Alert Services Agreement

Version 5.0

Last Updated: 22 March 2026

The following terms apply to Agreements entered into on or after 22 March 2026, as well as any earlier agreements where the Parties agreed to the application of the updated terms (including in a Schedule).

For other Agreements entered into before 22 March 2026, please see the relevant terms here.

WHEREAS:

1. the Company wishes to engage CBH for the provision of Services as described herein;

2. CBH has agreed to supply the said services on the terms and conditions set out in this Agreement;

3. it is the express objective and intention of the Parties to this Agreement to achieve a high degree of efficiency in their professional relationship, to their mutual benefit.

NOW, THEREFORE, the Parties hereto agree as follows:

1. Conditions Precedent

1. The following shall be the condition precedent for CBH to start rendering the Services:

   1. The Company has integrated with CBH according to the Documentation and CBH instructions;

   2. The Company successfully underwent the verification and due diligence processes by providing the Company Information requested by CBH, and provided CBH with the following information: Acquirer BIN, Acquirer CAID number, payment descriptor, d.b.a. (doing business as), Company's legal entity name, and MCC;

   3. The Company granted the Acquirer and other third-party service providers (if any) consent (for the term of the Agreement) to provide CBH with information regarding the Company's Transactions.

2. If the Company becomes non-compliant with any of the conditions precedent set out in clause 1.1, CBH shall have the right to suspend rendering Services until the Company is compliant again.

3. In consideration of the Fees and subject to the Company's conformity with the Agreement, CBH shall render Services as set out in this Agreement.

2. Services

1. Subject to the terms and conditions of this Agreement, CBH shall provide Company with chargeback prevention services that enable the Company to attempt to resolve Account Holder's billing disputes before they are escalated to Chargebacks, and other related services as described in Schedule A hereto or otherwise expressly agreed between the parties in writing (the "Services").

2. The Services may include tools and features designed to prevent disputes before they occur (including, without limitation, Order Insight CE 3.0 and Mastercard Clarity), facilitate the resolution of disputes, mitigate or avoid chargebacks (such as RDR/CDRN) and monitor, analyse, and report on fraud-related data (including, without limitation, TC40). The tools included in the Services for a particular Company shall be detailed in Schedule A.

3. Unless the Company integrates the Services with its Acquirer and chooses the relevant integration type through Customer Portal, CBH will not be responsible for cancelling and/or refunding any Transaction on behalf of the Company. CBH shall also not be responsible if the Company's Acquirer is unable to issue Refunds for Transactions for any reason, or if CBH does not have the appropriate access or permissions to perform Refunds on behalf of the Company, including where the Company fails to provide timely access to its Acquirer, whether through API integration or otherwise.

4. CBH shall render the Services with reasonable care and skill and in accordance with the Applicable Law.

5. The change in Applicable Laws may affect CBH's ability to provide and the Company's ability to receive the Services.

6. Without derogating from any other right available to CBH under this Agreement, Applicable Laws or otherwise, on the basis of risk management considerations or where required to comply with the Applicable Law, CBH, in its sole discretion, has the right to suspend the Services in any jurisdiction at any time and for any period of time.

7. The Company acknowledges and agrees that while the Services help enhance security and minimise risks associated with Transactions, they do not guarantee complete protection against fraud, Chargebacks, or disputes.

8. The Company expressly acknowledges and agrees that CBH acts as a reseller of products and tools provided by third parties. The provision, availability, functionality, and accuracy of the Services are inherently dependent upon the availability and performance of the relevant third parties. CBH does not control and shall not be liable for any decisions, modifications, interruptions, suspensions, or terminations of the products or tools offered by these third parties.

9. Any updates, technical changes, or policy modifications implemented by the third parties may directly impact the performance or scope of the Services. CBH shall not be held responsible or liable for any such effects, limitations, or consequences arising therefrom.

10. CBH reserves the right to use other third-party providers in rendering any of the Services to the Company. CBH shall exercise reasonable care while choosing the provider. CBH accepts no liability for the provision of the Services by any third party.

3. Fees

1. The Company shall pay the Fees defined in Schedule A to the Agreement.

2. Where Schedule A to the Agreement provides for a prepayment amount, the Company acknowledges and agrees that CBH may, at its sole discretion, refuse to commence providing the Services until such prepayment amount has been paid.

3. For purposes of using the Services, CBH shall provide the Company with access to a Customer Portal. The Customer Portal will show information on the Company's use of the Service and the available Account Balance. The Company shall be solely responsible for maintaining the security of its account. The Company acknowledges and understands that it will be charged for any Services used or ordered through its account.

4. The Company may use the Services only while it maintains a positive Account Balance or, where a Credit Limit has been established in accordance with Schedule A to the Agreement, until its negative Account Balance reaches that Credit Limit. Once the Account Balance is depleted or the Credit Limit is reached, CBH may, at its sole discretion (but without any obligation to do so), suspend the provision of the Services without further notice to the Company until the Account Balance is topped up.

5. CBH shall exert commercially reasonable effort to notify the Company whenever its Account Balance is close to zero or, if a Credit Limit is established, when the Credit Limit is about to be reached. The Company agrees that such notifications shall be for convenience only and no right or remedy available to CBH under this Agreement or otherwise shall be contingent on CBH providing such notification.

6. The Account Balance can only be used to pay for the Services. The Account Balance does not constitute a personal property right and has no value outside the Services. Additionally, the Account Balance is not a bank account or a payment account. The Account Balance is non-transferable, does not accrue interest, dividends, or any other earnings, does not constitute deposits, and is not insured by deposit insurance or any other governmental agency or any other guarantee fund, coverage or compensation mechanism. The Account Balance has no cash value and cannot be redeemed or exchanged for cash, in whole or in part. CBH may place a hold on the Company's Account Balance if CBH reasonably suspects fraud, abuse, Chargebacks, or a breach of this Agreement, or to comply with law or a request from an Acquirer, Third-Party Services Provider or Regulatory Authority.

7. The Fees paid and due and the then-current Account Balance shall be confirmed by an invoice (or an electronic invoice) issued by CBH on a monthly basis. CBH shall have the right, in its sole discretion, to issue the invoice to Company if the Fees due reach the applicable Credit Limit (or equivalent in any currency). This shall be without prejudice to CBH issuing a monthly invoice. The Company grants its consent to obtain electronic invoices from CBH. The invoices will be sent to the Company's e-mail address indicated in the Company Information.

8. Unless otherwise specified in the relevant invoice, the net Fees due shall be paid by the Company to CBH's bank account stipulated in the invoice within ten (10) calendar days of receiving the invoice.

9. The Company shall be responsible for providing to CBH complete and accurate billing and contact information and shall notify CBH of any changes to such information.

10. The Company may add amounts to its Account Balance using Top Up Methods supported by CBH. CBH shall notify the supported Top Up Methods to the Company from time to time. CBH supports Top Up Methods at its own discretion and may disable any Top Up Method at any time.

11. By submitting credit card details or connecting or using any other Top Up Method in its account, the Company (i) represents and warrants that the Company is duly authorised to use the Top Up Method; and (ii) authorises CBH and/or its payment service provider to charge the Top Up Method or otherwise process the payment of the Fees using such Top Up Method. If the Company enables auto top-ups, the Company also authorises CBH to charge its Top Up Method by the amount and frequency chosen by the Company until that setting is disabled by the Company.

