Kianopay
Terms & Conditions V3.0

General Terms and Conditions 3.0 (25 May 2020)

A. GENERAL

1. Definitions

The following words are capitalised in these General Terms and Conditions. These definitions have the same meaning in the singular and in the plural form.

Account: setting up a virtual account that can be used to process Transactions, linked to a number of Transactions determined by KIANOPAY that is made available to the Customer as an offered package.

Acquiring Partner: A financial institution that offers credit cards or debit cards and that processes these transactions.

Annexes: The Annexes attached to these General Terms and Conditions. The Annexes form part of the Agreement. The General Terms and Conditions prevail in case of a conflict between the Annexes and the General Terms and Conditions.

Back-up: Backup copies of digital data and/or files.

Business Days: Every Monday through Friday between 09:00 – 17:30 hours CET, with the exception of UK public holidays.

Chargeback: reversal by the Acquiring Partner of a Transaction performed previously by an End User that is settled with the Customer by Kianopay.

Conditions: These Kianopay General Terms

Contract: All of the agreements between the Customer and Kianopay concerning the provision of Payment Services, including the Platform Contract, the Price List, the Conditions, Annexes, Third- Party General Terms and Conditions and any alterations thereof.

Customer: A natural person or a legal entity acting in the conduct of a profession or business, who operates a webshop and instructs Kianopay to deliver the Payment Services. The Customer is responsible for and bears the risk of payment on the part of End Users, inter alia in case of Chargebacks, reversals and fraud.

End User: buyers who purchase and pay for a product or service from the Customer on the website or in the Customer’s physical store using the Kianopay Payment Services.

Force majeure: Force majeure is defined as any circumstance beyond Kianopay’s control as a result of which full or partial compliance with the Contract becomes temporarily or permanently impossible, such as but not limited to failures on the part of third parties to comply with the Third- Party Services, failures on the part of suppliers, the fact that necessary information is not available on time, changes or inaccuracies in the information that has been provided, poor weather conditions, fires, explosions, electricity and other grid failures, floods, illness, lack of personnel, strikes or other industrial disputes, accidents, government acts, rejection or impossibility of a required permit or approval or the extension thereof, scarcity of materials, theft, and/or traffic nuisance.

High-risk Country: a country in which a high level of terrorism and/or other forms of crime exist.

Holdback: the (fixed) percentage or fixed amount agreed in the Platform Contract, which is reserved by Kianopay in respect of the End User’s payment by way of surety for Chargebacks, refunds, reversals etc.

Kianopay: Kianopay and its successors in title or a company affiliated with Kianopay, which provides the Payment Services.

Identification details and information: Login name, passwords, address details and/or other codes provided to the Customer by Kianopay for the purpose of gaining access to the Payment Services, including information regarding the nature and scope of the conduct of a profession or a business and all unique webshops/URLs connected directly or indirectly or linked to the Platform for this purpose. Kianopay has the right to alter the Identification Details. Kianopay will communicate new Identification Details to the Customer following changes. The Customer handles the Identification Details provided by Kianopay in confidence and with due care and it will only disclose them to authorised employees.

Infrastructure: All of the systems, hardware, software, network components and connections required for the delivery and receipt of Payment Services. This collection of facilities is used among other things to store and transport data.

Offer: An offer of products and/or Payment Services made by Kianopay to the Customer.

Payment Services: Kianopay services that facilitate the fact that the Customer is able to accept online and/or point-of-sale payments via

General Terms and Conditions 3.0 (25 May 2018)

various payment methods from its End Users, which includes the authorisation of payments, the financial settlement thereof, reporting, making supporting web applications and Infrastructure available as well as any related services.

PEP: Politically Exposed Person; prominent political person.

Permit: A written legal act under public law performed by UK or another government body, which gives Kianopay rights as regards the provision of the Payment Services.

Personal Data Legislation: the EU Data Protection Legislation 95/46/EC until 25 May 2018, and on and after that date, the General Data Protection Regulation 2016/979 (GDPR); GDPR definition used: data controller, data processor, processing, data breach.

Platform Contract: The form completed online by means of which the Customer has concluded the Contract with Kianopay subject to the condition subsequent of a positive outcome of the customer screening and Kianopay’s acceptance via the Suppliers of Payment Methods.

Price List: The price list as provided as an annex to the Platform Contract.

Rules & Regulations: the conditions of use that apply to the use by the Customer of the Payment Services and Third-Party Services purchased from Kianopay. These conditions are issued by Kianopay and the Suppliers of Payment Methods. The Rules & Regulations prevail in case of a conflict between the Rules & Regulations and the Conditions.

Second Line Support: Oral and/or written support provided to the End User in connection with a Transaction if such is requested by the Customer. The Customer remains responsible at all times for the relationship with the End User and provides first-line support.

Supplier Payment Methods: third parties that deliver a specific payment method or that manage

a network, such as the Acquiring Partner, Visa, MasterCard, Currence (iDEAL) and banks. Supplier Payment Methods deliver Third-Party Payment Services, which are used by Kianopay to deliver its Payment Services.

Third-Party General Terms and Conditions:

General terms and conditions applied by third parties, such as the Supplier Payment Methods (including but not limited to: Card Associations such as Visa/MasterCard).

Third-party Infrastructure: That part of the Infrastructure that is managed by third parties or the Customer.

Third-party Services: All third-party products and services delivered (on) by Kianopay (including Supplier Payment Methods).

Transaction Data: The data entered by the Customer and/or End Users for the purpose of carrying out a Transaction, such as but not limited to personal data required for Kianopay’s provision of the Payment Services.

Transaction(s): a payment request made by an End User for payment to the Customer, which is processed by Kianopay, irrespective of whether payment is successful and/or concerning a reversal of a payment that has been processed.

2. Applicability

2.1 The Conditions apply to all Contracts and Offers on the part of Kianopay.

2.2 The Conditions apply to the exclusion of the Customer’s conditions.

2.3 Kianopay has the right at all times to make changes or additions to the Conditions. The changed Conditions will be notified to the Customer and they will become effective upon that notification. If the Customer does not agree to the changes, the Customer will have the right to terminate the Contract with notification thereof within the term of 30 days provided for above.

2.4 If the Customer refers to several natural persons or legal entities, these will be obliged jointly and severally to comply with the Contract.

2.5 Rules & Regulations may apply in addition to the Conditions. The Customer is responsible for familiarising itself with the Rules & Regulations that apply to the Payment Services and Third Party Services to be

3/20

purchased by it.

3. Offers

1. 3.1  Offers are without obligation, unless agreed otherwise. Errors or mistakes on the part of Kianopay are not binding for Kianopay.
2. 3.2  Offers are based on the information provided by the Customer in accordance with article 7.
3. 3.3  If an Offer is not without obligation it will be valid for a period of 14 (fourteen) days after the date of the Offer unless agreed otherwise. The Offer lapses and no rights can be derived therefrom if the Customer has not accepted the Offer within the aforementioned term. In the event acceptance deviates from the Offer in minor respects (such to be decided by Kianopay), Kianopay will not be bound by these minor changes.
4. 3.4  A compound quotation does not oblige Kianopay to deliver part of the Payment Services against a proportionate part of the offered price.
5. 3.5  OffersdonotapplytofutureContracts.
6. 3.6  Offers and obligations to comply with Payment Services for which Kianopay requires an (additional) Permit or registration in case of Suppliers of Payment Methods will take place subject to the condition precedent that Kianopay obtains this Permit and/or registration, or has this Permit and/or registration and does not lose it.

