Terms of Service UK (CCA)

2 www.elavon.co.uk

1. DEFINITIONS AND RULES OF INTERPRETATION

(a) Unlessotherwisestated,thedefinitionssetoutintheglossaryattheendoftheseTOSapplytotheAgreement.

(b) Singulartermsshallincludetheplural,andviceversa,unlessthecontextotherwiserequires.

(c) “Including”shallnotbeconstruedasexclusiveorlimiting,andshallgenerallymean“includingbutnotlimitedto.”

(d) AnyreferencetoasectionshallbetotherelevantsectionoftheseTOS,andapartorparagraphshallbetotherelevantpartorparagraphoftherelevantscheduleunlessotherwisestated.

(e) ReferencestoaPersonincludeareferencetothatPerson’ssuccessorsorassignees.

(f) In the event of a conflict between the documents comprising the Agreement (excluding any SecurityDocument), the following order of prioritywill apply, only to the extent of such conflict: (i) these TOS; (ii)theApplication;(iii)anyotherAgreementyouhaveenteredintowithElavonforsimilarorrelatedservices; (iv)anyagreemententeredintopursuanttosection6(a)(ii);(v)theOperatingGuide;and(vi)anyotherguidesormanualsprovidedtoCustomerfromtimetotime;provided,however,intheeventofaconflictbetweentheAgreementandtheCardSchemeRules,theCardSchemeRuleswillprevailandtheAgreementwillbeinterpretedtogiveasfulleffectasispossibletoboththeCardSchemeRulesandtheAgreement.

(g) InthisAgreement,referencestoanyenactmentshallbedeemedtoincludereferencestosuchenactmentasamended,re-enactedorextendedandanysubordinatelegislationmadefromtimetotimeunderit.

2. THE AGREEMENT, RULES AND LAWS

Youshallcomplywiththefollowingatalltimes:

(a) theprovisionsoftheAgreement;

(b) theCardSchemeRules;

(c) allLaws;and

(d) yourobligationsrelatingtothesaleand/orsupplyofgoodsand/orservicesbyyoutoyourcustomers.

3. CARD ACCEPTANCE

UnderthisAgreement,unlessotherwiseagreedwithElavon,youshall:

(a) onlyacceptvalidandcurrentCardsaspaymentforanyofthefullrangeofgoodsand/orservicesthatyouhavesoldandsupplied;

(b) acceptTransactionsonlyinaccordancewiththetermsandconditionsoftheAgreement;

(c) not imposeany financial limit in respect of Transactions, or otherwise establishminimumormaximumTransactionamounts;

(d) notuseyourpersonal/businessCardstoconductaTransactionincircumstanceswhereyouareactingasbothCustomerandCardholder;

(e) notacceptTransactionsinrespectofwhichanemployee,directororothermemberofyourbusinessistheCardholder;

(f) onlyacceptTransactionsinthecurrency(orcurrencies)statedintheApplication;

3 www.elavon.co.uk

(g) subjecttosections3(h)and3(i),whendealingwithyourcustomers,treatpurchasesbyCardinthesamewayascashpurchases,includingofferingthegoodsand/orservicesyousellatthesamepriceregardlessoftheformofpayment;

(h) wherepermittedbytheCardSchemesorbytheLaws,beentitledtoofferareductiontoacustomerforusingaCard,providedthatyouclearlyinformtheCardholderatyourbusinesslocation,beforeacceptingtheTransactionoftheamountormethodofcalculationofanysuchreduction;and

(i) wherepermittedbytheCardSchemesorbytheLaws,beentitledtosurchargeacustomerforusingaCard,providedthat(i)anysuchsurchargebearsareasonablerelationshiptoyourcostofacceptingtheCardand(ii) youclearlyinformtheCardholderatyourbusinesslocation,beforeacceptingtheTransaction,oftheamountormethodofcalculationofsuchsurcharge.AllrequirementsofLaws,anyCompetentAuthorityortheCardSchemesregardingdisclosureofsuchasurchargemustbecompliedwithbyyou.

4. YOUR BANK ACCOUNT

(a) Establishment and authority.Youshall:

(i) openandthroughouttheTermoftheAgreementmaintainYourBankAccount(s);and

(ii) maintainsufficientfundsinYourBankAccount(s)onamonthlybasis,tocoverourMerchantServiceCharges,anyChargebacks,allFeesandAdjustmentsandanyothersumsdueandpayabletousunderorinconnectionwiththisAgreement.

(b) Changes to Your Bank Account.

(i) Youmust:

(aa)subjecttosection4(b)(i)(bb),providethirty(30)dayswrittennoticetousbeforeyouchangeYourBankAccount,includingthefinancialinstitutionorthelocationofthebranchatwhichYourBankAccountismaintained,andyoushallnotimplementsuchchangeswithoutourpriorwrittenconsent(suchconsentnottobeunreasonablywithheldordelayed);

(bb)notifyusinwritingimmediatelyifanychangestoYourBankAccountdetailsareimposedonyou,givingusfulldetailsofsuchchangesandthereasonsbehindthem.

(ii) ElavonwillhavenoliabilitytoyouwhatsoeverforanylosscausedbyanydelayinpaymentsintoYourBankAccountpursuanttosection4(d),duetoand/orduringanychangesetoutinsection4(b)(i).

(c) Direct Debit Mandate.

(i) Unlessweagreeotherwise,youshallmaintainwithyourbankaninstructionauthorisingustodirectlydebitfromYourBankAccountallsumsthatbecomedueandpayablebyyoutousunderorinconnectionwith thisAgreement at the timewespecify (“Direct Debit Mandate”) andwemaydebitYourBankAccountinaccordancewiththeDirectDebitMandate.

(ii) Subjecttosection4(b)(i)(bb),youmustalwaysobtainourpriorwrittenconsenttomodify,limitorrevokeanyDirectDebitMandaterelatingtoYourBankAccountregardlessofwhereitisheld.IntheeventthatyourevokeanyDirectDebitMandateatanytimeduringtheAgreement,Elavonreservestherighttochargeyouforsuchrevocation

(iii) The Direct Debit Mandate shall remain in effect throughout the term of the Agreement and afterterminationof theAgreementuntil the laterof (i) threehundredandninety (390)days following theeffectivedateofterminationoftheAgreement,or(ii)untilallyourObligationshavebeenfulfilled.

4 www.elavon.co.uk

(d) Payments into Your Bank Account

(i) Subject always to the Laws, Card Scheme Rules, any direction of a Competent Authority or anydeduction made by a Card Scheme and sections 14 and 15, Elavon shall pay you for all SalesTransactionsacceptedbyyouinaccordancewiththisAgreementbytransferringtheSettlementFundsintoYourBankAccount.

(ii) PaymentsintoYourBankAccount,subjectalwaysto4(d)(i)willbemadeinaccordancewiththefundingfrequencydetailssetoutintheApplication(subjectalwaystoElavon’srighttoincreasethefundingfrequencyperiodbythenumberofdelaydays,alsosetoutintheApplication).

(iii) Incasethechoiceofthefundingcurrency,thechoiceofyourbankoryourBankAccountresultinanyintermediaryfeesimposedbyintermediatingbanksoranyotherintermediaryinstitutions,Elavonshallpassthosefeesontoyou.Thatmeansthatsuchintermediaryfeeswillbedeductedfromtheamounttransferred to yourBankAccount. Intermediarybanks (andother intermediary institutions) and theCardholder’sbankdeducttheirchargesdirectlyfromtheamountbeingtransferred.Thismeansthatyouwillreceiveanamountthatislessenedbythefeesappliedbyallsuchpartiesinvolved.

(e) Provisional credit.AllpaymentsintoYourBankAccountpursuanttosection4(d)aresubjectto(i)auditandadjustmentbyElavonforinaccuraciesorerrors,(ii)Chargebacks,(iii)allotherFeesandAdjustments;and(iv)anyconditionalcreditElavonmayelecttograntforindividualorgroupsofTransactions.

(f) Acquiring limits.ElavonmaylimitthevolumeofTransactionsitwillacquirefromyou.SuchlimitmaybechangedbyElavonfromtimetotime,uponreasonablenoticetoyou.Ifyouexceedtheestablishedlimit,ElavonmaysuspendtheacquiringofTransactions,andeitherreturnallTransactionsexceedingtheagreedvolumetoyouorretainthesumsitwouldotherwisepayintoYourBankAccountpursuanttosection4(d)inaccordancewiththeprovisionsofsection14.

(g) Card Scheme Fees.IfCardSchemeFeesoranysimilarfeesareadjustedand/orintroducedbytheCardSchemesoranIssuerforanyreason,Elavonreservestherighttopassonanysuchadjustmentornewfeetoyoupursuanttosection27(g).CardSchemeFeesandrulesapplicabletoMasterCard®Transactions,areavailableonMasterCard’spublicinternetsiteatwww.mastercard.com.Inaddition,informationregardingTransactionrelatedcardschemefeesareavailableviatheReportingTool.

(h) Customer statements.Elavonwillprovideyouwithmonthlystatementsshowing thevalueofallSalesTransactions acquired by Elavon as well as any: Merchant Service Charges; Refunds; Chargebacks;chargesintheScheduleofFees;InterchangeFees;aswellasFeesandAdjustments.

5 www.elavon.co.uk

5. OUR FEES

(a) YoushallpayElavontheMerchantServiceCharges,allotherchargessetoutinScheduleofFeesandanyotherFeesandAdjustments(plusanyVATapplicable)payablebyyouinaccordancewiththeprovisionsofthisAgreement.

(b) Wemayfromtimetotimevarythefeesandchargessetoutatsection5(a)aboveand/orintroducenewadditionalchargesinaccordancewithsection27(g).

(c) AtanytimethroughoutthelifetimeofthisAgreement,youcanrequestthatElavonprovidesyouwithanofferoftheMerchantServiceChargeonanInterchangePlusPlusbasis.

(d) IfyouareanInterchangePlusPlusCustomeranychangesinCardSchemeFeesoranyothercostschargedby theCardSchemestoElavonwillbeautomaticallypassedon toyou,howeversuchchangesdonotconstituteanamendmenttotheAgreement.Wewillendeavourtoprovide2(two)months’noticeofanymaterial change inCardSchemeFeesorCardSchemeFineswhere reasonablypracticable. If youarenotanInterchangePlusPlusCustomer,changesinCardSchemeFeesandcostschargedbytheCardSchemes,mentionedinthefirstsentenceofthissection5(d)willnotbeautomaticallypassedontoyouandanychangestotheAgreementwillbedealtwithinaccordancewithsection27(g)below.

6. TERMINALS AND OTHER GOODS

(a) Use.

(i) UnlessalternativeformsofacceptingTransactionsareprovidedforbytheCardSchemeRulesortheLaws,youshalluseaTerminalforacceptingTransactionsregardlessoftheamountinvolvedandnotwithstandinganyAuthorisedFloorLimit.

(ii) Forthepurposesofsection6(a)(i),thoseTerminalsshalleitherbe:

(aa)providedtoyoubyElavonpursuanttoaseparatehireagreement,inwhichcaseyoumustcomplywiththetermsofanysuchhireagreement;

(bb)ThirdPartyTerminals,subjectto(i) thepriorwrittenconsentofElavonand(ii) thetermsofthisAgreement;or

(cc)CardReaderspurchasedinaccordancewithsection6(d).

(iii) YoushallcomplywiththeprovisionssetoutinSchedule1inrespectofThirdPartyTerminalsandCardReaders.

(iv) TheplacementofaTerminalonyourlocationsshallbeagreedbetweentheparties.ElavonreservestherighttowithholdorwithdrawitsagreementorconsenttotheplacementoftheTerminalsincludingThirdPartyTerminals,intheeventofthelocationsbeing,orbecoming,unsatisfactoryforthatpurpose.

(b) Third Party Terminals.

(i) Pursuanttosection6(a)(ii)(bb),youmayutiliseatyourownexpenseThirdPartyTerminals,providedsuchThirdPartyTerminalsareinallrespectscompliantwiththerequirementsoftheCardSchemesincluding, for the protection of Cardholder information. You agree that the onus of showing suchcomplianceshallrestwithyou.

6 www.elavon.co.uk

(ii) IfwehaveagreedthatyoumayuseaThirdPartyTerminal,youshalleithereffecttheoutrightpurchaseofanysuchThirdPartyTerminalorshallensure itscontinuedanduninterruptedavailabilitybywayofleasingorhiringorsimilarsucharrangement.IfyourThirdPartyTerminalsareleased,youshallbeobligedtohonourthetermsandconditionsofyourleasingcontract.However,youmaynotuseaThirdPartyTerminaluntilElavonhastestedandapproveditslocationandrelevantsystems.Inaccordancewithparagraph1(c)ofSchedule1andsection21(h),whereyouemployaThirdPartyTerminal,youwillassumefullresponsibilityandliabilityforanyfailureoftheThirdPartyTerminaltocomplywiththeLaws,theAgreementandtheCardSchemeRules.

(iii) Youwill operate and keep the ThirdParty Terminals in goodworking order and repair, replace orupgradethemasElavonortheCardSchemesmayrequirefromtimetotime.

(c) Chip and PIN Technology.

(i) YouareresponsibleforensuringthatyourTerminals,andyouruseofthoseTerminalsareChipandPINCompliant.

(ii) YoushallhavesoleandexclusiveliabilityforfraudulentTransactionsthatoccurbutwhichcouldhavebeenpreventedhadyoubeenChipandPINCompliant.Withoutlimitingtheforegoing,subjecttothetermsoftheAgreement,liabilityforallfailedorfraudulentTransactionscarriedoutusingC&PCardswillstillrestwithyou,inanycase,whereyouacceptaC&PCardTransaction:

(aa)usingaTerminalorThirdPartyTerminalthatdoesnotincorporateChipandPINTechnology;

(bb)usingaTerminal,CardReaderorThirdPartyTerminalwhichincorporatesChipandPINTechnologybutdoesnotusetheChipandPINfunctionalitytoaccepttheC&PCardTransaction;

(cc)withoutusingaPINPad.

(d) Goods.

InconsiderationoftheFeesElavonshallprovidetheGoodssetoutintheApplicationtotheCustomeronthetermssetoutinSchedule1.

(e) Secured Pro.

(i) Subjectto:(a)makingandcomplyingwiththerepresentationsthatappearintheSchedule7;and(b)yourpaymentoftheSecuredProFeesandcomplianceand/oracceptanceofthematterscoveredinsections6(e)(ii)to6(e)(x),YoushallbeentitledtousetheCyberSecurityTools.

(ii) EachtimeyouavailofanyscanningCyberSecurityTools(whereapplicable)youauthoriseusoroursuppliersorproviders toperformthescanningon the IPaddressesyouprovide in relation tosuchscanningandyouacknowledgeandconfirmthat:

(a) itisyourresponsibilitytoidentifytheIPaddressesandfullyqualifieddomainnamesinscopeforscanning;

(b) any IP addresses to be excluded from the scan scope have been segmented from the list ofincludedIPs;

(c) thescopeofIPaddressestobetestedisaccurateandcorrecttomeetPCIDSSrequirementsandcomprisesallexternallyfacingIPaddressesthatcouldimpactthesecurityofyourcardholderdataenvironment;

(d) ifyourequirevalidationofscopeyouhaveadviseduspriortocommencementofanyscanning;

(e) youhavecoordinatedwithandobtainedanynecessaryconsentfromyourinternetserviceproviderand/orhostingprovidertopermitscanstorun,whereapplicable;

(f) you will ensure that our scanner IP addresses are white-listed through any active protectionsystemsforthedurationofthetesttoavoidanyscaninterference;

7 www.elavon.co.uk

(g) yourdomainandIPaddresseswillgrantaccesstoourprovidedIPs;

(h) youhaveadvisedusofanyloadbalancersinuse;

(i) youhavemadeanytemporaryconfigurationchangestoyournetworkdevicesasmaybenecessarytoobtaina scan that accuratelyassessesyourexternal securitypostureandwill reapply yourpreviousconfigurationassoonasthescaniscomplete;

(j) youhaveadvisedusofanylegacysystemsorunreliableoperationsthatmightnotrespondwelltotesting;and

(k) youhavecreatedafullback-upofallsystemstobetestedandknowhowtousethoseback-upstorecoverandrestoresystemstonormaloperations.

(iii) Inconnectionwithyouruseof theCyberSecurityTools:youmayprovideusoroursuppliersandproviderswith;we or our suppliers and providersmay access; and/or aCyber Security Toolmayprovidetousoroursuppliersandproviders:deviceinformationandstatus,location,applicationlistandlicencelist;certaininformationaboutyouruseofaCyberSecurityToolincludingstatisticsrelatingtotheuseoftheCyberSecurityTool,performancemetricsrelatingtotheCyberSecurityTool,andconfiguration settings, performance data, installed software; information about: applications, date,operatingsystem,CPUinformation;ifpotentialmalwareisrunning;systeminformation;logdataaboutyourwebsite’swebtraffic,includingbutnotlimitedtosignatures,request/responseheaders,sourceIPandtime;thefile/applicationlistscanned;reportingofinformationofscanevents;administratoraccesscontrol foradevice;anyfilesorprograms thatareunknownoruntrustedor identifiedaspotentialmalware, including informationontheactions takenbysuchfiles.Thecollectedfilescouldcontainpersonaldatathathasbeenobtainedbythefile thathasbeen identifiedasunknown,untrustedorpotentialmalwarewithoutyourpermission.Suchinformationmayalsobeprovidedtooursuppliersandproviders, includingComodoSecurity Inc. (“Comodo”),whoassistuswith theprovisionof theCyberSecurityTools.

(iv) ACyberSecurityToolmayprovidecontainmentservicesthatisolateunknownprograms.Bydefaultanyunknownprogramsidentifiedaspotentialmalwareareexecuted insideacontainmentsandboxand thenautomaticallysent toComodo formalwareanalysis. Ifaprogram is foundbyComodotobemaliciousitisthenaddedtotheCyberSecurityToolmalwaredefinitionslist.Ifitfoundtobesafeit isaddedtoasafeprogramlist.Thenext timetherelevantCyberSecurityTool receivesantivirusupdates,itscansalltheprogramsrunninginsidethecontainmentsandbox.Ifanyprogramisfoundtobemalicious,thecontainmentsandboxisolatestheprogramandmovesittothequarantinelist.Safeprogramsareremovedfromcontainmentandarenolongerexecutedinsidecontainment.Ifyouwishyoumayrequestdisablingofcontainmentand/orautomaticsubmissionofprogramstoComodo.

8 www.elavon.co.uk

(v) Yoursubscriptionmay include theWebSecurityGatewayCyberSecurityTool,which isprovidedbyComodo.TheWebSecurityGatewayisaserviceforwebsitesandapplicationsthatcombinesaWebApplicationFirewall(“WAF”)provisionedoverasecurecontentdeliverynetwork(“CDN”).TheCDNisanetworkofgloballydistributedserverstoassist intheperformanceofwebsitesandwebapplicationsbydeliveringcontentwithuseoftheclosestservertotheuser.WebtrafficwillbesenttoComodo’sserversandinspectedbyComodo,withthetrafficroutedbasedongeo-balancing. IfyousubscribedtotheWebSecurityGatewayCyberSecurityTool,youauthoriseustorouteyourwebsite’strafficviatheComodoCDN,tomanagethewebsiteDNS,monitorforand/orblockmaliciousactivityandattacksagainsttherelevantwebsiteetc.AspartoftheconsiderationofyouruseoftheWAF,youmayberequiredto(1)providedomainandSSLcertificateinformation,(2)downloadandinstallsoftwarerelatingtotheWAF,(3)reconfigurewebsitesettings,firewalls,antivirussolutions,andotherITsecurityservicesthatinterferewith or prevent theWAF from operating correctly, and (4) continuously forward SubscriberInformation.“SubscriberInformation”meanslogdataaboutyourwebtraffic,includingbutnotlimitedto, signatures, request/responseheaders, source IP,and time.Onceyouhavecompleted theaboveinstallationrequirements(ifany),whichshallbedeterminedbyusatoursolediscretion,theWebSecurityGatewaywillstartanalysingSubscriberInformation.ServicesrelatingtotheWebSecurityGatewaydonotincludeanyremediationassistancefromusnorshallweberesponsibleforassistingyouincorrectingoreliminatinganysecurityflaworvulnerability.ServicesrelatingtotheWebSecurityGatewaydonot,andarenotintendedto,fix,remedy,prevent,oreliminatevulnerabilitiesorotherinsecurities.Remedyinganyvulnerabilitiesorinsecuritiesissolelyyourresponsibility.Youacknowledgeandagreethatitisyourresponsibilitytomonitortheexpirydateofwebsitecertificates,ensuringtheirrenewalpriortoexpiry,toensurecontinuedoperationoftheWebSecurityGatewayCyberSecurityToolandtherelevantwebsite.

(vi) WeorourlicensorsorsuppliersownallintellectualpropertyinandtotheCyberSecurityTools.TheCyber Security Tools are being licensed, not sold. TheCyber Security Tools containmaterial thatis protected by intellectual property laws, including copyright, trade marks and trade secrets. Allrightsnotexpresslygrantedtoyouhereinarereserved.Youmaynotremoveanycopyrightorotherproprietarynotice fromanyCyberSecurityTool.CertainCyberSecurityToolscontaincertainopensourceproductsandlicencesrelatingtothemandwhattheseareandwheretheycanbefoundhasbeensetoutatinclause6(e)(x).

(vii) OurtotalliabilityinrelationtotheCyberSecurityTools,whethertoyouoranotherparty,howsoeverarisingshallnotexceedintheaggregateanamountequaltotheSecuredProFeespaidbyyouduringthetwelve(12)monthsimmediatelyprecedingthefirstactoromissionthatformedtheprincipalbasisofthelossorclaimbeingsought.

(viii)ForthepurposesoftheCyberSecurityTools,thedefinitionsof“We”,“Us”,“Our”and“Elavon”includeElavon’ssubcontractorsincludingSysxnetLimitedalimitedliabilitycompanyincorporatedunderthelawsofIrelandwithcompanynumber147176andaregisteredofficeat1stFloor,Block71a,ThePlaza,ParkWestBusinessPark,Dublin12,Ireland.

(ix) Youwillnot,andwillnotpermitanythirdpartyto:useanyCyberSecurityToolinawaythatmayinfringetheprivacyorintellectualpropertyrightsofathirdparty.Youwillnot,andwillnotpermitanythirdpartyto:useanyCyberSecurityTooltodistributeortransmitanyfilethatcontainsmalwareorinanymannerthatisnotlawful.Youwillnot,andwillnotpermitanythirdpartyto:exportorre-exporteitherdirectlyorindirectly,anyCyberSecurityTooltoanycountryorentityunderUnitedStates,UnitedKingdomorEuropeanUnionrestrictionsortoanycountryorentitysubjecttoapplicabletradesanctionsandyourepresentthatyouarenotlocatedinanysuchcountry.Youhavethenecessaryrightsandlicencestoanyfilessubmittedtousforscanning.Youalsorepresentthatyoursubmissiontousofanyfileswillnotviolateanythird-partyrightstosuchfiles,includingintellectualpropertyrightsandrightstoprivacy.

(x) Thefollowingthirdpartyoropensourcesoftwaremaybeincludedandisprovidedunderotherlicencesand/orhassourceavailablefromotherlocations.

9 www.elavon.co.uk

Framework/Software Licence URL

OpenSSL https://www.openssl.org/source/license.html

Zlib https://www.zlib.net/zlib_license.html

SQLite http://www.sqlite.org/copyright.html

QTCorev4.8 http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html

FileHash.h https://github.com/JoeKun/FileMD5Hash/blob/master/Library/FileHash.h

NSPR https://github.com/servo/nspr/blob/master/LICENSE

OpenLDAP https://github.com/LMDB/lmdb/blob/mdb.master/libraries/liblmdb/LICENSE

LuaJIT http://luajit.org/luajit.html

JSON https://www.json.org/license.html

YAML::Syck http://search.cpan.org/dist/YAML-Syck/lib/YAML/Syck.pm#COPYRIGHT

jQueryUI https://github.com/jquery/jquery-ui/blob/master/LICENSE.txt

jQueryBonsai https://github.com/aexmachina/jquery-bonsai/blob/master/LICENSE.txt

jQueryQubit https://github.com/aexmachina/jquery-qubit/blob/master/LICENSE.txt

Chromium https://chromium.googlesource.com/chromium/src/+/master/LICENSE

7za.dll https://www.7-zip.org/license.txt

TOR https://github.com/torproject/tor/blob/master/LICENSE 

OracleJava7 http://www.oracle.com/technetwork/java/javase/terms/license/index.html

ApacheMaven3.3.1 http://www.apache.org/licenses/LICENSE-2.0

MongoDB3.0 https://www.mongodb.com/community/licensing

ApacheTomcat8 http://tomcat.apache.org/legal.html

Nginx http://nginx.org/LICENSE

WinExe https://github.com/skalkoto/winexe/blob/master/COPYING

SpringBoot https://github.com/spring-projects/spring-boot/blob/master/LICENSE.txt

Electron https://github.com/electron/electron/blob/master/LICENSE

ReactJS https://github.com/facebook/react/blob/master/LICENSE

Redux https://github.com/reactjs/redux/blob/master/LICENSE.md

Python3.6.5 https://docs.python.org/3/license.html

Nodejs https://raw.githubusercontent.com/nodejs/node/master/LICENSE

Scapy https://github.com/secdev/scapy/blob/master/LICENSE

Npcap https://github.com/nmap/npcap/blob/master/LICENSE

Luhn https://github.com/mmcloughlin/luhn/blob/master/LICENSE

Requests https://github.com/requests/requests/blob/master/LICENSE

PyInstaller https://github.com/pyinstaller/pyinstaller/blob/develop/COPYING.txt

10 www.elavon.co.uk

7. AUTHORISATION AND SECURE CUSTOMER AUTHENTICATION

(a) Authorised Floor Limit.UnlessotherwiseagreedbyElavoninwriting,theAuthorisedFloorLimitforSalesTransactionsshallbezero.YoumustnotsplitthevalueofsalesmadetoaCardholderatanyonetimeovermorethanoneTransactiontoavoidobtainingAuthorisation.