12. The Company is solely liable for problems arising from failed payment, including but not limited to payment processing errors, delays, or failures caused by third-party payment processors. If CBH and/or the payment service provider cannot charge the Company's Top Up Method for any reason, the Company remains responsible for any uncollected amounts.

13. All bank fees, bank commissions, exchange rate losses or commissions on currency exchange, fees imposed by the card issuer or other Top Up Method provider or payment processor and all other costs and fees related to payments are at the expense of the Company. The Company undertakes to perform all necessary actions and pay all necessary accompanying fees and expenses so that CBH receives the full amounts due hereunder.

14. Any outstanding Fees and other amounts that are not paid within the timeframe specified in the relevant invoice (except to the extent they are disputed by the Company in accordance with this Agreement) shall be considered overdue ("Overdue Amounts"). Where there is any Overdue Amount owed by the Company to CBH, in addition to all other remedies that may be available under this Agreement or otherwise:

1. in case the invoice is over thirty (30) calendar days past due, there will be an interest rate applied on any Overdue Amounts, calculated as days overdue multiplied by the EURIBOR annual interest rate +1,99% divided by 365, or, if lower, the highest rate permitted under Applicable Law, provided that CBH can, at its sole discretion, waive its right to claim the accrued interest or claim a lower interest;

2. CBH also will be entitled at any time and without further notice or liability to the Company (i) to suspend providing Services, (ii) to inform any third party providers about any Overdue Amounts owed by the Company to CBH, (iii) to suspend the release of any data provided by the Company, including CAID(s), BIN(s), Payment Descriptor(s), and any other data or otherwise disrupt the provision of any third party providers' services to the Company, (iv) to instruct any third party providers to withhold any data provided by the Company or otherwise disrupt the provision of their services to the Company, and (v) apply to the Acquirers (and/or other relevant third parties involved) with instructions to debit the Company's bank account for repayment of any sums that are due and owing by the Company to CBH, and the Company irrevocably authorises its financial institution to accept such instructions;

3. CBH may also take other steps to recover the Overdue Amounts, such as instructing a debt collection agency to contact the Company; issuing legal proceedings for enforcement purposes; informing fraud prevention agencies and selling, transferring or assigning the Overdue Amount to a third party; and

4. Company shall reimburse CBH for all reasonable costs incurred by CBH in collecting any Overdue Amount or interest, including attorneys' fees, court costs, and collection agency fees.

15. CBH or its Affiliate may, at any time, with reasonable prior written notice to Company, deduct, recoup or set-off any liability of Company or its Affiliate to CBH or its Affiliate from any funds, sums or other liabilities owed by CBH and/or its Affiliate to Company and/or its Affiliate, whether either liability is present or future, and whether or not either liability arises under this Agreement. If the liabilities to be set off are expressed in different currencies, CBH or its Affiliate may convert either liability at a market rate of exchange for the purpose of set-off. Any exercise by CBH or its Affiliate of its rights under this clause shall not limit or affect any other rights or remedies available to it under this Agreement or otherwise.

16. The Company acknowledges and understands that all Fees paid and due and Account Balance will be calculated exclusively based on the numbers in CBH's online system. If the Company has any valid reason for disputing any amount of an invoice or any charge to its Top Up Method, the Company shall notify CBH in writing within five (5) business days of receipt of the disputed invoice or charge. Within five (5) business days of receipt of the notification from the Company, CBH shall decide whether the invoice or charge amount is disputed reasonably. If CBH accepts the Company's objections, the respective adjustments will be made to the Company's Account Balance, and, where the Top Up Method was not already charged by CBH, the Company shall pay the adjusted sum within five (5) business days when the adjusted invoice has been sent. If CBH rejects the Company's objections, the Company shall pay the Fees defined in the initial invoice. For the avoidance of doubt, where the Top Up Method was charged by CBH, the charge may not be reversed. Instead, the successfully disputed amount of the charge will be credited to the Company's Account Balance.

17. All payments made by Company to CBH are non-refundable, except for pre-paid Account Balance, which shall be refunded upon termination hereof at the request of the Company. Payment made by Company to CBH confirms the Company's agreement with the Fees defined in the invoice.

18. All fees payable to CBH under this Agreement are exclusive of Taxes. All Taxes shall, if applicable, be borne by the Company. In case any Tax is or becomes chargeable (retroactively or going forward) in accordance with applicable laws, CBH shall add such amount to the Fees accordingly. Where Fees are charged by CBH, the Company acknowledges and understands that CBH will charge its Top Up Method or deduct against its available Account Balances so as to cover any applicable Taxes. If CBH makes payment for such Taxes or if a tax authority requires CBH to pay any Taxes relating to the Company and/or the goods and services sold by the Company, the Company will indemnify and reimburse CBH for such payment.

19. All Fees and other amounts payable to CBH hereunder shall be paid by the Company in full without any setoff, recoupment, counterclaim, deduction, debit, or withholding for any reason (other than deduction from a positive Account Balance).

20. Any repayment of funds to the End User for the execution of the Transaction (as a result of the Chargeback, Refund or otherwise) is subject to the following terms:

1. the Company is solely responsible for repayment of funds, on the terms indicated in the agreement with the Acquirer (and/or other service providers (if any));

2. the Fees charged by CBH in relation to the execution of such Transaction are not to be returned to the Company;

3. notwithstanding any Refund, the original Transaction may still be subject to Chargeback by the End User or Issuer, which may cause the Company to provide a Refund for the same Transaction twice.

21. The Company shall meet all costs associated with its compliance with the Applicable Law.

4. Service Maintenance and Updates

1. CBH will use reasonable efforts consistent with prevailing industry standards to provide the Services in a manner that minimises errors and interruptions in accessing and using the Services.

2. CBH is authorised to suspend rendering the Services for scheduled maintenance or for unscheduled emergency maintenance, either by CBH or by third-party providers, or because of other causes beyond CBH's reasonable control. CBH will use commercially reasonable efforts to conduct maintenance without downtime, but if downtime is necessary, CBH shall have reasonable discretion to determine when to suspend Services and shall use reasonable efforts to give the Company 5 days' prior written notice of such suspension within CBH's control.

3. The Company acknowledges and agrees that the Services and Software are continually evolving and CBH reserves the right to change, update, or amend the Services and/or Software at any time, to provide the Company with a new version thereof, and/or to change the functionalities and characteristics thereof. CBH shall give reasonable advance notice to the Company if the changes will materially reduce the functionality of the Services, except where such changes are made necessary by:

   1. a need to follow generally accepted changes in industry standards;

   2. changes in Applicable Law or Payment Method Rules;

   3. a need for increased security due to security risks identified by CBH; or

   4. other grounds which reasonably warrant immediate reduction of functionality.

5. Obligations of the Company

1. The Company shall:

   1. cooperate with CBH in good faith in all matters relating to the Service (including Fees calculation);

   2. respond promptly to any CBH request to provide information, approvals, authorisations, or decisions that are reasonably necessary for CBH to provide the Services in accordance with this Agreement; and

   3. provide such Company Materials or Company Information as CBH may reasonably request to provide the Services and ensure that such materials or information are complete and accurate in all material respects.