4. Conclusion and duration of the Contract

1. 4.1  The Contract is concluded between Kianopay and the Customer at the moment the Platform Contract signed by the Customer has been accepted electronically and activated by Kianopay, subject to the conditions mentioned in the Platform Contract.
2. 4.2  The Contract has a minimum term of three (3) months. The Customer cannot terminate the Contract during this initial term. Kianopay reserves the right to dissolve or terminate the Contract in accordance with the conditions of the Contract during the initial term. Following this initial term, the Contract will be extended automatically for an indefinite period, unless it is terminated in writing before the end of a calendar month: a) by the Customer while observing a notice period of one (1) month; or b) by Kianopay while observing a notice period

of two (2) months. This provision is without prejudice to all other rights that vest in the Customer or Kianopay to dissolve or terminate the Contract in accordance with the conditions of the Contract.

4.3 Kianopay has the right to suspend performance of the Payment Services and/or suspend or dissolve the Contract in whole or in part or withdraw the Offer without (prior) notice of default and without any liability for damage arising if: (a) the Customer is a natural person and dies, (b) the Customer submits a request for application of the Debt Management (Natural Persons) Act; (c) the Customer loses control and/or the right to dispose of his assets, or is longer legally competent, (d) the creditworthiness or payment behaviour of the Customer includes a risk (such to be decided exclusively by Kianopay), (e) the Customer is requested to provide security for compliance with its obligations arising from the Contract, at the moment of or after conclusion of the Contract and said security is not provided or is insufficient (such to be decided exclusively by Kianopay), (f) bankruptcy or a suspension is applied for by or against the Customer, (g) the Customer is declared bankrupt or is granted a suspension of payment, (h) the Customer’s business is liquidated or terminated, other than for the purpose of reconstruction or a merger of businesses, (i) the product sold/service provided by the Customer or its business operations no longer complies or no longer continuous to comply with Kianopay’s requirements (such to be decided exclusively by Kianopay), (j) the Customer does not process Transactions for a consecutive period of 3 (three) months; (k) for credit card solution, the Customer significantly exceeds (decreases) the approved transaction volumes without notification to Kianopay; (l) Payment Services are used for criminal, fraudulent or unlawful activities, (m) the Customer initiates Transactions that are in contravention of Kianopay’s acceptance policy, Suppliers of Payment Instruments and/or the Rules & Regulations, (n) Kianopay’s Permit or registration with a Supplier of Payment Methods is withdrawn, (o) compliance is impossible or cannot be demanded of Kianopay within reason, (p) other circumstances occur as a result of which unaltered maintenance of the Contract cannot be expected of Kianopay within reason, (q) the Customer does not

4/20

comply with its obligations arising from article 19 or the (repeated) customer screening results in the fact that Kianopay is not or no longer willing to do business with the Customer or a circumstance occurs as referred to in articles 19, 20 and/or 23.10, (r) the fraud/reversal rate of the Transactions is unacceptable under the Rules & Regulations or according to Kianopay, (s) Kianopay processes Transactions for URLs that have not been approved by Kianopay, (t) changes the nature of the business, operations (e.g. but not limited to, changes of the processing currency, location, target customers, etc.) or ownership without prior approval by Kianopay, (u) the risk profile of Kianopay Transactions (volume or mix) changes to a material extent, (v) the Customer does not have a sound (such to be decided by Kianopay) complaints/refund procedure in place or its website does not comply with the requirements under the Rules & Regulations (such as clear notification of the name and location of the Customer to End User), and/or (w) any other circumstance occurs or any other act on the part of Kianopay which – in Kianopay’s perception – has an impact on the Customer’s proper compliance with the Contract and/or the Rules & Regulations or has a negative impact on the integrity, reputation or brand of Kianopay and/or the Suppliers of Payment Methods, (x) breaches any provision of the Platform Contract and this Terms and Conditions.

4. 4.4  In case of suspension under article 4.3., Kianopay will enable the Customer to remedy the circumstance that leads to the suspension. Kianopay reserves the right to dissolve the Contract if this does not take place within 10 (ten) Business Days. Depending on the cause of the suspension, Kianopay has a right to increased or impose an additional service fee.
5. 4.5  In the event the Contract is dissolved by Kianopay, the Customer will be obliged to pay the amounts mentioned in the Price List for the Payment Services provided up to the termination of the Contract. Any claim on the part of Kianopay against the Customer is immediately due and payable. In case the dissolvent is caused by the serious breach of the contract (to be determined solely by Kianopay), Kianopay has a right to impose an increased service fee.
6. 4.6  AftertheContracthasended,theobligations

that are intended by their nature to continue to apply, such as but not limited to articles 8, 9, 12, 21.2 and 23.11, will continue to apply in full.

5. Performance of the Contract

5.1 The availability and provision of the Payment Services concerns a best-efforts obligation.

5.2 Kianopay will perform the Contract to the best of its knowledge and abilities, in accordance with the agreements reached with the Customer.

5.3 Kianopay has the right to change the Payment Services. Kianopay will notify the Customer of the substance of changes before the relevant change becomes effective.

5.4 The Customer has the right to change its Account into a lesser Account (downgrade) against payment of 50% of the payable costs related to the Account selected by the Customer.

6. Transfer of rights and obligations

6.1 The Contract concluded between Kianopay and the Customer and rights and obligations that arise therefrom cannot be transferred to third parties or encumbered without the prior, written approval of Kianopay.

6.2 The Customer agrees that Kianopay has the right to transfer (parts of) (its rights and obligations arising from) the Contract or parts thereof, to third parties.

7. Cooperation/duty of disclosure on the part of the Customer

7.1 Kianopay will deliver Payment Services on the basis of the information provided to Kianopay by the Customer.

7.2 The Customer will render Kianopay its full cooperation and always provide all necessary information for: (i) proper performance of the Contract, (ii) identification and verification of the Customer, (iii) verification of the Customer’s compliance with this Contract or the Rules & Regulations, (iv) validation of the Customer’s financial position and risk profile, and/or (v) verification of information provided previously. The Customer guarantees the accuracy of this information. Without prejudice to the provisions above, the Customer will provide Kianopay at all times with the valid addresses of its offices, any trade names and

5/20

a full description of its products and/or Payment Services.

3. 7.3  If information that is required for the performance of the Contract is not available (on time) to Kianopay changes, or the information that was provided proves to be incorrect or misleading or if the Customer otherwise fails to comply with its obligations, Kianopay will have the right to terminate the Contract or suspend its obligations on the basis of the Contract without prior notification in accordance with article 4.3. The costs already incurred will be charged to the Customer upon termination.
4. 7.4  The Customer is responsible for the use and correct application within its organisation of the Payment Services to be provided by Kianopay as well as for the tools to be used in that connection of any kind whatsoever and for the security thereof.
5. 7.5  The Customer will comply at all times with the rules and instructions of Kianopay and the Suppliers of Payment Instruments. If the Customer fails to comply with its obligations in this article, Kianopay will have the right to suspend all or part of its Payment Services.

