1003-00003 · Harrowgate Private Equity Fund IV LP · Diligence

due-diligence-request-list.docx DOCUMENT M&A / Corporate

32 / 78 ← → ✕

Contract analysis Extract to table

DUE DILIGENCE REQUEST LIST

VELOPAY SYSTEMS, INC.

Prepared by: Calderwood & Harkness LLP 787 Seventh Avenue, 38th Floor New York, New York 10019

Matter Number: 1003-00003

Prepared on Behalf of: Harrowgate Private Equity Fund IV LP

Delivered to: VeloPay Systems, Inc. c/o Whitford Jessup & Crane LLP 600 Congress Avenue, Suite 2400 Austin, Texas 78701

Attention: Rebecca Thornton-Hayes, Esq. and James Okoro, Esq.

Date of Delivery: December 12, 2024 (Coinciding with Opening of Virtual Data Room)

Questions Regarding This Request List Should Be Directed To: Megan Chu, Lead Associate — mchu@calderwoodharkness.com — (212) 555-3184 Derek Okonkwo, Working Associate — dokonkwo@calderwoodharkness.com — (212) 555-3291

CONFIDENTIAL — This document has been prepared by Calderwood & Harkness LLP on behalf of Harrowgate Private Equity Fund IV LP and is subject to the Mutual Confidentiality and Non-Disclosure Agreement dated October 14, 2024, between VeloPay Systems, Inc. and Harrowgate Private Equity Fund IV LP. Distribution is limited to authorized recipients only.

Right-click to update Table of Contents

INTRODUCTORY INSTRUCTIONS AND GENERAL NOTES

This comprehensive legal due diligence request list (this "Request List") has been prepared by Calderwood & Harkness LLP ("Buyer's Counsel") in connection with the proposed acquisition (the "Transaction") of VeloPay Systems, Inc., a Delaware corporation ("VeloPay" or the "Company"), by Harrowgate Private Equity Fund IV LP, a Delaware limited partnership ("Buyer"). This Request List is delivered to VeloPay and its counsel, Whitford Jessup & Crane LLP, as of December 12, 2024, concurrent with the opening of the virtual data room established for purposes of Buyer's due diligence investigation.

Unless otherwise expressly specified, requests set forth herein cover VeloPay Systems, Inc. and each of its direct and indirect subsidiaries, specifically including the following entities (collectively, the "Subsidiaries"):

(a) VeloPay Processing LLC, a Delaware limited liability company;

(b) VeloPay Canada Inc., an Ontario corporation;

(d) VeloPay Fraud intelligence Inc., a Delaware corporation; and

(e) PayStream Gateway LLC, a Delaware limited liability company.

As used throughout this Request List, references to the "Company" or "VeloPay" shall be understood to refer to VeloPay Systems, Inc. and each of its Subsidiaries, unless the context requires otherwise or a specific entity is identified by name.

The following general instructions apply to the production of documents and information responsive to this Request List:

1. Data Room Organization. All documents and information should be uploaded to the virtual data room organized by category number corresponding to the sections of this Request List (i.e., Section I, Section II, etc.), with subfolders corresponding to each numbered request within each section. A proposed data room folder structure is set forth in Appendix B to this Request List.

2. Time Period. Unless otherwise noted, documents and information should cover at least the past five (5) fiscal years (i.e., from January 1, 2020, through the date of production). Where a request specifies a different time period, the specified period controls. For documents relating to organizational matters, capitalization, or other items for which historical records from inception may be relevant, the Company is requested to produce documents from the date of VeloPay's founding in 2014, to the extent available.

3. Non-Existent Documents. If any requested item does not exist or is not applicable to VeloPay or any Subsidiary, the Company should indicate "N/A" or "Does Not Exist" in the data room index corresponding to the relevant request number, and should not leave the request unaddressed. If the Company believes a particular request is inapplicable for a specific reason, a brief explanation of such inapplicability would be appreciated.

4. Supplemental Requests. This Request List may be supplemented from time to time as Buyer's due diligence investigation progresses. Receipt and review of documents produced in response to this initial Request List may generate follow-up requests for additional documents, information, or clarification. Buyer reserves the right to issue supplemental request lists as appropriate.

5. Confidentiality. All materials provided in response to this Request List will be treated as Confidential Information (as defined in the Mutual Confidentiality and Non-Disclosure Agreement dated October 14, 2024, between VeloPay Systems, Inc. and Harrowgate Private Equity Fund IV LP (the "NDA")). All authorized recipients of such materials are bound by the terms and conditions of the NDA, and the production of documents pursuant to this Request List shall not constitute a waiver of any rights thereunder.

6. Format of Production. Documents should be provided in native format where possible, including Microsoft Word (.docx) and Microsoft Excel (.xlsx) formats for working documents, drafts, and spreadsheets. Executed agreements, certificates, and other final instruments should be provided in PDF format. To the extent that native format files contain metadata that the Company considers sensitive or privileged, the Company should advise Buyer's Counsel accordingly prior to production.

7. Foreign Language Documents. Any documents in languages other than English should be accompanied by certified English translations. This instruction is particularly relevant with respect to documents of VeloPay Europe, Unipessoal Lda. that may be in Portuguese, and any documents of VeloPay Canada Inc. that may be in French. The Company should identify any foreign-language documents for which certified translations will require additional time to prepare, so that the parties may coordinate a reasonable production schedule.

8. Privilege. If any responsive document is withheld on the basis of attorney-client privilege, work product doctrine, or any other applicable privilege, the Company should prepare and maintain a privilege log identifying each withheld document with sufficient specificity to permit Buyer to assess the applicability of the claimed privilege. A template for the privilege log is provided in Appendix B.

9. Materiality and Reasonableness. While this Request List is comprehensive, the Company and its counsel should exercise reasonable judgment in responding. To the extent that a particular request would encompass an unreasonably burdensome volume of documents, Buyer's Counsel is available to discuss reasonable limitations on the scope of production.

10. Contact Information. All questions regarding this Request List, including questions regarding the scope or intent of particular requests, should be directed to Megan Chu (Lead Associate) at mchu@calderwoodharkness.com or (212) 555-3184, or Derek Okonkwo (Working Associate) at dokonkwo@calderwoodharkness.com or (212) 555-3291.

I. CORPORATE ORGANIZATION AND GOOD STANDING

Request 1.1 Certificate of Incorporation (including any certificates of amendment, certificates of correction, and any restated certificates of incorporation) for VeloPay Systems, Inc., a Delaware corporation (Delaware Secretary of State File No. 5748392), as currently in effect, together with all historical versions of such certificate since the Company's initial incorporation in 2014.

Request 1.2 Bylaws (including any amendments and restatements) of VeloPay Systems, Inc., as currently in effect, together with all historical versions of such bylaws since the Company's initial incorporation.

Request 1.3 Certificates of incorporation, articles of incorporation, articles of formation, articles of organization, or equivalent organizational documents for each Subsidiary, including all amendments, restatements, and corrections thereto, specifically including:

(a) VeloPay Processing LLC — Certificate of Formation filed with the Delaware Secretary of State, and any amendments thereto;

(b) VeloPay Canada Inc. — Articles of Incorporation filed with the Ontario Ministry of Government and Consumer Services (or successor authority), and any articles of amendment thereto;

(c) VeloPay Europe, Unipessoal Lda. — Portuguese articles of association (pacto social), extracts from the commercial registry (Registo Comercial), and any amendments thereto (with certified English translations);

(d) VeloPay Fraud intelligence Inc. — Certificate of Incorporation filed with the Delaware Secretary of State, and any amendments thereto; and

(e) PayStream Gateway LLC — Certificate of Formation filed with the Delaware Secretary of State, and any amendments thereto, including any amendments filed in connection with VeloPay's acquisition of PayStream Gateway LLC in 2021.

Request 1.4 Operating agreements, limited liability company agreements, or equivalent organizational documents for each Subsidiary organized as a limited liability company, including all amendments, supplements, and restatements thereto, specifically including:

(a) VeloPay Processing LLC — Limited Liability Company Agreement (or Operating Agreement) and all amendments; and

(b) PayStream Gateway LLC — Limited Liability Company Agreement (or Operating Agreement) and all amendments, including any operating agreement adopted in connection with VeloPay's acquisition in 2021.

Request 1.5 Good standing certificates (or certificates of existence, certificates of status, or equivalent certificates) for VeloPay Systems, Inc. and each Subsidiary from their respective jurisdictions of organization, dated within the last thirty (30) days prior to the date of production. Specifically:

(a) VeloPay Systems, Inc. — Certificate of Good Standing from the Delaware Secretary of State;

(b) VeloPay Processing LLC — Certificate of Good Standing from the Delaware Secretary of State;

(c) VeloPay Canada Inc. — Certificate of Status (or equivalent) from the Ontario Ministry of Government and Consumer Services;

(d) VeloPay Europe, Unipessoal Lda. — Certificate of existence or commercial registry extract confirming active status issued by the Portuguese commercial registry authority (with certified English translation);

(e) VeloPay Fraud intelligence Inc. — Certificate of Good Standing from the Delaware Secretary of State; and

(f) PayStream Gateway LLC — Certificate of Good Standing from the Delaware Secretary of State.

Request 1.6 Good standing certificates, certificates of authority, certificates of qualification, or equivalent certificates from each jurisdiction in which VeloPay or any Subsidiary is qualified, registered, or authorized to do business as a foreign entity, dated within the last thirty (30) days prior to the date of production. This request encompasses all U.S. states in which VeloPay or any Subsidiary is registered, as well as Ontario, Canada, Portugal, and any other foreign jurisdiction in which VeloPay or any Subsidiary maintains a registration or qualification.

Request 1.7 A current organizational chart showing the complete corporate structure of VeloPay Systems, Inc. and all Subsidiaries, including:

(a) Each entity's full legal name and jurisdiction of organization;

(b) Ownership percentages at each level of the corporate structure (including identification of any direct vs. indirect ownership);

(d) Any joint ventures, partnerships, or other collaborative arrangements in which VeloPay or any Subsidiary holds an equity interest; and

(e) Any dormant, inactive, or dissolved entities that were formerly part of the VeloPay corporate family.

Request 1.8 A comprehensive list of all jurisdictions in which VeloPay or any Subsidiary is qualified, registered, or authorized to transact business, including the nature of such qualification or registration (e.g., foreign corporation qualification, money transmitter license, sales tax registration, etc.) and the date of initial qualification or registration.