2. It is prohibited for the Company to:

   1. use the Services in a way that infringes Applicable Law, good practices, rights of third parties, or the policies of the Acquirers, or Third-Party Services Providers;

   2. use the Services to handle the Transactions on the websites and in IT environments that were not previously approved by CBH;

   3. use the Services to process alerts received not via the Technical Solution;

   4. fail to protect the data relating to its End Users, which is collected and stored by the Company against unauthorised access. The Company shall immediately notify CBH if the Company reasonably believes that there has been any security breach, including but not limited to instances of unauthorised access or attempt to access Transaction data or sensitive End-User data, where there is a suspected or confirmed damage, loss or theft of Transaction data or sensitive End-User data;

   5. conduct activity or use the Services in a way that may result in complaints, disputes, charges, penalties and other burdens to CBH or the third parties;

   6. take actions or omissions that may expose CBH to credit risk, risk of fraud, breach of duties related to anti-money laundering and terrorist financing or other statutory obligations or a sudden increase of risk (assessed under the procedures adopted by CBH based on the Company Information and other information available);

   7. take any actions, as a result of which the Technical Solution or any part of CBH's infrastructure will be negatively affected;

   8. engage in misleading or deceptive conduct, nor to use the Services itself or permit others to use the Services for any improper, immoral, or unlawful purposes;

   9. interfere with billing, meter usage, or any Account Balance features, including attempts to circumvent charges or manipulate top-ups;

   10. make improper use of CBH support services or submit false reports of abuse or misconduct;

   11. attempt to bypass any measures of the Services designed to prevent or restrict access to the Services, or any portion of the Services, including circumvent, disable, or otherwise interfere with security-related features of the Services; or

   12. rent, lease, lend, sell, sublicense, assign, distribute, or transfer in whole or in part the right to use the Service or any part thereof without CBH's express written authorisation.

6. Amendments

1. Except for the Fees and any special terms that may be agreed in Schedule A, CBH reserves the right to modify or update any provision of this Agreement, including Standard Clauses, at any time, in particular to reflect changes in Applicable Law, Payment Method Rules, Services offering, technological developments, or internal policies. CBH will give reasonable advance notice to the Company of any material changes. The updated version shall be published on CBH's website and shall become effective on the date of its publication. Upon request, CBH shall provide the Company with a copy or record of previous versions of the terms of the Agreement for reference or compliance purposes.

2. In addition, CBH shall have the right, upon a ten (10) day notice, to change any provision of the Agreement, including but not limited to clause 3 of the Agreement, if:

   1. the changes are made at the request of or due to changes in the terms or rules of Payment Method Owners, Third-Party Services Providers, Acquirers and/or other third parties;

   2. the changes are imposed upon CBH under the Applicable Law;

   3. the change is required on the basis of risk management considerations of CBH, provided that CBH shall communicate the reason for and substantiation of such considerations; or

   4. Company commits a material breach of its obligations under the Agreement.

3. If the Company does not accept the amendments, it may terminate the Agreement before the new provisions enter into force; otherwise, the Company's continued use of the Services after the effective date shall constitute acceptance.

7. Term and Termination

1. The term of this Agreement shall commence on the Effective Date and shall continue until terminated by either Party upon 30 (thirty) days' notice in writing to the other Party.

2. Without limiting or affecting any other right or remedy available to it under this Agreement or otherwise, CBH may terminate this Agreement and/or terminate or suspend any part of the Services immediately and without any liability to the Company if:

   1. the Company fails to perform any obligation required under this Agreement and does not remedy such breach within 5 (five) days from a written request to such effect made by CBH;

   2. CBH is required to do so by any Payment Method Owners or Regulatory Authority;

   3. the changes are imposed upon CBH under the Applicable Law;

   4. this is required on the basis of risk management considerations of CBH, including where CBH reasonably suspects or believes that the Company is using the Services in connection with any unauthorised, dishonest or criminal activities or that the Company's use of the Services presents fraud risk, credit risk, or any other material risk to CBH, or upon notice from the Payment Method Owners that the Company is suspended or violated any of their rules; or

   5. the Company becomes insolvent, fails to pay its debts due to CBH, makes a general assignment for the benefit of creditors, commences procedures for voluntary winding up, suffers or permits the appointment of a receiver for its business assets, or is wound up or liquidated, voluntary or otherwise.

3. In case the Agreement is terminated by any Party, CBH will be under no obligation to provide any Services to the Company after the effective date of such termination, and all Fees due to CBH under the Agreement will become payable on the date of termination of the Agreement.

4. Any termination of this Agreement shall not relieve the Company from any liability arising prior to the termination of this Agreement. Any Services provided and Transactions processed prior to the termination of the Agreement will remain subject to the terms of the Agreement.

8. Standard Clauses

1. The Standard Clauses are an integral part of this Agreement and, except where expressly stated otherwise, all references to this Agreement shall include references to the Standard Clauses. The Company, by signing the Agreement or Schedule A to this Agreement (including signing electronically by checking the box on CBH's website and/or Customer Portal by the Company's representative), acknowledges and accepts the Standard Clauses.

2. The Agreement, including these Standard Clauses, shall be interpreted as a consistent whole, insofar as possible, and the provisions of Standard Clauses are intended to supplement, and not restrict or contravene those outlined elsewhere in the Agreement and vice versa.

3. In the event of a genuine conflict between the provisions of the Agreement (including any Schedule(s)), and except where expressly provided otherwise, the following order of precedence shall apply, but only to the extent of such conflict:

   1. the provisions set forth in Schedule(s), including special terms agreed between the Parties (if any), shall prevail over the other provisions of the Agreement;

   2. the service-specific provisions of the Agreement (i.e. provisions other than the Standard Clauses) shall prevail over the Standard Clauses.

9. Data Protection

1. Personal data processing in connection with this Agreement shall be governed by Schedule C "Data Processing Agreement", which forms an integral part of the Agreement.

10. Use of Terms

1. In this Agreement:

   1. Account Balance means the net amount shown in CBH's online system equal to all payments, prepayments, promotional credits, and adjustments in the Company's favour, less all Fees, Taxes, and other charges accrued or invoiced under the Agreement. The Account Balance may be positive (prepaid Fees for the use of Services) or negative (amounts owed for the Services used).

   2. BIN means the Bank Identification Number (BIN) that is used to clear and settle the transaction within Payment Methods and the country in which it is licensed for use.

   3. CAID means the Card Acceptor ID, which is a numeric string that identifies a store location or transaction point and is provided by the Company's Acquirer.

   4. Credit Limit means the maximum negative Account Balance defined in Schedule A to this Agreement that CBH allows the Company to incur before payment is required.

   5. Standard Clauses means CBH Standard Clauses attached as Schedule B hereto, which are incorporated by reference in this Agreement and form an integral part hereof.

   6. Top Up Method means any payment instrument or funding mechanism accepted by CBH and designated by the Company to add funds to the Account Balance or to pay amounts due, including, without limitation, payment cards, direct debit, e-money/wallets, or other payment methods that CBH supports from time to time.

2. Capitalised terms used but not defined in this Clause will have the meaning given to them in the Standard Clauses.

SCHEDULE B TO THE ALERT SERVICES AGREEMENT

CBH Standard Clauses

1. Scope

1. These Standard Clauses, presented below, are part of the Agreement between CBH and the Company that has the reference to these Standard Clauses and form an integral part of the Agreement.

2. Interpretations

1. In this Agreement, unless the context otherwise requires:

   1. headings are for convenience only and do not affect the interpretation of this Agreement;

   2. words denoting the singular include the plural and vice versa;

   3. a reference to a person includes a reference to any individual or legal entity and any governmental authority;

   4. if the numeric and literal versions of a number differ, the literal version shall have precedence;

   5. a reference to a specific clause, subsection, Annex, Schedule or Preamble is a reference to the applicable clause, subsection, Annex, Schedule or Preamble hereof;

   6. references to any law or normative act shall include any changes, amendments, supplements or substitutions of such law or normative act (in whole or in part);

   7. a reference to any agreement or document is a reference to that agreement or document as may be amended, novated, supplemented, extended or restated, however, to the exclusion of any amendments and supplements made in breach of this Agreement; and

   8. a reference to a party to any document (including to this Agreement) includes that party's successors and permitted assigns.