8. Confidentiality/Non-competition clause

1. 8.1  Kianopay and the Customer commit towards each other that they will observe confidentiality concerning each other’s organisation, such as but not limited to information concerning customers and Payment Services, which comes to their attention during the performance of the Contract.
2. 8.2  Kianopay has the right to place the name and logo of the Customer on the Kianopay website and/or a list of references and disclose it to third parties.
3. 8.3  The Customer will not establish direct or indirect professional relationships with Kianopay employees in any way during the term of the Contract and for a period of up to 12 (twelve) months after the Contract has ended, unless it has obtained Kianopay’s written approval to do so.

9. Intellectual property rights

9.1 Kianopay reserves all intellectual property rights, industrial property rights and all other rights with respect to all Payment Services, the Kianopay Infrastructure and Offers. The

Customer is not allowed to reproduce, surrender to third parties or give in use the Payment Services and/or Offers in any way.

9.2 Any intellectual property rights arising from the performance of the Contract are the property of Kianopay.

9.3 The Customer is not allowed to remove or have removed or change any indication regarding the aforementioned intellectual property rights, industrial property rights or any other rights.

9.4 The intellectual property rights concerning the altered Payment Services held by Kianopay continue to vest in Kianopay irrespective of the party that makes the changes to the Payment Services. If the aforementioned rights do not vest in Kianopay, the Customer will arrange for the transfer of the aforementioned rights to Kianopay free of charge.

9.5 If the Customer forms a new product of the Payment Services, all intellectual property rights in respect thereof shall vest in Kianopay.

9.6 If third parties claim these intellectual property rights, the Customer will be obliged to notify Kianopay thereof without delay.

10. Penalty Clause

10.1 In the event the provisions of article 8 and/or 9 are violated, the Customer shall forfeit without further notice of default an immediately due and payable penalty of €10,000 (ten thousand euros) per violation as well as

€5,000 (five thousand euros) for each day the violation continues, which is to be paid to Kianopay, without prejudice to Kianopay’s right to claim additional compensation and/or to dissolve the Contract with immediate effect.

11. Complaints

11.1 Complaints must be submitted electronically by the Customer to Kianopay at the e-mail address stated for this purpose on the website within eight days, failing which it will be assumed that the Customer has accepted the Service unconditionally.

11.2Following its receipt, the complaint will be registered and forwarded to the responsible Kianopay department.

11.3 Complaints are not handled if the complaint is caused by a change to the Service by the Customer or a third party.

6/20

4. 11.4  Kianopay will handle the complaint if the complaint is well-founded (such to be decided by Kianopay).
5. 11.5  Complaints from End Users are always forwarded to the Customer and will also be registered at Kianopay for the purpose of combating fraud. Kianopay has the right to charge costs for handling complaints in accordance with the Price List.

11.6The Customer has a well-documented and functioning complaints and escalation procedure in place for its End Users, which includes a telephone reporting centre and an e-mail address, which complies with the requirements imposed in that connection by the banks and institutions that process payments for the Customer.

12. Liability

12.1 Kianopay’s liability is limited to compensation of direct loss up to the amount (excluding VAT) that was invoiced to the Customer on the basis of the Contract during the calendar year of submission of the complaint, subject to a maximum of €100,000 (one hundred thousand euros), unless Kianopay has taken out insurance with respect to the loss in which case the loss is maximised at the insured amount.

12.2 The Customer indemnifies Kianopay against liability towards third parties, including – but not limited to – End Users and Suppliers of Payment Methods with respect to Transactions or any other claims that are the result of any failure on the part of the Customer concerning its services, failure to comply with the Contract, the Third Party General Terms and Conditions and/or the Rules & Regulations. This liability continues to apply in full after this Contract has been terminated.

12.3 Kianopay is not liable if the Customer itself is in default.

12.4Kianopay is never liable for losses that arise or that are caused as a result of the fact that the Customer used the Payment Services for a purpose other than the one for which they were provided.

12.5 Direct loss includes exclusively the reasonable costs: a) incurred by the Customer to have the Kianopay Service comply with the Contract unless the Contract is dissolved by the Customer or the Service of Payment

Services are suspended by Kianopay; b) incurred for the purpose of determining the cause and extent of the loss; c) incurred in order to prevent or mitigate loss, to the extent the Customer demonstrates that these costs have led to a limitation of the loss.

12.6 Kianopay’s liability for indirect loss, including consequential losses, lost profit, missed savings, destruction or loss of files and/or data, loss due to delay, losses sustained, losses caused by defective provision of information and/or defective cooperation by the Customer, losses resulting from business interruption or third-party claims against the Customer are excluded.

12.7Kianopay’s liability does not arise until the Customer has given Kianopay notice of default in writing by means of a registered letter within 2 (two) weeks after the loss arises, which notice of default provides a reasonable term for remedying the failure, Kianopay attributably fails also after that term to comply with its obligations and the Customer implements measures to limit the loss. The notice of default must include a description of the failure that is as accurate as possible.

12.8Kianopay is not liable for losses that are the result of the failure to provide (on time) Third Party Services or for losses that are the result of the fact that Kianopay is obliged to comply with certain changing and new legislation and other regulations.

12.9The Customer acknowledges at all times – including after the Contract has been terminated – that it is liable for and the Customer will indemnify Kianopay against all claims with respect to Transactions performed by it as well as any losses that result therefrom, including – but not limited to – reversals, chargebacks and/or penalties arising from the Rules & Regulations or this Contract.

12.10 The Customer acknowledges that Kianopay is not a party to the agreement between it and End Users. The Customer indemnifies Kianopay against all claims from End Users.

12.11 Without prejudice to the provisions of Article 6:89 of the United Kingdom and the term for submitting complaints included in these conditions, every claim against Kianopay prescribes in any event 12 (twelve) months after the event that caused the loss was

7/20

discovered or should have been discovered by the Customer within reason.

13. Force Majeure

13.1Kianopay is not obliged to comply with the Contract if it is prevented from doing so as a result of Force Majeure. Kianopay also has the right to invoke Force Majeure if Force Majeure occurs after Kianopay should have complied with its obligations.

13.2If the failure resulting from Force Majeure is temporary in nature, Kianopay will have the right to suspend its obligations until the situation of force majeure no longer exists such without being obliged to compensate losses. In case of Force Majeure, Kianopay reserves the right to claim payment from the Customer for performances already delivered by Kianopay.

13.3Failure as a result of Force Majeure does not give the Customer the right to dissolve the Contract and/or entitle it to compensation unless the failure lasts for more than three (3) months.

14. Nullity

14.1If one or more provisions of the Contract are void or voidable in whole or in part, the other (parts of the) provisions of the Contract will continue to apply in full.

14.2 The parties will consult with each other concerning the (parts of the) provisions that are void or voidable in order to implement a replacement arrangement in the sense that the parties will endeavour to ensure that the purport of the Contract (or the remaining part of the provision) remains in force in its entirety.

15. Applicable Law and Dispute Settlement Rules

15.1All contracts concluded by Kianopay with the Customer are governed by UK law, unless agreed otherwise. The Vienna Sales Convention does not apply. Other disputes will be settled by the Amsterdam District Court, such to be decided by Kianopay.