Request 1.9 A list of all fictitious or assumed business names (i.e., "d/b/a" names, trade names, or fictitious business name statements) used by VeloPay or any Subsidiary in any jurisdiction, including copies of all fictitious business name filings or registrations.

Request 1.10 Copies of all stock ledgers and records of VeloPay Systems, Inc., including the original stock ledger maintained at the Company's principal office and any stock transfer records maintained by the Company's transfer agent, Keystone Pacific Transfer Services Inc., or any predecessor transfer agent. This request includes records of all stock issuances, transfers, cancellations, and retirements since inception.

II. CAPITALIZATION AND EQUITY

Request 2.1 A fully diluted capitalization table for VeloPay Systems, Inc. as of the most recent practicable date, setting forth the following in detail:

(a) All shares of common stock issued and outstanding (it is understood that approximately 82,400,000 shares of common stock are currently outstanding);

(b) All stock options outstanding, including the total number of shares subject to outstanding options (understood to be approximately 7,600,000 shares), the weighted average exercise price (understood to be approximately $12.84 per share), and a breakdown by grant;

(c) All restricted stock units (RSUs) outstanding, including the total number of shares subject to outstanding RSUs (understood to be approximately 3,200,000 shares);

(d) All warrants outstanding, including the total number of shares subject to outstanding warrants (understood to be approximately 1,800,000 shares with an exercise price of $8.50 per share), together with the identity of each warrant holder and the terms of each warrant;

(e) Any other convertible, exercisable, or exchangeable securities, including convertible notes, SAFEs, or other instruments that could result in the issuance of additional equity;

(f) The total number of shares reserved for issuance under the Company's equity incentive plans (including shares available for future grants);

(g) The fully diluted total share count (understood to be approximately 95,000,000 shares on a fully diluted basis); and

(h) A waterfall analysis showing the distribution of merger consideration under various total enterprise value scenarios, taking into account liquidation preferences, participation rights, and the priority of payments among different classes and series of equity.

Request 2.2 A list of all current stockholders of VeloPay Systems, Inc., including each stockholder's name, number of shares held, class and series of stock held, and percentage ownership on both an outstanding and fully diluted basis. This list should specifically identify the following stockholders and their respective holdings:

(a) Ridgeline Ventures Fund III LP (approximately 22.4%);

(b) Apex Growth Partners II LP (approximately 16.8%);

(d) Sonia Reyes-Watkins, CTO and Co-Founder (approximately 9.7%);

(e) Broadleaf Capital Partners LP (approximately 6.1%);

(f) Marcus Langford, CFO (approximately 1.3%);

(g) Danielle Moreau, General Counsel (approximately 0.6%); and

(h) All other holders of VeloPay equity, including management team members, employees, angel investors, smaller institutional funds, and any other holders, with identification of each holder by name and category.

Request 2.3 Copies of all equity incentive plans, stock option plans, restricted stock plans, employee stock purchase plans, phantom equity plans, stock appreciation rights plans, and any other equity-based compensation plans adopted by VeloPay Systems, Inc. or any Subsidiary, including all plan documents, all amendments thereto, and all board and stockholder resolutions authorizing such plans.

Request 2.4 Forms of all equity award agreements utilized by the Company under its equity incentive plans, including standard form option agreements, RSU agreements, restricted stock purchase agreements, stock appreciation rights agreements, and any other form award agreements, together with any variations or non-standard forms used for specific grantees.

Request 2.5 A complete schedule of all outstanding options, RSUs, warrants, and other equity awards as of the most recent practicable date, including for each award:

(a) The grantee's name and position with the Company;

(b) The date of grant;

(d) The exercise price or strike price (for options and warrants);

(e) The vesting schedule (including commencement date, vesting period, cliff vesting provisions, and acceleration provisions);

(f) The expiration date;

(g) The number of shares vested and the number of shares unvested as of the most recent practicable date;

(h) Whether the award is subject to early exercise;

(i) The treatment of the award upon a change of control, including whether the award is subject to single-trigger acceleration (i.e., accelerates solely upon consummation of the Transaction) or double-trigger acceleration (i.e., requires both a change of control and a qualifying termination of employment); and

(j) Any other material terms or conditions applicable to the award.

Request 2.6 All warrant agreements and any amendments, supplements, or side letters thereto, including the warrants outstanding at an exercise price of $8.50 per share, together with any notices of exercise, partial exercise records, and documentation relating to the terms and conditions of each outstanding warrant.

Request 2.7 All stockholder agreements, investor rights agreements, registration rights agreements, voting agreements, right of first refusal and co-sale agreements (including any ROFR/co-sale agreements among the Company and its investors), and any other agreements among stockholders or between stockholders and the Company that govern the rights, obligations, or relationships of VeloPay's stockholders, including all amendments, waivers, and side letters thereto.

Request 2.8 Complete documentation for each prior equity financing round of VeloPay Systems, Inc., including Series A, Series B, Series C, and Series D preferred stock financing rounds, comprising:

(a) Stock purchase agreements (or securities purchase agreements) and all exhibits and schedules thereto;

(b) Investors' rights agreements and all amendments thereto;

(c) Certificates of designation (or certificates of amendment to the certificate of incorporation) establishing each series of preferred stock, including the terms of each series (liquidation preferences, dividend rights, conversion rights, anti-dilution protections, protective provisions, etc.);

(d) Closing binders, signature pages, legal opinions, and closing certificates for each financing round; and

(e) Any term sheets, letters of intent, or preliminary agreements relating to each financing round.

Request 2.9 All anti-dilution provisions applicable to any class or series of equity of VeloPay Systems, Inc., including a description of the type of anti-dilution protection (broad-based weighted average, narrow-based weighted average, full ratchet, or other) and the current conversion price or ratio for each series of preferred stock after giving effect to any anti-dilution adjustments.

Request 2.10 Any agreements, arrangements, or understandings relating to puts, calls, preemptive rights, tag-along rights, drag-along rights, redemption rights, or other transfer restrictions applicable to VeloPay equity, including any provisions in organizational documents, stockholder agreements, or equity award agreements that restrict the transfer, encumbrance, or disposition of VeloPay securities.

Request 2.11 Any outstanding conversion rights, exchange rights, subscription rights, or other rights to acquire or receive shares of VeloPay capital stock, whether arising under the certificate of incorporation, any agreement, or otherwise, other than those already disclosed in response to the foregoing requests.

Request 2.12 Copies of all elections under Section 83(b) of the Internal Revenue Code filed by founders, employees, consultants, or other service providers of VeloPay or any Subsidiary in connection with the receipt of restricted stock or other property subject to a substantial risk of forfeiture, together with evidence of timely filing of such elections with the Internal Revenue Service.

III. BOARD OF DIRECTORS AND GOVERNANCE

Request 3.1 A list of all current members of the Board of Directors of VeloPay Systems, Inc., including the following information for each director:

(a) Full name;

(b) Title and designation (e.g., Chair, independent director, investor-designated director, management director);

(d) Current term of office and, if applicable, the class of directors to which each director belongs (if the Board is classified);

(e) Committee memberships (audit committee, compensation committee, nominating and governance committee, or any other standing or special committee); and

(f) Any affiliation with a stockholder or investor (e.g., designee of Ridgeline Ventures Fund III LP, designee of Apex Growth Partners II LP).

It is understood that the current Board of Directors consists of the following individuals: Nathan Aldridge (Chair), Sonia Reyes-Watkins, Janet Gould, Kwame Asante, Catherine Lindström, and Philip Rosenthal.

Request 3.2 Minutes of all meetings of the Board of Directors of VeloPay Systems, Inc. for the past five (5) years, including all regular meetings, special meetings, telephonic meetings, and meetings held by videoconference, together with all attachments, presentations, and materials distributed to the Board in connection with such meetings.

Request 3.3 All written consents in lieu of meetings of the Board of Directors of VeloPay Systems, Inc. for the past five (5) years, together with any attachments, exhibits, or supporting materials referenced therein.

Request 3.4 Minutes of all meetings of each committee of the Board of Directors (including the audit committee, compensation committee, nominating and governance committee, and any special committee or transaction committee) for the past five (5) years, together with all attachments, presentations, and materials distributed to each committee in connection with such meetings.

Request 3.5 All committee charters for each standing committee of the Board of Directors (including the audit committee charter, compensation committee charter, and nominating and governance committee charter), together with any amendments thereto.

Request 3.6 All corporate governance guidelines, codes of business conduct and ethics, codes of ethics for senior financial officers, insider trading policies, and any other governance-related policies adopted by the Board of Directors or the Company.

Request 3.7 All director and officer questionnaires, annual certifications, and conflict-of-interest disclosures completed by directors and officers of VeloPay for the past three (3) years, including any disclosures of related party transactions or potential conflicts of interest.

Request 3.8 Copies of all indemnification agreements between VeloPay Systems, Inc. and its current and former directors and officers, including any agreements providing for advancement of expenses in connection with legal proceedings or investigations.

Request 3.9 A schedule of all officers of VeloPay Systems, Inc. and each Subsidiary, including each officer's full name, title, date of appointment or election, and the entity or entities for which such individual serves as an officer.

Request 3.10 Copies of any consulting agreements, advisory agreements, board observer agreements, or similar arrangements between VeloPay Systems, Inc. (or any Subsidiary) and any current or former director, including any compensation or fee arrangements for board service beyond standard director compensation.

IV. MINUTES AND STOCKHOLDER ACTIONS

Request 4.1 Minutes of all meetings of the stockholders of VeloPay Systems, Inc. for the past five (5) years, including all annual meetings and special meetings, together with all attachments, notices, and materials distributed to stockholders in connection with such meetings.

Request 4.2 All written consents of stockholders in lieu of meetings adopted during the past five (5) years, together with any attachments, exhibits, or supporting materials referenced therein, and evidence of compliance with any notice requirements applicable to actions taken by written consent.

Request 4.3 All notices sent to stockholders during the past five (5) years, including notices of meetings, notices of actions taken by written consent, notices of proposed amendments to organizational documents, notices of dividend declarations, and any other material communications to stockholders in their capacity as such.

Request 4.4 Copies of any proxy statements, information statements, or similar solicitation materials distributed to stockholders of VeloPay Systems, Inc. during the past five (5) years in connection with any stockholder vote or action.