2. The Preamble and Schedule(s) to this Agreement shall form an integral part thereof.

3. Definitions

In this Agreement, the following terms shall have the meanings ascribed to them below, unless the context otherwise requires:

4. Representations and Warranties

1. Each Party warrants, represents, covenants and agrees that:

   1. as of the date of this Agreement, it has full power and lawful authority to execute and deliver this Agreement and to perform its obligations under this Agreement;

   2. it is duly organised and validly existing under the laws of its domicile and has the legal capacity and corporate authority to own its property and carry on its business as now conducted and is not in breach of its by-laws;

   3. there is no action, suit or proceeding at law or in equity now pending or, to the best of its knowledge, threatened by or against or affecting the Party which would impair its right to carry on its business as now conducted or affect its financial conditions or operations or its ability to perform the obligations required under this Agreement;

   4. it has knowledge of all applicable Anti-Corruption Laws and that neither it nor any of its officers, directors, employees, agents, contractors, designees, ultimate beneficial owners or shareholders, nor any other party acting on its behalf, will directly or indirectly take any action that would constitute a violation of the Anti-Corruption Laws with respect to any activities related to any business for CBH or the Company. Neither it nor any of its direct or indirect Representatives has or will pay, offer, promise to pay or authorize the payment of, offer or promise to pay, directly or indirectly, any monies or anything else of value to any current or former official, political party or official of a political party, or any candidate for public office in connection with this Agreement. Each party acknowledges that, for purposes of this Agreement, an "official" is (i) any officer or employee of a government or any department, agency or instrumentality of a government, (ii) any officer or employee of a public international organization such as the United Nations or the World Bank, (iii) any individual acting in an official capacity for or on behalf of a government agency, department, instrumentality or of a public international organization, (iv) any officer or employee of a company owned or controlled by a government or (v) any member of a royal family who may lack formal authority but who may otherwise be influential, including by owning or managing state-owned or controlled companies. Each party represents and warrants that all representations, warranties and covenants set forth in this clause are truthful and accurate. Each party shall notify the other party in writing immediately upon the occurrence of any event which would render the representations, warranties or covenants contained herein incorrect. If, in good faith, CBH believes that any action under this Agreement will likely cause a violation of the Anti-Corruption Laws, nonperformance shall be excused, and this Agreement may be terminated at CBH's option;

   5. it will comply at all times with all applicable laws, rules, regulations, decrees and prohibitions of whatsoever nature relating (a) to the sale, export or transfer of items or (b) to transactions of any kind with restricted or embargoed countries or territories, restricted or blocked persons or restricted or blocked entities (together, "Embargoed Targets"), including, without limitation, those of the United States, Switzerland and the European Union or its member states ((a) and (b) together, the "Sanctions Laws"). Each party warrants, represents and covenants that (c) it is not located, organised under, ordinarily resident in or acting on behalf of an Embargoed Target and (d) that it is not an Embargoed Target and is not owned or controlled by an Embargoed Target, as defined either expressly or substantively, by the Sanctions Laws. Each party warrants, represents and covenants that it is not aware of any reason why it should be named on any list identifying Embargoed Targets maintained by implementing authorities of, without limitation, the United States, Switzerland or the European Union or member states thereof (together, "Lists"), as such Lists may be amended from time to time. Each party agrees that it shall not (e) sell, directly or indirectly, resell or deliver any good, software or technology to an Embargoed Target, (f) transport any such item on any vessel or other carrier that is owned, operated, flagged or chartered by an Embargoed Target or (g) broker, finance or otherwise facilitate any sale or resale of any such item or transaction that would cause a violation of any Sanctions Law. Each party agrees that it will provide immediately to the other party all information, including, without limitation, information concerning end customer, transit and final destination, shipping and intended end-use, to enable an assessment of compliance with the Sanctions Laws. If, in good faith, CBH believes that any action under this Agreement will likely cause a violation of the Sanctions Laws, nonperformance shall be excused, and this Agreement may be terminated at CBH's option.

2. The Company additionally warrants, represents, covenants and agrees that:

   1. it is in all material respects in compliance with and has at all times been, and is not in material default or violation in any respect of any Applicable Law;

   2. any and all information and documentation provided by the Company hereunder is true, accurate, complete and updated, and no information, document or statement provided or made available is untrue, false, incorrect, incomplete or misleading;

   3. it will not knowingly do anything or allow anything to be done which is likely to harm CBH's reputation or the reputation of Payment Method Owners and/or Acquirers;

   4. to the extent the Company signs this Agreement electronically, including by checking the box through CBH's website, this Agreement is signed by an authorised signatory, and the electronic signature is the legally binding equivalent to a handwritten physical signature.

3. The Company should promptly notify CBH if it believes there has been or will be a misappropriation or unauthorised checking of the box or other usage of CBH's website. The Company must give CBH all the information in its possession as to the circumstances of any misappropriation or unauthorised use of CBH's website, including, but not limited to, unauthorised online acceptance of this Agreement by checking the box. CBH may provide third parties with the information it considers relevant in such circumstances.

4. Each Party undertakes that it shall not, for the term of the Agreement and for a period of 2 years thereafter on its own behalf, or on behalf of any person directly or indirectly, canvass, solicit or endeavour to entice away from the other Party any person who has at any time during the term of the Agreement been employed or engaged by that Party.

5. If any of those representations and warranties are affected at any time during the term of this Agreement, immediately, but no later than 5 Business Days, the Party shall inform the other Party of any changes.

6. Except as expressly stated in this Agreement, no representation, inducement, or warranty was, prior to the execution of this Agreement, given or made by one of the Parties hereto with the intent of inducing the other Party to enter into this Agreement, and any representations, inducements or warranties that may have been so given are hereby denied and negated.

7. Except as expressly stated in this Agreement, the Services, Software, and Documentation are provided on an "as is" and "as available" basis and to the maximum extent permitted by Applicable Law, CBH specifically disclaims all representations, warranties and conditions whether express or implied, arising by statute, operation of law, usage of trade, course of dealing, or otherwise, including but not limited to, warranties or conditions of merchantability, fitness for a particular purpose, or non-infringement. The Company may not rely on any representation or warranty regarding the Services by any third party in contravention of the foregoing statements.

5. Indemnification

1. Company agrees to defend, indemnify and hold CBH (including its officers, directors, employees, agents, successors, and assigns) harmless from any claim or demand, actions, proceedings, damages, expenses, costs (including without limitation court costs and reasonable legal fees) and any other Losses made due to or arising out of any act or omission of Company, including:

   1. Company's breach of this Agreement;

   2. Company's use of the Services;

   3. Company Materials;

   4. Company's negligence or willful misconduct, and/or

   5. Company's violation of Applicable Law or the rights of a third party.

2. CBH agrees to defend, indemnify and hold Company harmless from any claim or demand (including reasonable legal fees) made by any third party asserting that the Company's use of the Services and/or Software in accordance with the terms of this Agreement infringes any third-party intellectual property rights, provided that the Company shall immediately notify CBH of any such claim, give CBH sole control over the defense and settlement of such claim, and cooperate with CBH in good faith in its defence or settlement.