(b) Authorisation Code Required. You must obtain an Authorisation Code before completing any SalesTransactionwhetherelectronicallythroughuseofaTerminalorverballybytelephoningforanAuthorisationCodeinaccordancewiththeOperatingGuide.

(c) Effect of Authorisation Code.AnAuthorisationCodedoesnot:

(i) guaranteeCustomerpaymentforaSalesTransaction;

(ii) guaranteethataSalesTransactionwillnotbedisputedlaterbytheCardholderorIssuerasanySalesTransactionissubjecttoChargeback;

(iii) protectCustomerintheeventofaChargebackregardingunauthorisedSalesTransactionsordisputesinvolvingthequalityofgoodsand/orservices;

(iv) preventusfromrecoveringaChargebackorotheramountwithrespecttoaSalesTransactionwherepermittedunder the termsof thisAgreement; even in eachcase,where “Code10”proceduresasprovidedinsection7(o),havebeencarriedout).

(d) Cancellation of Authorisation.IfyouortheCardholderdecidenottoproceedimmediatelywithaSalesTransaction,youmustcancelthecorrespondingAuthorisationRequest.

(e) No Authorisation. IfyoudonotmakeanAuthorisationRequestwhererequiredunderthissection,or ifAuthorisationisrefused,youmustnotcompletetheSalesTransaction.WheretheoriginalAuthorisationisrefused,youmustnotresubmitaSalesTransactionforAuthorisation.Shouldyoudoso,andyourelyonanysubsequentAuthorisation,youwillbeliable(andwillindemnifyus)inrespectofanyChargeback,FeesandAdjustmentsorotherlossesinrelationtosuchSalesTransaction.

(f) Zero value Authorisations.AuthorisationRequestsinordertovalidateaCard(usuallyforanamountbetween£0.01and£1.00)arenotpermitted.YoumustprocesssuchrequestsasanAccountStatusInquiryshouldyouwishtovalidateaCardwithnosubsequentsettlement,inaccordancewiththeCardSchemeRules.

(g) Cardholder authority.YoumustobtainauthorityforeachTransactiontobedebitedtotheCardholder’saccount. Suchauthorityshallbedeemedgiven(unlesstheCardisreportedlost,stolenorcompromised):

(i) foraTransactionthatisCardPresentonlywhen:(aa)withrespecttoPINTransactions,theCardholderentersthePINcorrectlyintotheTerminal,andpromptlyeffectsasuccessfulPINverification,or(bb)youprocuretheCardholdersignatureontheTransactionReceiptproducedbytheTerminal.ThesignedTransaction Receipt or printed Transaction record (following successful PIN verification) producedbytheTerminalwhichshallconstitutetheTransactionReceipt,will ineachcasebeevidenceoftheCardholder’sauthorisationtodebittheamountoftheTransactionfromtheCardholder’saccount.

(ii) for MO Transactions, by obtaining the signed written authority of the Cardholder and for TOTransactions,byretainingdocumentaryevidenceoftheCardholder’sauthoritytodebithis/heraccountfortheTransactionamount.

(iii) forInternetTransactions,byobtainingtheCVV2/CVC2numberfromtheCard.

11 www.elavon.co.uk

(h) Application of SCA.SCAappliestoallSalesTransactions,subjecttosection7(k)andsection7(l)below.UnlessotherwiseagreedbyElavoninwriting,youmust:

(i) electronicallyrequesttheapplicationofSCAbeforecompletinganySalesTransaction,throughtheuseofaTerminalorthroughtheServiceandSoftware(inthecaseofInternetTransactions);

(ii) enableandcooperateintheapplicationofSCAtoallSalesTransactions;

(iii) followany instructionswithregardtoSCAreceivedfromanIssuerorElavon, including instructionsprovidedelectronicallythroughaTerminalorthroughtheServiceandSoftware(inthecaseofInternetTransactions).IfanIssuerandElavongiveyouincompatibleinstructionsregardingtheapplicationofSCAtoaSalesTransaction,youmustgiveprioritytotheinstructionsoftheIssuer.

(i) SCA Decisions.Youmustnot:

(i) applySCAonyourowninitiativeifanIssuerorElavonhavenotinstructedyoutodoso;

(ii) split the valueof salesmade to aCardholder at anyone timeovermore thanoneTransactionorotherwisemisrepresentthecircumstancesofaparticularTransactiontoavoidapplyingSCA.

(j) No SCA.Ifyoudonotrequest,enableorcooperateintheapplicationofSCAwhererequiredunderthissection,orifSCAisunsuccessful,youmustnotcompletetheSalesTransaction.Shouldyoudoso,youwillbeliable(andwillindemnifyus)inrespectofanyChargeback,FeesandAdjustmentsorotherlossesinrelationtosuchSalesTransaction.

(k) SCA Exemptions.AnIssuerorElavonmaydecidenottoapplySCAtocertainSalesTransactionstotheextentallowedbyLawsorCardSchemeRules,suchasinthecaseofthefollowingSalesTransactions:

(i) contactlessSalesTransactionsandInternetTransactionsbelowthresholdsspecifiedinSCARTS;

(ii) SalesTransactionsatunattendedTerminalsforpurposesspecifiedinSCARTS.

(iii) InsuchcaseyouwillbenotifiedelectronicallythroughaTerminalorthroughtheServiceandSoftware(inthecaseofInternetTransactions).

(l) SCA Regulatory Technical Standards Scope.SCAdoesnotapplytoSalesTransactionsthatareoutsidethescopeofSCARTS,including:

(i) MO/TOTransactions;

(ii) SalesTransactionsinitiatedbyyou.

(m) Personalised Security Credentials.ACardholder’sPersonalisedSecurityCredentials are confidential.YoumaynotatanypointduringpaymentrequestorrequireaCardholdertodisclosehis/herPersonalisedSecurityCredentials,captureormodifyPersonalisedSecurityCredentials,captureormodifyAuthenticationcodesgeneratedwiththeuseofPersonalisedSecurityCredentials,orobscureormodifyanyinformationcommunicatedthroughaTerminalorthroughtheServiceandSoftwarebyanIssuerorElavontoaCardholderinconnectionwith theuseofPersonalisedSecurityCredentials.During theTransactionprocess, ifuseofPersonalisedSecurityCredentialsrequiresaTerminal,youmustprovideareasonablysecureareaforCardholderstousetheirPersonalisedSecurityCredentialsthroughaTerminal.

(n) Effect of SCA.TheapplicationofSCAdoesnot:

(i) guaranteeCustomerpaymentforaSalesTransaction;

(ii) guaranteethataSalesTransactionwillnotbedisputedlaterbytheCardholderorIssuerasanySalesTransactionissubjecttoChargeback;

(iii) protectCustomerintheeventofaChargebackregardingunauthorisedSalesTransactionsordisputesinvolvingthequalityofgoodsand/orservices;

12 www.elavon.co.uk

(iv) preventusfromrecoveringaChargebackorotheramountwithrespecttoaSalesTransactionwherepermittedunderthetermsofthisAgreement;

(Evenineachcase,where“Code10”proceduresasprovidedinsection7(o)havebeencarriedout).

(o) “Code 10”.Youmustcarryouta“Code10”procedure(asapplicable)inaccordancewiththeOperatingGuide.

(p) Card Recovery. You will use reasonablemeans to recover any Card in circumstances set out in theOperatingGuide(i)ifyouareadvisedbyElavonorinstructedtodosobyaTerminal,aCompatibleDevice,theIssuer,oravoiceauthorisationcentretoretainit;(ii)ifyouhavereasonablegroundstobelievetheCardislost,stolen,counterfeit,fraudulent,orotherwiseinvalid,oritsuseisnotauthorisedbytheCardholder;(iii) with respect to Visa branded andMasterCard® brandedCards, if the four digits printed below theembossedaccountnumberdonotmatchthefirstfourdigitsoftheembossedaccountnumber;or(iv)withrespecttoMasterCard®brandedCardsonly,theCarddoesnothavethe“TwinGlobes”hologramonthelowerright-handcorneroftheCardface.

(q) No agency.Youmustnotsuggestthatyouareactingonourbehalfatanytime,unlessyouareholdingbackorrecoveringaCardatourrequest.

(r) Disputes with Cardholders.AnydisputebetweenyouandaCardholderrelatingtoaTransactionwillbesettledbetweenyouandtheCardholder.Elavonshallbearnoresponsibilityforsuchdisputes.

8. TRANSACTIONS

(a) Transactions that are Card Present and Card Not Present. Youmust use aTransactionReceipt todocumenteachTransaction.ATransactionReceiptmaybegeneratedeitherelectronicallyormanuallyandmustincludethefollowingdetails:

(i) Cardaccountnumber(andexceptwheretheonlywaytorecordaCardaccountnumberisinhandwritingorbymakingan imprintorcopyof theCard),suchnumberbeingtruncatedsothatallbut the lastfour(4)digitsoftheCardaccountnumberonaTransactionReceiptaredistinguishedorsuppressed.Truncateddigitsshouldbereplacedwithafillcharactersuchas“x,”“*,”or“#,”andnotwithblankspacesornumericcharacters);

(ii) Customernameandlocation;

(iii) Transactionamount(includingapplicabletaxes)indicatedintheTransactioncurrencysuchasGBPor£;

(iv) Transactiondate;

(v) AuthorisationCode;

(vi) Transactiontype(e.g.purchase,credit);

(vii) forCardPresentTransactionsthatarenotPINTransactionsonly,spacefortheCardholder’ssignature;

(viii)forCardPresentTransactionsonly,indicationofwhoshallreceiveeachcopyoftheTransactionReceipt(e.g.,MerchantCopy,ElavonCopy,CardholderCopy).TheCardholdercopyofaTransactionReceiptmust inparticular,bear thewording“retain thiscopy forstatementverification”orsimilarwording,whichmustasaminimum,appearinthelanguageoftheTransactioncountry;

(ix) forCardPresentTransactionsonly,thetermsandconditionsofthesale,ifrestricted;

(x) forCardPresentTransactionsonly,Merchantcityandcountry;

13 www.elavon.co.uk

(xi) in relation to thepurchaseofgamblingservicesonlyand inaddition to theabove requirementsatsection8(a)(i-x),thefollowing:

(aa)Terminalnumber;

(bb)dateofplay;and

(cc)netamountofwinningsorlosses.

(xii) inrelationtoMO/TOTransactionsonlyandinadditiontotheaboverequirementsatsection8(a)(i)-(x),insofarasapplicable,thefollowing:

(aa)Cardholderaddress

(xiii)inrelationtoInternetTransactionsonlyandinadditiontotheaboverequirementsatsection8(a)(i)-(x),insofarasapplicable,thefollowing:

(aa)Customer’sURLaddress

(b) Warranties for Transactions. WhenpresentinganyTransactiontoElavon,youwarrantandrepresentthat:

(i) the Transaction is represented by a Transaction Receipt conformingwith the requirements of theAgreementandtheCardSchemeRules;

(ii) theTransactionwasenteredintoinaccordancewiththeLawsandtheCardSchemeRules;

(iii) allstatementsoffactcontainedintheTransactionReceiptaretrue,accurateandcomplete;

(iv) theuseoftheCardbytheCardholderhasbeenauthorisedandauthenticatedbytheCardholder,includingwhereapplicablebymeansofSCA,inamannerappropriatetothatCard,asprescribedfromtimetotime;

(v) exceptinrelationto,sections8(k),8(l),or8(m)below,nootherTransactionReceipthasbeenorwillbeissuedinrespectofthesamegoodsand/orservices;

(vi) theTransactionisbonafide;

(vii) youhaveprovided(orwillprovide,inaccordancewithsection8(f)(ii)or8(n))thegoodsand/orservicestotheCardholderpursuanttotheSalesTransaction;

(viii)youhavenotbrokenanyobligationsyoumayhavetotheCardholder.IfyouhavebrokenanyofyourobligationstotheCardholder,youwillhavealsobreachedthisAgreement;and

(ix) exceptwherepermittedinwritingbyElavonandsubjecttotheCardSchemeRulesandtheLaws,noTransactioninvolvestheuseofaCardforanypurposeotherthanthepurchase,Refundorreturnofgoodsand/orservicesfromyou.NoTransactioninvolvesaCardholderobtainingcashfromyouunlessallowedbytheAgreementandtheCardSchemeRules.

(c) Invalid Transaction Receipts.ATransactionReceiptshallbeinvalidifitisnotissuedinaccordancewiththeAgreement,LawsandCardSchemeRules,including:

(i) therelatedTransactionisforanyreasonillegalorincomplete,or,hastheresultofmakingaRefundorcreditwithrespecttogamingorgamblingwinnings,unspentgamingorgamblingchips,oranyothervalueuseableforgamingorgambling;

(ii) whererequired,thesignatureonitisincompatiblewiththatontheCard;

(iii) thecopyofitthatispresentedtoElavonisincompatiblewiththecopyprovidedtotheCardholder;

(iv) theCardhasexpiredorhasnotyetbecomevalidatthetimeoftheTransaction;

(v) anothersuchreceipthasbeenissuedforthesamegoodsand/orserviceswhicharethesubjectoftheTransaction;(exceptinrelationtosections8(k),8(l),or8(m)below).

14 www.elavon.co.uk

(d) Delivery of Transaction Receipts.ForaTransactionthatisCardPresent,youwilldeliveracompleteandlegiblecopyoftheTransactionReceipt(ineitherelectronic(e.g.e-mail,textmessage(SMS)orfax)orpaper(e.g.,handwrittenorTerminal-generated)format)totheCardholderatthetimeoftheTransaction.ForaTransactionthatisCardNotPresent,thisshallbedonepromptlybutinanyevent,nolaterthanseven(7)daysfollowingcompletionoftheTransaction.

(e) Retention of Transaction Receipts. You will retain in an accessible place and produce on demandthe “CustomerCopy”of theTransactionReceipt for at least thirteen (13)months following thedateofcompletionoftheTransactionorfollowingthedeliveryofthegoodsorservices(whicheverthelonger),orsuchlongerperiodastheCardSchemeRulesortheLawsmayrequire.Withoutprejudicetosection18(b),allsuchreceipts(regardlessofelectronicorpaperformat)mustatalltimesbekeptinasecuremannerinaccordancewiththePCIDSS.

(f) Presentment of Transactions to Elavon. UnlessotherwiseagreedwithElavoninwriting:

(i) youshall,subjecttosections8(f)(ii)and26(f)(ii),presentallTransactionstoElavonwithinthree(3)BusinessDaysofthedateofsuchTransaction,andinallevents,withinthirty(30)BusinessDaysfromsuchdateforaMasterCard®Transactionandtwenty-one(21)BusinessDaysfromsuchdateforaVisaTransaction;

(ii) MO/TO and Internet Transactionsmust not be presented until the relevant goods ordered by theCardholderhavebeendispatchedorarrangementsmadeforservicestobeprovided.Notwithstandingthe foregoing: (aa) VisaMO/TO and Internet Transactions for goodsmay be presented before thedispatchofthegoodsorperformanceoftheservices,providedthatwithinseven(7)daysofpresentmentawrittenacknowledgementquotingthedispatchdateissentbyyoutotheCardholder,suchdispatchdatenottobelaterthantwenty-eight(28)daysfromthedateofreceiptoftheorder,(bb)MasterCard® CardMO/TOandInternetTransactions,mustnotbepresenteduntilafterthegoodsaredispatchedortheservicesareperformedunless,atthetimeoftheSalesTransaction,theCardholderagreestoaproperlydiscloseddelayeddeliveryofthegoodsorservices.

(g) Mail Order and Telephone Order (MO/TO) Transactions.

(i) YoumaynotacceptMO/TOTransactionswithoutElavon’spriorwrittenconsent todoso.For theavoidanceofdoubt,consentwillbedeemedtohavebeengivenbyElavonwhereyouhaveincludedyouranticipatedMO/TOTransactionswithinyourApplicationandthatApplicationhasbeenacceptedbyElavon.

(ii) IfElavonprovidestheconsentsetoutinsection8(g)(i),foreachMO/TOTransaction,youmustretaininanaccessibleplaceandproduceondemanddocumentaryproofofdispatchofgoodsorsupplyofservicesrendered,fornotlessthantwo(2)yearsfromtheTransactiondate.

(iii) If you do acceptMO/TO Transactions without the consent set out in section 8(g)(i), then withoutprejudicetoElavon’sotherrightsandremediesundertheAgreementoratLaw,youmayhavetopayasurchargeoneachsuchMO/TOTransaction.

(h) Internet Transactions.

(i) Youmay not accept or present to Elavon Internet Transactions and/or InternetDCCTransactionswithoutElavon’spriorwrittenconsenttodoso.Fortheavoidanceofdoubt,consentwillbedeemedtohavebeengivenbyElavonwhereyouhaveincludedyouranticipatedInternetTransactionswithinyourApplicationandthatApplicationhasbeenacceptedbyElavon.

(ii) IfElavonprovidestheconsentsetoutinsection8(h)(i),youmustcomplywiththeprovisionssetoutinSchedule2inrespectofInternetTransactions.

15 www.elavon.co.uk

(i) DCC Transactions.YoumaynotacceptDCCTransactionswithoutElavon’spriorwrittenconsenttodoso.Fortheavoidanceofdoubt,consentwillbedeemedtohavebeengivenbyElavonwhereyourScheduleofFeessetsoutourfeesinrelationtoDCCTransactions.IfElavonprovidestheaboveconsent,youmustcomplywiththeprovisionssetoutinSchedule3inrespectofDCCTransactions.

(j) Electronic Gift Cards.YoumaynotacceptEGCswithoutElavon’spriorwrittenconsenttodoso.Fortheavoidanceofdoubt,consentwillbedeemedtohavebeengivenbyElavonwhereyourScheduleofFeessetsoutour fees in relation toEGCs. IfElavonprovides theaboveconsent,youmustcomplywith theprovisionssetoutinSchedule4inrespectofEGCs.

(k) Recurring Sales Transactions.YoumaynotacceptRecurringSalesTransactionswithoutElavon’spriorwrittenconsenttodoso.Fortheavoidanceofdoubt,consentwillbedeemedtohavebeengivenbyElavonwhereyouhaveconfirmedthatyouacceptRecurringSalesTransactionswithinyourApplicationandthatApplicationhasbeenacceptedbyElavon.IfElavonprovideswrittenconsentyoumust:

(i) obtainaRecurringSalesTransactionAuthorityfromtheCardholder;

(ii) obtainAuthorisationatthefirstdebit;

(iii) notify theCardholder (aa) that his RecurringSales TransactionAuthority is subject to cancellationbytheCardholderatanytimeand(bb)ofanychangetotheSalesTransactiondetailssetoutintheRecurringSalesTransactionAuthorityatleastfourteen(14)dayspriortothesubsequentdebit;

(iv) not complete any Recurring Sales Transaction after receiving: (aa) a cancellation notice from theCardholder;(bb)anoticefromElavonthatauthoritytoacceptRecurringSalesTransactionshasbeenrevoked;or(cc)aresponsethattheCardisnottobehonoured;

(v) retaintheRecurringSalesTransactionAuthorityforaperiodof18monthsafterthefinalpaymentthatismadepursuanttoit,andproducetheRecurringSalesTransactionAuthoritytousondemand;

(vi) complywithanyapplicableCardSchemeRulesrequiringregistrationofRecurringSalesTransactionsorotherapplicableTransactionsecurityrequirements;and

(vii) acknowledgeandacceptthataCardholderhastherighttorevokeaRecurringSalesTransactionatanytimeuptotheendoftheBusinessDayprecedingthedayagreedfordebitingfunds.

(l) Multiple Transaction Receipts. Youwill accept payment for goods and/or services in a single SalesTransaction Receipt unless: (aa) partial payment is entered on the Sales Transaction Receipt and thebalanceoftheSalesTransactionamountispaidincashorbychequeatthetimeoftheSalesTransaction;or(bb)aSalesTransactionReceiptrepresentsanadvancedepositforaSalesTransactioncompletedinaccordancewiththeAgreementandtheCardSchemeRules.

(m) Deposits.YoumaynotacceptanyCardpaymentrepresentingadepositorpartialpaymentforgoodsand/orservicestobedeliveredinthefuturewithoutElavon’spriorwrittenconsenttodoso.Fortheavoidanceofdoubt,consentwillbedeemedtohavebeengivenbyElavonwhereyouhavecompletedthe‘deposits’sectionwithinyourApplicationandthatApplicationhasbeenacceptedbyElavon.IfElavonprovideswrittenconsent,youmustexecuteoneSalesTransactionReceiptwhenacceptingthedepositSalesTransactionandasecondSalesTransactionReceiptuponacceptingthebalanceof theSalesTransaction.Youwillnotethewords“deposit”or“balance”ontheapplicableSalesTransactionReceipt.YouwillnotpresenttheSalesTransactionslabelledorotherwiseattributabletothe“balance”untilthegoodshavebeendeliveredtoCardholderorservicesfullyperformed.

16 www.elavon.co.uk

(n) Future Delivery.YoumaynotpresentanySalesTransactionstoElavon(whetherbyelectronicmeansorotherwise)thatrelatetothesaleofgoodsand/orservicesforfuturedeliveryunlessyouhaveobtainedthepriorwrittenconsentofElavontodoso.Fortheavoidanceofdoubt,consentwillbedeemedtohavebeengivenbyElavonwhereyouhavecompletedthe‘upfrontpayments’sectionwithinyourApplicationandthatApplicationhasbeenacceptedbyElavon.IfElavonprovideswrittenconsent,youmustmaintainsufficientworkingcapitaltoprovideforthedeliveryofgoodsand/orservicesattheagreedfuturedate;suchworkingcapitalshallbeindependentofanycreditorproceedsresultingfromfuturedeliverySalesTransactions.

(o) Purchase with Cashback.YoumaynotprovidePurchasewithCashbackwithoutthepriorwrittenconsentofElavontodoso.Fortheavoidanceofdoubt,consentwillbedeemedtohavebeengivenbyElavonwhereyouhavecompletedthe‘cashback’sectionwithinyourApplicationandthatApplicationhasbeenacceptedbyElavon.IfElavonprovidessuchconsent,youmustcomplywiththeprovisionssetoutinSchedule5inrespectofPurchasewithCashback.

(p) Other Transactions.YoumustobtainElavon’spriorwrittenconsentforotherTransactiontypesincluding,pre-Authorisations (assured reservations); foreign exchange (Bureau de Change) Transactions; andcontactlessCardTransactions.

(q) Prohibited Transactions. You will not present to Elavon, directly or indirectly, any Transaction notoriginatingfromaTransactiondirectlybetweenyouandaCardholder,oranyTransactionyouknoworshouldknowtobeillegal,fraudulentornotauthorisedbytheCardholder.YouwillnotpresentanyTransaction(i)representingtherefinancingortransferofanexistingobligationofaCardholder,or(ii)thatarisesfromthedishonourofaCardholder’spersonalcheque.Inallevents,youmustgivereasonableassistancetoElavoninthepreventionanddetectionoffinancialcrimeatyourlocations.

(r) Multi-Currency Conversion

(i) IfyousubmitTransactionsforwhichyouhaveofferedtotheCardholderthegoodsand/orservicesinacurrency (TransactionCurrency) thatdiffers fromyourchosensettlementcurrency (SettlementCurrency) (Multi-CurrencyConversion), then, inaddition to theotherprocessing feespayable foraTransaction,ElavonshallapplyaconversionratecalculateddailybyElavonforeachMulti-CurrencyConversion.ForthepurposesofPSD2andotherequivalentregulationstransposingPSD2ineachEUMemberStates,theconversionratewillbeshownintheReportingTool.

(ii) Fortheavoidanceofdoubt,iftheTransactionCurrencyandSettlementCurrencyarethesame,noMulti-CurrencyConversionshallberequiredandnoconversionrateshallbeappliedtosuchTransaction.

(s) MCP

(i) If youofferMCPTransaction toCardholdersyouaresolely required toapply to thisTransactionaforeigncurrencyconversionorMCPrateobtainedfromElavon.Theforeigncurrencyconversionrateisdynamicandvalidityofaparticularratemaynotbe longerthan24hours.ChangeoftheforeigncurrencyconversionratedoesnotconstitutechangeoftheAgreement.

(ii) Application of the foreign currency conversion rate after its period of its validity has expired (asexplainedin(i)above)doesnotguaranteethesettlementwithuseofthisrate–Elavonmayapplyadifferentforeigncurrencyconversionrateapplicableforagivendate.Elavondoesnotbearanyliabilityforthedifferencebetweentheforeigncurrencyconversionratesinthecircumstancepresentedinthissubsection(ii).

(iii) ElavonshallapplyaMCPMarkuptotheforeigncurrencyconversionrateforeachMCPTransaction.TheMCPMarkupispresentedtoyouinyourScheduleofFeesorotherwise.ForthepurposesofPSD2 and other equivalent regulations transposing PSD2 in each EU Member States, foreign currencyconversion rate used for theMCP Transaction as well any other fees added will be show in theReportingTool.

17 www.elavon.co.uk

(t) High Risk/ Cost Additional Loading Transactions

(i) TheHighRisk/CostAdditionalLoadingFeewillapplytoHighRiskCostAdditionalLoadingTransactions.

9. REFUNDS

(a) YoumustmaintainandproperlydisclosetotheCardholder,atthetimeoftheSalesTransactionandinaccordancewiththeCardSchemeRulesandtheLaws,afairpolicyforthereturnofgoodsorcancellationofservices,includinganylimitationyouhaveonacceptingreturnedgoodsorthecancellationofservices.AlthoughthegivingofaRefundremainsatyourdiscretionsubjecttotheLaws,youmustofferRefundsineachlocationwhereyouacceptSalesTransactions.

(b) InordertoevidenceaRefund,youwillissueaRefundReceipt,givingacopytotheCardholder.

(c) InnoeventwillyoupresentaRefundthatexceedstheamountoftheoriginalSalesTransaction.YouwillonlymakeaRefundtothesameCardorthesameCardholder’saccountwhichwasusedfortheoriginalSalesTransaction.YoumustnotmakeaRefundwithcashwheretheoriginalSalesTransactionwasmadeusingaCard,unlessrequiredbytheLaws,noracceptcashorothercompensationformakingaRefundtoaCard.