16. Inspections

16.1Kianopay has the right to process technical restrictions and control mechanisms in the Payment Services. In addition, Kianopay and/or the Suppliers of Payment Methods have the right to perform unannounced inspections

themselves or via third parties with respect to compliance with this Contract and/or the Rules & Regulations. The Customer will cooperate fully in this connection. If the Customer refuses to cooperate or refuses to grant Kianopay access, Kianopay will have the right to dissolve the Contract with immediate effect.

17. Second Line Support

17.1The Customer is responsible for First Line Support. Kianopay will provide Second Line Support in accordance with the rates of the Price List if the Customer does not facilitate this First Line Support sufficiently or at the request of the Customer.

B. INTEGRITY

18. Supervision

18.1Kianopay is an ethical company that acts in accordance with legislation and regulations and it is supervised by DNB. The Customer is aware that as a payment service provider Kianopay is subject to statutory obligations and it will indemnify Kianopay against losses it sustains in connection with the application of relevant legislation and regulations within the context of the performance of the Contract and/or the Offer.

19. Customer screening

19.1Within the context of customer screening as condition subsequent for the conclusion of the Contract, Kianopay will conduct a full investigation of the Customer, the Customer’s profile and Know-Your-Customer documentation delivered, its products and/or services, in accordance with the Platform Contract. The Customer will also be identified and verified and it will be investigated who the ultimate beneficial owners of the Customer are. Regular reassessments of the customer file, inspections and transaction monitoring will be performed following acceptance of the Customer. The Customer will ensure at all times that its customer file at Kianopay is correct and up-to-date. A successful completion of the customer screening is required and is a condition pre-requisite in order to receive payments by the Customer.

19.2 The Customer guarantees towards Kianopay that all (Know-Your-Customer) information and documentation that has been delivered is complete and correct. The

8/20

Customer is required to notify Kianopay immediately of new URLs (including in the event these are linked directly or indirectly to an URL that has already been assessed) and/or changes to the Customer’s customer file in the manner prescribed for this purpose, whereafter a new screening will be performed for the aspects described in 2.2.1.

19.3In addition to Kianopay’s rights in accordance with article 4.3, in the event the Customer abuses the Payment Services, commits fraud, acts in contravention of legislation and regulations and/or the Rules & Regulations, deliberately provides incorrect information or performs any other fraudulent and/or abusive act, the Customer will owe a penalty to be paid to Kianopay, without requiring further notice of default, as provided for in article 19.5, without prejudice to Kianopay’s right to claim additional compensation, including loss of sales if Kianopay also dissolves the Contract as well as the right to claim other costs such as legal and research costs. The amount of the penalty will be determined in accordance with Kianopay’s (reasonable) opinion depending on the seriousness of the circumstances of the case in accordance with the categories in article 19.5.

19.4 Kianopay reserves the right to turn collection of the penalty over to a third party. All related costs are for the account of the Customer that forfeits the penalty.

19.5 Category 1: A penalty of €3,000 (three thousand euros) per violation and €1,500 (fifteen hundred euros) for every day the violation continues, Category 2: A penalty of €5,000(fivethousandeuros)perviolation and €2,500 (twenty-five hundred euros) for every day the violation continues, Category 3: A penalty of €10,000 (ten thousand euros) per violation and €5,000 (five thousand euros) for every day the violation continues.

20. Fraud / Money Laundering

20.1 Kianopay reserves the right, such to be decided by it, to suspend all or part of the Payment Services and/or to dissolve the Contract, if it is established or the suspicion exists that the Customer and/or its ultimate beneficial owner act in contravention of the Money Laundering and Terrorist Financing (Prevention) Act (Wwft) inter alia (but not

limited to) by serving fraudulent, money- laundering or terrorist purposes, or performs activities in respect of High-risk Countries or PEPs (unacceptable to Kianopay), infringes the rights of Suppliers of Payment Methods or third parties and/or acting contrary to the Rules & Regulations and/or the Contract.

20.2Kianopay may submit a report to the police concerning fraud or other conclusions or, as the case may be, suspicions as referred to in article 20.1.

20.3 The costs related to investigation will be charged to the Customer in accordance with article 20.1 on the basis of subsequent calculation at an hourly rate of €100.

20.4Kianopay reserves the right to change the risk scoring of the Customer, in case Kianopay in its reasonable discretion on the basis of clear and objective indications judges these to pose an unacceptable risk for accepting fraudulent transactions or creating increased chargeback levels. For some payment methods, Transactions can be cancelled by the Customer after they have been authorised. The final responsibility for accepting or rejecting a Transaction will remain with the Customer. Kianopay reserves the right to cancel transactions that it has reasonable grounds to suspect to be fraudulent or involving other criminal activities.

20.5In case of an increased level of fraud and chargeback levels, Kianopay reserves the right to impose on a Customer a fraud prevention tool.

21. Rules & Regulations

21.1 When performing their obligations arising from this Contract and when performing or, as the case may be, receiving the Payment Services, both parties will always comply with the Rules & Regulations, including but not limited to the Payment Card Industry Data Security Standards (PCI-DSS). The Customer will provide evidence of its compliance with the PCI-DSS standards upon request.

21.2 The Customer will indemnify Kianopay against any and all claims from Suppliers of Payment Instrument and issuers of Rules & Regulations with respect to a failure to comply with its obligations under the Rules & Regulations. This liability will continue to apply

9/20

also after this Contract has been terminated.

C. PAYMENT SERVICES 22. General

14 (fourteen) days in which connection Kianopay will charge to the Customer the part of the funds. In the event Kianopay owes an amount to the Customer on the basis of an Outpayment Overview, Kianopay will pay this amount to the Customer within 5 (five) Business Days after the Outpayment Overview becomes available (and only under the condition, that the payments of End-Users have been priorly received by Kianopay).

23.4When concluding the Contract, the Customer grants (depending on the nature of the Service) (i) an irrevocable power of attorney to Kianopay to collect from Stichting Derdengelden the amounts owed by the Customer to Kianopay pursuant to the Contract (such as but not limited to service fee, refunds, Chargebacks, Outpayment Overview, amounts invoiced), or (ii) debit the payable amounts from the Customer’s account by means of direct debit collection. The Customer will have this power of attorney registered with his or her bank, failing which Kianopay will have the right to suspend its obligations.

23.5In the event option (i) of the previous article applies, Kianopay will have the right to set the payable amounts off against the amounts Kianopay is required to pay to Kianopay and to pay the remainder to the Customer.

23.6 Stichting Derdengelden has the right to suspend payment in the event a third party claims this payment or to make this payment to a third party if it is obliged to do so pursuant to an enforceable title. In such cases, Stichting Derdengelden also arranges for payment of the amounts owed by the Customer to Kianopay. Kianopay may charge administrative costs in this connection.

23.7In the event collection of the invoiced amount does not succeed in the calendar month of the invoice (despite the request from Kianopay side), Kianopay will collect the amount from Stichting Derdengelden / the Customer the next calendar month. An amount of €40 (forty euros) in administration costs will be charged to the Customer in such cases.