3. CBH's obligations in clause 5.2 above shall not apply to the extent any claim arising from or relating to (i) misuse of the Services (including any use not in accordance with the Documentation, CBH's instructions, and this Agreement); (ii) any modification, alteration or conversion of the Services not created or approved in writing by CBH; (iii) any combination of the Service with any computer, hardware, software or service not provided by CBH; (iv) CBH's compliance with specifications or other requests of Company; or (v) any third party data or Company Materials.

4. If the Service is or may be subject to a claim of infringement described in clause 5.2 above, CBH may, at its cost and sole discretion: (i) obtain the right for Company to continue using the Service as contemplated herein; (ii) replace or modify the Service so that it becomes non-Infringing without substantially compromising its principal functions; or (iii) to the extent the foregoing are not commercially reasonable, terminate this Agreement and return to Company any pre-paid fees for the Service. CBH's obligations in this clause 5 shall be CBH's sole obligations, and Company's sole remedies, in the event of any infringement of intellectual property or proprietary rights by or related to the Service.

6. Limitation of Liability

1. Save for liability arising under clause 5 ("Indemnification"), neither Party (or either of its affiliates, directors, officers, employees, contractors or representatives) shall be liable for special, incidental or consequential damages or lost profits (however arising, including negligence) arising out of or in any way relating to this agreement, even if there was prior notice of the possibility of such damage arising.

2. In no event shall CBH be liable for an amount exceeding any amounts paid to CBH under this Agreement in the 6 (six) months preceding the occurrence of facts that first give rise to any liability hereunder. The existence of more than one claim or event from which liability arises will not enlarge this aggregate limitation. This aggregate limit is a single, global limit that applies to CBH.

3. CBH shall not bear contractual or non-contractual liability for any delay or failure to perform its obligations under this Agreement to the extent that the delay or failure is caused by any of the following:

   1. failure, interruption, infiltration or corruption of any hardware, software or other telecommunications or data transmission system;

   2. CBH's belief that the Transaction is unauthorised, fraudulent, or poses a security risk;

   3. interception or seizure compelled by Applicable Law;

   4. acts or omissions of any third parties, including the Company, Payment Method Owners, Third-Party Services Providers or Issuers; or

   5. other circumstances beyond CBH's reasonable control.

4. The Company shall be liable and responsible for the actions of its Representatives, Affiliates, and service providers, acting in connection with the Services or in any manner that may impact the Services and any other party acting on its behalf. Company accepts full responsibility for its Affiliates and service providers in connection with the Services as if the acts and omissions of the Affiliates and service providers were those of the Company.

5. Company understands and acknowledges that during the term of this Agreement and after its termination for any reason whatsoever, Company shall continue to bear total responsibility for the Chargebacks, Refunds, reversed payments, penalties, any other Losses, Fees, credits and adjustments resulting in any way from receiving Services and all other amounts then due or which thereafter may become due under this Agreement.

6. Any compensation claim for faults or damages must be presented in writing by the Company to CBH within 12 (twelve) months after the occurrence of the alleged fault or damage. Otherwise, the claim shall be considered invalid.

7. Nothing in this Agreement excludes or restricts a Party's liability for death or personal injury, fraud or fraudulent misrepresentation, or any other liability which cannot be excluded or limited by Applicable Law, nor for the Company's payment obligations.

8. The Parties agree that the limitations of liability set forth in this clause 6 are a fundamental basis of the bargain, that CBH has set its fees in reliance on the enforceability of these provisions, and that they shall apply notwithstanding that any remedy shall fail its essential purpose.

9. All references to CBH in this clause 6 shall, for the purposes of this clause, be treated as including all Representatives, subcontractors and suppliers of CBH and its Affiliates, all of whom shall have the benefit of the exclusions and limitations of liability set out in this clause.

7. Remedies

1. Except where expressly provided otherwise in this Agreement, the rights and remedies provided under this Agreement are in addition to, and not exclusive of, any rights or remedies provided by law.

2. Each Party agrees that breach of clause 8, "Intellectual Property", and clause 9 "Confidentiality" of this Agreement will give rise to irreparable injury for which:

   1. money damages may not be a sufficient remedy for any breach of this Agreement by such Party;

   2. the other Party may be entitled to specific performance, injunction, and other equitable relief with respect to any such breach.

3. In the event of litigation relating to this Agreement, if a court of competent jurisdiction determines in a final non-appealable order that one Party, or any of its representatives, has breached this Agreement, such Party will be liable for reasonable legal fees and expenses incurred by the other Party in connection with such litigation, including, but not limited to, any appeals.

8. Intellectual Property

1. CBH or its licensors own the Proprietary Information.

2. Except as expressly stated herein, this Agreement does not transfer any right, title or interest in the Services or the Proprietary Information to the Company.

3. CBH grants to the Company a limited, revocable, non-exclusive, non-transferable, worldwide right to use the Services and the Proprietary Information, solely for the Company's own internal business purposes and subject to the terms and for the duration of this Agreement.

4. CBH grants to the Company a non-exclusive, non-transferable license to display certain logos and trademarks of CBH as CBH may from time to time designate (provided the prior written approval of CBH for such display has been obtained by the Company), on the Company's Websites for the sole purpose of advising the Company's customers of the availability of the Services. For the avoidance of doubt, any use of logos and/or trademarks of CBH, and/or Third-Party Services Provider shall occur only upon the prior written approval obtained by the Company. CBH and/or Third-Party Services Provider shall have the right to prohibit usage of logos/trademarks at any time for any reason or for no reason.

5. The Company acknowledges that it is prohibited from any use, reproduction, decompilation, reverse engineering, modification or distribution of any Proprietary Information that is not expressly authorised in this Agreement. The Company may not sell, resell, assign or otherwise transfer rights to CBH Services or any Proprietary Information. Company must comply with CBH's instructions for using the Services and the Proprietary Information, including those set out in the Documentation.

6. Company grants to CBH, without additional remuneration, for the duration of the Agreement, a non-exclusive, irrevocable and not territorially limited license to use Company's name, trademark, and other identifying marks and brand assets for marketing of CBH's services.

7. If Company provides to CBH any feedback (e.g., questions, comments, suggestions, or the like) regarding the Services (collectively, "Feedback"), such Feedback shall be deemed to be non-confidential, and CBH shall have a non-exclusive, royalty-free, worldwide, perpetual license to use such Feedback for any purpose.

9. Confidentiality

1. Each Party agrees to maintain all Confidential Information of the other Party in confidence to the same extent that it protects its similar confidential information and to use such Confidential Information only to exercise its rights or perform its obligations under or in connection with this Agreement. Each Party agrees to take all reasonable precautions to prevent any unauthorised disclosure or use of the Confidential Information of the other Party, including, without limitation, disclosing such Confidential Information only to its employees or contractors with a need to know and who are parties to appropriate agreements sufficient to comply with this clause.

2. CBH is entitled to disclose Confidential Information to its Affiliates, Payment Method Owners, its Third-Party Services Providers or any third parties involved in the provision of the Services, where such information is reasonably required to provide their services and/or carry out their own risk assessments (provided that such third parties are bound by equivalent or stronger obligations of confidentiality).

3. Each Party may disclose Confidential Information to the extent such Confidential Information is required to be disclosed:

   1. to a third party for the purposes of (i) equity or debt financing, (ii) acquisition or sale of a business or assets, or (iii) acquisition or sale of a corporate entity or the shares in such entity (provided that such third party is bound by equivalent or stronger obligations of confidentiality);

   2. by law or by any Regulatory Authority, provided that, to the extent it is legally permitted to do so, it gives the other Party as much notice of the disclosure as possible.

