in Switzerland retain equivalent rights and remedies under Swiss law.

SECTION B - CALIFORNIA CONSUMER PRIVACY ACT / CALIFORNIA PRIVACY RIGHTS ACT (CCPA/CPRA)

This Section B applies where the CCPA applies to the processing of Customer Personal Data. The terms "business", "consumer", "contractor", "personal information", "sale", "sell", "service provider", "share", and other similar terms used in this Section B have the meanings given in the CCPA. References to "Customer Personal Data" in this Section B include "personal information" as defined in the CCPA.

B.1 Role and Scope

Verifone acts as a service provider, contractor, or processor to Customer when processing Customer Personal Data to provide the Services under the Agreement. Verifone acts as an independent business for personal data it processes to manage the business relationship with Customer, including invoicing, account administration, legal compliance, fraud screening, business continuity, and account access management.

B.2 Permitted Processing

Verifone will process Customer Personal Data only to provide, maintain, and secure the Products and Services, follow Customer's documented instructions, and otherwise perform its obligations under the Agreement, which may include facilitating payment transactions, managing customer accounts, providing customer service, managing and improving Verifone's Products and Services, complying with legal obligations, and protecting against fraudulent or unauthorized transactions, in each case as permitted by the CCPA.

B.3 Restrictions on Use of Personal Information

Except as otherwise permitted by the CCPA, Verifone will not: (i) sell or share (for cross-context behavioral advertising) Customer Personal Data, nor use it to build or augment profiles for advertising or marketing to consumers; (ii) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes set out in this Agreement; (iii) retain, use, or disclose Customer Personal Data outside the direct business relationship between Verifone and Customer; or (iv) combine or update Customer Personal Data with personal information received from another source or collected from Verifone's own interaction with any consumer.

B.4 Compliance

Verifone will comply with the CCPA and applicable CCPA regulations to the extent they apply to Verifone's processing of Customer Personal Data under this Agreement and will provide the same level of privacy protection for such Customer Personal Data as required by the CCPA.

B.5 Consumer Requests

Verifone will assist Customer in responding to consumer requests to access, correct, delete, obtain a portable copy of data, and opt-out of sales, targeted advertising, and profiling. Verifone will promptly notify Customer of requests it receives directly. Where technically feasible and as directed by Customer, Verifone will pass through or honor Customer's implementation of universal opt-out mechanisms recognized under the CCPA.

B.6 Notice of Inability to Comply

Verifone will notify Customer without undue delay if Verifone determines that it can no longer meet its obligations under the CCPA or this Section B, unless such notification is prohibited by applicable law.

B.7 Certification

To the extent Verifone acts as a contractor under the CCPA, Verifone certifies that it understands the restrictions and requirements applicable to it under the CCPA and will comply with them.

EXHIBIT A - TECHNICAL AND ORGANIZATIONAL MEASURES

Verifone maintains a written information security program designed to protect Customer Personal Data, including cardholder data, consistent with PCI DSS requirements applicable to Verifone's Products and Services and broadly aligned to the NIST Cybersecurity Framework, Center for Internet Security controls, and ISO 27000 standards. The specific implementation of the measures below may be updated from time to time, provided the overall level of protection is not materially reduced:

• Governance: Verifone maintains written information security policies reviewed at least annually, designates information security leadership, provides security and data protection training to all personnel with system access at least annually, and performs background checks on personnel with access to Customer Personal Data to the extent permitted by applicable law.
• Access Controls: Verifone grants access to systems processing Customer Personal Data on a role-based, least-privilege basis and requires multi-factor authentication for such access and access to sensitive systems, maintains centralized identity management with periodic access reviews, and revokes access promptly upon role change or departure. Verifone controls physical access to data processing facilities through access logging, visitor management, and environmental controls.
• Encryption: Verifone encrypts Customer Personal Data in transit over public networks using industry-standard protocols and encrypts Customer Personal Data at rest when stored in production systems used to host or operate the Services. Verifone maintains documented key management procedures.
• Network and System Security: Verifone segments its network between production and non-production environments and maintains firewalls, intrusion detection and prevention capabilities, and malware protection on applicable systems. Verifone conducts vulnerability scanning with timely remediation, maintains hardened system configurations, and logs and monitors security-relevant events with log retention consistent with PCI DSS requirements.
• Secure Development: Verifone follows a secure software development lifecycle that includes code review, security testing, and separation of development, testing, and production environments, and conducts periodic application security testing.
• Monitoring and Incident Response: Verifone operates a global Security Operations Centre providing 24/7 monitoring and response to security events and maintains a documented incident response plan with defined roles, response procedures, escalation paths, and customer notification processes, and tests the plan periodically.
• Business Continuity and Backup: Verifone maintains documented business continuity and disaster recovery plans and maintains 24/7 managed backup for production systems used to host or operate the Services with data backed up at least daily to a secondary site and retained for ninety (90) days.
• Assessments and Certifications: Where required, a Qualified Security Assessor assesses Verifone's Products and Services against PCI DSS, and Verifone makes its Attestation of Compliance available to Customer on request on a confidential basis. Additional certifications applicable to specific Services are listed on Verifone's trust center and may be provided on request.