23.8In the event Kianopay is also unable for any reason whatsoever to collect or does not receive its claim against the Customer from the

1. 22.1  Kianopay
   Kianopay may deliver these Payment Services with respect to credit card Transactions as Payment Service Provider (PSP) or as Payment Facilitator (PF) as laid down in the Rules & Regulations. In the event Kianopay operates as PF, it acts on behalf of the Acquiring Partner when concluding this Contract.
2. 22.2  The Customer acknowledges that it is responsible and liable (financially) at all times for all Transactions processed under its account with Kianopay during the term of the Contract and after it has ended, including the liabilities that arise therefrom such as Chargebacks, reversals, penalties, etc. The Customer does not have the right to process Transactions from third parties or from webshops that are not owned by the Customer.

23. Stichting Derdengelden

1. 23.1  Kianopay has outsourced the collection of funds to Stichting Derdengelden. Stichting Derdengelden manages part of the funds received on behalf of the Customer until the moment of payment to the Customer in accordance with the Contract.
2. 23.2  Unless another payment method is agreed, the Customer agrees that the payments of End Users are paid by the Suppliers of Payment Methods into a bank account of Stichting Derdengelden.

23.3Kianopay will send the Customer an overview on a regular basis (Outpayment Overview) of the funds received by Stichting Derdengelden on behalf of the Customer, which specifies what part of those amounts accrues to the Customer and what part accrues to Kianopay on the basis of the Contract. There will be 1 (one) Business Day between the dispatch of the Outpayment Overview and collection of the payable amount evident therefrom in accordance with the next article. Kianopay will also invoice the Customer on a regular basis subject to a payment term of

provides

Payment

Services.

10/20

Customer in this second calendar month, the Customer will owe statutory interests and costs on the outstanding amount without prior notification from the first day after expiry of a period of 14 (fourteen) days after the date of invoicing until the day of payment in full. The claim may be turned over to a third party for collection in which case the Customer will be obliged to compensate extrajudicial and judicial costs subject to a minimum of 15% of the outstanding amount.

23.9Payment by the Customer serves primarily to pay the collection costs incurred by Kianopay and subsequently to pay the interest and finally to pay the outstanding amount.

23.10 In case of (a suspicion of fraud) on the part of the Customer and/or (a) certain End User(s), Kianopay will have the right to implement all measures to minimise its loss and the loss of Stichting Derdengelden, such as (but not limited to) suspension of its Payment Services in accordance with article 4.3, which includes blocking payments to the Customer and the automatic collection of balances with the Customer related to reversals, refunds, chargebacks etc.

23.11 The Customer is responsible and liable at all times for the Transactions processed by Kianopay as well as all losses that may arise as a result. In the event a negative balance arises at Stichting Derdengelden as a result of reversals, refunds, Chargebacks and penalties imposed by Kianopay or the Suppliers of Payment Methods, Kianopay will have the right to suspend its obligations and the Customer will be obliged to make up the deficit within ten (10) days. In addition to statutory interest, Kianopay will have the right to charge €25 in administration costs for each day the claim has not been paid. Kianopay has the right to dissolve the Contract if the Customer fails to comply with its obligations under this article.

23.12 The Customer acknowledges that Kianopay has the right at all times, in the event (fixed) Holdbacks are necessary, to withhold a (fixed) percentage from the payments to the Customer or demand a fixed amount as surety for Chargebacks, reversals and other risks with respect to the Transactions. The levels of the various Holdbacks may be adjusted by Kianopay at any time during the term of the Contract, if such is justified by the Customer’s risk profile and/or its Transactions. The

amounts that are withheld will be paid in due time. The withholding percentage or the fixed amount may be adjusted by Kianopay in consultation with the Customer. Nevertheless, the Customer acknowledges that the ultimate decision is always Kianopay’s. Kianopay will exercise its rights pursuant to this article with the necessary care. Any Holdbacks may be retained by Kianopay for a period of 6 (six) months after termination of the Contract or after delivery of the services by the Customer to End Users if such is necessary to cover its financial risks, including but not limited to chargebacks, penalties and reversals.

23.13 Kianopay has the right to retain the Customer’s full payment for an indefinite period by way of a Holdback in the event of an ongoing investigation into the (organisation of the) Customer, irrespective of the Customer or the nature of this investigation also in the event Kianopay is not allowed to make any statements concerning this investigation. Depending on the conclusion of such investigation, Kianopay has a right to increase the service fee up to a 100% of Customer’s turnover to cover the incurred costs and liabilities.

24. Interest rate and exchange rate mark-ups

24.1Changes to the interest rate or the exchange rate can be applied immediately by Kianopay without notification in which connection the changes are based on the reference interest rate or the reference exchange rate that has been agreed.

24.2In case of Transactions that are performed in countries that are not part of the European Monetary Union (EMU), Kianopay charges an exchange rate mark-up of 1% on the transaction amount in euros (on the top of any charges applied by the Suppliers Payment Methods).

25. Systems

25.1 Within the context of the access to and use of the Payment Services, the Customer has and will continue to have an Infrastructure in place that complies with the requirements determined by Kianopay. Kianopay’s obligation to provide the Payment Services will be suspended by Kianopay if the Customer fails to comply with these requirements or adds a new website that is not in compliance.

11/20

2. 25.2  The Customer enables Kianopay to check whether the requirements referred to in this article are being complied with and to analyse the use of the Payment Services. The results of any analysis will not be made available to third parties. This does not apply to figures and data concerning the use of the Payment Services that cannot be traced back directly to the Customer’s use.
3. 25.3  If the Customer fails, as yet after an inspection, to comply with the requirements referred to in article 25.1, Kianopay will have the right to terminate all or part of the Contract without prior notice of default.
4. 25.4  The Customer is obliged to comply with Kianopay’s instructions concerning the use of the Payment Services and/or adjustments to its website(s).

25.5A malfunction in the Payment Services must be notified immediately by the Customer to Kianopay.

25.6The costs of resolving the malfunction are for the Customer’s account if it becomes clear that the cause of the malfunction is attributable to its acts or omissions.

25.7Kianopay notifies the Customer in advance of the scope of the intended maintenance to the Infrastructure, if this maintenance leads to problems concerning access to the Payment Services. Kianopay has the right, without being obliged to pay compensation, to make changes to the Kianopay Infrastructure that could have an impact on the browsers used by the Customer. Kianopay will notify the Customer thereof.

26. Availability of the Payment Services

26.1 Kianopay ensures that the Payment Services are available. Kianopay strives for an availability rate of:

1. a)  99% from Monday to Friday between 06:00 and 24:00 hours (CET);
2. b)  98% from Monday to Friday between 24:00 and 06:00 hours (CET);
3. c)  97% from Saturday to Sunday between 00:00 and 24:00 hours (CET).

26.2 The rate mentioned in article 26.1 is measured over a calendar year. Time for maintenance is not included.

26.3Kianopay strives to implement all useful and necessary measures to ensure the continuity

of the Payment Services by means of common virus protection software.

26.4Kianopay strives to provide sufficient security against unlawful access by third parties to the computer equipment and computer software used by Kianopay and/or the data that have been stored.

27. Using of Identification Details

27.1 Kianopay makes the Identification Details available to the Customer exclusively for the use of the Payment Services. The Customer handles the Identification Details with due care. The Customer notifies Kianopay in case of loss, theft and/or other forms of unlawful use. Kianopay is not liable for abuse and/or unlawful use of the Identification Details.