4. The obligation of confidentiality shall extend for a period of three years after the termination of this Agreement, but shall not apply with respect to information that lawfully becomes a part of the public domain, or of which the Parties gained knowledge or possession free of any confidentiality obligation.

10. Governing Law and Dispute Resolution

1. This Agreement and any dispute, controversy or claim (including any non-contractual dispute, controversy or claim) arising out of or in connection with this Agreement, including any question regarding its existence, validity, formation or termination, shall be governed by and construed in accordance with the substantive laws of England and Wales.

2. The competent courts of England and Wales shall have exclusive jurisdiction over any dispute or claim arising out of, or in connection with, this Agreement. Any dispute must be brought in the competent courts of England and Wales. For these purposes, each Party irrevocably submits to the jurisdiction of the English courts.

11. Entire Agreement

1. This Agreement, together with any Schedule(s) and other provisions expressed to be an integral part hereof, constitutes the entire understanding of the Parties concerning the subject matter hereof and supersedes any other prior or contemporaneous agreements or understandings, whether written or oral.

2. If any provision of the Agreement is found by a proper authority to be unenforceable or invalid, such unenforceability or invalidity shall not affect the other provisions of this Agreement, and this Agreement shall be construed as if such unenforceable or invalid provision had never been contained herein.

12. Assignment

1. Company may not assign, transfer, mortgage, charge, subcontract, delegate, declare a trust over or deal in any other manner with any of the rights and obligations under this Agreement without the written consent of CBH.

2. CBH may assign, transfer, mortgage, charge, subcontract, delegate, declare a trust over or deal in any other manner with any of the rights and obligations under this Agreement.

13. Notices

1. All communication, notices or reports permitted or required under this Agreement shall be in writing and in English.

2. All notices shall be by personal delivery, nationally recognized overnight courier service or by certified or registered mail, return receipt requested or by email, stated herein, and shall be deemed given upon the earlier of actual receipt or 1 (one) day after deposit with the courier service, 5 (five) days after deposit in the mail, or receipt by sender of confirmation of electronic transmission or on the date when the email has been sent. Notices shall be sent to the addresses set forth herein or such other address as either Party may specify in writing.

14. Execution

1. This Agreement may be executed in two or more counterparts in English (which both Parties understand properly), all of which, when taken together, shall be considered one and the same agreement and shall become effective when counterparts of the Schedule have been signed by each Party and delivered to the other Party, it being understood that the parties need not sign the same counterpart. In the event that any signature is delivered by facsimile transmission or by e-mail delivery of a ".pdf" format data file, such signature shall create a valid and binding obligation of the Party executing (or on whose behalf such signature is executed) with the same force and effect as if such facsimile or ".pdf" signature page were an original thereof.

2. The Agreement can be accepted and thus executed in electronic form (e.g., by an electronic or other means of demonstrating assent), including by checking the box through CBH's website or the Customer Portal. Each party agrees to sign this Agreement by electronic signature (whatever form the electronic signature takes) and that this method of signature is as conclusive of its intention to be bound by this Agreement as if signed by its manuscript signature. The Company cannot contest the validity or enforceability of this Agreement, including under any applicable statute of frauds, because it was accepted or signed in electronic form. Electronically maintained records, when produced in hard copy form, shall constitute business records and shall have the same validity as any other generally recognised business records.

3. For the avoidance of doubt, should either party fail to sign this Agreement, and despite the lack of signature by an authorised signatory of the Company, the Services under this Agreement are still provided by CBH to the Company, the performance of the Services shall constitute the Company's acceptance of the terms and conditions of this Agreement. The further may inter alia confirm the Company's acceptance of this Agreement:

   1. completing integration with CBH, including through the Technical Solution where applicable;

   2. starting processing Transactions or otherwise accepting payments through CBH's Services and/or the Technical Solution;

   3. opening merchant processing account(s) with CBH's facilitation;

   4. provision of any other Services to the Company;

   5. payment of the Fees by the Company;

   6. any other acts or omissions by the Company and/or CBH that are consistent with, or otherwise evidence the performance of, this Agreement, including where CBH has expressly communicated to the Company that a specific act or omission will be treated as constituting the Company's acceptance hereof.

4. If the Agreement was accepted electronically via CBH's website, Customer Portal, or any other online means, CBH may request that the parties reconfirm their acceptance of the terms of the Agreement by means of a written document signed by both parties' authorised signatories. CBH may request such re-confirmation by providing notice of the same to the Company via the email stated herein. If Company does not comply with such a request within ten (10) business days following the request, CBH may suspend its provision or use of part or all of the Services until Company has complied with such request.

15. Integration

1. Where integration is required to use the Services, the Company will be solely responsible for the configuration, installation, servicing, maintenance, security and operation of the equipment and software needed to access the Services and/or connect to the Technical Solution (where applicable).

2. At the request of the Company, CBH may provide guidelines and support for the integration with the Services and/or Technical Solution, assist in reviewing integrations, and provide advice and guidance. However, the Company remains responsible for ensuring the correct integration with, and implementation and use of, the Services in its own systems in accordance with the guidelines provided by CBH, either directly or through Documentation. The Company should implement monitoring and periodically perform end-to-end tests to assess the correct functioning of the Services and report any identified problems to CBH's support team.

3. The Company shall keep all passwords and API keys provided to it safe and secure, share them only with people who require access to them, and rotate them if users who had access to these keys leave the Company. The Company shall be responsible for all use of the Service using passwords or API keys issued to the Company. Company shall notify CBH immediately of any actual or suspected unauthorised use of its passwords or API keys for the Services.

4. If CBH intends to make any material changes to the API that will require the Company to make changes to its integration with the API, where reasonably possible, CBH will provide the Company with reasonable notice in advance of implementation of the same to allow the Company to prepare for any potential impact from such changes. The Company shall promptly and without unreasonable delay update to the most up-to-date API and SDK versions for the Services when requested to do so by CBH. Failure to do so may impact the provision of the Services.

5. The Company acknowledges that there may be instances when upgrading to a specific version of the API or SDKs is deemed urgent due to security reasons, Applicable Law, changes made by third-party providers, or other reasons outside of CBH's control. In these instances, CBH will notify the Company, and the Company shall provide prompt action and cooperation in coordinating and completing such upgrade. CBH reserves the right to refuse calls and connections coming from older versions of the API/SDK to maintain the security of the Services.

16. Customer Portal

1. CBH will provide access to the Customer Portal to the Company.

2. CBH may rely on any information, instructions and confirmations submitted by the Company's Authorised Users through the Customer Portal or by other approved means. Any use of the Services by Authorised Users or by anyone using their accounts remains the sole liability of the Company and will legally bind the Company.

3. The Company is responsible for monitoring notifications and communications sent by CBH via the Customer Portal. The Company is solely responsible for registering and deregistering the Authorised Users, managing their access permissions, and for the actions and omissions of the Authorised Users. When granting access to the Customer Portal, the Company shall ensure that (i) User permissions align with their job functions and authority to represent the Company; (ii) Authorised User credentials are not shared, including other Authorised Users; and (iii) access credentials are immediately revoked when a User is no longer authorised to represent the Company. Where required by Applicable Law, the Company agrees to provide CBH with the necessary information to verify the identity of its Authorised Users.