(d) TheamountofeachRefundrepresentsadebtimmediatelydueandpayablebyyoutousirrespectiveofwhetherwemakedemanduponyouforthevalueofanyRefund.ElavonmaydebitYourBankAccountforthetotalamountofeachRefundsubmittedtoElavon(lessit’sMerchantServiceCharges).IfthevalueofRefundsismorethanthevalueofSalesTransactions,thedifferencewillbeduefromyoutoElavonandwewilldebitthedifferencefromYourBankAccount.

(e) Unlessotherwiseagreed,innoeventwillElavonbeobligedtoprocessreturns,refunds,oradjustmentsrelatedtotransactionsnotoriginallyacquiredbyElavon.

(f) Elavonmay,initssolediscretion,refusetoacceptanyRefund.IfwedorefusetoacceptaRefund,wewillnotifyyou(unlessprohibitedbytheLaws)oftherefusaland,ifpossible,thereasonsforsucharefusal.

10. REPORTING TOOL

WhereyouelectinyourApplicationtohaveaccesstotheReportingToolandElavonagreestoyourregistereduser (“Authorised User”) having such access, you are bound by andmust comply with and procure yourAuthorisedUser(s)areboundbyandcomplywiththetermsdisplayedviatheReportingTool.

11. RETRIEVAL REQUESTS

YouagreetoprovideallreasonableassistancetoresolveanydisputesarisingfromyourreceiptofMerchantServices.

Youmust respond to a Retrieval Request with a legible copy of the Sales Transaction Receipt within thetimeframespecifiedontheRetrievalRequest.FailuretodosomeansyouwillautomaticallyberesponsibleforanyChargebackrelatingtotheSalesTransaction,andsuchChargebackscannotbereversed.YouacknowledgethatresponsetoaRetrievalRequestdoesnotguaranteethataChargebackwillalwaysbereversed.

18 www.elavon.co.uk

12. CHARGEBACKS

(a) YoushallbefullyliabletoElavonfortheamountofanyandallTransactionsreturnedtoElavonforwhateverreason including, Chargebacks (together with any Chargeback Costs) or other disputes regarding thevalidityofaTransaction,evenwhere(aa)alltherequirementsofTransactionssetoutintheseTOShavebeencompliedwith,and/or(bb)youareundernolegal liability inrespectofthesupplyofthegoodsorservicesconcerned.

(b) WhereaChargebackisraised(aa)ifwehavenotyetpaidyouforthatSalesTransaction,wewillnotberequiredtodoso;or(bb)ifwehavealreadypaidyouforthatSalesTransaction,youmustpaythevalueofthatSalesTransactionbacktous.ThisisalsothecasewhereyousenddetailsaboutatransactiontouswhicharenotaSalesTransactionbutwhichhavebeenacquiredbyusasaSalesTransaction.

(c) TheamountofeachChargebackrepresentsadebtimmediatelydueandpayablebyyoutousirrespectiveofwhetherwemakedemanduponyouforthevalueofanyChargebacks.

(d) We shall notify you, to the extent permitted by the Laws, as soon as reasonably practicable of anyChargebackswhichhaveoccurredorbeenincurred.

(e) Wheresection12(b)applies,wewillbeundernoobligationtodealwiththeCardholderourselvesortotrytoobtainpaymentfromthemortheIssuer.

(f) IfyouwishtodisputeaChargeback,youmustprovetoourreasonablesatisfaction(orthatoftherelevantIssuerorCardScheme)thattheSalesTransactionwasauthorisedbytheCardholder(assetoutinsection(g)),includingtheapplicationofSCAwhererelevant,andprovideuswithanyadditionalevidencethatwe(ortherelevantIssuerorCardScheme)require.WeshallnotbeobligedtoinvestigateorchallengethevalidityofaChargeback.

(g) AChargebackcanoccurforanyreasonsetoutintheCardSchemeRules.

(h) YouacknowledgeandagreethatweshallcontinuetobeentitledtorecoverChargebacksfromyou(andwhererelevantfromanyPersonwhohasprovideduswithaGuaranteeorsecurityrelatingtoyourobligationsunderthisAgreement)inrelationtoallChargebacksthatoccurinrelationtoSalesTransactionsacquiredduringthetermofthisAgreement,notwithstandingtheterminationofthisAgreementforwhateverreason.

(i) YouwillnotresubmitorreprocessanySalesTransactionthathasbeenthesubjectofaChargeback.

13. EXCESSIVE CHARGEBACK AND EXCESSIVE FRAUD MERCHANTS

(a) Withoutprejudicetosection26(c),intheeventthatwearenotifiedthatyouareanExcessiveChargebackMerchantoranExcessiveFraudMerchant,weshalltakesuchactionaswemaydeemnecessaryincluding:

(i) making a request (with which you will comply) for further information from you in respect of theChargebacksorincidentsoffraudinquestion,includingthereasonsforthemandthemeasuresyouaretakingtoreducethem;

(ii) issuingyouwithinstructions(withwhichyouwillcomply)onhowtoreducethelevelofyourChargebacksorfraudincidents;

(iii) immediate suspension of your right to acceptCards or retention of funds in accordancewith theprovisionsofsection14.

(b) YouacceptliabilityforanyCardSchemeFinesasaresultofyoubeingdeemedanExcessiveChargebackMerchantoranExcessiveFraudMerchantasnotifiedbyElavontoyou.

19 www.elavon.co.uk

14. DELAYED PAYMENTS AND RESERVES

(a) Inthecircumstancessetoutbelowinsection14(b),andinadditiontoourrightsundersection12,wemay:

(i) delayanypaymentthatwewouldotherwisebeobligatedtopayyoupursuanttotheAgreement;and/or

(ii) requireyoutopayfundstous,inanamountdeterminedbyus,toholdasareserveagainstaliabilityyoumayincur;and/or

(iii) debitYourBankAccountinanyamount;and/or

(iv) otherwiseretainanyamountsweowetoyou.

(b) Therightssetoutatsection14(a)above,maybeexercisedbyuswhere:

(i) webecomeawareorreasonablybelievethatyouareinbreachoforarelikelytobeinbreachofyourobligationsundertheAgreement;

(ii) anythinghappenstoyou,oranythingcomestotheattentionofElavoninrelationtoyou,whichcouldreasonablybeexpectedtoresultinanadversechangeordeteriorationinCustomer’sfinancialposition,inparticular, includingbutnot limitedto(i)youbecomingthesubjectonanInsolvencyEvent,or(ii)wherewereasonablybelieveyoumaybethesubjectofanInsolvencyEvent,or(iii)youfailtonotifyusofanInsolvencyEvent;

(iii)theCustomer’sbusinessmodelchanges,exposingElavontoasignificantlyhigherfinancialrisk(e.g.offering services that differ from the Customer’s original business model) but excluding businessmodelstowhichElavonhasconsentedtoinwriting;

(iv) youfailtomaintainyourDirectDebitMandate;

(v) youfailtoprovidetheinformationwerequestpursuanttosection20(g);

(vi) youfailtoprovideanySecurityDocumenttoElavonfollowingnotificationpursuanttosection16and/oranySecurityDocumentisterminatedorwithdrawn(withoutourpriorconsent),oranytermofsuchSecurityDocumentisbreachedbyyouorbythePersonprovidingsuchsecurity;

(vii) onepartyterminatesthisAgreement;

(viii)webecomeawareof,orreasonablysuspectfraud,orothercriminalactivity,onyourpartoronthepartofoneofyouremployees,agentsorsub-contractors;

(ix) webecomeawareof,orreasonablysuspect,thatyouareanExcessiveChargebackMerchantoranExcessiveFraudMerchant;

(x) youbreachanyacquiringlimitinrespectofTransactionsimposedbyElavoninaccordancewithsection4(f);

(xi) anysanctionisimposeduponand/orannouncedtoElavonbyaCardSchemeinrelationtotheactionsoromissionsoftheCustomer;or

(xii) thevalueofRefundsismorethanthevalueofSalesTransactions.

(c) Elavonmay,withoutnoticetoyou,applyanyfundsretainedinaccordancewithsection14(a)againstanyObligations.Also,Elavonmayutiliseanyfundsretainedinaccordancewithsection14(a)inordertoexerciseits rightsunder theAgreement, including (i)withdrawinganyamounts that itmightotherwisewithdrawfromYourBankAccountor (ii) exercising its rightsofset-off tocollectanyMerchantServiceCharges,Chargebacks,allotherFeesandAdjustments,orotheramountsduetoElavonundertheAgreement.

20 www.elavon.co.uk

(d) Elavon’srightssetoutatsection14(a)aboveshallcontinueuntil:

(i) wearesatisfiedthatyouwillnotorcannothaveanyObligationsor,ifyoudo,youwillpayuspromptly(whichmayormaynotbeafterterminationoftheAgreement),followingwhichwewillpaytherelevantamounttoyou;or

(ii) the Agreement has been terminated and you have fulfilled all your Obligations (such time being“Complete Performance”, which in no event shall be deemed to have occurred earlier than threehundredandninety(390)daysfollowingtheeffectivedateofterminationoftheAgreementorthreehundredandninety(390)daysfollowingthedeliverydateofgoodsorperformanceofservicessubjectofaTransaction).AtthetimeofCompletePerformance,anyamountsthenretainedinaccordancewithsection14(a)willbetransferredtoyou,subjecttotheAgreement, theLaws,andtheCardSchemeRules.

15. SET-OFF

(a) You irrevocablyauthoriseElavon toset-offbywhatevermeansanyoutstanding liabilities (including theObligations)owedbyyou(inwholeorinpart)toElavonfromtimetotime,withoutnoticeandbothbeforeandafterdemand(whethersuchliabilitiesarepresent,future,actual,contingentorpotential)from:(i)anypaymentsduepursuanttosection4(d)and/oramountswewouldotherwisebeobligedtopaytoyouunderthisAgreement;or(ii)fundsheldbyElavonpursuanttoanyotheragreementbetweenyouandElavon.Weshallinformyou,assoonasreasonablypracticable,uponexercisingourrightsunderthissection15(a).

(b) InanInsolvencyEvent,youmustmaintainYourBankAccountasrequiredbyElavonandweshallhavetheright,subjecttotheLaws,tooffsetagainstamountsheldinYourBankAccount,anyandallObligationsyoumayhave toElavonwhetherornot relating toTransactions initiatedorcreatedbeforeorafter thecommencementoftheInsolvencyEvent.

(c) Elavonshall alsobeentitled toexercise its rightsof set-offasdescribed insections15(a)and15(b) inrelationtoanyofyourAffiliatesasifreferencetoyouinsection15(a)andsection15(b)wasareferencetosuchAffiliateofyours.

(d) AnyexercisebyElavonofitsrightsunderthissection15shallbewithoutprejudiceandinadditiontoanyotherrightsandremediesavailabletoitundertheAgreementorotherwise.

16. SECURITY

(a) Wemay,atanytime,requirethatyouprovideus,orthatyouprocurethataPerson(s)reasonablysatisfactorytousprovidesus,withsecurityinsuchformandoversuchassetsaswerequiretosecuretheperformanceofyourObligationsundertheAgreement(including,enteringintoand/orprocuringtheenteringintoofaSecurityDocumentinfavourofElavon).

(b) Youwill,intheeventthatwerequireyoutoprovideuswithsecurityassetoutatsection16(a),complywiththatrequirementandexecutesuchdocumentsasarenecessarytograntsuchsecurity,inbothcaseswithinthetimescalethatwespecify.

(c) NointerestispayableinrelationtoanysecurityarrangementsenteredintopursuanttothisAgreement.Allcosts(includinglegalcosts)andexpensesincurredbyyouincomplyingwiththissection16shallbeforyouraccountonly.

21 www.elavon.co.uk

17. DATA PROTECTION

The provision of Merchant Services

(a) Youshall,inrelationtotheprovisionofMerchantServices,complywithallapplicableDataProtectionRulesastheyapplytoyouinyourroleasdatacontroller.Theterms“processing”,“controller”and“processor”shallhavethemeaningascribedtothembytheDataProtectionRules.

(b) Youarethecontroller,andElavonistheprocessor,inrelationtoprocessingofTransaction-relatedpersonaldatainconnectionwiththeprovisionofMerchantServices.ThedataprocessingactivitiescarriedoutbyElavonareasfollows:

(c) WhenElavonprocessessuchpersonaldataforanypurposeotherthaninconnectionwiththeprovisionof Merchant Services (including, without limitation, carrying out fraud prevention checks, anti-moneylaunderingchecksanduseofaggregateddataforanalysispurposes),Elavonshallbeacontrollerinrespectofsuchprocessing.

(d) WhereElavonisactingasaprocessoronyourbehalfElavonshall:

(i) subjecttoyourcompliancewithsection17(e),onlyactoninstructionsfromyouregardingtheprocessingofpersonaldata,includingaspermittedunderthisAgreementandforthepurposesofprovidingtheMerchantServicesandtocomplywithlegalrequirementsinconnectionwiththeprovisionofMerchantServices;

(ii) complywithElavon’ssecuritypoliciesandanyothersecurityproceduresagreedbetweenthepartiesfromtimetotimewhichareintendedtoensurethatappropriatetechnicalandorganisationalmeasuresshallbetakenagainstunauthorisedorunlawfulprocessingofthepersonaldataandagainstaccidentallossordestructionof,ordamageto,thepersonaldatahavingregardtothestateofthetechnologicaldevelopmentandthecostofimplementingthemeasures,soastoensurealevelofsecurityappropriatetotheharmthatmayresultfrombreachofsuchmeasuresandthenatureofthepersonaldatatobeprotected;

(iii) maintain all applicablePCIDSS requirements to theextentElavonpossessesorotherwise stores,processesortransmitscardholderdataonyourbehalf;

(iv) beresponsible for thereliabilityofanyofElavon’semployeesorsub-contractorswhohaveaccesstothepersonaldataprovidedbyyouandshallensurethatsuchemployeesandsub-contractorsaresubjecttoobligationsofconfidentialityinrelationtothepersonaldataprocessedinconnectionwiththeprovisionoftheMerchantServices;

(v) promptlynotifyyouofanyrequestsmadebyanydatasubjectsundertheDataProtectionRulesorenforcementagenciesinrelationtotheprocessingofpersonaldatasothatyoumaydealwithanysuchrequest;

Subjectmatterandduration ofprocessing:

PersonaldataisprocessedforthepurposeofprovidingMerchantServicesunderthisAgreementduringthetermofthisAgreement.

Natureandpurposeof theprocessing:

Obtaining,recording,storingandtransmittingpersonaldataforthepurposeofenablingTransactions.

Typesofpersonaldata: CardholderdatathatisnecessarytoprocesstransactionsinthecourseofprovidingtheMerchantServices.

Categoriesofdatasubject: Customerswhopurchasegoodsorservices.

22 www.elavon.co.uk

(vi) taking into account the nature of the processing undertakenbyElavon, assist you, in so far as isreasonablyandlegallypossible,inrespondingtorequestsfromdatasubjectsexercisingtheirrightsundertheDataProtectionRules;and

(vii) takingintoaccountthenatureoftheprocessingundertakenbyElavonandtheinformationavailabletoElavon,assistyou,insofarasisreasonablyandlegallypossible,withnotificationofdatabreachestoregulatorsandindividuals,withtheconductofdataprotectionimpactassessmentsandwithpriorconsultationwithdataprotectionregulators,ineachcasetotheextentthatsuchassistanceislegallyrequiredundertheDataProtectionRules.

(e) YouwarrantandundertakethatanyinstructionsgivenbyyoutoElavoninrespectofthepersonaldatawhereElavonisactingasadataprocessorshallatall timesbe inaccordancewiththeDataProtectionRulesandthatcompliancewithsuchinstructionsandtheprocessingofthepersonaldataaspermittedbythisAgreementshallnotresultinabreachoftheDataProtectionRulesbyyouorElavon.

(f) YouagreethatElavonmayappointElavon’sAffiliatesassub-processorsandthatbothElavonandElavon’sAffiliatesmayappointthirdpartysub-processorsinconnectionwiththeprovisionoftheMerchantServices,providedineachcasethatequivalentobligationstothosecontainedinclause17areincludedinawrittencontractwithallsub-processors.

(g) YouacknowledgeandagreethatElavonmaytransferpersonaldatatocountriesoutsideoftheUK,theEuropeanUnionand/ortheEuropeanEconomicAreaincludingtheUnitedStatesofAmericainconnectionwiththeprovisionoftheMerchantServicesprovidedthatproperprecautionstosafeguardthesecurityandconfidentialityofsuchdataaretaken.

(h) Uponrequestandsubjecttosection19(Confidentiality),Elavonshallmakeavailabletoyou informationregardingElavon’scompliancewiththissection17.Notmorethanonceinany12monthperiodyoumayrequestanaudittocheckElavon’scompliancewiththissection17.YoushallberesponsibleforpayingthecostsoftheauditatElavon’sstandardrates.Thescopeandtimingoftheauditshallbeagreedinadvanceandanyinformationaccessedasaresultoftheauditshallbesubjecttotheobligationssetoutinsection19(Confidentiality).

(i) UponterminationofthisagreementtotheextentthatElavonholdsanypersonaldataonyourbehalfasaprocessoryouagreethatElavonshalldeletesuchpersonaldataunlessElavonisrequiredtoretainthepersonaldatatocomplywithapplicablelawsorisotherwiseauthorisedbylawtoretainthepersonaldata.

(j) Sections17(b)to(i)aboveonlyapplywhereElavonisactingasprocessoronyourbehalfanddonotapplywhereElavonisactingascontrollerofpersonaldata.

(k) Inhandling (i.e.storing,processingor transmitting)sensitivepaymentdata,youwill implementsecuritymeasuresinyourITinfrastructureasfollows:

(i) Indesigning,developingandmaintaininginternetpaymentservices,youwillpayspecialattentiontotheadequatesegregationofdutiesininformationtechnology(IT)environments(e.g.thedevelopment,testandproductionenvironments)andtheproperimplementationofthe“leastprivilege”principleasthebasisforsoundidentityandaccessmanagement.

(ii) You will have appropriate security solutions in place to protect networks, websites, servers andcommunication linksagainstabuseorattacks.Youwill stripserversofall superfluous functions inordertoprotect(harden)themandeliminateorreducevulnerabilitiesofapplicationsatrisk.Accessbythevariousapplicationstothedataandresourcesrequiredshallbekepttoastrictminimumfollowingthe“leastprivilege”principle. Inorder to restrict theuseof“fake”websites, transactionalwebsitesofferinginternetpaymentservicesshallbeidentifiedbyextendedvalidationcertificatesdrawnupinyournameorbyothersimilarvalidationmethods.

23 www.elavon.co.uk

(iii) Youwillhaveappropriateprocesses inplacetomonitor, trackandrestrictaccessto: (aa)sensitivepaymentdata,and(bb)logicalandphysicalcriticalresources,suchasnetworks,systems,databases,securitymodules,etc.Youwillcreate,storeandanalyseappropriatelogsandaudittrails.

(iv) Indesigning,developingandmaintaininginternetpaymentservicesyouwillensurethatdataminimisationisanessentialcomponentof thecore functionality: thegathering, routing,processing,storingand/orarchiving,andvisualisationofsensitivepaymentdataiskeptattheabsoluteminimumlevel.

(v) Securitymeasures for internet payment services will be tested under the supervision of your riskmanagementfunctiontoensuretheirrobustnessandeffectiveness.Allchangesaresubjecttoaformalchangemanagementprocessensuringthatchangesareproperlyplanned,tested,documentedandauthorised.Onthebasisofthechangesmadeandthesecuritythreatsobserved,testsarerepeatedregularlyandincludescenariosofrelevantandknownpotentialattacks.

(vi) Your security measures for internet payment services will be periodically audited to ensure theirrobustnessandeffectiveness.The implementationandfunctioningof internetpaymentserviceswillalsobeaudited.The frequencyand focusofsuchauditsshould take intoconsideration,andbe inproportionto,thesecurityrisksinvolved.Trustedandindependent(internalorexternal)expertscarryouttheaudits.Theyarenot involvedinanywayinthedevelopment, implementationoroperationalmanagementoftheinternetpaymentservicesprovided.

(vii) Wheneveryououtsourcefunctionsrelatedtothesecurityofinternetpaymentservices,theprovisionsofSCARTSrelatingtoSCAandanyrelevantguidelinespublishedbytheEuropeanBankingAuthorityandotherCompetentAuthoritiesshallbecompliedwith.

(l) Elavonshallimmediatelyinformyouif,initsopinion,aninstructiongivenorrequestmadepursuanttothisclause17infringesDataProtectionRules.

24 www.elavon.co.uk

18. PROTECTION OF CARDHOLDER INFORMATION

Withoutlimitingsection17:

(a) Youshallnot,withoutthepriorwrittenconsentofaCardholder,sell,purchase,provide,disclose,remit,shareorexchangeCardinformation,including,detailsofaCardholder,orinformationand/ordataregardingthemortheirTransactions,orregardingtheCardSchemesortheCardSchemeRules,howsoeverobtainedandwhatsoevertheform(includingCCTVfootage),toanythirdparty(otherthantoCustomer’sThirdPartyVendorsforthesolepurposeofassistingyouinyourbusinessand/orperformingyourobligationsundertheAgreement,andonlythenuponthewrittenagreementofsuchThirdPartyVendorstoholdsuchinformationconfidentiallyandtootherwisecomplywiththeLawsandtheCardSchemeRuleswithrespecttosuchinformation). Account and Transaction information belongs to Elavon, and,where applicable, theCardSchemes,and,withoutlimitingtheforegoing,youagreetouseAccountandTransactionInformationonlyforthesolepurposeofacquiringTransactionsandcomplyingwiththeAgreement,theCardSchemeRules,andtheLaws.

(b) Youshallstore,handleanddisposeallCardholderaccountinformation(includingAccountandTransactionInformationandotherpersonaldata, includingCardnumbers),whether inpaperorelectronicform, inasecuremannertopreventaccessby,ordisclosureto,orusebyanyoneotherthanCustomer’sauthorisedpersonneland incompliancewiththeDataProtectionRules, theLawsor theCardSchemeRules.YoushallatalltimescomplywiththeDataProtectionRules,andensurethatanyThirdPartyVendorsthatyouusesimilarlycomplywiththeDataProtectionRules.YoushallensurethatallThirdPartyVendorscomplywithallyourobligationsundertheseTOSandyoushallremainliableforallactionsandomissionsofThirdPartyVendorsasiftheywereyourown.PriortodisposingofanyCardholderaccountinformation,youshalldestroyitinsuchamannerastorenderitunreadable.YourobligationspertainingtothesecurityofAccountandTransactionInformationshallsurvivetheterminationoftheAgreement.

(c) YoumaynotatanytimeretainorstoremagneticstripeorotherCardholderdata,includingCVV/CVV2/CVC2/iCVV/PVVdataafterAuthorisationforanypurposesincludingrecordkeeping,andadditionalAuthorisationprocessing.IfyoustoreCardholderaccountnumbers,expirationdates,orotherpersonalCardholderdatainadatabase,youmustfollowtheLaws,theCardSchemeRules,andtheprovisionsoftheAgreementonsecuringsuchdataincluding,inaccordancewiththeDataSecurityStandards.

25 www.elavon.co.uk

19. CONFIDENTIALITY

(a) Elavon’s Confidential Information.YoushallkeepinstrictconfidenceallConfidentialInformation.

(b) YoumaydisclosesuchConfidentialInformation:

(i) toyouremployees,officers, representatives,advisers,agentsorsubcontractorswhoneedtoknowsuchinformationforthepurposesofcarryingoutyourobligationsundertheAgreement;and

(ii) asmayberequiredbylaw,courtorderoranygovernmentalorregulatoryauthority.

(c) You shall ensure that your employees, officers, representatives, advisers, agents or subcontractors towhomyoudiscloseConfidentialInformationcomplywiththissection19.

(d) YoushallnotuseanyConfidentialInformationforanypurposeotherthantoperformyourobligationsundertheAgreement.

(e) Customer’s Confidential Information and Transaction Data.Withoutprejudicetosections17and18,ElavonanditsAffiliatesmay,aspermittedbytheCardSchemeRulesandtheLaws,disclosetotheCardSchemes(i)confidentialinformationfurnishedbyyou;and(ii)anyinformationfurnishedbyyouthatwouldenabletheCardSchemestodetermineanindividual’sidentity,includingaCardaccountnumber.Elavonmaywhererelevant,alsodiscloseyourTransactiondatatothirdpartiesthroughwhichyouwereintroducedtoElavonforthepurposeofcalculationandpaymentofapplicablecommissionandotherfeestosuchthirdpartiesandforthepurposeoffacilitatingtheirservicestoyou.ElavonmayalsomakesuchdisclosuresofdataassetoutintheseTOS,theApplication,and(inthecaseofpersonaldata)inanyotherdataprivacynoticeswhichwemayprovidetoyoufromtimetotime.

20. REPRESENTATIONS, WARRANTIES AND COVENANTS

Yourepresent,warrantandcovenanttoElavonthroughouttheTermoftheAgreement,thefollowing:

(a) Information. All informationprovided toElavon in theApplication (and any other document submittedinconnectionwiththesame)orotherwisein,orinconnectionwith,theAgreementistrue,accurateandcompleteasof thedateoriginallygiven,properlyreflectsthebusiness,financialconditionandprincipalpartners,owners,orofficersoftheCustomerandthatallchangestosuchinformationhavebeenproperlynotifiedtoElavoninaccordancewithsection20(i).

(b) Powers.Customerand thepersonsigning theAgreementhave thepower toexecuteandperform theAgreement.ThePersonexecutingtheAgreementisdulyauthorisedtobindCustomertoallprovisionsoftheAgreement,andsuchPersonisauthorisedtoexecuteanydocumentandtotakeanyactionforandonbehalfofCustomer.Further,theCustomer’ssigningand/orperformingoftheAgreementwillnotviolateanyLaworRule,orconflictwithanyotheragreementtowhichtheCustomerissubject.

