Contract analysis

ARTICLE 1 — DEFINITIONS As used in this DPA, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this DPA shall have the meanings assigned to them in the Principal Agreement. 1.1 "Applicable Data Protection Laws" means all federal, state, and international laws, regulations, rules, orders, and regulatory guidance applicable to the processing of Personal Data under th

ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING 2.1 Subject Matter of Processing. Processor shall process Personal Data solely for the purpose of providing the Services under the Principal Agreement. The processing activities to be performed by Processor are limited to the following: (a) Real-Time Payment Processing. Processing of transaction data, account data, and related Personal Data to facilitate the initiation, aut

ARTICLE 3 — CONTROLLER OBLIGATIONS 3.1 Lawful Basis. Controller represents and warrants that it has established and will maintain a lawful basis for providing Personal Data to Processor for processing in connection with the Services. With respect to EU Data, Controller represents that it has identified and documented an appropriate legal basis for processing under Article 6 of the GDPR (and, where applicable, Article

ARTICLE 4 — PROCESSOR OBLIGATIONS 4.1 Processing on Instructions. Processor shall process Personal Data only on the basis of documented instructions from Controller, including with respect to transfers of Personal Data to a third country or an international organization, unless Processor is required to do so by applicable law to which Processor is subject. In such case, Processor shall inform Controller of that legal

ARTICLE 5 — SUB-PROCESSORS 5.1 General Written Authorization. Controller hereby grants Processor a general written authorization, in accordance with Article 28(2) of the GDPR, to engage Sub-processors to process Personal Data on behalf of Controller in connection with the Services, subject to and in accordance with the requirements set forth in this Article 5. Processor shall not engage any Sub-processor other than a

ARTICLE 6 — PERSONAL DATA BREACH NOTIFICATION 6.1 Notification Timeline. Processor shall notify Controller of any Personal Data Breach without undue delay and in no event later than forty-eight (48) hours after Processor becomes aware of such Personal Data Breach. For purposes of this Section 6.1, Processor shall be deemed to have become "aware" of a Personal Data Breach at the point at which Processor has a reasonab

ARTICLE 7 — AUDIT RIGHTS 7.1 Right to Audit. Controller, or a qualified independent third-party auditor designated by Controller and reasonably acceptable to Processor, shall have the right to audit Processor's compliance with this DPA and the security measures described in Schedule B. The exercise of audit rights under this Section 7.1 shall be subject to the following conditions: (a) Controller shall provide Proces

ARTICLE 8 — CROSS-BORDER DATA TRANSFERS AND STANDARD CONTRACTUAL CLAUSES 8.1 EU Data Transfers. To the extent that Processor, or any Sub-processor engaged by Processor, processes EU Data outside the territory of the European Economic Area ("EEA"), such transfer shall be effected in compliance with Chapter V of the GDPR and shall be subject to the Standard Contractual Clauses appended to this DPA as Appendix 1. No tra

ARTICLE 9 — INDEMNIFICATION 9.1 Processor Indemnification Obligation. Processor shall defend, indemnify, and hold harmless Controller and its affiliates, and their respective officers, directors, employees, agents, successors, and assigns (collectively, the "Controller Indemnified Parties") from and against any and all third-party claims, demands, suits, actions, proceedings, investigations, fines, penalties, damages

ARTICLE 10 — DATA RETENTION, RETURN, AND DELETION 10.1 During Term. During the term of the Principal Agreement, Processor shall retain Personal Data only to the extent necessary to perform the Services and shall not retain Personal Data for longer than is reasonably necessary for such purpose. Processor shall implement data minimization practices consistent with Applicable Data Protection Laws and shall periodically

ARTICLE 11 — LIMITATION OF LIABILITY 11.1 Liability Cap. Subject to Section 11.2, the aggregate liability of Processor to Controller under this DPA (including under Article 9 — Indemnification) for all claims arising out of or relating to this DPA shall not exceed the greater of: (a) Five Million United States Dollars ($5,000,000); or (b) Two (2) times the fees actually paid by Controller to Processor under the Princ

ARTICLE 12 — INSURANCE 12.1 Coverage Requirement. Processor shall maintain, at its own expense, throughout the term of this DPA and for a period of two (2) years following the expiration or termination of this DPA, technology errors and omissions and cyber-liability insurance coverage with the following minimum limits: (a) Per-Occurrence Limit: Not less than Ten Million United States Dollars ($10,000,000) per occurre

ARTICLE 13 — CONFIDENTIALITY 13.1 Obligations. Each party shall maintain the confidentiality of all Personal Data processed under this DPA, and shall not disclose such Personal Data to any third party except as expressly permitted by this DPA, the Principal Agreement, or applicable law. In addition, each party shall maintain the confidentiality of all information relating to the other party's security measures, audit

ARTICLE 14 — TERM AND TERMINATION 14.1 Term. This DPA shall be effective as of the date of execution by both parties and shall remain in full force and effect for the duration of the Principal Agreement (a five (5)-year term commencing on the effective date of the Principal Agreement), unless earlier terminated in accordance with the provisions of this Article 14. 14.2 Termination for Material Breach. Either party ma