V. PRIOR ACQUISITIONS, DISPOSITIONS, AND REORGANIZATIONS

Request 5.1 All acquisition agreements, purchase agreements, and related transaction documents for any business, company, or assets acquired by VeloPay or any Subsidiary, with particular attention to the acquisition of PayStream Gateway LLC completed in 2021 for a purchase price of approximately $45 million. For each acquisition, please provide:

(a) The acquisition agreement (whether asset purchase agreement, stock purchase agreement, membership interest purchase agreement, or merger agreement) and all exhibits, schedules, disclosure schedules, and amendments thereto;

(b) Any due diligence reports prepared by legal counsel, accounting firms, or other advisors in connection with the acquisition;

(c) Any earn-out arrangements, holdback arrangements, escrow agreements, or deferred consideration arrangements, including the current status of any earn-out milestones and any amounts remaining in escrow or holdback;

(d) Post-closing adjustment calculations and any disputes relating thereto;

(e) Any indemnification claims made or received following the closing, including the current status of any pending or unresolved indemnification claims; and

(f) Any integration plans, transition services agreements, or other post-closing arrangements.

Request 5.2 All agreements relating to any disposition, divestiture, spin-off, or restructuring of any business, division, or material assets of VeloPay or any Subsidiary, including any agreements under which VeloPay or any Subsidiary has transferred, sold, or otherwise disposed of any business unit, product line, or material assets.

Request 5.3 All joint venture agreements, partnership agreements, strategic alliance agreements, or similar collaborative arrangements to which VeloPay or any Subsidiary is a party, including all amendments, supplements, and side letters thereto.

Request 5.4 All documents relating to any prior merger, consolidation, reorganization, recapitalization, or similar corporate transaction involving VeloPay or any Subsidiary, including any internal reorganizations or restructurings of the corporate group.

VI. MATERIAL CONTRACTS

Request 6.1 Copies of all contracts or agreements to which VeloPay or any Subsidiary is a party that involve aggregate payments by or to the Company in excess of $500,000 per year (whether pursuant to a single agreement or a series of related agreements with the same counterparty).

Request 6.2 Copies of the top twenty-five (25) customer agreements by revenue, including master services agreements, merchant processing agreements, SaaS subscription agreements, gateway services agreements, and any other revenue-generating agreements with the Company's most significant customers. VeloPay is understood to serve more than 14,000 merchants, and this request is directed to those customers generating the most significant revenue for the Company and its Subsidiaries.

Request 6.3 Copies of all contracts or agreements with any customer that represents more than five percent (5%) of VeloPay's consolidated revenue for any of the past three fiscal years, together with a schedule identifying each such customer, the revenue attributable to such customer for each of the past three fiscal years, and the key terms of the applicable agreement.

Request 6.4 Copies of all contracts or agreements containing change of control provisions, including any provisions that require consent, notice, or that provide for termination, modification, acceleration, or any other change in rights or obligations upon or following a change in the ownership or control of VeloPay or any Subsidiary. This request specifically encompasses the fourteen (14) material customer contracts that have been identified as requiring change of control consent or notification in connection with the proposed Transaction. For each such agreement, please provide:

(a) The relevant contract provisions, highlighted or tabbed for ease of reference;

(b) The identity of the counterparty and the nature of the contractual relationship;

(c) The specific change of control trigger (e.g., whether the provision is triggered by a change in majority ownership, a change in beneficial ownership above a specified threshold, a change in the identity of the ultimate parent entity, or otherwise);

(d) The consequences of a change of control (e.g., consent requirement, termination right, automatic termination, modification of terms, acceleration of obligations, renegotiation right); and

(e) Any steps already taken or planned to obtain required consents or provide required notices.

Request 6.5 Copies of all contracts or agreements containing most-favored-nation provisions, exclusivity provisions, or non-competition provisions that restrict VeloPay's or any Subsidiary's ability to compete, offer services, or engage with third parties.

Request 6.6 Copies of all contracts or agreements containing minimum purchase commitments, minimum volume commitments, minimum revenue commitments, or similar requirements imposed on or by VeloPay or any Subsidiary.

Request 6.7 Copies of all agreements with payment networks, card brands, or acquiring banks, including agreements with Pinnacle Enterprises, Hollowell Partners LLC, Pinnacle Partners LLC, Discover, and any other card network or brand, as well as agreements with any acquiring bank through which VeloPay or any Subsidiary processes card transactions.

Request 6.8 Copies of all sponsoring bank agreements, sponsor bank agreements, or bank partnership agreements related to VeloPay's money transmission activities and payments processing operations, including all amendments, supplements, and side letters thereto.

Request 6.9 Copies of all key vendor and supplier agreements, including agreements with cloud hosting providers, data center operators, infrastructure providers, telecommunications providers, and other material technology and service vendors.

Request 6.10 Copies of all technology license agreements (both inbound and outbound), including software license agreements, software-as-a-service agreements (both as licensee and as licensor), API license agreements, data license agreements, and any other agreements pursuant to which VeloPay or any Subsidiary licenses technology to or from third parties.

Request 6.11 Copies of all partnership agreements, reseller agreements, referral agreements, distribution agreements, channel partner agreements, and similar arrangements pursuant to which VeloPay or any Subsidiary distributes its products or services through third parties or receives products or services through third-party channels.

Request 6.12 Copies of all contracts or agreements with any governmental entity or government agency, at the federal, state, local, or foreign level, including any contracts for payment processing services, SaaS services, or other technology services provided to government customers.

Request 6.13 In addition to the agreements identified in response to Request 6.4, copies of all other contracts or agreements that require consent, notice, or that provide for termination, modification, acceleration, or any other change in rights or obligations upon consummation of the proposed Transaction or a change of control of VeloPay, to the extent not previously provided.

Request 6.14 Copies of all guarantees, sureties, comfort letters, keep-well agreements, and similar credit support arrangements provided by or on behalf of VeloPay or any Subsidiary in favor of any third party.

Request 6.15 Copies of all powers of attorney currently in effect, granted by or on behalf of VeloPay or any Subsidiary, including any powers of attorney granted to agents, representatives, or regulatory counsel.

Request 6.16 Copies of all contracts, agreements, or arrangements between VeloPay (or any Subsidiary) and any related party, including directors, officers, affiliates, and stockholders holding more than five percent (5%) of VeloPay equity, together with a schedule identifying each such related party contract.

Request 6.17 Copies of all outstanding proposals, bids, letters of intent, memoranda of understanding, or term sheets for contracts or transactions not yet executed or consummated by VeloPay or any Subsidiary.

Request 6.18 Copies of all contracts or agreements containing uncapped indemnification obligations of VeloPay or any Subsidiary, or indemnification obligations that are not subject to customary caps, baskets, or survival limitations.

Request 6.19 Copies of all material amendments, waivers, side letters, supplements, and modifications to any of the foregoing agreements, to the extent not already provided as part of the underlying agreement.

VII. FINANCING AND INDEBTEDNESS

Request 7.1 Copies of all loan agreements, credit agreements, promissory notes, indentures, and other evidence of indebtedness to which VeloPay or any Subsidiary is a party, whether as borrower, guarantor, or otherwise. This request specifically encompasses the existing $112,000,000 senior secured credit facility with Meridian Commercial Credit Corp. (599 Lexington Avenue, 26th Floor, New York, New York 10022; contact: Brian Castellano), including the credit agreement, all promissory notes, and all related ancillary documents.

Request 7.2 Copies of all amendments, waivers, modifications, restatements, and supplements to existing credit facilities and other indebtedness documents, including any recent amendments to the Meridian Commercial Credit Corp. facility.

Request 7.3 Copies of all security agreements, pledge agreements, mortgages, deeds of trust, collateral assignments, and other collateral documents relating to any indebtedness of VeloPay or any Subsidiary, including a complete description of all assets pledged as collateral.

Request 7.4 Copies of all UCC financing statements filed against VeloPay or any Subsidiary (including UCC-1 initial filings, UCC-3 amendments, and UCC-3 continuations), and copies of lien search results from all relevant jurisdictions, including the Delaware Secretary of State, the Texas Secretary of State, and any other jurisdiction in which UCC filings have been made.

Request 7.5 Copies of all guarantees of indebtedness of third parties provided by VeloPay or any Subsidiary, including any upstream, downstream, or cross-stream guarantees within the VeloPay corporate group.

Request 7.6 Copies of all subordination agreements, intercreditor agreements, and similar agreements governing the priority or relative rights of creditors of VeloPay or any Subsidiary.

Request 7.7 Copies of all correspondence between VeloPay (or any Subsidiary) and any lender or creditor regarding defaults, events of default, potential defaults, waivers, or covenant compliance issues, including any notices of default delivered or received within the past three (3) years.

Request 7.8 Copies of the most recent compliance certificates delivered under existing credit facilities, including the Meridian Commercial Credit Corp. senior secured credit facility, together with the supporting calculations and financial data used to determine compliance with applicable financial covenants.

Request 7.9 A detailed description of all change of control provisions in existing credit agreements and other indebtedness documents, including a specific description of the mandatory prepayment trigger under the Meridian Commercial Credit Corp. facility that would be triggered by the proposed Transaction, together with an analysis of the steps required to satisfy or waive such provisions in connection with the Transaction.

Request 7.10 Copies of all capital lease agreements, equipment financing arrangements, and conditional sale contracts to which VeloPay or any Subsidiary is a party.

Request 7.11 Copies of any hedging agreements, interest rate swap agreements, foreign currency swap agreements, derivative contracts, or similar financial instruments to which VeloPay or any Subsidiary is a party.

Request 7.12 Copies of all letters of credit issued for the account of VeloPay or any Subsidiary that are currently outstanding, together with copies of letters of credit that expired within the past two (2) years, and a schedule identifying the issuing bank, the beneficiary, the face amount, the purpose, and the expiration date of each letter of credit.

VIII. FINANCIAL STATEMENTS AND ACCOUNTING

Request 8.1 Audited financial statements for VeloPay Systems, Inc. and its consolidated subsidiaries for each of the past three (3) fiscal years (FY2022, FY2023, and FY2024), including:

(a) Consolidated balance sheets as of each fiscal year-end;

(b) Consolidated statements of income (or statements of operations) for each fiscal year;

(d) Consolidated statements of stockholders' equity (or statements of changes in equity) for each fiscal year;

(e) Notes to the consolidated financial statements;

(f) Independent auditor's reports issued by Vance Thornbury & Co. LLP (engagement partner: Robert Paulsen) for each fiscal year; and

(g) Any supplemental schedules or exhibits included with or accompanying the audited financial statements.