(c) No litigation.Thereisnoaction,suit,proceedingorregulatoryinvestigationpendingor,toyourknowledge,threatenedwhich,ifdecidedadverselywould(i)impairyourabilitytocarryonyourbusinesssubstantiallyasconductedat the timeyousubmitted theApplication, (ii) adverselyaffect yourfinancialconditionoroperationsor(iii)otherwiseaffectyourabilitytoperformyourobligationsundertheAgreement.YouhaveneverbeenplacedontheVMAS™orMATCH™systems,or,ifyouhave,youhavealreadydisclosedthatfacttoElavoninwriting.

26 www.elavon.co.uk

(d) Business use.Theparties furtheragree that theyhavemutually reliedupon the representationsof theotherthatthisAgreementisenteredintoforcommercial,orbusinesspurposesandnotforpersonal,familyorhouseholdpurposes,thatneitherpartyisaconsumer,andthateachpartyisengagedintheircommontrade.YouareobtainingandusingMerchantServicesforlegitimatebusinesspurposesonlyandtofacilitatelawful business Transactions between yourself and your customers. Your business and themanner inwhichyouconductitcomplywithallLaws.Further,YourBankAccountintowhichdebitsandcreditsaremadeisbeingusedforlawfulbusinesspurposesonly.

(e) Data security.AsofthedateonwhichtheAgreementwasenteredinto,nosecuritybreach(includingaDataBreach)inrespectofdataofanynatureprocessedbyyouoronyourbehalfhasoccurredbefore,andremainsunresolved.Intheeventthatyoubreachthisrepresentationandwarranty,wemaysuspendtheMerchantServicesand/ortakeanystepsaswe(ortheCardSchemes)deemnecessarytoremedythebreach.

(f) Nature of Transactions.WithoutthepriorwrittenconsentofElavon,youwillnotsubmitTransactionsforacquiringforanybusinesses,products,ormethodsofsellingotherthanthosesetoutintheApplicationatthetimeyouapplyforMerchantServices.

(g) Provision of Information.PriortoMerchantServicesbeingmadeavailableandatanytimethroughouttheTerm,youshallsupplysuchinformationasmayberequired,eitherforcreditassessmentpurposes,includingbutnotlimitedto(i)auditedfinancialstatementspreparedbyanindependentcharteredaccountantandanyotherinformationregardingyourfinancialconditionasreasonablyrequestedbyElavonfromtimetotime;and(ii)afinancialstatementofprofitandlossandabalancesheetforthefiscalyear;ortoallowElavontocomplywithanyobligationsplacedonitbytheLawsfromtimetotime,includinginformationtoidentifyyouforanti-moneylaunderingandterrorismpurposes.Tohelppreventthefundingofterrorismandmoneylaunderingactivities,theLawsrequireustoobtain,verify,andrecordinformationthatidentifieseachPersonwhoopensanaccount.

(h) Insolvency Event.YouwillimmediatelynotifyElavonofanyInsolvencyEvent.

(i) Accuracy of Information.YouwillpromptlynotifyElavoninwritingofanychangestoinformationprovidedbyoraboutyouoryourbusinesssetoutintheAgreement(includinganyinformationthatmaymaketherepresentationscontainedinthissection20untrueorincompleteinanyrespect),includingachangeto:

(i) your locations, including any additional locations or new business at which you desire to receiveMerchantServicesorotherwiseacceptorprocessTransactions;

(ii) yourname;

(iii) theidentityofyourprincipalsand/orowners;

(iv) yourassetstructure(i.e.thesaleofalloramaterialpartofyourbusiness)ortheformofyourbusinessorganisation(e.g.soleproprietorship,partnership,limitedcompanyetc.);

(v) yourusualtrading,includingifyoustop,orplantostop,trading;or

(vi) thenatureofyourbusiness,includingthetypeofgoodsand/orservicesprovidedbyyou,yourtradingtermsand/orhowsalesarecompleted(e.g.bytelephone,mail,internet,orinpersonatyourplaceofbusiness);suchnoticetobereceivedbyElavonatleastten(10)BusinessDayspriortotheproposedchange.YouwillprovideanyadditionalinformationrequestedbyElavon(including,productinformation,copiesoftradingterms,supplierinvoices)withinareasonabletime.

27 www.elavon.co.uk

(j) Audit.InordertoascertainwhetherornotyouarecomplyingwiththeAgreement,youauthoriseElavonatanytime(includingpriortoprovidingMerchantServices)toperformanon-siteauditofthosefacetsofyourbusiness,which inourdeterminationarerelevanttoMerchantServices,andwithsuchreasonablepriornoticeasispermittedbytheCardSchemeRules.Aspartofsuchanaudit,youshall:

(i) giveusorourdulyauthorisedagentsaccesstoalloranyofyourbusinesslocationsorpremisesinorder to examine your records, facilities, systems, equipment, data, stock and those of any otherbusinesswhichweconsiderisormaybeconnectedtoyou;and

(ii) permitustoobtainandretaincopiesofalloranysuchrecords;

(iii) provideuswithanyreasonableassistancethatwerequestinconnectionwithsuchaudit;and

(iv) obtainandsubmitacopyofanauditreportfromathirdpartycertifiedbytheCardSchemesofthefinancial,physical,informationsecurity(andoperationalfacetsofyourbusiness)atyourexpense,whenreasonablyrequestedbyElavon.

(k) YoushallfurtherprocureauthorityfromanyThirdPartyVendorforElavontoperformasimilarauditofsuchThirdPartyVendor.Further,youacknowledgeandagreethattheCardSchemeshavetherighttoaudityourbusinesstoconfirmcompliancewiththeCardSchemeRules.

(l) Insurance.(i)Youagreethatitisyourresponsibilitytoeffectpublicliabilityinsuranceonyourownbehalf,and youwill verify the existenceof suchpublic liability insurance toElavonon requestbymeansof acertificateofinsurance.(ii)Youwillhaveprofessionalliabilityinsuranceinplace,whichshallincludecoverageonanindemnitybasisforliabilitytoElavonfornegligentactsandomissionsandfraudonthepartofyouremployeesandinrespectofthosemattersforwhichtheindemnitysetoutinsection21(h)isgiven.Youfurtheragreethatyouwillarrangeforyourunderwritersand/orinsurerstorenouncetheirrightsofrecourse(ifany)againstElavonandtoverifytheexistenceofsuchprofessionalliabilityinsurancetousonrequestbymeansofacertificateofinsurance.

(m) Compliance with Laws and Card Scheme Rules.Youagreetocomplywith(andprocurethatyouragentsandsubcontractorscomplywith)andassistElavonincomplyingwith:(i)theCardSchemeRulesandwithanyinstructions,policiesandproceduresprovidedbyElavoninordertofacilitatesuchcompliance;(ii)allLaws;(iii)theEGCRules(whereapplicable)governingtheissuance,useandacceptanceofEGCs.YouwillexecuteanddelivertoElavonallsuchinstrumentsitmayfromtimetotimereasonablydeemnecessarytoverifyyourcompliancewiththissection.

(n) Data Security Standards.Youshall:

(i) complywiththeDataSecurityStandards

(ii) producetoElavonevidenceofcompliancewiththeDataSecurityStandardsonElavon’srequest,saveforthosePCILevel3orLevel4CustomersthatsubscribetoaSolution(asdescribedfurtherinSchedule6).

(iii) procurethatallThirdPartyVendorsfromwhomyoureceiveValueAddedServicesorTerminalsandanyagents,sub-contractorsorthirdpartiesusedbyyou,complywiththeDataSecurityStandards,togetherwithanyadditionaldatasecuritystandardsofthePCISSC.

28 www.elavon.co.uk

(iv) intheeventthatyoubecomeawareoforsuspectanysecuritybreachorcompromiseofCardholderorTransactiondataorinformationbyyouoranyThirdPartyVendorsfromwhomyoureceiveValueAddedServicesorTerminalsandanyagents,sub-contractorsorthirdpartiesusedbyyou(whetherornotyouhavecompliedwiththeDataSecurityStandards):

(aa) immediatelynotifyElavonofyourawarenessorsuspicion,identifyandresolvethecauseofthesecuritybreachorcompromise inquestion,co-operate,provideanyassistanceandactonthereasonableinstructionsofElavon(whichmayincludetheprocurement,atyourcostandwithinthetimescaleswestipulate,ofanyforensicreportfromathirdpartyrecommendedbyusortheCardSchemes,andcompliancewithallrecommendationssuggestedinsuchreportto improveyourdatasecurity);

(bb)ensureandprocurethatwhereCardholderorTransactiondataorinformationisstoredforyoubyaThirdPartyVendororyouragent,sub-contractororanythirdpartyusedbyyou,thatsuchThirdPartyVendororagent,sub-contractoror thirdpartyalsoco-operateswithusandactsonourreasonableinstructionsassetoutinsection20(n)(iv)(aa)above;

(cc)ensureandprocurethatElavonhastherighttoreview,commentonandmakechangestoanyforensicinvestigationreportpreparedbyaforensicinvestigator(assetoutinsection20(n)(iv)(aa)above),beforeitissubmittedtotheCardSchemes;and

(dd)beresponsibleforyourownactions,omissionsorfailurestoact,thoseofyourAffiliates,officers,directors, shareholders, employeesandagents, includinganyThirdPartyVendorsor agentorsub-contractoror thirdpartywithwhomyoucontract toperformservices foryou inrelationtocompliancewiththissection.

(v) intheeventthatwereasonablysuspect(includingwhereweareinformedbyaCardSchemethattheysuspect)anysecuritybreachorcompromiseofCardholderorTransactiondataorinformationbyyouoranyThirdPartyVendorsfromwhomyoureceiveValueAddedServicesorTerminalsandanyagents,sub-contractorsorthirdpartiesusedbyyou(whetherornotyouhavecompliedwiththeDataSecurityStandards):

(aa) (ifrequiredbyus)instructatyourowncostandwithinthetimescaleswestipulate,aforensicreportfromathirdpartyrecommendedbyusortheCardSchemes,andcomplywithallrecommendationssuggestedinsuchreporttoimproveyourdatasecurity);and

(bb)complywiththeprovisionsofsections20(n)(iv)(bb)and20(n)(iv)(dd)aboveasiftheyapplytothissection20(n)(v)(bb).

(o) Card Scheme Marks. The Customer shall prominently display themost current versions of the CardSchemes’names,symbols,and/orservicemarksoftheCardsacceptedbyyouatorneartheTerminals.TheCustomer’suseofsuchmarksmustcomplywiththerequirementsofeachmark’sowner.YouruseofCardSchememarksorpromotionalmaterialsprovidedbyoronbehalfofanyCardSchemewillnot(i)indicate,directlyorindirectly,thatanyCardSchemesendorsesanygoodsand/orservicesotherthantheirownandyoumaynotrefertoanyCardSchemesinstatingeligibilityforyourgoods/andorservices,or(ii)giveyouanyownershiporinterestinanysuchmarksormaterials.

(p) Proprietary Interest.YouhavenointerestwhatsoeverinanyIPRsandareonlypermittedtousetheIPRsasexpresslyauthorisedbytheseTOS.Customermaynotcopy,reproduce,distribute,orcreatederivativeworksfromtheIPRswithoutElavon’spriorwrittenconsenttodoso.NothingintheAgreementshallbeconstruedasgrantingyouanypatentrightsorpatentlicenseinanypatentwhichElavonmayhaveormayobtaininrespecttoElavon’sservices,softwareorequipment.Customerwillmakenoattempttoduplicateorotherwiseascertainthecomponents,circuitdiagrams,logicdiagrams,flowcharts,sourceandobjectcode, schematicsoroperationof,orotherwiseattempt to reverseengineer, reverseassemble, reversecompile,de-compileordissemblethewholeoranypartofanyofElavon’sservices,equipmentorsoftware.

29 www.elavon.co.uk

21. INDEMNIFICATION

ExcepttotheextentasmaybeadirectresultofthegrossnegligenceorbreachbyElavonoftheAgreement,youwillbeliablefor,indemnifyandkeepindemnified,defend,andholdharmlesstheProtectedPartiesfromandagainstClaimsorLossrelatingto,orinconnectionwith,orresultingfrom,orarisingoutof,orinconsequenceof:

(a) the operation of the Agreement, including in relation to: (i) any Transaction, Chargeback (includingChargebackCosts)and/orRepresentmentacquiredorprocessedundertheAgreement;(ii)anybreachbyyouoftheAgreementincludinganyinfringementoftheIPRs;(iii)theuseofYourBankAccountandanyfundsretainedinaccordancewithsection14(a),and(iv)theoccurrenceofanyofthecircumstancessetoutatsection26(c);

(b) yourutilisationoftheMerchantServices,includinganyClaimorLossincurred,madeagainstorpaidbyortoanythirdparties,whetherarisingdirectlyorindirectlyfromourprovisionofMerchantServicestoyou;

(c) any act or omissionby yougiving rise to a claimunder theConsumerCredit Act 1974or other Laws(whetherornotsuchclaimisproven);

(d) anychangeundersection20(i),whetherornotreportedtoElavon,and/oryourfailuretoproviderequestedinformationunderthatsectioninatimelymanner;

(e) ourreportingunderVMAS™and/orMATCH™pursuanttosection17(k);

(f) anyfailuretoreturnmaterialsfollowingterminationundersection26(g);includinganyinfringementofIPRs;

(g) your(andanyAuthorisedUser’sorunauthoriseduser’s)useofanypasswordsprovidedbyElavonoranythirdpartyandaccesstotheReportingToolincluding,anyinformationobtainedthroughthis,anydamagetoyourcomputersystemorlossofdata;

(h) theuse,operationormalfunctionofaTerminal,orinrelationtoanymatterarisingoutofitspresenceonyour locationsor inconnectionwithanyworkdoneorservice to theTerminalsprovidedbyElavon, itsservants,agentsand/orsub-contractors.

(i) anybreachofDataSecurityStandardsbyyou,yourofficers,directors,employeesand/oranyThirdPartyVendorsorbyanyagentorsub-contractorretainedbyyouinrelationtothisAgreement, includingthirdpartycostsinrelationtoaninvestigationofthesamerequestedbyElavonand/oraCardSchemeandCardSchemeFines;

(j) theactionsof,orfailuretoactby,yourofficers,directors,employees,agents,sub-contractor,ThirdPartyVendorsandthoseofanyotherPersonwho,withorwithoutyourconsentorco-operation,obtainsaccesstoinformationrelatedtoTransactions;

(k) theCardSchemeRules,anyCardSchemeFine,oranyotherfeesorpenaltiesofanynatureincluding,duetoyoubecominganExcessiveChargebackMerchantoranExcessiveFraudMerchant;or

(l) anystepstakenintheprotectionofElavon’sinterestsinconnectionwithanyaspectofElavon’srelationshipwithyou(includingthecostofanythirdpartiesnominatedbyElavonorinstructedbyElavonforthispurpose).

(m) Elavonshallbeentitledatitsdiscretiontoaccept,dispute,compromiseorotherwisedealwithanyClaimsorLossandshallbeundernoliabilityinsuchrespecttoyou.

30 www.elavon.co.uk

22. EXCLUSION AND LIMITATION OF LIABILITY

(a) General limitation of liability.

(i) Subject to section 22(a)(ii), Elavon shall only have liability for any proven direct losses or damagewhichyousufferorincurasadirectresultofElavon’snegligenceoranybreachbyElavonofElavon’sobligationsundertheAgreement,saveifandtotheextentthatsuchnegligenceorbreachiscausedorcontributedbyyou.

(ii) Exceptasprovidedbysection22(d),theliabilityofElavonduringeachContractYear,whethertoyouoranyotherparty,howsoeverarising(whateverthebasisoftheliability,whetherarisinginrespectofanyoneeventorseriesofeventsarisingfromthesamecauseofaction,andwhetheranact,omissionorbreachofstatutorydutyofElavonoranyofitsemployees,agentsorsubcontractors),shallnotexceedintheaggregateanamountequaltotheMerchantServiceCharges(lessCardSchemeFees)duefromyouduringthetwelve(12)monthsimmediatelypriortothefirstactoromissionthatformedtheprincipalbasisofthelossorclaimbeingsought(orwherethatactoromissionarisesduringthefirsttwelve(12)monthsfollowingtheCommencementDate,anamountequivalenttotheaveragemonthlyMerchantServiceCharges(lessCardSchemeFees)duetoElavonintheperiodfromtheCommencementDateupuntilthefirstactoromission,multipliedbytwelve(12)).

(iii) InnoeventwillanyoftheProtectedPartiesbeliablefor(aa)anylossofprofits,lossofrevenue,lossofsales,lossofbusiness,lossofbargain,lossofopportunity,lossofgoodwill,lossofreputation,lossofanticipatedsavings,lossofcomputerequipment,softwareordata(including,throughtheuseortheinabilitytousetheReportingTool,unauthoriseduseoralterationofCustomer’stransmissionsordata),orlossoftimewhichmayariseinconnectionwiththeAgreementorMerchantServices,evenifsuchlosswasreasonablyforeseeableorwithinthecontemplationoftheparties(ineachinstance,whethersuchlossisdirect,indirectorconsequential);or(bb)anyindirect,incidental,specialorconsequentiallossordamagehowsoeverarising.

(b) Limitation of Warranties.ElavonwillperformallservicesrequiredtobeperformedbyitundertheAgreementusingreasonablecareandskill.ElavonherebywarrantsthatitshallprovideyouwithallnecessarytitletouseitsTerminals,wheresupplied.Exceptasspecificallyprovidedbytheforegoing,Elavonmakesnootherwarranties,guaranteesorundertakings,expressorimplied,regardingtheperformanceofsuchservices,andnothingcontainedintheAgreementwillconstitutesuchawarrantyincluding:

(i) inrelationtotheEGCservicesprovidedtoCustomerortheEGC’scompliancewiththeLaws,theCardSchemeRulesortheEGCRules.

(ii) in relation to use of the Reporting Tool in particular but without limitation, that it will meet yourrequirements,willremainuninterrupted,timely,secureorerrorfree,willalwaysprovideaccurateandreliableadvice/information/results,thatanydefectsinrelatedsoftwarewillbecorrectednorinrelationtoanyadviceorinformation(whetherwrittenororal)obtainedbyyoufromElavon.Fortheavoidanceofdoubt,youexpresslyacknowledgeandagreethat(aa)theuseoftheReportingToolisatyoursoleandentireriskand,withtheexceptionoftheprovisionofstatutorilyrequiredstatements,itisprovidedonan“asis”and“asavailable”basis;and(bb)anyinformationobtainedbyyouthroughuseoftheReportingToolisusedatyourowndiscretionandrisk.

Allotherconditions,terms,undertakingsandwarranties,expressor implied,whetherstatutoryorotherwise,inrespectof theservices (includingquality,performance,suitabilityorfitnessforaparticularpurposeornoinfringement)areherebyexcludedtothefullestextentpermittedbytheLaws.

31 www.elavon.co.uk

(c) Force majeure.Elavonshallnotbeliabletoyouforanyfailure,delay,breachofperformance,orlossyousufferduetocircumstancesbeyondElavon’scontrolwhichleadstotheservicesprovidedbyustoyouinconnectionwiththisAgreementbeingwhollyorpartiallyunavailableforsuchreasonsincluding,atechnicalfailure,aconnectivityfailurewithanyCardScheme,systemsupgrades,industrialdispute,communicationsorpowerfailure,oranyactofGod.Further,ElavonshallnotbeliableforanycontraventionoftheAgreementwherethecontraventionisduetoElavon’sobligationsunderanyLaws(includingthecircumstancessetoutinsection27(b)(ii)).

(d) No limitation on liability in certain instances.Notwithstandingtheforegoingprovisionsofthissection22,noprovisionoftheAgreement(includinganyindemnitygivenbyyou)shallhavetheeffectoflimitingorexcludingtheliabilityofaparty(i)fordeathorpersonalinjuryresultingfromnegligenceor(ii)forfraudorfraudulentmisrepresentationor(iii) lossessufferedbyusinrelationtoChargebacks,ChargebackCosts,CardSchemeFinesorRefundsunderthisAgreement,or(iv)inrespectofanyliabilitywhichcannotlawfullybeexcludedorlimited.

(e) If twoormorePersonsareshown in theApplicationas theCustomer,eachofyoushallbe jointlyandseverallyliablewiththeother(s)toperformyourobligationsunderthisAgreement.

(f) Should youwish tomake a claim against Elavon pursuant to the Agreement, youmust informElavon(providingdetailsoftheclaimandoftheallegedloss)immediatelyuponidentifyingsuchclaim,andinanyeventwithinsix(6)monthsafteryoubecomeaware(orshouldhavereasonablybecomeaware)oftheactoromissionwhichformsthebasisofyourclaim.

23. PCI WAIVER PLAN

SubjecttothetermsofSchedule6,youshallbeentitledtoreceivethebenefitofthewaiverssetoutunderthePCIWaiverPlanifyou:

(a) meettheeligibilitycriteriaspecifiedinSchedule6(includingthatyouareclassifiedaseitheraPCILevel3orLevel4Customerandmaintainsuchclassification);and

(b) subscribetooneoftheSolutions(asfurtherdescribedinSchedule6).

24. THIRD PARTIES

(a) Products or Services.YoushallnotutiliseanyValueAddedServicesofanyThirdPartyVendorwithoutthepriorwrittenconsentofElavon.Whereconsentisprovided,youshall:

(i) procurethatsuchValueAddedServicesandtheThirdPartyVendorarefullycompliantwithall theLawsandtheCardSchemeRules;

(ii) ensure,wheretheThirdPartyVendorprovidesCardholderdataprocessing,storingand/ortransmittingservices(directlyorindirectly)(oranycombinationofthese)toyou,thatanysuchThirdPartyVendorisregisteredwitheachoftheCardSchemesandlistedonsuchCardSchemes’website(includingtheVisaEuropeMerchantAgentsList);and

(iii) beboundbytheactsandomissionsoftheThirdPartyVendor.

(b) Appointment of Agents.Elavonmay,subjecttocompliancewiththeCardSchemeRules,appointoneormore agents or representatives in relation toMerchant Services provided under the Agreement. Allstatements,requests,decisionsandothercommunicationsconveyedtoCustomerbyanysuchagentorrepresentativeshallbetreatedasiftheyhadbeenmadebyElavon,asapplicable.

32 www.elavon.co.uk

25. TERM

TheAgreementshallcomeintoforceontheCommencementDateandremainineffectforaperiodoftwelve(12)Months(“Initial Term”)unlessotherwiseterminatedinaccordancewithsection26.Thereafter,theAgreementwillautomaticallycontinueuntilterminatedbyeitherpartyinaccordancewithsection26.

26. TERMINATION AND SUSPENSION

(a) Termination by Customer.TheAgreementmaybeterminatedbyyouintheeventofamaterialbreachofthetermsoftheAgreementbyElavon,providedyoufirstgivewrittennoticetoElavonofanysuchallegedbreachrequiringittoberemedied,andsuchbreachremainsunremediedforaperiodofthirty(30)daysfollowingreceiptofsuchwrittennoticebyElavon.

(b) Termination by Elavon.Withoutprejudice toanyother rights and remedies setout in theseTOS, theCardSchemeRules or Laws, theAgreementmay be terminated by Elavonwithout cause at any timeincludingduringtheInitialTermandatElavon’sconveniencebygivingtwo(2)monthspriorwrittennoticetotheCustomer.IntheeventthatanyotheragreementbetweenyouandElavonisterminatedbyElavon,includingbutnotlimitedtoanagreementforthehireofTerminals,ElavonmayatitsreasonablediscretionterminatetheAgreement.

(c) Immediate suspension and termination by Elavon.WithoutprejudicetoanyotherrightsandremediessetoutintheseTOS,theCardSchemeRulesorLaws,theAgreementoranypartoftheobligationsofElavon(includingtheprovisionofanyaspectoftheMerchantServices)maybesuspendedand/orterminatedbyElavonwithimmediateeffectwhere:

(i) youfailbyyoutopayanyamountduetoElavonundertheAgreement;

(ii) anInsolvencyEventoccurs,orwereasonablybelieveitmayoccuroryoufailtonotifyusofanInsolvencyEvent;

(iii) youbecomeanExcessiveChargebackMerchantoranExcessiveFraudMerchantand/oryoufailtocomplywithourrequestsorinstructions,assetoutinsection13;

(iv) ElavonreasonablybelievesthattheSalesTransactionmaybefraudulent,suspicious,ormayinvolveanycriminalactivity;

(v) ElavondiscoversthatyouhaveprovidedfalseormisleadinginformationindocumentssubmittedtoElavon,orotherwiseinconnectionwithMerchantServices;

(vi) youbreachanyacquiringlimitinrespectofTransactionsimposedbyElavoninaccordancewithsection4(f);

(vii) youfailtoobtainourpriorwrittenconsentwhererequiredundertheAgreementincluding,pursuanttosub-sections8(g)-8(k)and8(m)-8(p);

(viii)anythinghappenstoyou;orcomestotheattentionofElavoninrelationtoyou;orarisesfromorisincidentaltoyourbusiness;ortheconductofyourbusiness(includingtheproducts/servicesofferedbyyou,tradingpractices,methodsofsellingandindividualactivities);oryouengageinanybusinesstradingpracticesor individualactivity;andElavonconsiders, in its reasonablediscretion thatsuchcircumstances:

(aa)mayaffectyourabilityorwillingnesstocomplywithalloranyofyourObligationsundertheAgreement;

(bb)maydamagethereputationorbedetrimentaltothebusinessoftheCardSchemesorElavon;

(cc)mayordogiverisetofraudoranyothercriminalactivityorbreachofLaws,orasuspicionofthesame;

33 www.elavon.co.uk

(dd)mayordogiverisetoincreasedriskofliabilityorlosstoElavon;

(ee)havenotbeenconsentedtobyElavonasatthedateoftheacceptanceoftheApplication;

(ix) ElavonisrequiredorrequestedtodosobyanyCardSchemeoranyCompetentAuthorityorbyreasonoftheCardSchemeRulesoranyLawsapplicabletoeitherElavonoryou,orifaCardSchemeorotherthirdpartyceasestoprovideuswithanyservicethatwerequireinordertoprovidetheMerchantServicestoyou;

(x) youbreachorfailtocomplywiththeDataSecurityStandards;

(xi) ForceMajeureeventoccursasdefinedinsection22(c).