4. The Company must promptly notify and cooperate with CBH if it suspects any credentials have been compromised or if it becomes aware of unauthorised access to the Customer Portal, misappropriation of Authorised User credentials or any unauthorised actions on behalf of the Company, including, but not limited to, unauthorised online acceptance of this Agreement by checking the box.

5. CBH shall not be responsible or liable to the Company for any losses arising from a compromise of an Authorised User's access credentials.

17. Company Materials and Data

1. As between the Parties and subject to the limited license grant set forth in this clause, the Company shall own and retain all right, title, and interest in and to all Company Materials. During the term of this Agreement, the Company hereby grants to CBH a non-exclusive, royalty-free, worldwide, sublicensable license to access, collect, use, process, store, transmit, modify, copy, display, and create derivative works of all Company Materials solely in connection with and to the extent necessary for the provision of the Services to the Company in accordance with this Agreement.

2. The Company represents and warrants that:

   1. it has obtained all necessary rights, licenses, consents, permissions, and authorisations necessary to grant CBH the rights outlined in this Agreement with respect to all Company Materials;

   2. all Company Materials have been collected, stored, transferred, processed, used, disclosed, and otherwise handled in full compliance with Applicable Law;

   3. Company Materials do not and will not infringe, violate, or misappropriate any third-party rights, including intellectual property rights, privacy rights, or contractual rights;

   4. Company Materials do not and will not contain any viruses, malware, or other harmful or malicious code; and

   5. Company Materials do not violate Applicable Law and Payment Method Rules.

3. The Company acknowledges and agrees that CBH may monitor, collect, use, and store anonymous, aggregated statistics and performance data about the use of the Services, transaction patterns, system performance metrics, and other non-personally identifiable information related to the provision of the Services, which will be aggregated and anonymised such that it cannot identify the Company or any specific individuals. CBH may use such data for service improvement, research and development, industry benchmarking, regulatory reporting, and other business purposes. The Company acknowledges that such aggregated and anonymised data does not constitute Company Materials or Confidential Information of the Company and may be retained and used by CBH indefinitely.

4. The Company agrees to receive commercial and marketing information from CBH.

18. No Agency

1. It is agreed and understood that, except where this Agreement expressly provides otherwise, neither Party is the agent or representative of the other Party and has no authority or power to bind or contract in the name of or to create any liability against the other Party in any way or for any purpose. Nothing contained herein shall be construed to create a partnership or joint venture between the Parties.

19. Expenses

1. Notwithstanding any other provision in this Agreement to the contrary, in no event will CBH be obligated to pay any expenses, fees, costs or other amounts to any subcontractor, person, or entity under this Agreement.

20. No Waiver

1. All waivers by a party must be in writing to be effective. No failure or delay by either Party in enforcing any provision of this Agreement will be deemed a waiver of such Party's ability to enforce the same provision of this Agreement at a future date. No single or partial exercise of such right or remedy shall prevent or restrict the further exercise of that or any other right or remedy. No waiver of any provision of this Agreement shall constitute a waiver of any other provision, nor shall any waiver constitute a continuing waiver unless otherwise expressly provided.

21. Force Majeure

1. Except for the Company's payment obligations hereunder, neither Party will be liable for any delay or failure to perform any obligation under this Agreement due to a Force Majeure Event. In the event of such a failure, the Parties' obligations shall be suspended until such time as the cessation of all causes of such failure.

22. Set-Off

1. CBH or its Affiliate may, at any time, with reasonable prior written notice to Company, deduct, recoup or set-off any liability of Company or its Affiliate to CBH or its Affiliate against any liability of CBH or its Affiliate to Company or its Affiliate, whether either liability is present or future, and whether or not either liability arises under this Agreement. If the liabilities to be set off are expressed in different currencies, CBH or its Affiliate may convert either liability at a market rate of exchange for the purpose of set-off.

23. Cooperation

1. The Parties covenant and agree to make all applications, execute all other deeds, documents, instruments and assurances, and do such further and other acts as may be necessary or desirable to carry out the real intent and meaning of this Agreement, and to give full effect to the transactions contemplated or intended hereby.

24. Survival

1. The following clauses shall survive termination of this Agreement: clause 2 (Interpretations), clause 3 (Definitions), clause 5 (Indemnification), clause 6 (Liability), clause 7 (Remedies), clause 8 (Intellectual Property), clause 9 (Confidentiality), clause 10 (Governing Law and Dispute Resolution), clause 12 (Assignment), clause 22 (Set-Off), this clause 24 (Survival), as well as any other terms which by their nature should survive termination of this Agreement.

SCHEDULE C TO THE ALERT SERVICES AGREEMENT

Data Processing Agreement

This Data Processing Agreement (the "DPA"), presented below, is part of the Agreement between the Company (the "Data Controller") and CBH (the "Data Processor") that has reference to this DPA and forms an integral part of the Agreement.

1. Definitions

The following definitions shall apply in this DPA in addition to other definitions in the Agreement; and, for the avoidance of doubt, in the event of any inconsistency or conflict, the applicable special definitions below shall supersede and/or amend the definitions in the Agreement.

2. General Provisions

1. The Company attests that it is the Data Controller of Personal Data within the meaning of the Data Protection Laws, and CBH determines that it will be acting as a Data Processor in respect of the Personal Data that is the subject of the Agreement.

2. Personal data processing shall be entrusted to the Data Processor for the purposes and period of the performance of the Agreement and/or until no further processing is required by the Agreement or Applicable Law.

3. The subject matter, duration, nature and purpose(s) of the processing of Personal Data, as well as the type of Personal Data and categories of Data Subjects are specified in Annex A.

4. The Data Processor shall refrain from processing Personal Data that is beyond the scope set forth in Annex A.

5. In case the Data Processor receives additional information that is not needed to fulfil the Agreement, it must inform the Data Controller immediately and stop the processing of the additional Personal Data.

3. Instructions

1. The Data Processor shall process the Personal Data only on instructions from the Data Controller and for no other purpose than the purpose(s) defined in Annex A.

2. The Data Processor shall inform the Data Controller if, in its opinion, an instruction infringes the Data Protection Laws. The processing of the Personal Data required in said instruction shall be delayed.

3. If the Data Processor is required to transfer Personal Data to a law enforcement agency, it shall inform the Data Controller of that legal requirement before processing the Personal Data, unless that law prohibits such information on important grounds of public interest.

4. Technical and Organisational Measures

1. The Data Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk before starting to process Personal Data.

2. In assessing the appropriate level of security, the Data Processor shall take into account the risks that are presented by Processing Personal Data, in particular risks arising from a Data Breach.

3. The Data Processor undertakes to ensure the security of Personal Data entrusted for personal data processing in accordance with the Data Protection Laws and industry practices, in particular, to formulate and apply appropriate documentation and procedures for personal data processing, as well as technical, informational and legal security measures, as required by the Data Protection Laws, including inter alia:

   1. the pseudonymisation and encryption of personal data;

   2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

   3. the ability to restore the availability and access to personal data in a timely manner in the event of technical problems or any other incident;

   4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of personal data processing.

4. The Data Processor or its representative shall maintain a record (in writing or electronic form) of all categories of processing activities carried out on behalf of the Data Controller, containing:

   1. the name and contact details of the Data Processor or its Sub-Processors and of the Data Controller, and, where applicable, of the Data Controller's or the Data Processor's representative, and the data protection officer;

   2. the categories of Personal Data processing carried out on behalf of the Data Controller;

   3. where applicable, transfers of Personal Data to a third country or an international organisation, including the identification of that third country or international organisation and including, where applicable, the documentation of suitable safeguards;

   4. where possible, a general description of the technical and organisational security measures.