It is understood that for fiscal year 2024, VeloPay's consolidated financial results include approximately $412.3 million in revenue, approximately $98.1 million in Adjusted EBITDA, approximately $41.7 million in net income, approximately $689.4 million in total assets, approximately $112.0 million in total debt, and approximately $53.8 million in cash and cash equivalents.

Request 8.2 Unaudited interim financial statements (including balance sheets, income statements, and cash flow statements) for all quarterly and monthly periods since the most recent fiscal year-end, including any internal management financial reports or "flash" reports prepared for the Board of Directors.

Request 8.3 All management letters, internal control deficiency letters, and other communications from VeloPay's independent auditors (Vance Thornbury & Co. LLP) to the Board of Directors, audit committee, or management for the past three (3) fiscal years, including any reports identifying material weaknesses, significant deficiencies, or other control deficiencies.

Request 8.4 A description of all material accounting policies applied by VeloPay in the preparation of its financial statements, and a description of any changes in accounting policies, accounting estimates, or accounting methods adopted during the past three (3) fiscal years, including the reasons for any such changes and the financial impact thereof.

Request 8.5 A schedule of all off-balance-sheet arrangements, contingent liabilities, and unconsolidated variable interest entities, including a description of each arrangement, the potential financial impact, and the reasons such items are not reflected on VeloPay's consolidated balance sheet.

Request 8.6 A detailed reconciliation of GAAP net income to Adjusted EBITDA for each of the past three (3) fiscal years, including identification of all adjustments (e.g., depreciation and amortization, stock-based compensation expense, one-time or non-recurring items, transaction-related costs, restructuring charges, and any other adjustments). It is understood that VeloPay's Adjusted EBITDA margin for FY2024 was approximately 23.79%.

Request 8.7 A revenue breakdown by product and service line for each of the past three (3) fiscal years, including separate disclosure of revenue attributable to:

(a) Interchange-plus processing fees and transaction-based payment processing revenue;

(b) SaaS subscription fees for the analytics dashboard and fraud detection suite;

(d) Any other material revenue streams.

Request 8.8 A revenue breakdown by geography for each of the past three (3) fiscal years, including separate disclosure of revenue attributable to:

(a) The United States;