27.2 Identification or suspicion of abuse of the Identification Details constitutes default on the part of the Customer. In such cases, Kianopay will have the right to issue instructions to the Customer in order to end the abuse.

28. The Customer’s data traffic

28.1 Kianopay commits that it will observe confidentiality concerning the information related to the Transactions, which are processed for the Customer and Kianopay will implement the necessary technical and organisational measures with respect to the processing and storage of data pertaining to Transactions. In principle, Transaction Data are laid down by Kianopay in such a manner that they can be consulted by the Customer for a period of at least one year after they were recorded. They are then archived by Kianopay in accordance with the statutory requirements.

28.2 The Customer is responsible for the content of its data traffic in accordance with the code of conduct set out in article 30 and for creating Backups.

28.3The Customer indemnifies Kianopay against third-party claims in connection with (the content of) the data traffic or information originating from the Customer.

28.4Kianopay will cooperate in transferring Transaction Data and/or other data to another application for the Customer’s account if such is requested by the Customer. Kianopay never guarantees that the Transaction Data present and/or the other data can be transferred to another application or another payment service

12/20

provider during the term of the Contract and/or after the Contract has ended.

29. Personal Data

29.1 The Customer is responsible for protecting the personal and other data that are processed within the context of the Payment Services for the Customer. Kianopay will process the Transaction Data on the basis of its role as Data Processor in accordance with the Personal Data Legislation and for this purpose it will comply with all instructions issued by the Customer (Customer acting as Data Controller).

29.2The Customer indemnifies Kianopay against all claims in connection with invasion of privacy (it includes among others, but is not limited to, all fines imposed to Kianopay by data protection supervisory authorities, all costs in connection to potential/actual data breach).

29.3To the extent the Customer has the right to do so, the Customer agrees to the processing of the personal and other data of the Customer, the End Users as regards the performance of this Contract and receipt of Third Party Services. This processing of personal data includes among other things Identification Details and Transaction Data and is only accessible to Kianopay, its subcontractors, Suppliers of Payment Methods and third parties to the extent this is necessary for the performance of the Contract (subject to ensuring that the sub-processor has implemented substantially the same level of protection, as required under the GDPR). These data are not disclosed to third parties with the exception of those cases in which Kianopay is obliged to do so pursuant to the law or a court order or the consent of the data subject has been obtained. In the latter case, Kianopay will notify the Customer immediately of such disclosure (provided such is allowed by law). Kianopay is not liable for abuse of these data by third parties.

29.4With the exception of the provisions of article 29.1, Kianopay is responsible for the protection of personal data that are processed and/or stored in the Kianopay Infrastructure, and will take appropriate steps to ensure that persons authorised to process personal data are under a contractual, professional or statutory obligationof confidentiality .

Customers as regards the processing of personal data. Processing of personal data takes place exclusively within the context of the performance of the Service, unless processing is required by EU regulations, in which case Kianopay shall specifically inform the Customer (within legal framework) before processing that Personal data.

29.6Both Parties ensure they have implemented appropriate organisation and technical solution to secure the right level of protection over processing of personal data.

29.7In case the data subject will want to exercise their rights or file a complaint under the GDPR, Kianopay will promptly inform the Customer of such event. In case of a personal data breach, Kianopay shall immediately inform the Customer of such event and assist the Customer in complying with its reporting obligations.

29.8 Customer needs to comply with the data protection legislation of the country of origin, but also of the countries where he is operating and offering their services.

29.9 If End Users have direct access to the Service, the Customer will be responsible for providing information concerning rights pursuant to the Personal Data Legislation to the persons whose personal data are processed and compliance with the other provisions of this act.

29.10 Customer will ensure to obtain and provide all necessary consent, to extend necessary for the processing of personal data, that Kianopay require for delivering the Payment Services. Personal data will be kept on file for the duration of the contract and after, to minimum for the period necessary for dealing with chargebacks, etc. Upon the termination or expiry of the Kianopay Contract, all personal data shall be deleted, unless explicitly agreed otherwise by the Parties or required under the rules and regulations.

29.11 In case of the processing within the Cardholder data environment: the disclosure of cardholder data is prohibited; the Customer must not disclose the cardholder data to third parties, expect from the purpose necessary for dealing with Kianopay Services, chargebacks, retrievals, other legally required orders; both Parties ensure high level of internal controls and technical and organisational solutions over

29.5

Kianopay acts on the instructions of the

13/20

the access to cardholder data (e.g. PCI DSS).

30. Code of conduct

30.1The Payment Services must be used in a responsible manner. It is not allowed to use the Payment Services in such a manner that: a) the Infrastructure could be damaged; and/or b) disruptions to their use may occur.

30.2It is not allowed to use the Payment Services, including the payment methods, for illegal purposes and/or to use them in contravention of the Contract and/or in contravention of the required certainty for End Users, Customers and/or Kianopay. This includes among other things but is not limited to the following acts and conduct:

1. a)  infringement of third-party rights or enabling the infringement of third-party rights, such as but not limited to intellectual property rights and privacy rights;
2. b)  failure to comply with the applicable legislation and/or other relevant regulations;
3. c)  (possibly) causing damage to payment networks or the brands of the Suppliers of Payment Methods;
4. d)  spamming (unsolicited dissemination (or, at any rate, making this possible for third parties) of advertisements and other communications);
5. e)  storing/disseminating (animal and/or child) pornography;
6. f)  sexual intimidation, discrimination and/or bothering persons in any other way;
7. g)  dissemination or otherwise making obscene, offensive and hurtful material and/or material of such nature, available to third parties;
8. h)  threats;
9. i)  storing and spreading viruses, worms and/or other destructive activities;
10. j)  unauthorised breaking into (hacking) accounts, systems and/or networks owned by third parties and/or Kianopay and/or performing and/or omitting any other act that makes hacking possible.

30.3 Kianopay and/or the Suppliers of Payment Methods are liable for losses sustained by the Customer and/or third parties as a result of measures implemented by Kianopay as referred to in the previous paragraph, such without prejudice to the Customer’s obligation to pay the agreed amounts.

30.4 If the seriousness of the acts and/or failure to act on the part of the Customer justifies such and/or the acts and/or failure to act is continued, despite the measures implemented by or on behalf of Kianopay, as set out in article 30.2, Kianopay will have the right to dissolve the Contract, without Kianopay being obliged to pay any compensation in this connection or to refund amounts that have already been paid.

D. THIRD PARTY SERVICES

31. General

31.1The Customer acknowledges that the use of certain payment methods requires the consent of the Suppliers of Payment Instruments. Several payment methods also create an agreement between the Customer and the Suppliers of Payment Instruments, which agreement is subject to the Third Party General Terms and Conditions. The Customer bears the risk concerning the actual provision of the Third Party Services by the Suppliers of Payment Instruments, including the payment of payments made by Suppliers of Payment Instruments, with or without intervention on the part of Kianopay.

31.2 The Suppliers of Payment Methods that provide Third Party Services are not considered to be subcontractors of Kianopay. Kianopay is not responsible for the sustained offer, availability or proper operation of the payment and other services and payment methods of the Supplier of Payment Instruments.