5. Data Processor's Employees

1. The Data Processor shall ensure that all Employees with access to the Personal Data are legally bound by confidentiality obligations during and after the termination of the DPA, including after the termination of their employment and/or other contractual arrangements with the Data Processor.

2. The Data Processor shall provide access to Personal Data to its Employees on a need-to-know basis only and shall make sure that the Employees are aware and compliant with the DPA, the Data Controller's written instructions and the Data Protection Laws.

3. The Data Processor shall keep records of persons authorised for Personal Data processing.

4. The Data Processor shall train its Employees involved in the processing of the Personal Data to comply with the Data Protection Laws and with the requirements established in this DPA.

6. Sub-Processors

1. Data Controller authorises Data Processor to appoint (and permit each Sub-Processor appointed in accordance with this clause 6 to appoint) Sub-Processors in accordance with this clause 6 and any restrictions in the Agreement.

2. The Data Controller hereby grants general written authorisation to the Data Processor to engage additional or replace existing Sub-Processors for the processing of the Personal Data under the Agreement. Upon request of the Data Controller, the Data Processor will provide a list of such Sub-Processors. The Data Controller has the right to object to any Sub-Processor. The objection shall be made by written communication within 10 business days after receipt of the requested list of Sub-Processors. The Data Processor shall use reasonable efforts to replace the Sub-Processor.

3. Where the Data Processor engages Sub-Processors, the Data Processor shall ensure that Sub-Processors comply with data protection obligations compatible with those of the Data Processor under this clause 6 as applicable to their processing of Personal Data. The Sub-Processor in particular shall provide sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the Data Protection Laws. Where a Sub-Processor fails to fulfil its data protection obligations, the Data Processor shall remain fully liable to the Data Controller for the performance of that Sub-Processor's obligations.

7. Data Breaches

1. The Data Processor shall notify the Data Controller of a Data Breach without undue delay. The notification shall include:

   1. description of the Data Breach, including, if possible, the categories of data and records concerned, the category and number of Data Subjects affected;

   2. likely consequences of the Data Breach;

   3. measures taken or proposed to address and/or mitigate the effects of the Data Breach.

2. The Data Processor shall, without undue delay, take all urgent measures as are agreed by the Parties or necessary under the Data Protection Laws, to investigate, mitigate and remedy the Data Breach and to protect the Personal Data.

3. Each Party needs the prior approval of the other Party to include and identify it in the breach notifications. The other Party should not delay or withhold the approval without a reasonable cause.

8. Cooperation

1. Upon request, the Data Processor shall assist the Data Controller to comply with its obligations under the Data Protection Laws when related to the processing of the Personal Data, including but not limited to:

   1. Data Breaches;

   2. data protection impact assessments (DPIA);

   3. consultations with the Data Protection Authority; and

   4. enquiries, complaints, audits, or claims from any court, government official, or Data Protection Authority.

2. Taking into account the nature of the processing, the Data Processor shall assist the Data Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Data Controller's obligation to respond to requests for exercising the Data Subject's rights laid down in the Data Protection Laws.

3. The Data Processor shall make available to the Data Controller all information necessary to comply with its obligations under the DPA and the Data Protection Laws.

4. The Data Processor shall notify the Data Controller of any requirements from an official authority as soon as possible.

5. The Data Processor shall assist the Data Controller in fulfilling its obligations concerning the requests to exercise Data Subject rights under the Data Protection Laws.

6. The Data Processor shall promptly transfer to the Data Controller any request received from the Data Subjects and shall inform the Data Subjects that they can direct their requests directly to the Data Controller. The Data Processor will only handle the requests of the Data Subjects according to the Data Controller's instructions.

9. Audit

1. Upon prior notice and no more than once a year, the Data Controller has the right to conduct an audit to verify the Data Processor's compliance with the DPA.

2. The Data Processor shall make available to the Data Controller documentation necessary to demonstrate compliance with this DPA and Data Protection Laws, in particular, to provide information about appropriate technical and organisational measures that have been implemented.

3. The Data Controller shall schedule the audit with the Data Processor at least 2 weeks in advance. The Parties shall agree upon the scope, the timing, and the duration of the audit.

4. The audit might be carried out by the Data Controller directly or by a third-party auditor appointed by the Data Controller. The Data Processor has the right to object to the use of a particular third-party auditor if it could be considered a competitor of the Data Processor.

10. Cross-Border Transfer of Personal Data

1. The Data Processor may transfer or otherwise process Personal Data outside the European Economic Area ("EEA") without obtaining the Data Controller's prior written consent.

2. The Data Processor may only process, or permit the processing, of Personal Data outside the EEA under the following conditions:

   1. the Data Processor is processing Personal Data in a territory in relation to which the European Commission has made an adequacy decision; or

   2. the Parties have executed Standard Contractual Clauses.

3. If the transfer requires execution of the SCC, the unchanged version of the SCC shall be deemed incorporated by reference hereto and completed as follows:

   1. Module Two will apply;

   2. in Clause 7, the optional docking clause will apply;

   3. in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-processor changes shall be at least 5 (five) business days;

   4. in Clause 11, the optional language will not apply;

   5. in Clause 17, Option 1 will apply, and the SCC will be governed by the law of Ireland;

   6. in Clause 18(b), disputes shall be resolved before the courts of Ireland;

   7. Annex I of the SCC shall be deemed completed with the information set out in Annex A to this DPA and in the Agreement. The Data Controller is the data exporter, and the Data Processor is the data importer;

   8. Annex II of the SCC shall be deemed completed with the information set out in Annex B to this DPA and in the Agreement.

11. California Consumers Privacy Rights

1. This Clause 11 is applicable to the processing of Personal Information of Consumers. The terms "Personal Information" and "Consumer" shall have the meanings stipulated in the California Consumer Privacy Act of 2018, as amended from time to time ("CCPA").

2. The Data Processor shall not retain, use, or disclose Personal Information for any purpose other than for the specific purpose of performing the services specified in the Agreement.

3. The Data Processor shall not retain, use, or disclose Personal Information for a commercial purpose other than providing the services specified in the Agreement.

4. The Data Processor shall not retain, use, or disclose Personal Information outside of the direct business relationship between the Data Processor and the Data Controller.

5. The Data Processor shall refrain from selling Personal Information, as the term "sell" is defined in the CCPA.

6. The Data Processor certifies that it understands the restrictions in Clauses 11.2 – 11.5 hereof and will comply with them.

12. Termination

1. Termination of this DPA shall not affect the Parties' accrued rights and obligations before or at the date of termination.

2. Upon the termination of the Agreement, whereby no further processing is required by the Agreement or Applicable Law, the Data Processor shall promptly return or irrevocably delete or remove the Personal Data.

3. The Data Processor may retain Personal Data to the extent required by Applicable Law and only to the extent and for such period as required by Data Protection Laws and always provided that Data Processor shall ensure the confidentiality of such Personal Data and shall ensure that such Personal Data is only processed as necessary for the purpose(s) specified in the Data Protection Laws requiring its storage and for no other purpose.

13. Miscellaneous

1. In the case of conflict or ambiguity between:

   1. any provision of the DPA and any other provision of the Agreement, the provisions of the DPA shall prevail;

   2. any provision of this DPA and the SCC, the provisions of the SCC shall prevail.

Annex A to Schedule C

Details of Personal Data Processing

Annex B to Schedule C

Technical and Organizational Security Measures