(b) Canada (VeloPay Canada Inc.); and

DUE DILIGENCE REQUEST LIST
VELOPAY SYSTEMS, INC.
Prepared by: Calderwood & Harkness LLP 787 Seventh Avenue, 38th Floor New York, New York 10019
Matter Number: 1003-00003
Prepared on Behalf of: Harrowgate Private Equity Fund IV LP
Delivered to: VeloPay Systems, Inc. c/o Whitford Jessup & Crane LLP 600 Congress Avenue, Suite 2400 Austin, Texas 78701
Attention: Rebecca Thornton-Hayes, Esq. and James Okoro, Esq.
Date of Delivery: December 12, 2024 (Coinciding with Opening of Virtual Data Room)
Questions Regarding This Request List Should Be Directed To: Megan Chu, Lead Associate — mchu@calderwoodharkness.com — (212) 555-3184 Derek Okonkwo, Working Associate — dokonkwo@calderwoodharkness.com — (212) 555-3291
CONFIDENTIAL — This document has been prepared by Calderwood & Harkness LLP on behalf of Harrowgate Private Equity Fund IV LP and is subject to the Mutual Confidentiality and Non-Disclosure Agreement dated October 14, 2024, between VeloPay Systems, Inc. and Harrowgate Private Equity Fund IV LP. Distribution is limited to authorized recipients only.
Right-click to update Table of Contents
INTRODUCTORY INSTRUCTIONS AND GENERAL NOTES
This comprehensive legal due diligence request list (this "Request List") has been prepared by Calderwood & Harkness LLP ("Buyer's Counsel") in connection with the proposed acquisition (the "Transaction") of VeloPay Systems, Inc., a Delaware corporation ("VeloPay" or the "Company"), by Harrowgate Private Equity Fund IV LP, a Delaware limited partnership ("Buyer"). This Request List is delivered to VeloPay and its counsel, Whitford Jessup & Crane LLP, as of December 12, 2024, concurrent with the opening of the virtual data room established for purposes of Buyer's due diligence investigation.
Unless otherwise expressly specified, requests set forth herein cover VeloPay Systems, Inc. and each of its direct and indirect subsidiaries, specifically including the following entities (collectively, the "Subsidiaries"):
(a) VeloPay Processing LLC, a Delaware limited liability company;
(b) VeloPay Canada Inc., an Ontario corporation;
(c) VeloPay Europe, Unipessoal Lda., a Portuguese limitada (sociedade unipessoal por quotas);
(d) VeloPay Fraud intelligence Inc., a Delaware corporation; and
(e) PayStream Gateway LLC, a Delaware limited liability company.
As used throughout this Request List, references to the "Company" or "VeloPay" shall be understood to refer to VeloPay Systems, Inc. and each of its Subsidiaries, unless the context requires otherwise or a specific entity is identified by name.
The following general instructions apply to the production of documents and information responsive to this Request List:
1. Data Room Organization. All documents and information should be uploaded to the virtual data room organized by category number corresponding to the sections of this Request List (i.e., Section I, Section II, etc.), with subfolders corresponding to each numbered request within each section. A proposed data room folder structure is set forth in Appendix B to this Request List.
2. Time Period. Unless otherwise noted, documents and information should cover at least the past five (5) fiscal years (i.e., from January 1, 2020, through the date of production). Where a request specifies a different time period, the specified period controls. For documents relating to organizational matters, capitalization, or other items for which historical records from inception may be relevant, the Company is requested to produce documents from the date of VeloPay's founding in 2014, to the extent available.
3. Non-Existent Documents. If any requested item does not exist or is not applicable to VeloPay or any Subsidiary, the Company should indicate "N/A" or "Does Not Exist" in the data room index corresponding to the relevant request number, and should not leave the request unaddressed. If the Company believes a particular request is inapplicable for a specific reason, a brief explanation of such inapplicability would be appreciated.
4. Supplemental Requests. This Request List may be supplemented from time to time as Buyer's due diligence investigation progresses. Receipt and review of documents produced in response to this initial Request List may generate follow-up requests for additional documents, information, or clarification. Buyer reserves the right to issue supplemental request lists as appropriate.
5. Confidentiality. All materials provided in response to this Request List will be treated as Confidential Information (as defined in the Mutual Confidentiality and Non-Disclosure Agreement dated October 14, 2024, between VeloPay Systems, Inc. and Harrowgate Private Equity Fund IV LP (the "NDA")). All authorized recipients of such materials are bound by the terms and conditions of the NDA, and the production of documents pursuant to this Request List shall not constitute a waiver of any rights thereunder.
6. Format of Production. Documents should be provided in native format where possible, including Microsoft Word (.docx) and Microsoft Excel (.xlsx) formats for working documents, drafts, and spreadsheets. Executed agreements, certificates, and other final instruments should be provided in PDF format. To the extent that native format files contain metadata that the Company considers sensitive or privileged, the Company should advise Buyer's Counsel accordingly prior to production.
7. Foreign Language Documents. Any documents in languages other than English should be accompanied by certified English translations. This instruction is particularly relevant with respect to documents of VeloPay Europe, Unipessoal Lda. that may be in Portuguese, and any documents of VeloPay Canada Inc. that may be in French. The Company should identify any foreign-language documents for which certified translations will require additional time to prepare, so that the parties may coordinate a reasonable production schedule.
8. Privilege. If any responsive document is withheld on the basis of attorney-client privilege, work product doctrine, or any other applicable privilege, the Company should prepare and maintain a privilege log identifying each withheld document with sufficient specificity to permit Buyer to assess the applicability of the claimed privilege. A template for the privilege log is provided in Appendix B.
9. Materiality and Reasonableness. While this Request List is comprehensive, the Company and its counsel should exercise reasonable judgment in responding. To the extent that a particular request would encompass an unreasonably burdensome volume of documents, Buyer's Counsel is available to discuss reasonable limitations on the scope of production.
10. Contact Information. All questions regarding this Request List, including questions regarding the scope or intent of particular requests, should be directed to Megan Chu (Lead Associate) at mchu@calderwoodharkness.com or (212) 555-3184, or Derek Okonkwo (Working Associate) at dokonkwo@calderwoodharkness.com or (212) 555-3291.
I. CORPORATE ORGANIZATION AND GOOD STANDING
Request 1.1 Certificate of Incorporation (including any certificates of amendment, certificates of correction, and any restated certificates of incorporation) for VeloPay Systems, Inc., a Delaware corporation (Delaware Secretary of State File No. 5748392), as currently in effect, together with all historical versions of such certificate since the Company's initial incorporation in 2014.
Request 1.2 Bylaws (including any amendments and restatements) of VeloPay Systems, Inc., as currently in effect, together with all historical versions of such bylaws since the Company's initial incorporation.
Request 1.3 Certificates of incorporation, articles of incorporation, articles of formation, articles of organization, or equivalent organizational documents for each Subsidiary, including all amendments, restatements, and corrections thereto, specifically including:
(a) VeloPay Processing LLC — Certificate of Formation filed with the Delaware Secretary of State, and any amendments thereto;
(b) VeloPay Canada Inc. — Articles of Incorporation filed with the Ontario Ministry of Government and Consumer Services (or successor authority), and any articles of amendment thereto;
(c) VeloPay Europe, Unipessoal Lda. — Portuguese articles of association (pacto social), extracts from the commercial registry (Registo Comercial), and any amendments thereto (with certified English translations);
(d) VeloPay Fraud intelligence Inc. — Certificate of Incorporation filed with the Delaware Secretary of State, and any amendments thereto; and
(e) PayStream Gateway LLC — Certificate of Formation filed with the Delaware Secretary of State, and any amendments thereto, including any amendments filed in connection with VeloPay's acquisition of PayStream Gateway LLC in 2021.
Request 1.4 Operating agreements, limited liability company agreements, or equivalent organizational documents for each Subsidiary organized as a limited liability company, including all amendments, supplements, and restatements thereto, specifically including:
(a) VeloPay Processing LLC — Limited Liability Company Agreement (or Operating Agreement) and all amendments; and
(b) PayStream Gateway LLC — Limited Liability Company Agreement (or Operating Agreement) and all amendments, including any operating agreement adopted in connection with VeloPay's acquisition in 2021.
Request 1.5 Good standing certificates (or certificates of existence, certificates of status, or equivalent certificates) for VeloPay Systems, Inc. and each Subsidiary from their respective jurisdictions of organization, dated within the last thirty (30) days prior to the date of production. Specifically:
(a) VeloPay Systems, Inc. — Certificate of Good Standing from the Delaware Secretary of State;
(b) VeloPay Processing LLC — Certificate of Good Standing from the Delaware Secretary of State;
(c) VeloPay Canada Inc. — Certificate of Status (or equivalent) from the Ontario Ministry of Government and Consumer Services;
(d) VeloPay Europe, Unipessoal Lda. — Certificate of existence or commercial registry extract confirming active status issued by the Portuguese commercial registry authority (with certified English translation);
(e) VeloPay Fraud intelligence Inc. — Certificate of Good Standing from the Delaware Secretary of State; and
(f) PayStream Gateway LLC — Certificate of Good Standing from the Delaware Secretary of State.
Request 1.6 Good standing certificates, certificates of authority, certificates of qualification, or equivalent certificates from each jurisdiction in which VeloPay or any Subsidiary is qualified, registered, or authorized to do business as a foreign entity, dated within the last thirty (30) days prior to the date of production. This request encompasses all U.S. states in which VeloPay or any Subsidiary is registered, as well as Ontario, Canada, Portugal, and any other foreign jurisdiction in which VeloPay or any Subsidiary maintains a registration or qualification.
Request 1.7 A current organizational chart showing the complete corporate structure of VeloPay Systems, Inc. and all Subsidiaries, including:
(a) Each entity's full legal name and jurisdiction of organization;
(b) Ownership percentages at each level of the corporate structure (including identification of any direct vs. indirect ownership);
(c) Any minority interests, non-controlling interests, or third-party equity holdings in any Subsidiary;
(d) Any joint ventures, partnerships, or other collaborative arrangements in which VeloPay or any Subsidiary holds an equity interest; and
(e) Any dormant, inactive, or dissolved entities that were formerly part of the VeloPay corporate family.
Request 1.8 A comprehensive list of all jurisdictions in which VeloPay or any Subsidiary is qualified, registered, or authorized to transact business, including the nature of such qualification or registration (e.g., foreign corporation qualification, money transmitter license, sales tax registration, etc.) and the date of initial qualification or registration.
Request 1.9 A list of all fictitious or assumed business names (i.e., "d/b/a" names, trade names, or fictitious business name statements) used by VeloPay or any Subsidiary in any jurisdiction, including copies of all fictitious business name filings or registrations.
Request 1.10 Copies of all stock ledgers and records of VeloPay Systems, Inc., including the original stock ledger maintained at the Company's principal office and any stock transfer records maintained by the Company's transfer agent, Keystone Pacific Transfer Services Inc., or any predecessor transfer agent. This request includes records of all stock issuances, transfers, cancellations, and retirements since inception.
II. CAPITALIZATION AND EQUITY
Request 2.1 A fully diluted capitalization table for VeloPay Systems, Inc. as of the most recent practicable date, setting forth the following in detail:
(a) All shares of common stock issued and outstanding (it is understood that approximately 82,400,000 shares of common stock are currently outstanding);
(b) All stock options outstanding, including the total number of shares subject to outstanding options (understood to be approximately 7,600,000 shares), the weighted average exercise price (understood to be approximately $12.84 per share), and a breakdown by grant;
(c) All restricted stock units (RSUs) outstanding, including the total number of shares subject to outstanding RSUs (understood to be approximately 3,200,000 shares);
(d) All warrants outstanding, including the total number of shares subject to outstanding warrants (understood to be approximately 1,800,000 shares with an exercise price of $8.50 per share), together with the identity of each warrant holder and the terms of each warrant;
(e) Any other convertible, exercisable, or exchangeable securities, including convertible notes, SAFEs, or other instruments that could result in the issuance of additional equity;
(f) The total number of shares reserved for issuance under the Company's equity incentive plans (including shares available for future grants);
(g) The fully diluted total share count (understood to be approximately 95,000,000 shares on a fully diluted basis); and
(h) A waterfall analysis showing the distribution of merger consideration under various total enterprise value scenarios, taking into account liquidation preferences, participation rights, and the priority of payments among different classes and series of equity.
Request 2.2 A list of all current stockholders of VeloPay Systems, Inc., including each stockholder's name, number of shares held, class and series of stock held, and percentage ownership on both an outstanding and fully diluted basis. This list should specifically identify the following stockholders and their respective holdings:
(a) Ridgeline Ventures Fund III LP (approximately 22.4%);
(b) Apex Growth Partners II LP (approximately 16.8%);