31.3 The Customer acknowledges that the Suppliers of Payment Instruments and/or the issuers of the Rules & Regulations have the right to deny the Customer access to the relevant payment instrument or payment network at any time, without the aforementioned parties and/or Kianopay being liable in this connection.

31.4 Kianopay does not perform Maintenance, Support or other services with respect to the Third Party Service, unless agreed otherwise in writing.

31.5As regards the Third Party Services that have been provided, Kianopay arranges, if such has been agreed, for the servicing and warranty of the hardware delivered by third

14/20

parties (such as payment terminals), subject to the conditions of the Third Party General Terms and Conditions.

31.6The Customer only has the right to place the name and logo of the relevant Supplier of Payment Methods on the Customer’s website subject to the terms and conditions of the Suppliers of Payment Methods. The Customer acknowledges that the Suppliers of Payment Methods are the exclusive owners/licence holders of the brands of a payment method and that it will never contest this. Kianopay has the right to suspend and/or dissolve the Contract with immediate effect (in whole or in part) in the event of any fraudulent or unlawful use of the name and/or logo of a Supplier of Payment Methods. A Supplier of Payment Methods has the right at all times to demand that the Customer ceases the use of its name and/or logo.

E. PAYMENT

32. Prices and payments

32.1 All payable amounts
accordance with the Price List and are exclusive of VAT and other levies. The payable amounts will be invoiced in euros including VAT, other levies and any order costs, dispatch costs, hourly wages, travel and waiting time compensations, the actual travel and accommodation costs incurred and the other costs (incurred by third parties) related to the activities.

32.2Kianopay invoices the payable amounts each month unless agreed otherwise, subject to a payment term of 14 (fourteen) days. Kianopay has the right to set off the invoiced amounts.

32.3 If the Customer fails to comply with a payment obligation, the Customer will be in default without requiring notice of default for this purpose. The Customer owes Kianopay the costs and statutory interest as set out in article 23.8.

32.4 Kianopay has the right to keep in its possession the property, rights and information received or generated within the context of the Contract until the Customer has paid all amounts payable to Kianopay. Provision of Payment Services will be suspended if the

Customer is in default as regards payment of the invoiced amounts. This suspension does not alter Kianopay’s payment obligation.

32.5Kianopay has the right to suspend its activities and other obligations until payment in full has been made, without prejudice to the Customer’s obligation to comply with its obligations.

33. Rate changes

are calculated in

33.1 Kianopay has the
transaction costs and rates in the event for example of a change to one or more cost items including but not limited thereto new legislation and regulations and/or changed exchange rates, Consumer Price Index (CPI, all households) or the Statistics Netherlands index concerning commercial services.

33.2In case of a price adjustment independent of Kianopay resulting in the buy rates exceeding sell rates, Kianopay is entitled to clawback.

33.3Kianopay indexes its rates annually. Kianopay will notify the Customer in writing of changes to the rates one calendar month before the change enters into effect. A change to the transaction costs becomes effective immediately after the Customer has been notified of such an increase.

33.4If the Customer does not agree to a price adjustment, the Customer will have the right to terminate the Contract effective as from the date the price adjustment will enter into effect, provided that the overall price increase exceeds the inflation figure published by Statistics Netherlands for the current year (or the previous year for price increases announced for the coming year) by more than 10% for a period of 1 (one) year.

33.5If the Customer initiates and/or re- negotiates the rates changes, the Customer is responsible to process that change with Kianopay, and/or other Supplier of Payment Method (by delivering a dully signed forms), and the Customer acknowledges that the change is only effective as of the explicit confirmation by Kianopay, and/or other Supplier of Payment Method.

34. Costs

34.1Without prejudice to the provisions above, all costs that arise for Kianopay from the

right

to change the

15/20

relationship with the Customer, including but not limited to legal and other costs related to attachments levied against Kianopay at the

expense of the Customer, are for the account of the Customer within the boundaries of reasonableness.

16/20

APPENDIX 1 – GDPR: Data Processing Conditions

The terms “process/processing/processed”, “Data Subject”, “Personal Data”, “Data Controller”, Data Processor”, Personal Data Breach”, shall have the same meaning as in the Data Protection Legislation, and shall refer to the personal data of Customers or any other personal data in card data or transaction data, in each case processed by Kianopay as part of the Services.

Definitions
Data Subject: the identified or identifiable natural person to whom the Personal Data pertain, as referred to in Article 4 at 1) GDPR.

Employee: the employees and other persons engaged by the Processor for whose activities it is responsible, and who are engaged by the Processor for the performance of the Agreement.

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Personal Data: all information relating to a Data Subject; a natural person who can be directly or indirectly identified, in particular based on an identifier such as a name, an identification number, an online identifier or one or more elements that are characteristic of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person, as referred to in Article 4 at 1) GDPR, is deemed identifiable.

Personal Data Breach: (suspicion of) a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed, as referred to in Article 4 at 12) GDPR.

Processing: any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, as referred to at Article 4 at 2) GDPR.

Recipient: a natural or legal person, public authority, agency or another body, whether or not a Third Party, to whom/which the Personal Data are disclosed, as referred to in Article 4 at 9) GDPR.

Service: the payment service(s) to be provided by the Processor to the Controller based on the Agreement.

Sub-processor: another processor, including but not limited to group companies, sister companies, subsidiaries and auxiliary suppliers, engaged by the Processor to perform specific processing activities at the Controller’s expense.

Supervisory Authority: one or more independent public bodies responsible for supervising the application of the GDPR, in order to protect the constitutional rights and fundamental freedoms of natural persons in connection with the Processing of their Personal Data and to facilitate the free traffic of Personal Data inside the Union, as referred to in Article 4 at 21) and Article 51 GDPR.

Third Party: a natural or legal person, public authority, agency or body other than the Data Subject, the Controller or the Processor, or the person who, under the direct authority of the Controller or Processor, is authorised to process Personal Data, as referred to in Article 4 at 10) GDPR.

In processing the Personal Data, the Parties (Kianopay and the Customer) acknowledge that Kianopay acts as the Data Processor and Customer as the Data Controller of such personal data.

The Parties are committed to treat the Personal Data that are or will be processed for the performance of the Contract with due care, and in accordance with the GDPR and other applicable rules and regulations concerning the Processing of Personal Data.

In accordance with the GDPR and other applicable rules and regulations concerning the Processing of Personal Data, this document describes the rights and obligations in respect of the Processing of the Data Subjects’ Personal Data.

Terms:

1. Subject of the Data Processing Conditions.

1.1. The Data Processing Conditions form a supplement to the Platform Contract and replaces any arrangements agreed earlier between the Parties in respect of the Processing of Personal Data.

1.2. The general provisions from the Data Processing Conditions apply for all Processing under the performance of the Platform Contract. The Processor shall immediately notify the

General Terms and Conditions 3.0 (25 May 2018)

Controller if the Processor has reason to assume that the Processor can no longer comply with the Data Processing Conditions.
1.3. The Controller shall give the Processor assignments and instructions for processing the Personal Data on behalf of the Controller. The Controller’s instructions are described in more detail in this Rules as well as in the Platform Contract. The Controller may issue reasonable supplementary instructions in writing.