(d) Elavon shall, subject to the Laws, notify you at the earliest opportunity after the deemed receipt of aTransaction,of:(i)anyrefusalofaTransaction,(ii)ifpossible,thereasonsforsuchrefusal;and(iii)whereitispossibletoprovidereasonsfortherefusalandthosereasonsrelatetofactualmatters,anystepsyoumusttakeforrectifyinganyfactualerrorsthatledtotherefusal.

(e) Elavonshallbeentitled tochargeyou for thenotificationssetoutat section26(d)where the refusal isreasonablyjustified.

(f) Unblocking of transactions. In the case of unblocking/stopping transactions you can apply to us tounblockatransactionandwewilldealwithyourrequestwithintwodays.

(g) Action upon and effect of termination.

(i) Termination by Customer within the Initial Term.Withoutprejudicetoanythingcontained in thissection26,whereyouterminatetheAgreementduringthefirst6monthsof the InitialTermonly,aterminationfeeshallbecomepayableandwillbeaddedtothefinalinvoice/statement.Theterminationfeeshallbethesumofthefollowingfeesinsofarastheyareapplicabletoyou:foreveryremainingfullmonthoftheInitialTerm,anyunpaidTerminalrentalFees(aswellastheTerminalRecoveryFee),FeesfortheSolutionand/orthePCINon-ComplianceFee.Thestructureofourterminationfeesmaychangefromtimetotime.TerminationofAgreementbyCustomershallbefreeofchargefortheCustomer,iftheAgreementhasbeeninforceformorethan6months.

(ii) Survival.UponterminationoftheAgreement,therightsandobligationsofbothpartiesshallimmediatelyceasetohaveeffect,except:

(aa) terminationshallnotaffectaccruedrightsorobligationsundertheAgreementasatthedateoftermination, including for the avoidance of doubt, your obligations in relation to Transactionsacquiredpriortotermination;and

(bb)thoseprovisionscontained intheAgreementthatareexpressly,orbytheirsenseandcontext,intendedtosurvivecompletionorperformance,terminationorcancellationoftheAgreement,suchprovisionsshallsurviveandcontinueinfullforceandeffect.

(iii) Transactions.UponterminationoftheAgreement,youmust:

(aa)ceasetoacceptSalesTransactionsandceasetosendtousSalesTransactionReceiptsinrespectofSalesTransactionsthatoccurredaftertheterminationoftheAgreement(ifyoudonotceasetodoso,weshallbeundernoobligationtoacquireorpayyouinrespectofsuchtransactions);

(bb)inrespectofSalesTransactionsthatoccurredpriortotheterminationoftheAgreement,presentthoseSalesTransactionstouswithinthree(3)BusinessDaysofthedateofsuchSalesTransaction;and

(cc) inrespectofSalesTransactionsthatoccurredpriortotheterminationoftheAgreement,continuetopresentRefundsandsendtousRefundReceipts.TheamountofsuchRefundswillremaindueandowingfromyoutouspursuanttosection9(d)notwithstandingterminationoftheAgreement.

34 www.elavon.co.uk

(iv) Accounts.FundsrelatingtoTransactionsacquiredbyuspriortotheterminationoftheAgreementmayberetainedbyElavoninaccordancewiththeprovisionsofsection14(a)untilyoufullysatisfyallyourObligations.Youmustmaintainenough funds inYourBankAccount following termination tocoveranyMerchantServiceCharges,Chargebacks, all other Fees andAdjustments, andother amountsdueundertheAgreementuntilsuchtimeasCompletePerformancehasoccurred.MerchantServiceChargesandanyotherFeesandAdjustmentspayableshallbeapportionedupuntilthetimeofeffectiveterminationoftheAgreementandanychargespaidinadvancewillbereimbursedproportionally.

(v) VMAS™ and MATCH™ Reporting.IntheeventthattheAgreementisterminatedforcausepursuanttosection26(b),yournamemaybelistedonVMAS™andMATCH™.

(vi) Card Scheme marks.UponterminationoftheAgreement: (i)yourrighttouseordisplayanyCardSchememarksshallterminateautomatically,(ii)anydisplayofsuchmarksonyourwebsiteand/oryourbusinesslocations,mustbeimmediatelyremoved,and(iii)youmustimmediatelyreturnanymaterialsdisplayinganysuchmarks.

(h) Promotional materials.Allpromotionalmaterials,advertisingdisplays,emblems,TransactionReceipts,RefundReceipts,andotherformssuppliedtoyouandnotusednorpurchased,willremainthepropertyofElavonandmustbereturnedtoElavonoratElavon’sinstruction,destroyedwithinten(10)BusinessDaysafterterminationoftheAgreement.

27. MISCELLANEOUS PROVISIONS

(a) Entire agreement. The Agreement as amended from time to time, constitutes the entire agreementand understanding between the parties, and supersedes all prior representations, understandings andagreements(whetherwrittenororal)provided,however,theAgreementshallnotsupersedeanySecurityDocumententeredintoinfavourofElavon,whichshallbedeemedtoremainanagreementseparateanddistinctfromtheAgreement.OnenteringintotheAgreement,neitherpartyreliesonanypriorrepresentation,statementorunderstanding,overandabovethoseexpresslyprovidedforintheAgreement.

(b) Governing law.

(i) TheAgreementandtheparties’non-contractualobligationsarisingthereunderwillbegovernedbyandconstruedinaccordancewiththeLawsofEnglandandWales.Thepartiessubmit,subjectasprovidedbelow, to the exclusive jurisdiction of the English courts to settle any claim, dispute ormatter ofdifferencewhichmayariseoutoforinconnectionwiththeAgreementorlegalrelationshipsestablishedbytheAgreement.NothinginthissectionlimitsElavon’srighttobringproceedingsarisingoutoforinconnectionwiththeAgreement(i)inanyothercourtofcompetentjurisdiction,or(ii)concurrentlyinmorethanonecourtofcompetentjurisdiction.YouwaiveanyobjectiononthebasisofvenueorforumtoanyproceedingsbroughtbyElavonpursuanttothissection.

(ii) In the provision by Elavon of products and services pursuant to this Agreement, Elavon relies onentitiesgovernedby the lawsof theUnitedStates. In that role,suchentitiesareunable toprovideanyproductsorservicestoElavon,ortoitscustomers,thatcontravenethelawsoftheUnitedStatesofAmericaincludingwithoutlimitationthelawspromulgatedbytheUnitedStatesDepartmentoftheTreasury’sOfficeofForeignAssetsControloranysuccessorthereto.

35 www.elavon.co.uk

(c) Assignment, novation and sub-contracting.

(i) Youcannot assign, transfer or novate theAgreementor anyof your rightsor obligationsunder it,whetherdirectlyorbyoperationoflaw.

(ii) Youmay,subjecttoourpriorwrittenconsent,useasubcontractororagentinrespectoftheperformanceofyourobligationsundertheAgreement (suchconsentmayreasonablybewithdrawnbyusatanytime).Youwillbe responsible forensuring thatanysuchsubcontractororagentcomplieswith therelevanttermsoftheAgreement.

(iii) Youare liable for theactsoromissionsofanyagent,subcontractor,Affiliateoremployeeofyours(whetherornotwehaveprovidedconsentinaccordancewithsection27(c)(ii))inconnectionwiththeperformanceofyourobligationsundertheAgreementorinrelationtoanyTransactionorChargeback.

(iv) Elavoncanonwrittennoticeassign,novateorotherwisetransfer,eitherinwholeorinparttheAgreement.YouagreetoenterintoanydocumentsasElavonmayrequireinordertoevidencesuchassignment,novationorothertransfer.Notwithstandingtheforegoing,Elavonisentitledto:(i)assignanyandallreceivablesarisingoutoftheAgreementtoathirdpartyforfinancingorrefinancingpurposes;or(ii)totransfer(e.g.,bysub-participation)theeconomicriskofthereceivablesarisingoutoftheAgreementtoathirdparty.Incaseofsuchassignmentortransfer,Elavonmay,subjecttosection17,discloseandtransmittoanysuchthirdpartyallinformationaboutyouandtheAgreementrelevantfororrequiredbythethirdpartyinconnectionwithsuchassignmentortransfer.

(d) Taxes.AllamountsstatedintheAgreementareexclusiveofVATorothertaxes.IfVAToranyothertaxischargeableinrespectofalloranyamountspaidtoElavonundertheAgreement,youshallpaytoElavonsuchVATattherateproperlychargeable,inrespectoftherelevantsupplyofgoodsand/orservicesprovidedbyElavon.Weshall,whererequiredbytheLaws,issueaVATinvoiceandsummaryofTransactions.

(e) Interest.You shall (withoutprejudice to anyother rights and remediesofElavon), pay immediatelyondemand,interestattheratesetundertheLatePaymentofCommercialDebts(Interest)Act1998(or itsreplacement fromtime to time),compoundeddaily, fromtheduedateuntil thedateofactualpayment(whetherbeforeorafteranyjudgment)onanyoverduesumpursuanttotheAgreement.

(f) Notices.

(i) Anywrittennotice toCustomerunder theAgreementwill bedeemed receivedupon theearlierof: (i)actualreceipt;or(ii)five(5)BusinessDaysafterbeingpersonallydelivered,sentbyfirstclasspost,orwithanationallyrecognisedovernightcarrier,andaddressedtothelastaddressshownontherecordsofElavon.

(ii) AnywrittennoticetoElavonshallbepersonallydelivered,sentbyregisteredpostoranationallyrecognisedovernightcarrierto:ElavonFinancialServicesDAC,UKBranch,POBox56,IDABusinessPark,Arklow,Co.Wicklow,Irelandandshallbedeemedreceivedonlyuponactualreceipt.

(iii) Anynotice to terminate inaccordancewithclause26(a)of thisAgreementmaybeservedeither inwriting(includinge-mailtoqueries@elavon.com)orupontelephoningElavonCustomerServices.

(iv) AnynoticesorotherinformationtoCustomerinrelationtotheAgreementshallbeinEnglishlanguageandcommunicatedfromtimetotimeinwriting,viatelephone,e-mail,faxand/orviainternetincludingbutnotlimitedtothroughourReportingTool.

(g) Amendments.ElavonmaymakeanychangestotheAgreementatanytimeontwo(2)months’notice.YoumayterminatetheAgreementpriortothedatethechangescomeintoeffectwithoutcharge(otherthananyliabilitiesthatyouhaveorwillhavetoElavonunderthetermsoftheAgreement).Uponexpiryofthetwo(2)months’noticeperiodyouwillbedeemedtohaveagreedtothechanges.

36 www.elavon.co.uk

(h) Severability.AnyprovisionoftheAgreementfoundtobeillegalorotherwiseunenforceable,shallnotaffectanyoftheenforceabilityoftheremainingprovisionsoftheAgreement,whichwillfurtherbeconstruedasiftheillegalorunenforceableprovisionwasnotcontainedintheAgreement.

(i) Waiver.Neitherthefailure,northedelaybyElavontoexercise,inwholeorinpart,anyrightorremedyundertheAgreementorundertheLawsshalloperateasawaiver,releaseorestoppelofsuchrightorremedy,norshallitamendtheAgreement.ThesingleorpartialuseofarightorremedyundertheAgreementorundertheLawsshallneitherrestrictnorpreventthefurtherexerciseofsuchrightorremedyinthefuture.AnywaiverrequestedbyyoushallhavenolegalforceoreffectunlessspecificallyagreedtoinwritingbyElavon,initssolediscretion.

(j) Independent Contractors. The parties will be deemed independent contractors and nothing in theAgreementshallbeconstruedasconstitutinganagency,jointventure,orpartnershipbetweentheparties,unlessandtotheextentotherwisespecificallyprovided.

(k) Counterparts.TheAgreementmaybesignedinoneormorecounterparts,eachofwhichshallconstituteanoriginalandallofwhich,takentogether,shallconstituteoneandthesameAgreement.

(l) Remedies Cumulative.TherightsconferreduponElavonintheAgreementarenotintendedtobeexclusiveofeachotherorofanyotherrightsandremediesofElavonundertheAgreement,atLaworinequity.Rather,eachandeveryrightofElavonundertheAgreement,atLaworinequityiscumulativeandconcurrentandinadditiontoeveryotherright.

(m) Service.ElavonwillacceptelectronicserviceofdocumentsincludingofthisAgreementandanynoticesincludedhereinonlyifsenttoElavonCustomerServicesatqueries@elavon.com

(n) Complaints. Elavon is committed to providing an excellent customer experience; however, if you feelthatwehavenotmetyourexpectations,wewouldliketoknow.Ifyouarenotsatisfiedwithanyaspectofourservice,pleasecontactusbytelephoneatourServiceCentre03458500195.Ourlinesareopen24hoursaday,7daysaweek.Alternatively,writetousatElavonMerchantServices,Building8,CherrywoodBusinessPark,Loughlinstown,Co.Dublinorsendanemailtocomplaints@elavon.com.Ifwecan’tresolvethemattertoyoursatisfactioninformallywewillsendyouawrittenacknowledgementwithin5businessdaysof having received your complaint. Youwill beprovidedwith onepoint of contact to handle anyquestionsyoumayhave,andwewillensurethatyoureceiveafullwrittenresponse.Ouraimistoresolveyourconcernsandrespondtoyouassoonaspossibleandnolaterthan15businessdaysoffirstreceivingyourcomplaint.If,forreasonsbeyondourcontrol,weareunabletoissueafinalresponsetoyouwithin15 business dayswewill write to you to keep you updated, clearly outlining the reason for our delayandwewillsetoutthetimelinebywhichyouwillreceiveafullresponse.Thisdeadlinewillbenolongerthan 35 business days from the receipt of your initial complaint. If you are not satisfiedwith our finalresponse, youmaybe eligible to refer the complaint to the FinancialOmbudsmanServices (FOS) andwewillprovideyouwiththecontactdetails.PleasenotethattheFOSwillonlybecomeinvolvedafterwehavehadtheopportunitytoresearchandaddressthecomplaint.TheFOScanbecontactedat:Financial Ombudsman Service, Exchange Tower, London E14 9SR Telephone: 0800 023 4567 Website: www.financialombudsman.org.uk. In theevent thatyouarenoteligible to referyourcomplaint to theFOS,Elavondoesnotsubscribetoanalternativedisputeresolutionservice.

37 www.elavon.co.uk

(o) Acknowledgement of Bail In.NotwithstandingandtotheexclusionofanyothertermofthisAgreementoranyotheragreements,arrangements,orunderstandingbetweenElavonandyou,youacknowledgeandacceptthataBRRDLiabilityarisingunderthisAgreementmaybesubjecttotheexerciseofBail-inPowersbytheRelevantResolutionAuthority,andacknowledge,accept,andagreetobeboundby:

(i) theeffectoftheexerciseofBail-inPowersbytheRelevantResolutionAuthorityinrelationtoanyBRRDLiabilityofElavontoyouunderthisAgreement,that(withoutlimitation)mayincludeandresultinanyofthefollowing,orsomecombinationthereof:

(aa) thereductionofall,oraportion,oftheBRRDLiabilityoroutstandingamountsduethereonincludinganyaccruedbutunpaidinterest,ifanyifdue;

(bb)theconversionofall,oraportion,oftheBRRDLiabilityintoshares,othersecuritiesorinstrumentsofownershipofElavon,andtheissuetoorconferralonyouofsuchshares,securitiesorinstrumentsofownership;

(cc) thecancellationoftheBRRDLiability;

(dd)theamendmentoralterationofanyinterest, ifapplicable,thereon,thematurityorthedatesonwhichanypaymentsaredue,includingbysuspendingpaymentforatemporaryperiod;

(ii) thevariationofthetermsofthisAgreement,asdeemednecessarybytheRelevantResolutionAuthority,togiveeffecttotheexerciseofBail-inPowersbytheRelevantResolutionAuthority.

38 www.elavon.co.uk

GLOSSARY

3D Secure™:meansthethree-domainsecureprotocol,including(forthepurposesoftheAgreement)Verifiedby Visa™ developed by Visa andMasterCard® SecureCode™ developed byMasterCard® and such otherprogramsnotifiedtoCustomerbyElavonfromtimetotime(andineachcaseanyamendmentsand/orversionsfromtimetotime).

Account and Transaction Information: means any information that is necessary to acquire and processTransactions correctly, including all information recorded electromechanically or otherwise on a Card, andmorespecifically includesany informationusedtoauthenticateaTransaction,andany informationobtainedduringtheacquiringofaTransactionthatotherwiseidentifiesindividualconsumersandtheirpurchasesbut,excludingconsumername,purchasedescription,purchaseamount,andothersimilardetailsifsuchinformationisspecificallyandvoluntarilyprovidedtoyoubytheCardholderindependentlyoftheTransaction.

Account Status Inquiry:meansanAuthorisationtovalidateaCardwithnosubsequentsettlementandincludesMasterCardStatusInquiryChecksandVisaAccountVerification.

Add Location form:meansaformcompletedbyCustomertonotifyElavonofCustomer’sadditionalbusinesslocationswhereitshallacceptCardspursuanttotheAgreement.

Affiliate:means, with respect to any Person, any other Person directly, or indirectly through one ormoreintermediaries,controlling,controlledbyorundercommoncontrolwithsuchPerson.

Agreement:means,collectively,theApplication,theseTOS,theScheduleofFees,theOperatingGuide,anyAddLocationform,anyagreementforsimilarorrelatedservicestowhichCustomerisaparty,andanyotherguidesormanualsthatapplytoCustomerfromtimetotime,andallamendmentstoeachandanyofthosedocumentsfromtimetotime.

Application:meansElavon’sapplicationformthatiscompletedbyCustomerandsubmittedtoElavontoapplyforMerchantServices.

ASV:meansanorganizationwith a set of security services and tools testedandapprovedbyPCISSC toconductexternalvulnerabilityscanningservicestovalidateadherencewiththeexternalscanningrequirementsofPCIDSS.

Audit:meansanindependentsecurityauditoftheCustomer’scomputersystemstoidentifythesourceoftheDataBreach.

Audit Costs:meansanysumsreasonablyrequiredtoconductanindependentsecurityauditoftheCustomer’scomputersystemstoidentifythesourceoftheDataBreach.

Authentication:meansaprocedurewhichallowstheIssuertoverifytheidentityofaCardholderorthevalidityoftheuseofaspecificCard,includingtheuseoftheCardholder’sPersonalisedSecurityCredentials;

Authorisation: theconfirmationatthetimeofaSalesTransactionfromtherelevantCardIssuerthat(i)theCardnumberisvalid(ii)theCardusedtopayfortheSalesTransactionhasnotexpiredorforanyreasonbeenlistedaslostorstolen,blockedorashavinghaditssecuritycompromisedand(iii)therearesufficientfundsavailablefortherelevantSalesTransaction(and“Authorise”and“Authorised”shallbeconstruedaccordingly).

Authorisation Code:meansthecodeorreferencenumbersentbyanIssuerfollowinganAuthorisation.

Authorisation Request:meansarequestbytheCustomerforAuthorisation.

Authorised Floor Limit:means the totalmonetary valueof anySalesTransaction youmayacceptonanyoccasionwithoutfirstobtaininganAuthorisationCode.

B2B:meansbusiness-to-business.

39 www.elavon.co.uk

Bail-in Legislation:meansinrelationtoamemberstateoftheEuropeanEconomicAreawhichhasimplemented,orwhichatanytimeimplements,theBRRD,therelevantimplementinglaw,regulation,ruleorrequirement.

Bail-in Powers:meansanywrite-downandconversionpowersinrespectofanentityinresolutionasdefinedin the relevant Bail-In Legislation including; write-down or convert relevant capital instruments into sharesorother instrumentsofownership; takingcontrol; exerciseofall the rightsandpowersconferredupon theshareholders,otherownersandthemanagementbody;transferofsharesorotherinstrumentsofownership;transfertoanotherentity,withtheconsentofthatentity,rights,assetsorliabilities;reduce,includingtoreducetozero,theprincipalamountoforoutstandingamountdueinrespectofBRRDLiability;convertBRRDLiabilitiesintoordinarysharesorother instrumentsofownership;canceldebt instrumentsissued;reduce, includingtoreducetozero, thenominalamountofsharesorother instrumentsofownershipandtocancelsuchsharesorotherinstrumentsofownership;requiretheissueofnewsharesorotherinstrumentsofownershiporothercapitalinstruments,includingpreferencesharesandcontingentconvertibleinstruments;toamendoralterthematurityofdebtinstrumentsandothereligibleliabilitiesissuedoramendtheamountofinterestpayableundersuchinstrumentsandotherBRRDLiability,orthedateonwhichtheinterestbecomespayable,includingbysuspendingpaymentforatemporaryperiod;closeoutandterminatefinancialcontractsorderivativescontractsforthepurposesofapplyingArticle49ofBRRD.

BRRD:meansDirective2014/59/EU,asamended,establishingaframeworkfortherecoveryandresolutionofcreditinstitutionsandinvestmentfirms.

BRRD Liability:meansaliabilityinrespectofwhichBail-InPowersmaybeexercised.

Business Day:meansaday(otherthanaSaturday,Sundayorpublicholiday)whenElavonisopenforbusinessinEngland.

C&P Card:meansaCardwhichincorporatesChipandPINTechnology.

Card:meansanyformofvalidpaymentcardorothervalidpaymenttokenordeviceusedforthepurposesofobtainingcreditordebitingofadesignatedaccountissuedbyaCardIssuerunderaCardScheme(including,aCreditCard,aDebitCard,anEGCorotherstoredvaluecard,contactlessCard),andacceptabletoElavon(asnotifiedtoyoufromtimetotime),whichmaybeusedbyaCardholdertocarryoutaTransactionofthetypesspecifiedintheApplication.

Cardholder:means(i)theindividualinwhosenameaCardhasbeenissued;and(ii)anyindividualwhopossessesandusesaCardandwhopurportstobethepersoninwhosenametheCardwasissuedorwhosesignatureappearsontheCardasanauthoriseduser,andwhoisacustomerpurchasinggoodsorservicesfromyou.

Card Not Present:meansanenvironmentwheretheCardisnotphysicallypresentedtotheCustomerbytheCardholderastheformofpayment,noristheCardholderphysicallypresent,atthetimeofsale(including,MailOrder/TelephoneOrderTransactionsandInternetTransactions).

Card Present:meansanenvironmentwheretheCardisphysicallypresentedtotheCustomerbytheCardholderastheformofpayment,andtheCardholderisphysicallypresent,atthetimeofsale.

Card Reader:meansthecardreader,includingPINPad,purchasedbytheCustomerfromElavonwhichtheCustomerwillusetoprocessanyTransactionandthatconformswiththerequirementsestablishedfromtimetotimebytheapplicableCardSchemeandbyElavon.

Card Schemes: means Visa, MasterCard®, American Express Payment Services Limited, Maestro, JCBInternational(Europe)Limited,DinersClubInternationalLimited(includingDiscover-brandedCards),UnionPayInternationalCo.,LimitedoranyotherCardsponsorshiporganisationorassociationorschemeandtheirAffiliatesgoverningtheissueanduseofCardsacceptabletoElavon,andanysuccessororganisationorassociationtoanyoftheforegoing.

40 www.elavon.co.uk

Card Scheme Fee:thechargesthatElavonisrequiredtopaytoanIssueroraCardSchemeincludingbutnotlimitedtoinrespectoftheprocessing,clearingandsettlementofTransactionsincluding,anychargesbasedonvolumesandnumbersofTransactions.

Card Scheme Fines:meansanyassessment,fine,liquidateddamages,fee,cost,expenseorchargeofanynaturewhichaCardSchemeoranyother thirdparty leviesonyouorusatany time,directlyor indirectly,inrelationtoanyaspectofourrelationshipwithyou(includingthecostsofanyIssuerormemberofaCardSchemeforthecostsofreplacingCards).

Card Scheme Rules:means all applicablebylaws, rules, regulations, operatingguidelines andproceduresissuedbyanyCardSchemefromtimeto timerelating toCards,Transactions,anyotherpaymentmethodsandanypaymentsorprocessingofTransactiondatarelatingthereto,asamended,extended,consolidatedorsupplementedfromtimetotime,andanycurrentwaiversorexceptionsagreedwiththeCardSchemes.

Chargeback:meansanycircumstanceswhereanIssuerorCardSchemerefusestosettleaSalesTransactiontousorseeksreimbursementfromusofaSalesTransactionwhichhasalreadybeensettledtous,notwithstandinganyAuthorisationortheapplicationofSCA.

Chargeback Costs:meansElavon’sadministrativechargeforprocessingaChargebackandanyreasonablecosts,expenses,liabilitiesorCardSchemeFinesthatElavonmayincurasaresultoforinconnectionwithaChargeback.

Chip and PIN Compliant: means (a) the Terminal is fully approved, tested, installed, and operational inaccordancewithElavon’sminimuminstallation,testingandoperatingrequirementsmadeavailabletoyoufromtimetotime(b)theTerminalcompliesandismaintained,upgradedandusedinaccordancewith:i)ourminimumTerminal requirementswhich aremade available to you from time to time, ii) any Terminalmanufacturer’smanuals, recommendations, instructions, guidance and training as issued or provided to you from time totime; (iii) the requirementsspecified in theEMVIntegratedCircuitCardSpecifications forPaymentSystems(as amended from time to time) and iv) the recommendationsandguidelines issuedby theCardSchemesfromtimetotimeunderthechipandPINprogramme;and(c)anyoneyouauthorisetooperatetheTerminalisappropriatelyexperienced,qualified,competentandproperlytrainedtouseit.

Chip and PIN Technology:meansanytechnologyinwhateverformintroducedbyanyCardSchemewhichemployschipembeddedCardsand/or theuseofaPIN inconjunctionwith,or in replacementof,amanualsignatureofaCardholder.

Chip and PIN Terminal:means Terminalswhich areChip and PINCompliant togetherwith PIN Pads, asappropriate.

Chip Failure:meansafailureoftheembeddedchipinaC&PCardtofunctioncorrectlywiththeresultthataproperlyenteredPINwillnoteffectanAuthorisationoftheSalesTransaction.