(c) Nathan Aldridge, CEO and Co-Founder (approximately 14.2%);
(d) Sonia Reyes-Watkins, CTO and Co-Founder (approximately 9.7%);
(e) Broadleaf Capital Partners LP (approximately 6.1%);
(f) Marcus Langford, CFO (approximately 1.3%);
(g) Danielle Moreau, General Counsel (approximately 0.6%); and
(h) All other holders of VeloPay equity, including management team members, employees, angel investors, smaller institutional funds, and any other holders, with identification of each holder by name and category.
Request 2.3 Copies of all equity incentive plans, stock option plans, restricted stock plans, employee stock purchase plans, phantom equity plans, stock appreciation rights plans, and any other equity-based compensation plans adopted by VeloPay Systems, Inc. or any Subsidiary, including all plan documents, all amendments thereto, and all board and stockholder resolutions authorizing such plans.
Request 2.4 Forms of all equity award agreements utilized by the Company under its equity incentive plans, including standard form option agreements, RSU agreements, restricted stock purchase agreements, stock appreciation rights agreements, and any other form award agreements, together with any variations or non-standard forms used for specific grantees.
Request 2.5 A complete schedule of all outstanding options, RSUs, warrants, and other equity awards as of the most recent practicable date, including for each award:
(a) The grantee's name and position with the Company;
(b) The date of grant;
(c) The number of shares subject to the award;
(d) The exercise price or strike price (for options and warrants);
(e) The vesting schedule (including commencement date, vesting period, cliff vesting provisions, and acceleration provisions);
(f) The expiration date;
(g) The number of shares vested and the number of shares unvested as of the most recent practicable date;
(h) Whether the award is subject to early exercise;
(i) The treatment of the award upon a change of control, including whether the award is subject to single-trigger acceleration (i.e., accelerates solely upon consummation of the Transaction) or double-trigger acceleration (i.e., requires both a change of control and a qualifying termination of employment); and
(j) Any other material terms or conditions applicable to the award.
Request 2.6 All warrant agreements and any amendments, supplements, or side letters thereto, including the warrants outstanding at an exercise price of $8.50 per share, together with any notices of exercise, partial exercise records, and documentation relating to the terms and conditions of each outstanding warrant.
Request 2.7 All stockholder agreements, investor rights agreements, registration rights agreements, voting agreements, right of first refusal and co-sale agreements (including any ROFR/co-sale agreements among the Company and its investors), and any other agreements among stockholders or between stockholders and the Company that govern the rights, obligations, or relationships of VeloPay's stockholders, including all amendments, waivers, and side letters thereto.
Request 2.8 Complete documentation for each prior equity financing round of VeloPay Systems, Inc., including Series A, Series B, Series C, and Series D preferred stock financing rounds, comprising:
(a) Stock purchase agreements (or securities purchase agreements) and all exhibits and schedules thereto;
(b) Investors' rights agreements and all amendments thereto;
(c) Certificates of designation (or certificates of amendment to the certificate of incorporation) establishing each series of preferred stock, including the terms of each series (liquidation preferences, dividend rights, conversion rights, anti-dilution protections, protective provisions, etc.);
(d) Closing binders, signature pages, legal opinions, and closing certificates for each financing round; and
(e) Any term sheets, letters of intent, or preliminary agreements relating to each financing round.
Request 2.9 All anti-dilution provisions applicable to any class or series of equity of VeloPay Systems, Inc., including a description of the type of anti-dilution protection (broad-based weighted average, narrow-based weighted average, full ratchet, or other) and the current conversion price or ratio for each series of preferred stock after giving effect to any anti-dilution adjustments.
Request 2.10 Any agreements, arrangements, or understandings relating to puts, calls, preemptive rights, tag-along rights, drag-along rights, redemption rights, or other transfer restrictions applicable to VeloPay equity, including any provisions in organizational documents, stockholder agreements, or equity award agreements that restrict the transfer, encumbrance, or disposition of VeloPay securities.
Request 2.11 Any outstanding conversion rights, exchange rights, subscription rights, or other rights to acquire or receive shares of VeloPay capital stock, whether arising under the certificate of incorporation, any agreement, or otherwise, other than those already disclosed in response to the foregoing requests.
Request 2.12 Copies of all elections under Section 83(b) of the Internal Revenue Code filed by founders, employees, consultants, or other service providers of VeloPay or any Subsidiary in connection with the receipt of restricted stock or other property subject to a substantial risk of forfeiture, together with evidence of timely filing of such elections with the Internal Revenue Service.
III. BOARD OF DIRECTORS AND GOVERNANCE
Request 3.1 A list of all current members of the Board of Directors of VeloPay Systems, Inc., including the following information for each director:
(a) Full name;
(b) Title and designation (e.g., Chair, independent director, investor-designated director, management director);
(c) Date of initial election or appointment to the Board;
(d) Current term of office and, if applicable, the class of directors to which each director belongs (if the Board is classified);
(e) Committee memberships (audit committee, compensation committee, nominating and governance committee, or any other standing or special committee); and
(f) Any affiliation with a stockholder or investor (e.g., designee of Ridgeline Ventures Fund III LP, designee of Apex Growth Partners II LP).
It is understood that the current Board of Directors consists of the following individuals: Nathan Aldridge (Chair), Sonia Reyes-Watkins, Janet Gould, Kwame Asante, Catherine Lindström, and Philip Rosenthal.
Request 3.2 Minutes of all meetings of the Board of Directors of VeloPay Systems, Inc. for the past five (5) years, including all regular meetings, special meetings, telephonic meetings, and meetings held by videoconference, together with all attachments, presentations, and materials distributed to the Board in connection with such meetings.
Request 3.3 All written consents in lieu of meetings of the Board of Directors of VeloPay Systems, Inc. for the past five (5) years, together with any attachments, exhibits, or supporting materials referenced therein.
Request 3.4 Minutes of all meetings of each committee of the Board of Directors (including the audit committee, compensation committee, nominating and governance committee, and any special committee or transaction committee) for the past five (5) years, together with all attachments, presentations, and materials distributed to each committee in connection with such meetings.
Request 3.5 All committee charters for each standing committee of the Board of Directors (including the audit committee charter, compensation committee charter, and nominating and governance committee charter), together with any amendments thereto.
Request 3.6 All corporate governance guidelines, codes of business conduct and ethics, codes of ethics for senior financial officers, insider trading policies, and any other governance-related policies adopted by the Board of Directors or the Company.
Request 3.7 All director and officer questionnaires, annual certifications, and conflict-of-interest disclosures completed by directors and officers of VeloPay for the past three (3) years, including any disclosures of related party transactions or potential conflicts of interest.
Request 3.8 Copies of all indemnification agreements between VeloPay Systems, Inc. and its current and former directors and officers, including any agreements providing for advancement of expenses in connection with legal proceedings or investigations.
Request 3.9 A schedule of all officers of VeloPay Systems, Inc. and each Subsidiary, including each officer's full name, title, date of appointment or election, and the entity or entities for which such individual serves as an officer.
Request 3.10 Copies of any consulting agreements, advisory agreements, board observer agreements, or similar arrangements between VeloPay Systems, Inc. (or any Subsidiary) and any current or former director, including any compensation or fee arrangements for board service beyond standard director compensation.
IV. MINUTES AND STOCKHOLDER ACTIONS
Request 4.1 Minutes of all meetings of the stockholders of VeloPay Systems, Inc. for the past five (5) years, including all annual meetings and special meetings, together with all attachments, notices, and materials distributed to stockholders in connection with such meetings.
Request 4.2 All written consents of stockholders in lieu of meetings adopted during the past five (5) years, together with any attachments, exhibits, or supporting materials referenced therein, and evidence of compliance with any notice requirements applicable to actions taken by written consent.
Request 4.3 All notices sent to stockholders during the past five (5) years, including notices of meetings, notices of actions taken by written consent, notices of proposed amendments to organizational documents, notices of dividend declarations, and any other material communications to stockholders in their capacity as such.
Request 4.4 Copies of any proxy statements, information statements, or similar solicitation materials distributed to stockholders of VeloPay Systems, Inc. during the past five (5) years in connection with any stockholder vote or action.
V. PRIOR ACQUISITIONS, DISPOSITIONS, AND REORGANIZATIONS
Request 5.1 All acquisition agreements, purchase agreements, and related transaction documents for any business, company, or assets acquired by VeloPay or any Subsidiary, with particular attention to the acquisition of PayStream Gateway LLC completed in 2021 for a purchase price of approximately $45 million. For each acquisition, please provide:
(a) The acquisition agreement (whether asset purchase agreement, stock purchase agreement, membership interest purchase agreement, or merger agreement) and all exhibits, schedules, disclosure schedules, and amendments thereto;
(b) Any due diligence reports prepared by legal counsel, accounting firms, or other advisors in connection with the acquisition;
(c) Any earn-out arrangements, holdback arrangements, escrow agreements, or deferred consideration arrangements, including the current status of any earn-out milestones and any amounts remaining in escrow or holdback;
(d) Post-closing adjustment calculations and any disputes relating thereto;
(e) Any indemnification claims made or received following the closing, including the current status of any pending or unresolved indemnification claims; and
(f) Any integration plans, transition services agreements, or other post-closing arrangements.
Request 5.2 All agreements relating to any disposition, divestiture, spin-off, or restructuring of any business, division, or material assets of VeloPay or any Subsidiary, including any agreements under which VeloPay or any Subsidiary has transferred, sold, or otherwise disposed of any business unit, product line, or material assets.
Request 5.3 All joint venture agreements, partnership agreements, strategic alliance agreements, or similar collaborative arrangements to which VeloPay or any Subsidiary is a party, including all amendments, supplements, and side letters thereto.
Request 5.4 All documents relating to any prior merger, consolidation, reorganization, recapitalization, or similar corporate transaction involving VeloPay or any Subsidiary, including any internal reorganizations or restructurings of the corporate group.
VI. MATERIAL CONTRACTS
Request 6.1 Copies of all contracts or agreements to which VeloPay or any Subsidiary is a party that involve aggregate payments by or to the Company in excess of $500,000 per year (whether pursuant to a single agreement or a series of related agreements with the same counterparty).
Request 6.2 Copies of the top twenty-five (25) customer agreements by revenue, including master services agreements, merchant processing agreements, SaaS subscription agreements, gateway services agreements, and any other revenue-generating agreements with the Company's most significant customers. VeloPay is understood to serve more than 14,000 merchants, and this request is directed to those customers generating the most significant revenue for the Company and its Subsidiaries.
Request 6.3 Copies of all contracts or agreements with any customer that represents more than five percent (5%) of VeloPay's consolidated revenue for any of the past three fiscal years, together with a schedule identifying each such customer, the revenue attributable to such customer for each of the past three fiscal years, and the key terms of the applicable agreement.
Request 6.4 Copies of all contracts or agreements containing change of control provisions, including any provisions that require consent, notice, or that provide for termination, modification, acceleration, or any other change in rights or obligations upon or following a change in the ownership or control of VeloPay or any Subsidiary. This request specifically encompasses the fourteen (14) material customer contracts that have been identified as requiring change of control consent or notification in connection with the proposed Transaction. For each such agreement, please provide:
(a) The relevant contract provisions, highlighted or tabbed for ease of reference;
(b) The identity of the counterparty and the nature of the contractual relationship;
(c) The specific change of control trigger (e.g., whether the provision is triggered by a change in majority ownership, a change in beneficial ownership above a specified threshold, a change in the identity of the ultimate parent entity, or otherwise);
(d) The consequences of a change of control (e.g., consent requirement, termination right, automatic termination, modification of terms, acceleration of obligations, renegotiation right); and
(e) Any steps already taken or planned to obtain required consents or provide required notices.
Request 6.5 Copies of all contracts or agreements containing most-favored-nation provisions, exclusivity provisions, or non-competition provisions that restrict VeloPay's or any Subsidiary's ability to compete, offer services, or engage with third parties.