1.4. The Processor shall process the Personal Data exclusively on assignment from the Controller and on the basis of instructions from the Controller. The Processor shall exclusively process the Personal Data in so far as the processing is necessary for the performance of the Platform Contract, and never for its own use, the use of Third Parties and/or other purposes, unless required so by the contractual or legal obligations. In that event, the Processor shall notify the Controller of this provision prior to the Processing, unless that legislation prohibits such notification for serious reasons of public interest.

1.5. The Processor and the Controller shall comply with the GDPR and other applicable rules and regulations concerning the Processing of Personal Data. The Processor shall immediately notify the Controller if, in the opinion of the Processor, an instruction from the Controller breaches the GDPR and/or other applicable rules and regulations concerning the Processing of Personal Data.

1.6. If the Processor determines the purpose and means of the Processing of Personal Data in violation of the Data Processing Conditions and/or the GDPR and/or other applicable rules and regulations concerning the Processing of Personal Data, the Processor is deemed the Controller for that Processing.

2. Processing of Personal Data

In performing the Payment Services (as agreed and specified in the Kianopay Conditions), the following activities may include the Processing of Personal Data:

• authentication of Customer access to an account;
• communication with Customer about the account, the website, the services;
• management of our business needs, such as monitoring, analysing, and improving our services;
• assessment and acceptance of (potential) Customers as part of the onboarding / customer due diligence process (performance

of the company checks, evaluation of applications, and comparison of information for accuracy and verification purposes);

• performing sanction checks and PEP (politically exposed person) checks on directors and ultimate beneficial owners of customers;

• creation of an account connection between the Customer account and a third-party payment method (as requested by Customer) and forwarding of transaction details to the relevant payment method supplier1/acquirer (sub- processors) for the performance of the Platform Contract and settlement purposes;

• performance of (targeted) marketing activities designed to establish a relationship with a Customer and/or maintain or extend a relationship with a Customer;

• management of risk and protection of the services and the Customer from fraud by verifying Customers identity, and helping to detect and prevent fraud and abuse of our services;

• forwarding to external suppliers relating to activities aimed at preventing and combating fraud;

• providing information on its Customers/transactions to supervisory bodies, if a transaction is considered unusual; and

• compliance with our obligations and to enforce the terms of our services, including to comply with all applicable laws and regulations.

Kianopay may be processing the following Personal Data categories:
Customers (e.g. Name, Date of Birth, ID number, Address, Phone number, Email, IP address, etc.); Consumers/End users (e.g. Name, Bank details, Address, Phone number, Email, IP address, etc.); Website visitors (e.g. Name, Location, IP address, etc.).

3. Cooperation and assistance

The Processor will assist and cooperate with the

1 Full list of Kianopay Supplier Payment Methods is included on www.Kianopay.biz

18/20

Controller in complying with the obligations borne by the Parties on the basis of the GDPR and other applicable rules and regulations concerning the Processing of Personal Data.

4. Access to Personal Data

4.1. The Processor shall limit access to Personal Data by Employees, Sub-processors, Third Parties and other Recipients of Personal Data to a necessary minimum, and what is necessary for the performance of the Contract.

4.2. Based on a strict Access Control, the Processor provides access only to Employees, who must have the access to Personal Data in the performance of the Platform Contract.

4.3. Customer generally authorises Kianopay to engage with sub-processors (e.g. Supplier of Payment Methods) to process the Personal Data on its behalf in accordance with the Platform Contract, subject to: Kianopay ensuring that it has a contractual agreement with any sub-processor, and which apply substantially the same level of protection as specified under the GDPR; and the Processor remains liable to the Customer for the performance of any processing operations transferred to the sub-processor.

4.4. At the Controller’s request, the Processor shall provide to the Controller a list of the Sub- processors engaged by the Processor.

5. Security

The Processor will take appropriate technical and organisational measures to safeguard an appropriate level of security, so that the Data Processing complies with the requirements under the GDPR and other applicable rules and regulations, and the protection of the rights of Data Subjects is safeguarded.

6. Audit

The Processor is obliged to periodically have an audit in respect of the Processor’s organisation, in order to demonstrate that the Processor complies with the provisions of the Platform Contract, the Data Processing Conditions, the GDPR and other applicable rules and regulations concerning the Processing of Personal Data.

7. Personal Data Breach

7.1. Without undue delay, and in any case, no later than within 24 hours after discovery, the Processor shall notify the Controller of a Personal Data Breach or a reasonable suspicion of a Personal Data Breach. The Processor shall notify the

Controller via the Controller’s main contact person, including the sufficient level of details. The Processor warrants that the information provided is complete, correct and accurate.

7.2. If and in so far as it is not possible for the Processor to simultaneously provide all of the details regarding the data breach, the information may be provided to the Controller step-by-step without undue delay and, in any case, no later than within 24 hours after the discovery.

7.3. The Processor has adequate policy and procedures to detect, notify and respond to Personal Data Breaches. The Processor takes measures to prevent or limit (further) unauthorised disclosure, alteration and provision or otherwise unlawful Processing, and to prevent repetition of the same.

7.4. The Processor will maintain a detailed register of all Personal Data Breaches that relate to or are connected with the (performance of the) Platform Contract. At the Controller’s request, the Processor shall provide the Controller with a copy of this register.

7.5. Notifications and communication regarding the Data Breach shall be sent to: support@Kianopay.biz

8. Transfer of Personal Data

Personal Data may be transferred to third parties and/or countries or international organisations only if there is an appropriate level of protection and the Controller has given specific consent for this. The Processor is exclusively entitled to these transfers to third countries or international organisations, unless a provision under EU law or under Member State law requires the Processor to perform Processing. In that event, the Processor shall notify the Controller of this provision prior to the Processing, unless that legislation prohibits such notification for serious reasons of general interest.

9. Confidentiality

9.1. All Personal Data are qualified as confidential and must be treated as such. Any breach of confidentiality or unlawful disclosure is considered a Breach of Personal Data.

9.2. Exceptions from disclosure includes:

1. Disclosure and/or provision of the Personal Data is necessary in the context of the performance of the Platform Contract or the Data Processing Conditions;
2. Any mandatory statutory provision or court decision requires the Parties to disclose and/or provide the Personal Data, in which

19/20

case the Parties shall first notify the other

Party of this;
iii. Disclosure and/or provision of the Personal

Data takes place with prior consent from the other Party.

10. Changes notification

The Processor is obliged to immediately notify the Controller of proposed changes in the offered Service, the performance of the Platform Contract and the performance of the Data Processing Conditions in cases it concerns the Processing of Personal Data. Changes that concern the Processing of Personal Data may never result in the Controller being unable to comply with the GDPR and/or other applicable rules and regulations concerning the Processing of Personal Data.

11. Requests from Data Subject

In the event that a Data Subject submits a request for the execution of his/her legal rights to the Processor, the Parties will deal with the request of the Data Subject in mutual consultation.

12. Liability

Parties agree that the normal statutory regulation applies with regard to liability.

13. Termination

The term of the Data Processing Conditions is the same as the term of the Platform Contract. The Data Processing Conditions cannot be terminated separately from the Platform Contract.

14. Applicable law

The Data Processing Conditions and its performance are governed by the laws of the United Kingdom.

20/20