Claims or Loss:includesallandanyclaims,actions,proceedings,loss,damages,liability,penaltiesandfines(whetherornotimposedbyaCardScheme),surcharges,costs(includinginvestigation,administrationandlegalcosts)andexpensesmadeagainst,paidorincurredbyanyProtectedParty.

Commencement Date:meansthedate(asreferredtoinyourwelcomeletter)onwhichyourApplicationhasbeenacceptedbyElavon.

Commercial Card:meansanycard-basedpaymentinstrumentissuedtoundertakingsorpublicsectorentitiesor self-employednatural personswhich is limited in use forbusinessexpenseswhere thepaymentsmadewithsuchcardsarechargeddirectlytotheaccountoftheundertakingorpublicsectorentityorself-employednaturalperson.

Compatible Device: means devices that are listed in our FAQ section on www.tellmemore.elavon.com/vmmobile/andthatareBluetoothenabledandshallnotincludeJailbrokenorRootedDevices.

41 www.elavon.co.uk

Competent Authority:meansanysupranational,national,state,county,localormunicipalgovernmentbody,bureau, commission, board, board of arbitration, instrumentality, authority, agency, regulatory body, court,department, minister, ministry, official or public or statutory persons (whether autonomous or not) havingjurisdiction over any party to the Agreement or any Transaction acquired pursuant to the Agreement or inrespectofanypartoftheAgreementinanyjurisdiction.

Complete Performance:hasthemeaningsetoutinsection14(d)(ii).

Confidential Information:meansall tradesecrets,proprietary,orotherconfidential informationor itemsofElavon,ofwhichtheCustomerobtainsknowledgeoforaccesstoasaresultofCustomer’srelationshipwithElavonpursuanttotheAgreementandwhetherornot inwrittenform,and including:scientific,technical,orbusinessinformation,productmakeuplists,ideas,concepts,designs,drawings,techniques,plans,calculations,systemdesigns,formulae,algorithms,programs,software(sourceandobjectcode),hardware,manuals,testproceduresandresults,identityanddescriptionofcomputerisedrecords,identityanddescriptionofsuppliers,customer lists, processes, procedures, “know-how,” marketing techniques and material, marketing anddevelopmentplans,pricelists,pricingpolicies,andallotherfinancialinformation.

Consumer Card:meansaCardissuedtoanaturalpersoninhis/herpersonalcapacity.

Contract Year: meanseachsuccessivetwelvemonthperiodcommencingontheCommencementDate.

Coverage Area:means the geographic area inwhichWireless Terminal Transaction processing is available toCustomer.

Credit Card:meansacardwheretheamountofthetransactionsisdebitedinfullorinpartatthepreagreedspecificcalendarmonthdatetothepayer,inlinewithaprearrangedcreditfacility,withorwithoutinterest.

Currency Payment Choice:hasthemeaningsetoutinSchedule3.

Customer (or you or your):meansthebusinessentityorotherPersonindicatedontheApplicationandincluding(whenrelevant),anysubsidiaryorAffiliate.

CVV/CVV2/CVC2/iCVV/PVV:meansthesecurityfeaturesonthebackofCardsandcontainedintheirmagneticstripsand/orchipsintendedtoinhibitthealterationormisuseofCarddataandenhancetheauthenticationoftheCard,andassuchterms,andsimilartermsmaybedefinedbytheCardSchemes.

Cyber Security Tools:meansthecybersecuritysoftwareorservicesubscribedtoandprovidedinrelationtotheProgrammeaslicensedpursuanttothesetermsandconditions.

Data Breach:meansafailureofsecurityataMIDattheCustomerresultinginacompromiseofitscustomers’Carddata.

Data Protection Rules:meanscollectivelyalldataprotection,datasecurityanddataprivacy requirementsimposedbylaw,including,theDataProtectionAct1998orothernationallegislationimplementingorreplacingtheEUDataProtectionDirective95/46/EC,Directive97/66/ECconcerningtheprocessingofpersonaldataandtheprotectionofprivacy inthetelecommunicationssector,Directive2002/58/ECconcerningtheprocessingofpersonaldataandtheprotectionofprivacyintheelectroniccommunicationssector,andthePrivacyandElectronicCommunications (ECDirective)Regulations2003, theGeneralDataProtectionRegulationandalllegislationthatimplementsorisenactedinconnectionwiththeGeneralDataProtectionRegulationandotherdataprotectionorprivacylegislationinforcefromtimetotimeinanyrelevantjurisdictionwhichisapplicabletotheprovisionofservicesundertheAgreement,togetherwithanysimilarprovisionsoftheCardSchemeRules,includingtheDataSecurityStandardsandanyregulationandregulatoryguidanceissuedbyacompetentdataprotectionauthority.

42 www.elavon.co.uk

Data Security Standards:means:

(a) PCI DSS, with further information in relation to the current requirements of the PCI DSS available at www.pcisecuritystandards.org;

(b) PaymentCard IndustryPaymentApplicationDataSecurityStandards aspublishedby thePCISSCatwww.pcisecuritystandards.org;

(c) Payment Card Industry PIN Transaction Security Standards published by the PCI SSC at www.pcisecuritystandards.org;

(d) VisaPaymentSystemRiskprogramme(formerlytheAccountInformationSecurityprogramme);

(e) MasterCard®SiteDataProtectionProgram;

(f) othersecuritystandardsofPCISSC;

(g) securitystandardsofanyotherCardSchemesofCardsthatyouacceptand/orprocess

asamendedorupdatedfromtimetotime,includinganysuccessorstandardstothosestandards.

DCC:meansthedynamiccurrencyconversionproductofElavonenablingaCardholdertopayforgoodsand/orservicesprovidedbytheCustomerinacurrencyotherthanthatinwhichtheCardwasissued,andofferedinrespectofthecurrenciesthatElavoncommunicatestotheCustomerfromtimetotime.

DCC Transaction:meansaSalesTransactionusingDCC.

Debit Card:meansacardwithamagneticstripeorwhichischip-enabled,andbearingthesymbol(s)ofoneormoredebitnetworkwhichenablestheCardholdertopayforgoodsand/orservicesbyauthorisinganelectronicdebittoadesignatedaccount,includingwhereapplicable,PIN-based,onlinedebitTransactions.

Direct Debit Mandate:hasthemeaningsetoutinsection4(c).

EEE: hasthemeaninggiventoitinSchedule1,paragraph8(a).

EGC:meansanelectronicgiftcardoraloyaltycardpurchasedbyacustomerthatisredeemableforin-storegoodsand/orservicesfromtheCustomer.

EGC Rules:meansanyandallrulesandregulationsappliedtoEGCprocessingbyElavonandotherrelevantbodies,andnotifiedtoCustomerfromtimetotime.

Elavon (or us, ours, we): meansElavonFinancialServicesDAC,alicensedcreditinstitutionincorporatedinIrelandand registeredwith theCompaniesRegistrationOffice, Ireland (RegistrationNo.418442), having itsregisteredofficeaddressatBuilding8,CherrywoodBusinessPark,Loughlinstown,Co.Dublin,Ireland;operatingforthepurposesoftheAgreementthroughitsUnitedKingdombranchhavingitsprincipleplaceofbusinessat4thFloor,MeridienHouse,69-71ClarendonRoad,Watford,Hertfordshire,WD171DSand,asthecontextmaydictate,anyAffiliateorsubsidiaryofElavoninrelationtoMerchantServices.ExcessiveChargebackMerchant:meanswhereweare informedbyaCardScheme that youare,orarebecominganexcessivechargebackmerchantbyexceedingorapproachingcertainchargebacklimitsinrespectofSalesTransactions,asdictatedbytheCardSchemes.

Excessive Fraud Merchant:meanswherewereasonablyconcludethatyouare,orarebecominganexcessivefraudmerchantbyexceedingorapproachingcertainfraudlimitsinrespectofSalesTransactions,asreasonablydeterminedbyElavon.

Fees and Adjustments: means, excludingMerchant Service Charges, all other charges as set out in theScheduleofFeesandallRefunds,returns,ChargebackCosts,CardSchemeFinesand/or,surcharges,aswellasanyotheramountsdueasaresultofaChargebackandanyotherchargessetoutinthe‘AdditionalProductsandServices’sectionoftheApplication(ifapplicable).

43 www.elavon.co.uk

Financial Crime Screening Services: means a third party pattern recognition fraud management serviceprovidedunderacontractwithoronbehalfofElavon.

General Data Protection Regulation:meansRegulation(EU)2016/679oftheEuropeanParliamentandoftheCouncilof27April2016ontheprotectionofnaturalpersonswithregardtotheprocessingofpersonaldataandonthefreemovementofsuchdata.

Goods:meansthegoodsspecifiedintheApplication(includingCardReaders(whereapplicable)but,fortheavoidanceofdoubt,excludinghiredterminals)bytheCustomer,inaccordancewiththisAgreement.

Guarantee:meansanywrittenguaranteeprovidedbyaPersonofCustomer’sObligations toElavon that isgiveninconnectionwiththeAgreement.

Guarantor:meansaPersonthatexecutesaGuarantee.

High Risk/ Cost Additional Loading Transactions:meansthefollowingTransactions:

(a) aCardswipeorsignatureorPANkeyenteredorunknowndataTransaction,occurringwhentheCustomerswipes themagneticstripeon theCard,oracceptsCardholder’ssignatureorCustomerkeys theCardnumberintotheTerminalasverification,orthemodeofacceptanceisnotknown;

(b) adelayedfilesubmissionTransaction,occurringwhentheCustomersubmitsclearingfiletoElavon2daysormoreaftertheCardwasacceptedbytheCustomer;

(c) aCardNotPresentnotusing3DSecure™Transaction,occurringwhentheCustomeracceptspaymentwhenCardNotPresentand3DSecure™isnotused;

(d) aB2BVirtualCardTransactionoccurringwhentheCustomeracceptspaymentviaaB2BVirtualCard;

(e) acommercialcrossborderTransactionoccurringwhentheCustomeracceptsaCommercialCardthatisnotissuedinthesamecountryastheCustomer;and

(f) Consumer Card Not Present Non-EEA Country Transaction occurring when the Customer accepts aConsumerCard that isCardNotPresentandeither theCardholderor Issuer isbased inaNon–EEACountry.

High Risk/ Cost Additional Loading Transactions Fee:meansthehighrisk/costadditionalloadingfeeassetoutintheScheduleofFees.

Initial Term:meanstheperiodsetoutatsection25oftheseTOS.

Insolvency Event:meanstheoccurrenceofanyofthefollowing:

(a) youareunable(ordeemedtobeunable)topayyourdebtsasdefinedinsections123,222,223or224oftheInsolvencyAct1986(asapplicable);or

(b) youarethesubjectofapetition,resolution,orderoranyotherstepinrelationtowindinguporbankruptcy;or

(c) youcease,orthreatentocease,tocarryonallorpartofyourbusiness(saveforthepurposesofagenuineamalgamation,reconstructionorreorganisation);or

(d) youenterintoeithercompulsoryorvoluntaryliquidation,oraprovisionalliquidatorisappointedinrelationtoyouoranyofyourassets;or

(e) youarethesubjectofapetitionforanadministrationorderoranapplicationforsuchanorder,oranoticeofintentiontoappointanadministratortoyouisgiven,oranyotherstepistakenbyanypersonwithaviewtotheadministrationofyouundertheInsolvencyAct1986;or

(f) amoratoriumbeingagreedordeclaredinrespectofallorpartofyourdebts;or

44 www.elavon.co.uk

(g) youenter,orpropose toenter, intoanycomposition,assignment,compromiseorarrangementofyourdebts,orwithorforthebenefitofsomeorallofyourcreditorsgenerally,orinrespectofaparticulartypeofyourdebts;or

(h) beginproceedingsornegotiations,orproposeoragreetoreschedule,readjustordeferyourdebts;or

(i) theappointmentofaliquidator,receiver,administrativereceiver,administrator,managerorothersimilarofficerinrespectofthewholeoranypartofyourassets;or

(j)enforcementofanysecurityover,oranexecution,distress,orothersimilarprocedureleviedagainstanyofyourassets;or

(k) any legalproceedings, corporateactionorotherproceduresor stepsare taken in connectionwith theappointmentofanadministrator,administrativereceiver,receiver,liquidator,manager,trusteeinbankruptcyorothersimilarofficerinrelationtoyouoranyofyourassets;or

(l) whereyouareanorganisation,anyprincipalormemberofyourbusinessissubjecttoanyoftheeventssetoutat(b),(g),(h),or(k)above;or

(m) anyanalogousprocedureorsteptothosesetoutat(a)to(l)abovethatyouaresubjecttoinanyjurisdiction.

Intellectual Property Rights or IPRs:includescopyrightinterestsandrelatedrights(includingrightsinrespectof software and the Reporting Tool), trademark rights (including servicemarks, trade names and businessnames),designrights,databaserights(whetherornotanyoftheseisregisteredandincludinganyapplicationforregistrationofanysuchrights),know-how,confidentialinformation,tradesecrets,franchiseinterests,licenseinterests,patentrights(includingutilitymodelsandinventions),propertyrights,orotherinterestinanyservices,software,orhardwareprovidedbyElavon.

Interchange Plus Plus:meansapricingmechanismwherebythechargesexpressedasapercentagefeeorfeeperTransactionintheScheduleofFeesrepresenttheElavonProcessingFeeandinadditiontotheElavonProcessingFee,theCustomerwillpay(i)theInterchangeFees,(ii)theAssessmentFeesaswellas(iii)anyotherfeesasmaybeintroducedbytheCardSchemesfromtimetotime.

Internet DCC Transaction:meansaDCCTransactionwhere theCardholderuses the internet topurchasegoodsand/ororderservicesfromCustomer,orwhereCustomerusestheinternettosubmitaDCCTransactiontoElavonforacquiring.

Internet Transaction:meansaSalesTransactionwheretheCardholderusestheinternettopurchasegoodsand/ororderservicesfromCustomer,orwhereCustomerusestheinternettosubmitaTransactiontoElavonforacquiring.

Issuer:meansthefinancialinstitutionorotherPersonthatissuedtheCardtotheCardholder.

Jailbroken Device:meansaniOSdevicewheretheoperatingsystem’slimitationshavebeenremovedthroughtheuseofsoftwareandhardwareexploits,thusgiving‘rootaccess’totheoperatingsystemandallowingthedownloadofadditionalapplications,extensionandthemesthatareunavailablethroughtheofficialapplicationstore.

Laws:meansallapplicablelaws,legislation,rules,regulations,directives,andrecommendationsapplicabletoapartytotheAgreementortoanyTransaction,forthetimebeinginforceinanyjurisdiction,includinganythingissuedbyanyCompetentAuthority,andanyamendments,extensionsorre-enactmentstothesamefromtimetotime.

Mail Order/Telephone Order Transaction or MO/TO Transaction:means,forMO,aSalesTransactionthatoccurswhentheCardholdermakesapurchasefromaCustomerbymail,andforTO,meansaSalesTransactionthatoccurswhentheCardholderusesatelephonetomakeapurchasefromaCustomer.

MasterCard®:meansMasterCardEuropesprl.

45 www.elavon.co.uk

MATCH™:meansMemberAlerttoControlHighRiskCustomer,afilemaintainedbyMasterCard®ofmerchantswhosecontractswithotherbankshavebeenterminatedorwheretheyhavebeengivennoticeoftermination,forcause.

MCP:meansthemulticurrencyprocessing.ThisisourforeigncurrencyconversionservicetoyouallowingyoutoofferCardholderstomakepaymentincurrencythatmaybedifferentsettlementcurrencychosenbyyouorthecurrencyinwhichtheCardhasbeenissued.ElavonwillprovideyouwiththedynamicexchangeratethatwillbeusedforsettlementofsuchTransactiontoyou.

MCP Transaction:meansaSalesTransactionusingMCP.

Merchant Services:meanstheacceptanceofSalesTransactionReceiptsinaccordancewiththeAgreement.

Merchant Service Charges:meansourcharges(expressedasapercentagefeeorfeeperTransactionorboth)forprovidingMerchantServicestoyouassetoutintheScheduleofFeesandasamendedfromtimetotime.

MID:meanstheCustomer’suniquemerchantidentificationnumberwithElavon.

MPI:meansmerchantplug-in;softwaredevelopedbyacertifiedthirdpartyinaccordancewiththeCardSchemeRules(currentlyMPI-Version1.02)forhandlinge-paymenttransactionsina3DSecure™systeminaccordancewiththespecificationspublishedbyVisaandanyamendmentsand/orversionsfromtimetotime.

Non - EEA Country:meansacountrywhichisnotamemberoftheEuropeanEconomicArea.

Obligations: means all of Customer’s current and/or future and/or actual and/or contingent payment andperformanceobligationsundertheAgreement,includingpaymentforMerchantServiceChargesandliabilityforanyChargebacks,andallotherFeesandAdjustments.

Online Authentication Solution:meansanytechnicalsolution,basedonsoftware,hardwareorcombinationthereof,including3DSecure™thatisdevelopedorrequiredbyanIssueroraCardSchemeinordertoenableandconductAuthentication,includingSCA,withregardtoInternetTransactions.

Online Authentication Solution Plugin: means any software, hardware or combination thereof, includingMPI thatmustbe installedonCustomer’s side inorder to enable theCustomer toparticipate in anOnlineAuthenticationSolution.

Operating Guide:meanstheoperatingmanualprovidedbyElavontoCustomer,andanyamendmentsfromtimetotime.

PAN:meansthePrimaryAccountNumberofaCard.

Payment Currency:hasthemeaningsetoutinSchedule3.

Personalised Security Credentials:meanspersonalisedfeaturesprovidedbyanIssuertoaCardholderforthepurposesofAuthentication.

PCI Service:meansthatelementoftheMerchantServiceswhichcomprisestheprovisionbyElavonand/oritscontractorofanyservicesdesignedtoassisttheCustomerinbeingPCIDSScompliant(whichmayincludeaSolution).

PCI Service Fee:meansthatelementofthefeeswhichrelatestothePCIServiceelementoftheMerchantServices.

PCI DSS: means the Payment Card Industry Data Security Standards as published by the PCI SSC at www.pcisecuritystandards.org/andupdated from time to time (includinganysuccessorstandards to thosestandards).

PCI Level 3 or Level 4 Customer:hasthefollowingmeaning,whichshalldependontheCustomer’s(anticipated)numberofTransactions: (i) if theCustomer isPCILevel3, theCustomerprocessesbetween20,000and1millionInternetTransactionsperannum;or(ii)iftheCustomerisPCILevel4,theCustomerprocesseslessthan20,000InternetTransactionsorupto1millionMO/TOandCardPresentTransactionsperannum.

46 www.elavon.co.uk

PCI SSC:meansthePaymentCard IndustrySecurityStandardsCouncil,oranysuchreplacementbodyasnotifiedtoyoubyus.

PCI Waiver Plan:meanstheplanformingpartofthePCIServiceasmoreparticularlydescribedinparagraph2ofSchedule6

PED:meansaPINentrydevice.

Person: includesanaturalperson,corporateorunincorporatedbody (whetherornothavingseparate legalpersonality).

PIN:meansapersonalidentificationnumber.

PIN Pad:meansasecuredevicewithanalphanumerickeyboardwhichconformstotheLawsandtheCardSchemeRules,andthroughwhichaCardholdermayenteraPIN.

PIN Transaction:meansaTransactionthatisverifiedbytheCardholderusingaPIN.

Programme:meanstheproactivedatasecurityserviceyousubscribedto,asofferedbyElavon,includingtheprovisionofanyrelevantCyberSecurityTools.

Protected Parties:meansElavon, itsAffiliates,employees,officers,directors,contractorsandagents;eachbeingaProtectedParty.

PSD 2:meansDirective(EU)2015/2366oftheEuropeanParliamentandoftheCouncilof25November2015onpaymentservicesintheinternalmarket,amendingDirectives2002/65/EC,2009/110/ECand2013/36/EUandRegulation(EU)No1093/2010,andrepealingDirective2007/64/EC.

Purchase with Cashback:meanstheprovisionofcashbytheCustomertoaCardholderatthepointofsaleinaCardPresentenvironmentonly,andwheretheCardholderhasmadeapurchaseofgoodsand/orserviceswithaCard.

Recurring Sales Transaction:meansarepetitiveperiodicSalesTransactionagreedinwritingandinadvancebetweenyouandtheCardholderforwhichyoudebittheCardholder’sCard(suchassubscriptions,paymentofinsurancepremiumsbyinstalments).

Recurring Sales Transaction Authority:meansaCardholder’spriorwrittenauthority(inaformapprovedbyus) foryoutodebit theCardholder’sCardaccount in relation toaRecurringSalesTransaction.Thewrittenauthoritymustsetouttheamountandfrequencyoftherecurringchargeandthedurationoftimeduringwhichsuchchargesmaybemade.

Refund:meansapaymentmadebytheCustomertotheCardholderand/orIssuerforcredittotheCardholder’saccounttowhollyorpartiallyreverseaSalesTransaction.

Refund Receipt:meansthepaperorelectronicrecordevidencingaRefund.

Regulation 2019/518:meansRegulationofTheEuropeanParliamentandof theCouncilof19March2019amendingRegulation(EC)No924/2009asregardscertainchargesoncross-borderpaymentsintheUnionandcurrencyconversioncharges.

Relevant Resolution Authority:meanstheresolutionauthoritywiththeabilitytoexerciseanyBail-inPowersinrelationtoElavon.

Reporting Tool: means the online reporting system owned and operated by Elavon and provided to theCustomerinaccordancewithsection10.

Re-presentment:meansaSalesTransactiontoreverseaChargebackbythere-executionoftheoriginalSalesTransaction,whereyouhavesuccessfullychallengedtheChargeback.

Rooted Device:meansadevicewhereauserhasperformedaprocesstogain‘rootaccess’withinAndroid’ssubsystem.

47 www.elavon.co.uk

Retrieval Request:meansarequestinitiatedbyaCardholderorIssuerthatrequiresyoutoproducealegiblecopyofaCardholder’ssignedSalesTransactionReceipt(exceptinthecaseofproperlyeffectedPINTransactionsorcertainotherTransactionsthatareCardNotPresent)withinaspecifiedperiodoftime,and/orrequestforRepresentmentbyanIssuerrequiringyoutorepresenttheSalesTransactionReceiptforaSalesTransaction.

Sales Transaction:means a payment using either aCard,Card number orCard account, for goods and/or servicesprovidedby theCustomer and in relation towhichElavon has supplied theMerchantServicestotheCustomer(includingRecurringSalesTransactionsoraseriesofconnectedSalesTransactions).SalesTransactionReceipt:meansthepaperorelectronicrecordevidencingaSalesTransaction.

SCA:StrongCustomerAuthentication(withinthemeaningofPSD2)meansanAuthenticationbasedontheuseoftwoormoreelementscategorisedasknowledge(somethingonlytheCardholderknows),possession(somethingonlytheCardholderpossesses)andinherence(somethingtheCardholderis)thatareindependent,inthatthebreachofonedoesnotcompromisethereliabilityoftheothers,andisdesignedinsuchawayastoprotecttheconfidentialityoftheAuthenticationdata.

SCA RTS: means Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementingDirective (EU)2015/2366of theEuropeanParliamentandof theCouncilwith regard to regulatory technicalstandardsforstrongcustomerauthenticationandcommonandsecureopenstandardsofcommunicationand,whererelevant,theequivalentregulatorytechnicalstandardspublishedbytheCompetentAuthority.

Schedule of Fees:meansthesectionsoentitledintheApplication(asamendedfromtimetotime)listingourstandardchargesthatarepayableinadditiontotheMerchantServiceCharges.

Secured Pro Fees: meansthefeesfortheCyberSecurityToolsasidentifiedintheScheduleofFees.

Security Document(s):meansany formoffixedorfloatingmortgage,charge,debenture, indemnityoranyGuaranteeoranyotherformofsecurity.

Service and Software:meansanyhardware,software,Terminals,orotherdevicesorIPRsprovidedbyoronbehalfofElavontoyouinconnectionwiththeacquiringofInternetTransactions.

Settlement Funds:meansthesumequaltothevalueofallTransactionsacquiredbyElavonlessMerchantServicesCharges;Refunds;Chargebacks;andallotherchargessetoutintheScheduleofFeesaswellasanyFeesandAdjustments.

Solution:hasthemeaninggiventoitinparagraph1ofSchedule6.

Term:means theperiod fromtheCommencementDateuntil theexpiryor terminationof thisAgreement inaccordancewithitsterms.

Terminal:meansapointofsaleterminalandallotherpointofsaledevices,hardware,associatedequipment,softwareandotherelectroniccomputerandtelecommunicationsdevicesandequipment(includinganyPED)usedbytheCustomertoprocessanyTransactionthatisCardPresentandthatconformswiththerequirementsestablished from time to time by the applicable Card Scheme and by Elavon, and includes Chip and PINTerminals,ThirdPartyTerminals,CardReadersandWirelessTerminals.

Third Party Terminal:meansaTerminalsold,hired,leased,orotherwiseprovidedtooronbehalfofCustomerbyanyPersonotherthanElavonoritsauthoriseddesignee.

Third Party Vendor:meansanyPersonprovidingor facilitatingValueAddedServices toyou that isnotanAffiliateofElavonandwhich,complieswiththePCIDSS.

TOS:meansthesetermsofservicewhichrelatetotheprovisionofMerchantServicesandthesaleofanyCardReaderorotherGoodsdetailedintheApplicationbyElavontotheCustomerandanyamendmentstothesamefromtimetotime.

Transaction:meansaSalesTransactionand/oraRefund(asthecontextrequires).

48 www.elavon.co.uk

Transaction Receipt:meansaSalesTransactionReceiptand/oraRefundReceipt(asthecontextrequires).

Value Added Services:meansanyproductorserviceprovidedbyaThirdPartyVendortoassistCustomerinacceptingTransactionsunder theAgreementand inconnectionwith theMerchantServicesprovidedbyElavon,including,internetpaymentgateways,Terminals,inventorymanagementandaccountingtools,loyaltyprograms, financial crime (fraud) prevention programs, and any other product or service that participates,directlyorindirectly,intheflowofTransactiondata.