Request 6.6 Copies of all contracts or agreements containing minimum purchase commitments, minimum volume commitments, minimum revenue commitments, or similar requirements imposed on or by VeloPay or any Subsidiary.
Request 6.7 Copies of all agreements with payment networks, card brands, or acquiring banks, including agreements with Pinnacle Enterprises, Hollowell Partners LLC, Pinnacle Partners LLC, Discover, and any other card network or brand, as well as agreements with any acquiring bank through which VeloPay or any Subsidiary processes card transactions.
Request 6.8 Copies of all sponsoring bank agreements, sponsor bank agreements, or bank partnership agreements related to VeloPay's money transmission activities and payments processing operations, including all amendments, supplements, and side letters thereto.
Request 6.9 Copies of all key vendor and supplier agreements, including agreements with cloud hosting providers, data center operators, infrastructure providers, telecommunications providers, and other material technology and service vendors.
Request 6.10 Copies of all technology license agreements (both inbound and outbound), including software license agreements, software-as-a-service agreements (both as licensee and as licensor), API license agreements, data license agreements, and any other agreements pursuant to which VeloPay or any Subsidiary licenses technology to or from third parties.
Request 6.11 Copies of all partnership agreements, reseller agreements, referral agreements, distribution agreements, channel partner agreements, and similar arrangements pursuant to which VeloPay or any Subsidiary distributes its products or services through third parties or receives products or services through third-party channels.
Request 6.12 Copies of all contracts or agreements with any governmental entity or government agency, at the federal, state, local, or foreign level, including any contracts for payment processing services, SaaS services, or other technology services provided to government customers.
Request 6.13 In addition to the agreements identified in response to Request 6.4, copies of all other contracts or agreements that require consent, notice, or that provide for termination, modification, acceleration, or any other change in rights or obligations upon consummation of the proposed Transaction or a change of control of VeloPay, to the extent not previously provided.
Request 6.14 Copies of all guarantees, sureties, comfort letters, keep-well agreements, and similar credit support arrangements provided by or on behalf of VeloPay or any Subsidiary in favor of any third party.
Request 6.15 Copies of all powers of attorney currently in effect, granted by or on behalf of VeloPay or any Subsidiary, including any powers of attorney granted to agents, representatives, or regulatory counsel.
Request 6.16 Copies of all contracts, agreements, or arrangements between VeloPay (or any Subsidiary) and any related party, including directors, officers, affiliates, and stockholders holding more than five percent (5%) of VeloPay equity, together with a schedule identifying each such related party contract.
Request 6.17 Copies of all outstanding proposals, bids, letters of intent, memoranda of understanding, or term sheets for contracts or transactions not yet executed or consummated by VeloPay or any Subsidiary.
Request 6.18 Copies of all contracts or agreements containing uncapped indemnification obligations of VeloPay or any Subsidiary, or indemnification obligations that are not subject to customary caps, baskets, or survival limitations.
Request 6.19 Copies of all material amendments, waivers, side letters, supplements, and modifications to any of the foregoing agreements, to the extent not already provided as part of the underlying agreement.
VII. FINANCING AND INDEBTEDNESS
Request 7.1 Copies of all loan agreements, credit agreements, promissory notes, indentures, and other evidence of indebtedness to which VeloPay or any Subsidiary is a party, whether as borrower, guarantor, or otherwise. This request specifically encompasses the existing $112,000,000 senior secured credit facility with Meridian Commercial Credit Corp. (599 Lexington Avenue, 26th Floor, New York, New York 10022; contact: Brian Castellano), including the credit agreement, all promissory notes, and all related ancillary documents.
Request 7.2 Copies of all amendments, waivers, modifications, restatements, and supplements to existing credit facilities and other indebtedness documents, including any recent amendments to the Meridian Commercial Credit Corp. facility.
Request 7.3 Copies of all security agreements, pledge agreements, mortgages, deeds of trust, collateral assignments, and other collateral documents relating to any indebtedness of VeloPay or any Subsidiary, including a complete description of all assets pledged as collateral.
Request 7.4 Copies of all UCC financing statements filed against VeloPay or any Subsidiary (including UCC-1 initial filings, UCC-3 amendments, and UCC-3 continuations), and copies of lien search results from all relevant jurisdictions, including the Delaware Secretary of State, the Texas Secretary of State, and any other jurisdiction in which UCC filings have been made.
Request 7.5 Copies of all guarantees of indebtedness of third parties provided by VeloPay or any Subsidiary, including any upstream, downstream, or cross-stream guarantees within the VeloPay corporate group.
Request 7.6 Copies of all subordination agreements, intercreditor agreements, and similar agreements governing the priority or relative rights of creditors of VeloPay or any Subsidiary.
Request 7.7 Copies of all correspondence between VeloPay (or any Subsidiary) and any lender or creditor regarding defaults, events of default, potential defaults, waivers, or covenant compliance issues, including any notices of default delivered or received within the past three (3) years.
Request 7.8 Copies of the most recent compliance certificates delivered under existing credit facilities, including the Meridian Commercial Credit Corp. senior secured credit facility, together with the supporting calculations and financial data used to determine compliance with applicable financial covenants.
Request 7.9 A detailed description of all change of control provisions in existing credit agreements and other indebtedness documents, including a specific description of the mandatory prepayment trigger under the Meridian Commercial Credit Corp. facility that would be triggered by the proposed Transaction, together with an analysis of the steps required to satisfy or waive such provisions in connection with the Transaction.
Request 7.10 Copies of all capital lease agreements, equipment financing arrangements, and conditional sale contracts to which VeloPay or any Subsidiary is a party.
Request 7.11 Copies of any hedging agreements, interest rate swap agreements, foreign currency swap agreements, derivative contracts, or similar financial instruments to which VeloPay or any Subsidiary is a party.
Request 7.12 Copies of all letters of credit issued for the account of VeloPay or any Subsidiary that are currently outstanding, together with copies of letters of credit that expired within the past two (2) years, and a schedule identifying the issuing bank, the beneficiary, the face amount, the purpose, and the expiration date of each letter of credit.
VIII. FINANCIAL STATEMENTS AND ACCOUNTING
Request 8.1 Audited financial statements for VeloPay Systems, Inc. and its consolidated subsidiaries for each of the past three (3) fiscal years (FY2022, FY2023, and FY2024), including:
(a) Consolidated balance sheets as of each fiscal year-end;
(b) Consolidated statements of income (or statements of operations) for each fiscal year;
(c) Consolidated statements of cash flows for each fiscal year;
(d) Consolidated statements of stockholders' equity (or statements of changes in equity) for each fiscal year;
(e) Notes to the consolidated financial statements;
(f) Independent auditor's reports issued by Vance Thornbury & Co. LLP (engagement partner: Robert Paulsen) for each fiscal year; and
(g) Any supplemental schedules or exhibits included with or accompanying the audited financial statements.
It is understood that for fiscal year 2024, VeloPay's consolidated financial results include approximately $412.3 million in revenue, approximately $98.1 million in Adjusted EBITDA, approximately $41.7 million in net income, approximately $689.4 million in total assets, approximately $112.0 million in total debt, and approximately $53.8 million in cash and cash equivalents.
Request 8.2 Unaudited interim financial statements (including balance sheets, income statements, and cash flow statements) for all quarterly and monthly periods since the most recent fiscal year-end, including any internal management financial reports or "flash" reports prepared for the Board of Directors.
Request 8.3 All management letters, internal control deficiency letters, and other communications from VeloPay's independent auditors (Vance Thornbury & Co. LLP) to the Board of Directors, audit committee, or management for the past three (3) fiscal years, including any reports identifying material weaknesses, significant deficiencies, or other control deficiencies.
Request 8.4 A description of all material accounting policies applied by VeloPay in the preparation of its financial statements, and a description of any changes in accounting policies, accounting estimates, or accounting methods adopted during the past three (3) fiscal years, including the reasons for any such changes and the financial impact thereof.
Request 8.5 A schedule of all off-balance-sheet arrangements, contingent liabilities, and unconsolidated variable interest entities, including a description of each arrangement, the potential financial impact, and the reasons such items are not reflected on VeloPay's consolidated balance sheet.
Request 8.6 A detailed reconciliation of GAAP net income to Adjusted EBITDA for each of the past three (3) fiscal years, including identification of all adjustments (e.g., depreciation and amortization, stock-based compensation expense, one-time or non-recurring items, transaction-related costs, restructuring charges, and any other adjustments). It is understood that VeloPay's Adjusted EBITDA margin for FY2024 was approximately 23.79%.
Request 8.7 A revenue breakdown by product and service line for each of the past three (3) fiscal years, including separate disclosure of revenue attributable to:
(a) Interchange-plus processing fees and transaction-based payment processing revenue;
(b) SaaS subscription fees for the analytics dashboard and fraud detection suite;
(c) Gateway transaction fees (including revenue attributable to the PayStream Gateway platform); and
(d) Any other material revenue streams.
Request 8.8 A revenue breakdown by geography for each of the past three (3) fiscal years, including separate disclosure of revenue attributable to:
(a) The United States;
(b) Canada (VeloPay Canada Inc.); and
(c) Europe/Portugal (VeloPay Europe, Unipessoal Lda.).
Request 8.9 A schedule of gross payment volume ("GPV") processed by VeloPay and its Subsidiaries for each of the past three (3) fiscal years and for each quarterly period within such fiscal years. It is understood that VeloPay's annualized GPV is approximately $87 billion.
Request 8.10 Copies of all budgets, financial projections, financial forecasts, and long-range strategic financial plans for FY2025 and beyond, including any projections or forecasts prepared for the Board of Directors, for potential investors, or in connection with the proposed Transaction.
Request 8.11 All reports issued by the internal audit function (if any) for the past three (3) fiscal years, including any reports relating to internal controls over financial reporting, operational audits, compliance audits, or IT audits.
Request 8.12 A schedule of all adjustments proposed by VeloPay's independent auditors (Vance Thornbury & Co. LLP) during the course of their annual audits that were not recorded by management ("passed adjustments"), together with management's rationale for not recording such adjustments.
IX. TAX MATTERS
Request 9.1 Copies of all federal, state, local, and foreign income tax returns filed by VeloPay Systems, Inc. and each Subsidiary for the past five (5) tax years, including all schedules, attachments, elections, statements, and supporting workpapers.
Request 9.2 Copies of all Canadian tax returns filed by VeloPay Canada Inc., including Canadian federal income tax returns (T2 Corporation Income Tax Return) and Ontario provincial corporate tax returns, for the past five (5) tax years, together with all schedules and supporting documentation.
Request 9.3 Copies of all Portuguese tax returns filed by VeloPay Europe, Unipessoal Lda., including Portuguese corporate income tax filings (Imposto sobre o Rendimento das Pessoas Coletivas / IRC), for the past five (5) tax years, together with all schedules and supporting documentation (with certified English translations).
Request 9.4 All correspondence with any taxing authority, including the Internal Revenue Service, state departments of revenue, the Canada Revenue Agency, and the Portuguese tax authority (Autoridade Tributária e Aduaneira), regarding examinations, audits, proposed adjustments, deficiency notices, assessment notices, or any other tax-related disputes or inquiries, for the past five (5) years.
Request 9.5 A schedule of all open tax years for VeloPay and each Subsidiary, including identification of any pending or ongoing tax audits or examinations, and any waivers or extensions of statutes of limitations on assessment or collection granted to any taxing authority.
Request 9.6 Copies of all closing agreements, private letter rulings, determination letters, technical advice memoranda, and similar rulings or determinations received from any taxing authority.
Request 9.7 A schedule of all net operating loss (NOL) carryforwards, capital loss carryforwards, tax credit carryforwards, and other tax attributes of VeloPay and each Subsidiary, including:
(a) The amount, vintage year, and expiration date of each carryforward;
(b) Any limitations on the use of such carryforwards under Section 382 or Section 383 of the Internal Revenue Code (or analogous state, Canadian, or Portuguese provisions), including an analysis of whether any prior ownership changes have triggered such limitations; and
(c) The impact of the proposed Transaction on the availability and utilization of such tax attributes.
Request 9.8 All transfer pricing studies, transfer pricing documentation, advance pricing agreements, and intercompany agreements among VeloPay Systems, Inc. and its Subsidiaries that govern the pricing of intercompany transactions, with particular attention to transfer pricing arrangements between VeloPay Systems, Inc. and VeloPay Canada Inc. and between VeloPay Systems, Inc. and VeloPay Europe, Unipessoal Lda.