Virtual Card:meansadigitalCommercialCard,includingaB2Bvirtualcard.

Visa:meansVisaInc.

VMAS™:meansVisaMerchantAlertService,apan-Europeanenquiryserviceprovidingmerchantacquirerswithacentraldatabaseofmerchantswhosecontractshavebeenterminatedbyotherbanksorwheremerchantisonnoticeoftermination,becauseoffraudulentorquestionableactivity.

Warranty Period:hasthemeaninggiveninSchedule1,paragraph9(a).

WEEE Regulations:meanstheWasteElectricalandElectronicEquipmentRegulations2006(asamended).

Wireless Terminal:meansaTerminalthatallowswirelessprocessingandincludesgeneralpacketradioserviceterminal(“GPRSTerminals”).

Your Bank Account:meansanaccount,inthenameofCustomeronly,withaninstitutionintheUnitedKingdomacceptabletoElavon,maintainedbytheCustomerforthepurposesoffacilitating(i)paymentfromElavonand(ii)formakingpaymentstoElavoninrespectofMerchantServiceCharges,Chargebacks,allotherFeesandAdjustments,andanyotherpaymentsduetoElavonfromtimetotime.

49 www.elavon.co.uk

SCHEDULE 1. THIRD PARTY TERMINALS, CARD READERS AND OTHER GOODS

PART A: USE OF THIRD PARTY TERMINALS AND CARD READERS

1. USE OF TERMINALS

(a) You shall provide, maintain and pay for all power and telecommunications connections necessary tooperatetheTerminalsincluding,paymentforallrelatedchargesincurredbyyouingainingaccesstoandusingtheMerchantServices.Youshallnotuse,orpermittobeused,theSIMcardfromanyGPRSTerminalforanypurposeotherthanthetransmissionandreceiptofdatainconnectionwiththeMerchantServices.Ifyoudosoinbreachofthisparagraph,thenyoushallbeliableforalladditionalvoicecalland/ordatatransmissionchargesincurredplusanadministrativechargetocoverallcostsincurredbyusinrecoveringthoseadditionalchargesfromyou.

(b) Youshallfromtimetotime,providetoElavonuponrequestthefollowinginformationinrelationtoeachThirdPartyTerminal,CardReaderorotherPED:

(i) stockandserialnumbersofeachThirdPartyTerminal(andinaddition,youshallkeeparecordofsuchinformationyourself);

(ii) locationofPEDs(andinaddition,youshallkeeparecordofsuchinformationyourself);

(iii) thelocationofeachCardReader;andinaddition,youshallkeeparecordofsuchinformation;and

(iv) detailsofThirdPartyTerminalmanagement systems (basic formof electronic identificationandofPEDs).

(c) IfyouuseValueAddedServicesforthepurposesofdatacaptureand/orauthorisationorotherwisewithrespecttoThirdPartyTerminals,youagree:(aa)thattheThirdPartyVendorprovidingsuchValueAddedServiceswill be your agent in the delivery of Transactions to Elavon via a data processing system ornetworksimilartoElavon’s;and(bb)toassumefullresponsibilityandliabilityforanyfailureofthatThirdPartyVendortocomplywiththeLaws,theCardSchemeRulesandtheAgreement.ElavonshallnotberesponsibleforanylossesorexpensesincurredbyyouasaresultofanyerrorbyaThirdPartyVendororbyamalfunctioninaThirdPartyTerminal.

2. USE AND AVAILABILITY OF PIN PADS

(a) ACardholder’sCardinformationandPINareconfidential.YoumaynotrequestorrequireaCardholdertodisclosehis/herPINatanypointduringpayment.DuringtheTransactionprocess,youmustprovideareasonablysecureareaforCardholderstoentertheirPINintothePINPad.YoushallcauseaTerminalandPINPaddevicetobereadilyavailableatyourlocationsforusebyallCardholderswheneverC&PCardsareaccepted.YoushalltakeallreasonablestepstoensurethatallTerminalsandPINPadsfunctionwithaminimumoferror,inareliablemannerandinaccordancewiththestandardsestablishedfromtimetotimebyElavonandtheCardSchemes.

(b) ExceptwhereotherwiseallowedbytheCardSchemeRulesortheLaws,youshalluseaTerminaltoinitiateeveryC&PCardTransactionandyoushallrequirethateithertheCardholderoryouinsertand/orswipetheC&PCardthroughtheTerminal.NoC&PCardTransactionmaybeinitiatedunlesstheC&PCardisphysicallypresent.

50 www.elavon.co.uk

(c) YoushallrequirethateachCardholderenterhis/herPINusingaPINPadattheTerminal.Unlessotherwiseallowedby theCardSchemeRulesor theLaws,youcannot requestaC&PCardCardholder tosignaTransactionReceiptorotherreceipt,orrequireanyothermeansofidentification.

(d) SubjecttotheLawsandtheCardSchemeRules,intheeventofChipFailureduringaC&PCardTransaction,the Transaction may be completed as a magnetic-stripe-read Transaction but must be submitted forAuthorisation,inaccordancewiththeproceduresdetailedintheOperatingGuide.

(e) IfyouacceptC&PCards,nodatareferencingtheCardholder’sPINshallbeprintedonanyTransactionReceipt.

3. REFUNDS

IfpermittedbytheapplicableCardScheme,youmayelectronicallyprocessaRefundforaC&PCardTransactiononlyatthesameCustomernamedontheTransactionReceiptwheretheoriginalC&PCardSalesTransactionwasinitiated.

ARefundrequiresthefollowingprocedures:

(a) theCardmustbeinsertedand/orswipedthroughtheTerminal;

(b) theCardholdermustre-enterthePINonthePINPad;

(c) Customermust transmit theAuthorisationCodeand theexactamount (in the relevantcurrency)of theTransaction(orpart)tobecreditedorrefunded.

4. MANUAL PROCESSING (OR BACK-UP PROCEDURES)

IfforanyreasonyourTerminalceasestofunctioncorrectlyoratall(e.g.itisunabletoreadthemagneticstripeonaCard),youwill,withrespecttoCards,followthemanualorotherback-upprocessingproceduresintheOperatingGuideorotherTerminaluserguide,andshallotherwisefollowanyproceduresspecifiedbyElavon.AnymanualTransactionReceiptsmustcomplywiththedatarequirementsfromtimetotimeoftherelevantCardScheme.

5. WIRELESS TERMINALS

(a) Limitations of Wireless Technology.IfyouuseaCardReaderorotherWirelessTerminal,youacknowledgeand agree that due to the nature of wireless technology, certain limitations exist that may affect theperformance,CoverageAreaandreliabilityofwirelesstechnologyandwirelessprocessinginrelationtoaCardReaderorotherWirelessTerminal.IntheeventthatyourabilitytoprocesswirelessTransactionsislimitedorpreventedforanyreason,youagreenottousetheWirelessTerminalandinstead,toprocesstheTransactionusingalternativemeansassetoutintheAgreement.

(b) Completing Unauthorised Transactions. If you choose to complete aCardReader or otherWirelessTerminalTransactionwithoutanAuthorisationCodeasrequiredbysection7(a)orwithoutapplyingSCAasrequiredbysection7(h),becausewirelesscoverageisnotavailableorotherwise(e.g.youstoreTransactiondatainaCardReaderorotherWirelessTerminal,providetheCardholderwithgoodsand/orservicesandsubsequentlyrequestAuthorisationoftheTransaction),youdosoentirelyatyourownrisk.

51 www.elavon.co.uk

6. SECURITY

(a) YouareresponsiblefortakingallreasonablesecuritymeasurestokeeptheCardReadersafe,includingmeasurestopreventunauthoriseduseofit.IfyouknoworsuspectthattheCardReaderhasbeenlost,stolenormisused,youmustnotifyElavonimmediately.

(b) YouareresponsibleforensuringthattheCardReaderisnotaccessedorusedtocommitanyfraudortheftbyyou,theCardholderoranythirdpartywhiletheCardReaderisinyourpossession.Youwillbeliableforanylossesthatresultfromsuchcriminalacts,iftheyoccurasaresultofeither:

(i) Youroryouremployees’negligence;or

(ii) Yournon-compliancewiththeTOS,OperatingGuide,anyCardReadermanualorgoodcommercialpracticetopreventfraudand/ortheft.

(c) ElavonmayblockuseoftheCardReaderif:

(i) ElavonhasreasonablegroundsforconcernaboutthesecurityoftheCardReader;

(ii) Elavonhas reasonablegrounds to suspect that it hasormaybeused for a fraudulent or criminalpurposeorinanunauthorisedmanner;

(iii) ElavonsuspectsorhasreasonablegroundstobelievethattheCardReaderisbeingusedoutsidetheUnitedKingdom;or

(iv) Elavonareobligedtodosotocomplywithlegalorregulatoryobligationshowsoeverarising.Elavonshallnotifyyouofanysuchaction,andthereasonsandtheproceduresforrectifyinganyfactualerrorsthathaveledtotheactionunlessElavonisprohibitedfromdoingsoundertheLaws.Elavonmaychargeyouthereasonablecostsofanysuchnotification.

PART B: TERMS APPLICABLE TO GOODS (INCLUDING CARD READERS)

7. DELIVERY AND/OR INSTALLATION OF GOODS

(a) WhereGoodsaretobeinstalled(asindicatedintheApplication),weshallagreeatimetablefortheinstallationoftheGoodswithyou.ElavonshallusereasonableendeavourstoinstalltheGoodsinaccordancewiththetimetablehowever,youagreethattimeofinstallationisnotoftheessenceandmaynotbemadesobytheserviceofanynotice.

(b) SaveforwhereinstallationisselectedintheApplicationweshalldelivertheGoodstoyouattheaddressyouspecifiedasyourTrading(DBA)AddressintheApplication.AnydatessuggestedfordeliveryoftheGoods(s)areestimatesonlyandtimeofdelivery isnotoftheessenceandmaynotbemadesobytheserviceofanynotice.

(c) Subjecttosection7(d),ElavonshallnotbeliableforanylossincurredbyyouifthedeliveryorinstallationoftheGoodsisdelayedforanyreasonfromtheanticipateddeliveryorinstallationdate.

(d) IfElavonfailstodeliverorinstalltheGoodswithin30daysofusnotifyingyouinwritingthatyourApplicationhasbeenacceptedand(i)younotifyElavonassoonaspossibleaftertheanticipateddeliveryorinstallationdate that delivery has not occurred; and (ii) we have had the opportunity tomake another delivery orinstallation;and(iii)deliveryorinstallationhasnotfailedduetoanyactionoromissionbyyou,includingyourfailuretosignfortheGoods(ifapplicable)oryourrefusaltoacceptdeliveryorinstallation;thenElavon’sobligationshallbelimitedtothevalueofarefundofthepurchasepriceoftheGoods.

52 www.elavon.co.uk

(e) Ifyoufailtoacceptinstallationof,ortakedeliveryoftheGoods,thenexceptwheresuchfailureordelayiscausedbyForceMajeureorbyElavon’sfailuretocomplywithourobligationsundertheAgreementinrespectoftheGoods:

(i) installationordeliveryoftheGoods(s)shallbedeemedtohavebeencompletedat9:00amGMTonthethirdBusinessDayfollowingthedayonwhichElavonattemptedtomakethefirstinstallation,ordeliveryoftheGoods(notwithstandinganyfurtherattemptsElavonmakestoinstall/delivertheGoodsafterthefirstattempt);and

(ii) Elavonshallstore theGoodsuntil installationordelivery takesplaceandchargeyou forall relatedcostsandexpenses(includinginsurance).

(f) If tenBusinessDaysafterElavonattempted tomake thefirstdeliveryor installationof theGoodsyouhavenotacceptedinstallationortakendeliveryoftheGoods,ornotifiedusthatdelivery/installationhasnot takenplace (notwithstandingany furtherattemptsElavonmakes todeliver,or install, theGoodsatourdiscretion),ElavonmayresellorotherwisedisposeoftheGoods.ElavonshallbeentitledtotreattheAgreement as havingbeen terminatedby you tenBusinessDays afterweattempted tomake the firstinstallationordeliveryoftheGoodsandElavonreservestherighttochargeareasonableadministrativefeetoyouinrespectofyourtermination.

(g) ElavonshallnotbeliableforanydelayorfailureindeliveryorinstallationintheeventofForceMajeure,oryourfailuretoprovideuswithadequatedeliveryinstructionsfortheGoodsoranyrelevantinstructionrelatingtothesupplyoftheGoods.

(h) Theriskofloss,theftordamagetotheGoodsshallpasstoyouoncompletionofdeliveryorinstallation,asapplicable.

(i) NotwithstandingdeliveryorinstallationoftheGoods,titletotheGoodsshallnotpasstotheCustomeruntilpaymentinfulloftheFeesdueinrespectoftheGoods,inaccordancewiththisAgreement.

8. DISPOSAL OF GOODS

Youshall undertakeall responsibilities andobligationsunder theWEEERegulations in connectionwith theenvironmentallysound,treatment,recyclingorrecoveryandsafedisposaloftheCardReaderandforanyotherelectricalorelectronicequipment(“EEE”),includinganybatteries.FurtherinformationregardingEEEwasteisavailableatwww.dontbinitbringit.org.

PART C: TERMS APPLICABLE TO CARD READERS

9. QUALITY OF CARD READERS

(a) Elavonwarrants thatondelivery, and for aperiodof twelve (12)months from thedateofdelivery (the“WarrantyPeriod”)theCardReadersshall:

(i) conforminallmaterialrespectswithitsdescription;

(ii) befreefrommaterialdefectsindesign,materialandworkmanship;

(iii) beofsatisfactoryquality(withinthemeaningoftheSaleofGoodsAct1979,asamended);and

(iv) befitforanypurposeheldoutbyElavon.

53 www.elavon.co.uk

(b) Exceptasexplicitlyprovided in thissection9, in relation to thesupplyofCardReaders,allwarranties,conditionsandothertermsimpliedbystatuteorcommonlaware,tothefullestextentpermittedbylaw,excludedfromtheAgreement.Fortheavoidanceofdoubt,thewarrantysetoutinsection9(a)excludes,inparticular,costsarisingfromnotbeingabletousetheCardReaderorfromdamageorlosscausedwhentheCardReaderbreaksdown (subjectalways tosection22(d));and thecostof replacingany itemsoraccessoriesthatareintendedtobereplaceable,suchasbatteries,cables,powersuppliersandplugs.

(c) Subjecttothissection9,ifduringtheWarrantyPeriodtheCardReaderdoesnotcomplywiththewarrantysetout insection9(a)andyounotifyElavonand (ifasked todoso) returnsuchCardReader (withinareasonable timeofdiscoveryof thedefect) to theaddressnotified toyoubyElavonatyourcost, thenElavonshall,atitsoption,havingexaminedtheCardReader,repairorreplacethedefectiveCardReader,orrefundthepurchasepriceofthedefectiveCardReaderinfull.

(d) ElavonshallnotbeliablefortheCardReader’sfailuretocomplywiththewarrantyinsection9(a)aboveif:

(i) thedefectarisesbecauseyouhave failed to followany instructions, including thosesetout in theTOS,(OperatingGuide,anyCardReadermanualorgoodtradepractice)astothestorage,installation,commissioning,useormaintenanceoftheCardReader;

(ii) youarenotusingtheCardReaderwithaCompatibleDevice;

(iii) youalterorrepairsuchCardReaderwithoutElavon’spriorwrittenconsent;

(iv) youfailtoreturntheCardReadertoElavonformaintenanceor,uponreasonablewrittennoticefromElavon, fail toapplysoftwaredownloads,updatesand/orupgradestotheCardReaderatElavon’sdirection;

(v) thedefectarisesasaresultoffairwearandtear,includingcosmeticdamage,oryourwillfuldamage,negligenceorabnormalworkingconditionsoruseinconjunctionwithitemsnotapprovedbyElavon.

(e) ElavonshallhavenoliabilitytoyouintheeventthattheCardReaderisrequiredtobereplacedormodifiedinanywayasadirectresultofanychangeintheCardSchemeRules,includingPCIDSS,andyouagreetoreturntheCardReadertoElavonatourwrittenrequest.YouacknowledgeandacceptthatElavonwillberequiredtodiscontinueuseofanyCardReaderwhichisnolongercompliantwithCardSchemeRules,includingPCIDSS,andthatyouareresponsibleforpurchasinganyreplacementCardReader(s)toensurecontinuedcompliancewiththeserequirements.

(f) TheseTOSshallapplytoanyrepairedorreplacementCardReadersuppliedbyElavonundersubsection9(a) althoughanywarranty in respectof a repairedor replacementCardReaderwill applyonly for theremainderoftheWarrantyPeriodwhichisunexpiredinrespectofthefirstCardReader.

54 www.elavon.co.uk

SCHEDULE 2. INTERNET TRANSACTIONS

1. ENCRYPTION

YoumayprocessInternetTransactionsonlyiftheyhavebeenencryptedbyaThirdPartyVendoracceptabletoElavon.Encryption isnotaguaranteeofpaymentandshallnotwaiveanyprovisionof theAgreementorotherwisevalidateafraudulentTransaction.

2. INTERNET SECURITY

Youmust (via a Third Party Vendor) utilise, or implement yourself, an internet payments service approvedbyElavon inadvancewhichadherestominimumsecuritymeasuresandtechnologyrequirements identifiedbyElavon fromtime to time including,compliancewith thePCIDSS.For InternetTransactions,youwillberesponsible for (i)maintaining the integrityofdata received,held,maintained,orsentacross the internetorothercommunicationchannel; (ii)managing the telecommunications link;and (iii)paymentofallpowerandtelecommunicationcosts.Youwill ensure thatall Transactionsare transmitted (whereapplicable)using theprotocolapprovedbyElavon fromtime to time toprocure thesecure transmissionofdataprovidedby theCardholderinorderinggoodsand/orservicesandeffectingpaymentovertheinternet.Youwillprovidecapabilityforsecuresocketslayerencryptiontotheminimumstandardfromtimetotime(currently128bit),andmayalsoberequiredbyElavontosupportencryptionrequirementsinrespectofthetransmissionofinformationovertheinternetviaavirtualprivatenetwork(“VPN”)supporting3DES(1028bit)encryption.

3. ONLINE AUTHENTICATION SOLUTIONS

Youagreetoimplementandpromptlyupdatetothenewestavailableversions,asdesignatedbyIssuersorCardSchemes(asapplicable)fromtimetotime,theOnlineAuthenticationSolutions,includingbyparticipatinginthe3DSecure™system,andtoacquiretherighttouseoraccessOnlineAuthenticationSolutionPlugins,includingtheMPIsoftware,by:

(a) agreementwithasellerofOnlineAuthenticationSolutionPlugins,includingMPIsoftware,thatisapprovedbytheCardSchemesorIssuers(asappropriate);or

(b) having Elavon host the Online Authentication Solution Plugins, including MPI software, or such othermerchantplug-insoftwareorhardwareproductdesignatedbyElavonfromtimetotime,onyourbehalf,andontermsnotifiedtoyoubyElavon;or

(c) procuringforyourownuseacustomerplug-insoftwareorhardwareproductofequivalentfunctionalitytotheOnlineAuthenticationSolutionPlugin,includingMPIsoftware,subjecttothepriorwrittenconsentofElavon.

4. UNAUTHORISED ACCESS

WhilstElavonwilltakereasonableprecautionsinrelationtouseandaccesstotheServiceandSoftware,youherebyacceptallriskofinformationorinstructionsbeinggivenbyanunauthorisedpersonandthepossibilityofhacking,cracking,virusesandanyandallmannerofunauthorisedaccess,use,activityorpurposewhichmayoccuronorinrelationtotheServiceandSoftware.

55 www.elavon.co.uk

5. WEBSITE

Yourwebsitemust:

(a) containallofthefollowinginformation:

(i) acompletedescriptionofthegoodsand/orservicesoffered;

(ii) returnedgoodsandrefundpolicy;

(iii) customerservicecontacts,includingelectronicmailaddressand/ortelephonenumber;

(iv) theCustomernameand/orany tradingname (prominentlydisplayed)and thecompleteaddressofthe permanent establishment of your business on either the checkout screen (which displays thetotalpurchaseamount)orwithinthesequenceofwebpagespresentedtotheCardholderduringthecheckoutprocess;

(v) Transactioncurrency;

(vi) exportorlegalrestrictions,ifknown;

(vii) deliverypolicy;

(viii)customerdataprivacypolicy;

(ix) yourmethodofTransactionsecurityandpolicyfortransmissionofCarddetails;and

(x) displayofCardSchemes’marks;

(b) prominentlyidentifytheCustomernameasbeingboththeCustomerandasbeingthenamethatwillappearontheCardholderstatement;and

(c) displaytheCustomernameinformationreferredtointhisparagraph5asprominentlyasanyotherinformationdepictedonyourwebsite,otherthanimagesoftheproductsorservicesbeingofferedforsale.

6. OPTION TO CANCEL PAYMENT

YourwebsitewillclearlyinformtheCardholderthathe/sheiscommittingtopaymentbeforehe/sheselectsthe“paynow”orequivalentbutton/screenandwillprovidetheCardholderanunambiguousoptiontocancelthepaymentinstructionatthispoint.

7. CARDHOLDER COMPLAINTS

ElavonmayinvestigateanycomplaintreceivedfromaCardholderaboutthecontentofyourwebsiteandshallbeentitledtorequireyoutoamendand/orclarifythetermsandconditionsofsalewithinaperiodofthirty(30)daysfromthereceiptofsuchcomplaint.

8. RECURRING TRANSACTION PAYMENTS

IfyouofferrecurringTransactionpaymentsonyourwebsiteyoumust:(aa)offeranonlinecancellationfacilitytoCardholders;and(bb)notifyCardholdersattheoutsetthatsubsequentchargeswillbedebitedfromtheirCardaccounts.

56 www.elavon.co.uk

SCHEDULE 3. DCC TRANSACTIONS

1. ThedefaultcurrencyofaTransactionmustbethelocalcurrencyoftheCardholder.TheCustomermustgive to Cardholders, in clear terms, disclosing all charges, the choice of whether to proceedwith theDCCTransaction in theCustomer’s local currencyor the currency inwhich theCard hasbeen issued(the“Payment Currency”),subjectalwaystothechosencurrencybeingacurrencyapprovedbyElavon(ascommunicatedbyElavontotheCustomerfromtimetotime)(the“Currency Payment Choice”).TheCustomermust inform theCardholder that selecting a DCC Transaction is optional andmust not useinaccurateormisleadingstatementsthatcouldleadtheCardholdertoselectaDCCTransaction.

2. TheCustomermustdiscloseandmakeavailabletotheCardholderthefollowinginformationpriortotheCardholderchoosingtoproceedwithaDCCTransaction:

(a) theTransactionamountinthelocalcurrencyoftheCustomer;

(b) theTransactionamountintheCardholder’sbillingcurrency;

(c) theexchangeratetobeusedandthesourceoftheexchangerate;and

(d) detailsofallcharges,mark-uporcommissiontobeapplied.Thetotalcurrencyconversionchargesshallbepresentedaccordingtotheapplicablelaw–especiallytotheRegulation2019/518(withinthescopeofitsapplicabilitytoaparticularTransaction).

3. ForeveryDCCTransactionusingaTerminal,Customershallensurethatit issuesadocumentinformingtheCardholderoftheCurrencyPaymentChoiceand(exceptwhereChip&PINproceduresareused)shallobtaintheCardholder’ssignatureonthisdocument.

4. For all DCC Transactions which are not Terminal DCC Transactions, the Customer shall obtain theCardholder’spriorconsenttosuchDCCTransactionswhichmustbeinaformthatclearlyevidencesthattheCardholder’sexpressandfinalconsenthasbeengiven inrelationtotheCurrencyPaymentChoice.ForInternetTransactions,thiscanbeintheformofanemailfromtheCardholderoran“Iagree”optiononCustomer’swebsitewhichcanberecordedandprovidedintheeventofadisputeorChargeback.ForMO/TOTransactions,therequirementsofsection7(g)(ii)onCardholderauthorityapplyinrespectofDCCTransactionswhicharenoteffectedwithaTerminal.

5. CustomermaynotconvertanyDCCTransactionfromthecurrencyselectedbyCardholder,intoanamountinanyothercurrencyaftertheTransactionhasbeencompletedbytheCardholder.

6. Asfurtherdetailedinparagraph2,iftheCardholderelectstoproceedwiththeTransactioninthePaymentCurrency,youmustdisclosetotheCardholderallyourchargesaswellastheexchangeratetobeusedforconvertingtheTransactionfromtheCardholder’slocalcurrencyintothePaymentCurrencypriortotheTransactionbeingcompleted.

7. IftheCardholderelectstoproceedwithaDCCTransaction,theTransactionReceiptorinvoicegeneratedmustcontain:

(a) theTransactionamountinthelocalcurrencyoftheCustomer;

(b) theTransactionamountintheCardholders’billingcurrency;

(c) theexchangerateused;

(d) details of all charges,mark-up or commission applied andwith respect to this the total currencyconversion charges The total currency conversion charges shall be presented according to theapplicablelaw–especiallytotheRegulation2019/518(withinthescopeofitsapplicabilitytoaparticularTransaction).

57 www.elavon.co.uk

(e) astatementthattheCardholderwasgivenachoiceandchosetheirbillingcurrency.ThestatementmustbeinEnglish,unlessavailableintheCardholder’slocallanguage.

8. Refunds(orcredits)relatingtoDCCTransactionsmustbeprocessedintheselectedcurrencyoftheoriginalDCCTransaction.

58 www.elavon.co.uk

SCHEDULE 4. ELECTRONIC GIFT CARDS

1. SERVICE

ElavonwillprovideelectronicprocessingservicesofEGCTransactions(exceptwherethesearelostorstolen)andfacilitate:

(a) electronicconfirmationthattheCardholderactivatingtheEGCTransactionthroughtheCustomerhasanactiveaccountontherelevantprocessingsystemwhichiscreditedwithsufficientfundstomeetthecostoftheTransaction;and

(b) debitingoftheCardholder’saccountwiththevalueofthepurchaseandthecreditingoftheCardholder’saccountifvalueisaddedtotheEGC;

(c)maintenanceofanaccessibleelectronic recordofanEGCTransaction for the lifetimeofanEGCwithabalanceandforaperiodofsixty(60)daysafterthebalanceoftheEGCCardhasfullydepleted.