Request 9.9 A schedule of all sales tax, use tax, goods and services tax (GST), harmonized sales tax (HST), value-added tax (VAT), and similar indirect tax filings made by VeloPay and each Subsidiary, together with copies of any exemption certificates, resale certificates, or other documentation relied upon to claim exemptions from such taxes.
Request 9.10 Any analysis or documentation regarding any elections under Section 338 of the Internal Revenue Code (including Section 338(g) and Section 338(h)(10) elections), or any similar elections under state, Canadian, or Portuguese tax law, that have been made or are being contemplated in connection with the proposed Transaction or any prior acquisition.
Request 9.11 Documentation regarding compliance with the Foreign Investment in Real Property Tax Act (FIRPTA), including any analysis of whether VeloPay Systems, Inc. is or has been a "United States real property holding corporation" within the meaning of Section 897(c)(2) of the Internal Revenue Code at any time during the applicable testing period.
Request 9.12 All tax sharing agreements, tax allocation agreements, and tax indemnification agreements to which VeloPay or any Subsidiary is a party, including any agreements among members of VeloPay's consolidated or combined group.
Request 9.13 A schedule of any unclaimed property or escheat liabilities of VeloPay or any Subsidiary, including any prior unclaimed property audits or voluntary disclosure agreements, and any pending unclaimed property compliance obligations.
Request 9.14 Copies of all employment tax returns (IRS Form 941, state equivalents, Canadian equivalents, and Portuguese equivalents) filed by VeloPay and each Subsidiary for the past three (3) years.
Request 9.15 Documentation of all research and development tax credit claims filed by VeloPay or any Subsidiary, including any studies, analyses, or reports prepared to support such claims, and a schedule of the amount of R&D tax credits claimed and utilized in each of the past five (5) tax years.
Request 9.16 An analysis of VeloPay's obligations under the Texas margin tax (Texas franchise tax), including any Texas margin tax returns filed for the past five (5) years, as well as an analysis of any other state-specific tax obligations arising from the Company's operations or presence in any state (including any nexus analysis for states in which VeloPay has employees, customers, or other operational activities).
X. INTELLECTUAL PROPERTY
Request 10.1 A complete schedule of all patents and patent applications (both U.S. and foreign) owned by or assigned to VeloPay or any Subsidiary, including for each patent or application:
(a) Patent or application number;
(b) Title of the invention;
(c) Filing date and priority date;
(d) Issue date (for issued patents);
(e) Expiration date (for issued patents);
(f) Assignee and record owner;
(g) Named inventor(s);
(h) Current status (issued, pending, abandoned, etc.); and
(i) Any maintenance fee status and upcoming due dates.
Request 10.2 A complete schedule of all registered trademarks, trademark applications, and service marks (both U.S. and foreign) owned by or registered to VeloPay or any Subsidiary, including for each mark:
(a) Registration number or application serial number;
(b) The mark (word mark, design mark, or combined mark);
(c) International class(es) of goods and/or services;
(d) Filing date;
(e) Registration date;
(f) Status (registered, pending, opposed, etc.);
(g) Registrant and record owner; and
(h) Any renewal dates or maintenance filing deadlines.
Request 10.3 A schedule of all registered copyrights owned by VeloPay or any Subsidiary, including the registration number, title of the work, date of registration, and claimant.
Request 10.4 A schedule of all domain names owned, registered, or controlled by VeloPay or any Subsidiary, including the registrar, registration date, expiration date, and any domain name disputes or proceedings (including UDRP proceedings).
Request 10.5 All intellectual property assignment agreements from founders, employees, and independent contractors, including assignments executed by Nathan Aldridge and Sonia Reyes-Watkins at or around the time of VeloPay's founding in 2014, as well as all standard form invention assignment agreements used as part of the Company's onboarding process.
Request 10.6 All intellectual property-related agreements, including:
(a) Inbound technology license agreements pursuant to which VeloPay or any Subsidiary licenses technology, software, or IP from third parties;
(b) Outbound technology license agreements pursuant to which VeloPay or any Subsidiary licenses technology, software, or IP to third parties;
(c) Patent cross-license agreements;
(d) Trademark license agreements (both as licensor and licensee);
(e) Source code escrow agreements, including agreements with escrow agents and beneficiaries;
(f) Co-development agreements or joint IP ownership arrangements; and
(g) Any agreements granting any third party a security interest in, lien on, or license to any intellectual property of VeloPay or any Subsidiary.
Request 10.7 A description of all material trade secrets and proprietary information of VeloPay and its Subsidiaries, including proprietary algorithms, machine learning models, data sets, customer lists, pricing methodologies, and other confidential business information, together with a description of the measures taken by the Company to protect the confidentiality and secrecy of such information (including access controls, encryption, non-disclosure agreements, employee training, and physical security measures).
Request 10.8 An open-source software audit report or a comprehensive inventory of all open-source software components incorporated into, linked with, or distributed as part of any VeloPay product or service, including:
(a) The name and version of each open-source component;
(b) The applicable open-source license type (e.g., GPL v2, GPL v3, LGPL, MIT, Apache 2.0, BSD 2-Clause, BSD 3-Clause, MPL, AGPL, or other);
(c) A description of how each component is used (e.g., incorporated into source code, dynamically linked, statically linked, distributed to end users, used internally only);
(d) An assessment of any copyleft or "viral" license obligations that could affect the Company's proprietary code; and
(e) A description of the Company's open-source compliance procedures, policies, and governance framework.
Request 10.9 All intellectual property acquired in connection with the PayStream Gateway LLC acquisition in 2021, including IP assignment agreements, bills of sale for IP assets, and any representations, warranties, or indemnities relating to IP ownership, non-infringement, or freedom to operate provided by the seller in connection with such acquisition.
Request 10.10 All cease-and-desist letters, infringement claims, demands, or other IP disputes (whether sent or received) involving VeloPay or any Subsidiary during the past five (5) years, together with all related correspondence and any settlement agreements or resolutions.
Request 10.11 Any opinions of counsel regarding IP validity, patentability, infringement, non-infringement, freedom to operate, or enforceability obtained by VeloPay or any Subsidiary.
Request 10.12 A description of the Company's invention disclosure process, IP review process, and procedures for identifying, evaluating, and protecting new intellectual property developed by employees and contractors.
Request 10.13 All agreements with universities, research institutions, government agencies, or other external organizations relating to the development, funding, or ownership of intellectual property, including any agreements under which a third party may have rights to or claims on IP developed with VeloPay funding or resources.
Request 10.14 Software development and maintenance documentation for the Company's core payments processing platform, including an architecture overview, description of key system dependencies, and identification of any third-party components or services that are critical to the operation of the platform.
XI. INFORMATION TECHNOLOGY AND DATA SECURITY
Request 11.1 A comprehensive description of VeloPay's IT infrastructure, including:
(a) Cloud hosting providers and services utilized (e.g., Meridian Technologies, Azure, GCP);
(b) Data center locations and co-location arrangements;
(c) Network architecture overview;
(d) Disaster recovery and business continuity plans, including recovery time objectives (RTOs), recovery point objectives (RPOs), and the results of any disaster recovery tests;
(e) Backup procedures and data replication strategies; and
(f) A description of the Company's DevOps, CI/CD, and deployment practices.
Request 11.2 PCI-DSS (Payment Card Industry Data Security Standard) compliance certificates, Reports on Compliance (ROCs), Self-Assessment Questionnaires (SAQs), and any related audit or assessment reports for VeloPay and each Subsidiary for the past three (3) years, including the identity of the Qualified Security Assessor (QSA) or Internal Security Assessor (ISA) who performed each assessment.
Request 11.3 SOC 1 (SSAE 18 / ISAE 3402) and SOC 2 audit reports (both Type I and Type II) for VeloPay and each Subsidiary for the past three (3) years, including any bridge letters or gap letters issued between reporting periods.
Request 11.4 A description of VeloPay's information security policies and procedures, including:
(a) Information security policy;
(b) Acceptable use policy;
(c) Access control and identity management policies;
(d) Incident response plan;
(e) Vulnerability management program;
(f) Change management procedures;
(g) Data classification policy; and
(h) Third-party risk management and vendor security assessment procedures.
Request 11.5 A schedule of all data security incidents, data breaches, or unauthorized access events involving VeloPay or any Subsidiary during the past five (5) years, including for each incident:
(a) Date of discovery and date of occurrence;
(b) Nature of the incident (e.g., unauthorized access, ransomware, phishing, insider threat);
(c) Data elements affected and number of individuals impacted;
(d) Notifications provided to regulators, law enforcement, affected individuals, card brands, or other parties;
(e) Remediation measures implemented; and
(f) Any fines, penalties, or assessments imposed as a result of the incident.
Request 11.6 All penetration testing reports and vulnerability assessment reports prepared for VeloPay or any Subsidiary during the past two (2) years, including reports from external security firms and internal security teams.
Request 11.7 A description of VeloPay's encryption standards and key management practices, including the encryption algorithms used for data at rest and data in transit, the key management lifecycle, and compliance with applicable industry standards (e.g., NIST, FIPS 140-2).
Request 11.8 All agreements with third-party IT service providers, cloud providers, managed security service providers (MSSPs), managed detection and response (MDR) providers, and other technology vendors that provide material IT or security services to VeloPay or any Subsidiary.
Request 11.9 Documentation relating to systems uptime, service level agreement (SLA) performance, and any material outages, service interruptions, or system failures experienced by VeloPay or any Subsidiary during the past three (3) years, including root cause analyses and post-incident reviews.
Request 11.10 Copies of any insurance policies specifically covering cyber risks, data breach liabilities, technology errors and omissions, or media liability risks.
XII. DATA PRIVACY AND PROTECTION
Request 12.1 All privacy policies (both current and historical versions for the past five (5) years), including website privacy policies, mobile application privacy policies, customer-facing privacy notices, and internal employee privacy policies, together with a record of all material changes made to such policies and the dates of each change.
Request 12.2 A description of VeloPay's compliance programs relating to the following data privacy and data protection laws and regulations:
(a) California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including any data mapping, data inventory, or records of processing activities maintained for purposes of CCPA/CPRA compliance;
(b) General Data Protection Regulation (GDPR), as applicable to VeloPay Europe, Unipessoal Lda.'s operations in Portugal and the European Union, including records of processing activities maintained under Article 30 of the GDPR;
(c) Personal Information Protection and Electronic Documents Act (PIPEDA), as applicable to VeloPay Canada Inc.'s collection, use, and disclosure of personal information in the course of commercial activity in Canada;
(d) Gramm-Leach-Bliley Act (GLBA), to the extent applicable to VeloPay's payments processing activities, including compliance with the Safeguards Rule and the Privacy Rule; and
(e) Any other applicable federal, state, provincial, or foreign privacy or data protection laws, including the Colorado Privacy Act, Virginia Consumer Data Protection Act, Connecticut Data Privacy Act, and any other state privacy laws to which VeloPay is subject.
Request 12.3 Records of all data subject access requests, data deletion requests, data portability requests, and opt-out requests (including "Do Not Sell or Share" requests under CCPA/CPRA) received by VeloPay or any Subsidiary during the past three (3) years, including summary statistics regarding the number and type of requests received and the Company's response times.
Request 12.4 Copies of all data processing agreements, data protection addenda, and similar agreements with third parties who process personal data on behalf of VeloPay or any Subsidiary, including agreements with sub-processors.
Request 12.5 Records of all data protection impact assessments (DPIAs) or privacy impact assessments (PIAs) conducted by VeloPay or any Subsidiary, including the scope, findings, and any recommended remedial measures.
Request 12.6 Copies of VeloPay's data retention policies and data destruction policies, including retention schedules for different categories of data and documentation of any data destruction activities.
Request 12.7 Documentation of all cross-border data transfer mechanisms relied upon by VeloPay and its Subsidiaries, including EU Standard Contractual Clauses (SCCs) for EU-to-U.S. data transfers, transfer impact assessments, and any other mechanisms used to comply with restrictions on cross-border transfers of personal data.
Request 12.8 All correspondence with any data protection authority or privacy regulator, including the Portuguese Comissão Nacional de Proteção de Dados (CNPD), the Privacy Commissioner of Canada, the California Attorney General's office, and any other relevant a