2. CUSTOMER RESPONSIBILITIES

Youshall:

(a) maintainallTransactionReceiptsandanyotherreceiptsasrequiredbytheLaws,theEGCRulesandtheseTOS;

(b) maintain sufficient back-up information and data whether in paper or electronic form with respect toEGCspreviouslysold,toreconstructanylossofinformationordataduetoanymalfunctionofCustomer’ssystems;

(c) in a timely manner when required by Elavon and/or Elavon’s approved provider(s), execute all suchagreements and do all such acts or things to enable Elavon to provide EGC processing services toCustomer,including,enteringintoadditionalagreementsforthesupplyofEGCs,forstationeryandotherrelatedmaterialsandforpromptlysettlingaccountsforsuchsupply;and

(d) onlyusematerials(includingstationaryandmarketingmaterials)toenabletheacceptanceandprocessingofEGCssuppliedbyElavonorElavon’sdesignatedprovider.

3. SYSTEM DOWNTIME

CustomershallnotprocessEGCTransactionsiftheEGCprocessingsystemisdownandisunabletoverifythevalidityofanEGCandanyavailablebalance.

59 www.elavon.co.uk

SCHEDULE 5. PURCHASE WITH CASHBACK

WhenprovidingPurchasewithCashback,youshall:

(a) onlyprovidesuchfacilityinrelationtoDebitCardSalesTransactionswheretheCardholderreceivesgoodsand/orservicesinadditiontocashandonlyonTerminalsapprovedforsuchusebyElavon;

(b) transmit in thePurchasewithCashbackSales Transactionmessage, the amount of cash given to theCardholder(ifpermittedbyElavon’ssystemsand/ortherelevantCardScheme);

(c) wherearequestforAuthorisationofaPurchasewithCashbackisrefusedsolelybecausethecashrequestedexceeds theDebitCard Issuer’s limit forcashwithdrawals, informtheCardholderof the reason for therefusalandthatanewSalesTransactionintheamountofthepurchasealonemightbeapproved;

(d) not,wheretheamountofcashavailabletoaCardholderinaPurchasewithCashbackSalesTransactionislimitedbytherelevantCardSchemeorIssuer,carryoutaPurchasewithCashbackSalesTransactioninexcessofsuchlimit,asnotifiedtoyoufromtimetotime;

(e) not offer Purchase with Cashback in respect of Sales Transactions carried out under paragraph 4ofSchedule1.

60 www.elavon.co.uk

SCHEDULE 6. SOLUTIONS AND PCI WAIVER PLAN

1. DEFINITIONS AND INTERPRETATION

In thisSchedule6 the followingdefinitionsshallhavethemeaningsetoutbelow.AnycapitalizedtermsnotdefinedbelowshallhavethemeaninggiventothemintheGlossary.

(a) “Device”hasthefollowingmeaning,whichshalldependontheSolutionyouhavesubscribedto:

(i) forthepurposesoftheSecuredPro,the“Device”meansanycomputer,laptop,mobiledevice,tabletor other computing system running on an operating systemwhich is listed on theWebsite in theproductinformationsectionrelatingtothatSolution;and

(ii) forthepurposesofSecuredEncrypt,the“Device”meanseachTerminal(excludingalwaysThirdPartyTerminals)whichisSecuredEncryptenabledandprovidedunderyourAgreement.

Ineachcase,referencesto“Devices”shallbeconstruedaccordingly.

(b) “Initial Subscription Period”means in relation to eitherSecuredPro orSecuredEncrypt, a period oftwelve(12)monthsbeginningonthedateweacceptandconfirmyourpricingforthatparticularSolutioninyourScheduleofFees.

(c) “PCI Non-Compliance Fee”hasthemeaninggiventoitinparagraph7(c)ofthisSchedule6.

(d) “Renewal Period”hasthemeaninggiventoitinparagraph5(a)ofthisSchedule6.

(e) “Secured PCI”means theproduct available toPCI Level 3 or Level 4Customers,which includes thefollowingservices:

• accesstoanonlinecertificationportalwithElavon’sapprovedthirdpartyproviderofPCIDSS;

• specialistassistanceinself-validationandmaintenanceofself-reportedcompliance;

• accesstodownloadableAttestationofCompliance(forthepurposesofPCIDSS)andcertificationofcompliancedocumentation;and

• theabilitytorunrequiredquarterlyscansperformedbyASVatnoadditionalcostthroughElavon’sapproved thirdpartyproviderofPCIDSS for customerswho require such scans to completePCIcompliancevalidation

(f) “Secured Pro”meanstheproductavailabletoPCILevel3orLevel4CustomersprovidedbyusorourthirdpartyrepresentativesthroughorviatheWebsite,overthetelephone,byemail,livechatorotherwiseinconnectionwiththeWebsite,asmoreparticularlydescribedinAnnexBofthisSchedule6belowandcomprisingofthefollowingServicesand/orSoftware:

• accesstoanonlinecertificationportalwithElavon’sapprovedthirdpartyproviderofPCIDSS;

• outboundphonecallfromaPCIspecialist;

• managementofPCIcompliancevalidationoverthephone;

• accesstodownloadableAttestationofCompliance(forthepurposesofPCIDSS)andcertificationofcompliancedocumentation;

• ability to run required quarterly scans performed by an ASV scans at no additional cost throughElavon’sapprovedthirdpartyproviderofPCIDSSforcustomerswhorequiresuchscanstocompletePCIcompliancevalidation;

• remoteinstallationofrelevantsecuritytoolsaslistedinAnnexBofSchedule6;

61 www.elavon.co.uk

• outboundcallwhenremediationisneededasindicatedasaresultofascanperformedbyanASV;and

• access tosecurity toolsas listed inAnnexBofSchedule6below:networkperimeterscan,devicesecurityscan,cardholderdatadiscoveryscan,antiviruslicense,POSapplicationdiscoveryscan.

(g) “Secured Encrypt”meanstheproductavailabletoPCILevel3or4CustomersandprovidedbyusorourthirdpartyrepresentativesthroughorviatheWebsite,overthetelephone,byemail,livechatorotherwiseinconnectionwiththeWebsite,andcomprisingofthefollowingServicesandSoftware:

• accesstoanonlinecertificationportalwithElavon’sapprovedthirdpartyproviderofPCIDSS;

• utboundphonecallfromaPCIspecialist;

• managementofPCIcompliancevalidationoverthephone;and

• accesstodownloadableAttestationofCompliance(forthepurposesofPCIDSS)andcertificationofcompliancedocumentation.

h) “Service”meanstheservicesdeliveredunderaparticularSolution.

(i) “Software”meanssoftwareintendedtobeinstalledonaDeviceandshallincludeanyUpdates.

(j) “Solution” means one of the following: (i) Secured PCI; (ii) Secured Pro; or (iii) Secured Encrypt (asapplicable).

(k) “Subscription Period”meanswithrespecttotherelevantSolutionsubscribedto,theInitialSubscriptionPeriodtogetherwithallRenewalPeriods.

(l) “Update”meanscontentorcodewedeploytoupdatetheSolution(inwholeorpart)includingrevisions,additions,replacements,newreleasesorversionsofSoftwareandanyavailableupdateprovidedbyusfromtimetotimeinconnectionwiththeSolution.

(m) “Website”meanshttps://elavonsecuritymanager.com.

2. PCI WAIVER PLAN

(A) INDEMNITY WAIVER

SubjecttothetermsofthisSchedule6,aPCILevel3orLevel4CustomerwhosubscribestoanySolutionmaybenefitfromcertainwaiversfromElavonofElavon’srightsunderthisAgreementregardingindemnificationbytheCustomerasfollows(eachofthefollowingparagraphs(2)(a)(i)–(iv)(inclusive)an“IndemnificationItem”):

(i) certainfinesimposedonElavonbytheCardSchemesarisingdirectlyfromaDataBreach;

(ii) anyAuditCostsincurredbyElavonininvestigatinganyDataBreach(orwheretheCustomerisobligedbythisAgreementand/ortheCardSchemeRulestoarrangeacertifiedthirdpartytocarryoutsuchAudit;

(iii) followingaDataBreachElavonshallwaiveanyrightsithasagainsttheCustomerunderthisAgreementtorecoverthoseinvestigationcosts(iftheyfallduetobepaidbyElavon)providedalwaysthatthethirdpartyisapprovedbytheinvolvedCardSchemeforthepurposeofconductingsuchanAudit;and

(iv) anyfeesElavonisobligedtopaytoIssuerstoreplaceanyCardsissuedbyVisaorMasterCard®,whichsuchIssuersmustcancelfollowingaDataBreach,providedalwaysthatsuchwaivershallonlybeavailableifyouuseElavon’sapprovedthirdpartyofPCIDSSassessmentservicespursuanttothisAgreement.

62 www.elavon.co.uk

(B) LIMITATIONS

ThereshallbeamaximumcapontheCustomer’srighttoenjoyawaiverpursuanttothisSchedule6foreachDataBreachdependingontheCustomer’sPCIDSScompliancestatusaccordingtoElavon’srecords.Thesecapsshallbeasfollows:

(i) anyCustomerwhoiscertifiedasPCIDSScompliantbyElavon’sapprovedthirdpartyproviderofPCIDSSassessmentservicesfromtimetotimeandispayingtheapplicableFeerelatingtothatMIDfortheSolution–£60,000perDataBreach;

(ii) anyCustomerwhoiscertifiedasPCIDSScompliantthroughathirdpartywhoisnotElavon’sapprovedthirdpartyproviderofPCIDSSassessmentservicesfromtimetotimeandispayingtheapplicableFeerelatingtothatMIDfortheSolution–£30,000perDataBreach;

(iii) anyCustomerwhohasnotnotifiedElavonofitscompliancestatus(deemedbyElavontobenon-compliant)(buthaspaidtheapplicableFeerelatingtothatMIDfortheSolution)–£6,000perDataBreach.

ElavonreservestherighttoamendtheforegoingcapsfromtimetotimeonnoticetotheCustomer.

(C) ELIGIBILITY

InordertobeeligibleforthewaiverunderthePCIWaiverPlan,theCustomermust:

(i) subscribetoaSolutioninaccordancewiththisSchedule6;

(ii) beeitheraPCILevel3orLevel4Customer;

(iii) withinseven(7)daysofitsdiscovery,adviseElavoninwritingofanyfailureofsecuritywithinitsbusinessoritscardacceptancesystemsthatgivesrisetoorcouldgiverisetoaDataBreach;

(iv) complywithPCIDSSatthetimeoftheDataBreach;

(v) retainbusinessrecords,logsandelectronicevidencerelatingtoaDataBreach;

(vi) provideaudit reportsof theCustomer’scomputersystemsto identify thesourceof theDataBreachorallowElavontoconductsuchanaudit;

(vii) co-operatewithElavonandtheinvolvedCardSchemeinallinvestigationsrelatingtoanyDataBreach;and

(viii)havepaidallFeesdueandpayabletoElavonfortheSolution.

(D) INELIGIBILITY

IftheCustomerfailstocomplywiththestepssetoutinparagraph2(c)ofthisSchedule6,thewaiverunderthePCIWaiverPlanshallnotbeavailableandElavon(and/oranypartywithrightsofsubrogationsuchasElavon’sinsurersand/orunderwriters)shallreservetherighttorecoverfromtheCustomerallamountswhichitwouldotherwisebeabletoclaimunderthisAgreementincludingwithoutlimitationanyfinesassessedbytheCardSchemeagainstElavonandAuditCostsforwhichtheCustomerisliable.

(i) InadditiontotheforegoingtheCustomershallhavenorighttoenjoyawaiverpursuanttothisSchedule6ifanyofthefollowingcircumstancesarise:

• theDataBreacharisespriortothepaymentoftheFeesfortheSolutionbytheCustomer;

• theDataBreacharisesoutofanywillfuldefault,orcriminalactoromissionoftheCustomer;

63 www.elavon.co.uk

• thisAgreementisterminated(foranyreason);or

• theCustomer’sclaimunderthisSchedule6doesnotrelatetoanIndemnificationItemorisotherwiseaCustomerobligationundertheTOSgoverningtheservicesrenderedbyElavon.

(E) WITHDRAWAL OR SUSPENSION

WithoutprejudicetotheaccruedrightsandliabilitiesoftheCustomer,theCustomerfurtheracknowledgesthatthePCIWaiverPlanmaybewithdrawnorsuspendedbyElavononreasonablewrittennotice.

3. SOLUTIONS

(a) ThetermsofthisSchedule6shallapplytoyoursubscriptionofyourSolution.Fortheavoidanceofdoubt,thetermsofthisSchedule6areintendedtosupplementandbereadinconjunctionwiththerestofyourAgreement.Inaddition,dependingontheSolutionyouhavesubscribedto,thefollowingtermsshallalsoapplywhere:

(i) yousubscribeforSecuredPro,thelicencetermsatPartAofAnnexAandthe“Set-up,DescriptionandTechnicalDetails”atAnnexBshallapply;and

(ii) yousubscribeforSecuredEncrypt,thelicencetermsatPartBofAnnexAshallapply.

4. EXCLUSION OF LIABILITY

(a) Wedonotwarrant that theoperationofSecuredEncryptorSecuredProwillbeuninterruptedorerrorfree,thatSecuredEncryptorSecuredProwillworkproperlyonanygivenDeviceorwithanyparticularconfigurationofhardwareand/or software, thatSecuredEncryptorSecuredProwill providecompleteprotectionfortheintegrityofanyDeviceoragainstallpossiblethreats,orthatSecuredEncryptorSecuredProwillmeetyourrequirements.WemakenowarrantyastotheresultsthatmaybeobtainedfromtheuseofSecuredEncryptorSecuredProorastotheaccuracyorreliabilityofanyinformationobtainedthroughSecuredEncryptorSecuredPro.Norecommendationorinformation,whetheroralorwritten,obtainedbyyoufromusorthroughorinconnectionwithSecuredEncryptorSecuredProshallcreateanywarrantynotcontainedherein.Wedisclaimany liability thatmayariseasa resultofunusedor incorrectlyusedrecommendationsprovidedbyusorimproperinstallationorremovalofsoftwareoramendmentordeletionofdata.Weshallhavenoliabilityforanydamagecausedbytheimplementationoforarisingfromanyerrorsoromissionsinanyinformation,recommendationorscriptprovidedinconnectionwithSecuredEncryptorSecuredProoranyactionstakenbyyouatourrecommendation.

(b) Youacknowledgeandagreethatanymaterial,update,patchand/ordatadownloaded,installed,amended,deletedorotherwiseusedinconnectionwithSecuredEncryptorSecuredProisatyoursolediscretionandriskandthatyouwillbesolelyresponsiblefor:theresultsobtainedfromtheuseofeitherSecuredEncrypt/SecuredPro;foranyconclusionsdrawnfromsuchuse;anydamagetoyourDevicesoranylossofdatathatresultsfromsuchdownloadingorinstallationofthatSolution.

(c) YouacknowledgethatwemayrelyuponinformationprovidedbyyouinordertoprovideyouwithaSolutionandaccordinglyyouagreethatweshallnotbeliabletoyouinanywaytotheextentsuchliabilityarisesfromthematerialinaccuracyofanysuchinformationoranymaterialfailurebyyoutoprovideinformationreasonablyrequestedbyusinrelationtoaSolution.

64 www.elavon.co.uk

(d) NothinginthisSchedule6shallexcludeorlimitanyliabilitythatcannot,asamatteroflaw,belimitedorexcluded.

5. YOUR SUBSCRIPTION

(a) AttheendofanyInitialSubscriptionPeriod,yoursubscriptionfortheSecuredEncryptorSecuredProwillautomaticallyextendforanadditionaltwelve(12)monthperiod(eacha“Renewal Period”)attheendoftheInitialSubscriptionPeriodoranyRenewalPeriod(asapplicable),unlessyoucancelyoursubscriptionbygivingusnotice(inaccordancewiththerequirementsofyourAgreement)atleastone(1)monthbeforetheendoftheInitialSubscriptionPeriodoranyRenewalPeriod(asapplicable).

(b) YoumayalsocancelyoursubscriptionbygivingnoticeatanytimeduringtheSubscriptionPeriodandanysuchcancellationwill takeeffectattheendoftheInitialSubscriptionPeriodorRenewalPeriod(asapplicable)andwillresultinyoursubscriptionnotbeingextended.YouwillremainliableforanyFeesdueinrelationtotheremainderofyourSubscriptionPeriodandwillretainaccesstoyourSolutionuntiltheendofthethen-currentSubscriptionPeriod.

(c) ShouldweterminateyourAgreementpriortotheendofanySubscriptionPeriodforconvenience,assetoutinparagraph6ofthisSchedule6below,youshallonlybeliableforanyFeesdueinrelationtothesupplyoftheSolutionuptoandincludingthedateofsuchtermination.

6. TERMINATION BY ELAVON

WithoutprejudicetoanyotherrightsandremediessetoutinyourAgreement,theCardSchemeRulesoratLaw,wemayandatourconvenience:

(a) At any timewithout causeduring the Initial SubscriptionPeriodor anyRenewalPeriod terminate yoursubscription to theSecuredEncryptorSecuredPro,subject togivingyou two (2)monthspriorwrittennotice;and

(b) Suspendor terminateanypartofourobligations for anySolution ,with immediateeffect, in theeventofamaterialbreachofthisSchedule6,and,whereanysuchbreachiscapableofremedy,wehavefirstprovidedyouwithwrittennoticeoftheallegedbreachandsuchbreachremainsun-remediedforaperiodofthirty(30)daysfollowingreceiptofthewrittennoticebyyou.

(c) Fortheavoidanceofdoubt,bothParties’rightsandconditionstoterminateyourAgreementalsoapplytothetermsofthisSchedule6foranySolution.Notwithstandingtheforegoing,thePartiesherebyacknowledgethatterminationofthetermsforanySolutionshallnotresultintheautomaticterminationofyourAgreement,andthatyourAgreementcanonlybeterminatedinaccordancewiththetermssetoutinyourAgreement.

7. PAYMENT OF FEES

(a) InconsiderationfortheprovisionoftheSolutionyouwillpayustherelevantFeefortheSolutionbydirectdebitorbyotherpaymentmethod,assetoutinyourScheduleofFees.TheFeesarepayableperMID,permonthincludingthemonthinwhichyourInitialSubscriptionPeriodcommences,nomatterwheninsuchmonthitcommences,butnotthemonthinwhichyourthencurrentSubscriptionPeriod(whetheritisyourInitialSubscriptionPeriodorRenewalPeriod,asapplicable)ends.

(b) WewillcollecttheFeesfromyou,inarrears,asperthetermsofyourAgreement.

65 www.elavon.co.uk

(c) PCINon-ComplianceFee

(i) ThePCINon-ComplianceFeeissetoutinyourScheduleofFees.YouwillbechargedthePCINon-ComplianceFee:

• IfyouareaPCILevel3orLevel4CustomerthatsubscribestoSecuredPCI;

• IfyoudonotcertifyyourcompliancewithPCIDSSinaccordancewithparagraph7(c)(ii)ofthisSchedule6within90daysofcompletionofyourboardingtoSecuredPCI.YouwillalsobechargedthePCINon-ComplianceFeeonamonthlybasisthereafter,untilyoucertifyyourcompliancewithPCIDSSinaccordancewithparagraph7(c)(ii)ofthisSchedule6;or

• In the event youdo not provide a renewedPCIDSS certification to Elavon in accordancewithparagraph7(c)(ii)ofthisSchedule6.Inthiscase,thePCINon-ComplianceFeeshallbecomepayableagain30daysafterthefirstanniversaryofthelastPCIDSScertificationdateyouprovidedtoElavon.

(ii) ThePCINon-ComplianceFeewill cease tobecomepayableonElavon’s receipt of yourPCIDSScertification.YoushouldreportyourcompliancewithPCIDSSbyprovidingdetailsofyourPCIDSScertificationthroughtheonlineportalavailableviayourSecuredPCIontheWebsite,orasotherwiseadvisedbyElavon.

(iii) If a valid PCI DSS certification date is updated by the 25th of a givenmonth in accordancewithparagraph7(c)(ii)ofthisSchedule6,thePCINon-ComplianceFeewillnotaccrueforthatmonth.Ifitisuploadedafterthe25thofagivenmonth,youwillbeliableforthePCINon-ComplianceFeeforthatmonth.

(d) Wemay from time to timevary theFeesandcharges for theSolutionand/or introducenewadditionalchargesinaccordancewithyourAgreement.

66 www.elavon.co.uk

ANNEX A TO SCHEDULE 6: LICENCE TERMS

A) SECURED PRO LICENCE TERMS

1. We,subjecttothetermsofthisSchedule6,grantyouanon-assignable,non-exclusive,revocable,limitedandnon-transferablelicencetousetheSolutionduringtheSubscriptionPeriod.

2. YoumayusetheSolutiononupto2(two)Devicesorupto2(two)IPaddresses(asapplicable,asspecifiedinAnnexB)foreachlicencepurchasedasspecifiedinyourScheduleofFeesunder“Quantity”(savefortheAntivirusProtection,assetoutinAnnexB,whichislimitedto1Device).

3. Youwillnot,andwillnotpermitanythirdpartyto:

(a) UseanylicenceorotherauthorisationnumberprovidedbyusinconnectionwiththeSolutiononmorethanthenumberofDevicesoragainstmorethanthenumberofIPaddressesspecifiedinthisSchedule6;

(b) Discloseany licenceor authorisationnumber for theSolution to anypartyother than tousorourauthorisedrepresentatives;

(c) CircumventorattempttocircumventcontrolsontheinstallationoruseoftheSolution;

(d) Copy,modify,change,alter,duplicate,createderivativeworksfrom,frame,mirror,republish,download,display,transmit,ordistributealloranyportionoftheSolutioninanyformormediaorbyanymeansnorattempttodoanysuchthing;

(e) Reversecompile,disassemble,translate,reconstruct,transform,extract,reverseengineerorotherwisereducetohuman-perceivableformalloranypartoftheSoftwareand/ortheSolutionnorattempttodoanysuchthingexcepttotheextentthat(byvirtueofsections50Band296AoftheCopyright,DesignsandPatentsAct1988)suchactionscannotbeprohibitedbecausetheyarenecessarytodecompiletheSoftwareand/ortheSolutiontoobtaintheinformationnecessarytocreateanindependentprogramthatcanbeoperatedwiththeSoftware,theSolutionorwithanotherprogram(“Permitted Objective”),andprovidedthattheinformationobtainedbyyouduringsuchactivities:

• isnotdisclosedorcommunicatedwithoutourpriorwrittenconsenttoanythirdpartytowhomitisnotnecessarytodiscloseorcommunicateitinordertoachievethePermittedObjective;

• isnotusedtocreateanysoftwarethatissubstantiallysimilarinitsexpressiontotheSoftware;

• iskeptsecure;and

• isusedonlyforthePermittedObjective

(f) Publish, sell, distribute, broadcast, transmit, communicate, transfer, rent, lease, assign, display,disclose,pledge,share,licenceorotherwisecommerciallyexploittheSolution;

(g) GrantanythirdpartyaccesstooruseoftheSolution;

(h) Accessoruse theSolutionother than inaccordancewith thisSchedule6, theother termsofyourAgreementoranytermsofusesetoutontheWebsiteorotherwisemadeavailabletoyou;

(i) InstallanySoftwareonanyoperatingsystemnotsupportedbyus;and/or

(j) Removeanycopyright,trademarkorotherproprietarynoticesfromtheSoftware.

4. ByusingtheSolutionyou:

(a) Agree and acknowledge that it is your responsibility at all times to back-up any data, software,informationorotherfilesstoredonanyDevice;

67 www.elavon.co.uk

(b) Confirm that the Solution may include recommendations in relation to: software installation,configurationorupdates;operatingsystemupdatesorconfiguration;amendmentstoDevice,router,firewallorsecuritysettingsorconfiguration;passwordresetoramendment;orremoval,amendmentoralterationofdatastoredonyourDevices;

(c) Confirmthatwemayremoveandinstallsoftware,changeDevicesettingsandotherwiseconfigureyourDevices;

(d) AcknowledgeandagreethatwemayrunsecurityscansagainstyourDevices;

(e) AcknowledgeandagreethatwemayfromtimetotimeprovideUpdateswithoutrequestingorobtainingyourseparateconsent;

(f) AcknowledgeandagreethatyoumaynotbeabletousetheSolutionorpartoftheSolutionunlessyouusethelatestUpdateswehaveprovided;

(g) AuthoriseustodownloadandinstallonyourDevicessoftwareprogramsthatenableustoaccessandcontrolyourDevicesremotely;and

(h) Acknowledgeandagreethatweshallnotbe liableunderanycircumstancesforanydamage, loss,alterationorcorruptionofanydata,information,software,filesoranyDeviceresultingfromyouruseoftheSolution.

5. Fortheavoidanceofdoubt,theSolutiondoesnotaffectyourresponsibilitytocomplywithPCIDSS.

B) LICENCE TERMS FOR SECURED ENCRYPT

1. We,subjecttothetermsofthisSchedule6,grantyouanon-assignable,non-exclusive,revocable,limitedandnon-transferablelicencetousetheSolutiononyourDevice(s)duringtheSubscriptionPeriod.

2. Youwillnot,andwillnotpermitanythirdpartyto:

(a) DiscloseanylicenceorauthorisationnumberforSolutiontoanypartyotherthantousorourauthorisedrepresentatives;

(b) CircumventorattempttocircumventcontrolsontheinstallationoruseoftheSolution;

(c) Copy,modify,change,alter,duplicate,createderivativeworksfrom,frame,mirror,republish,download,display,transmit,ordistributealloranyportionoftheSolutioninanyformormediaorbyanymeansnorattempttodoanysuchthing;

(d) Reversecompile,disassemble,translate,reconstruct,transform,extract,reverseengineerorotherwisereducetohuman-perceivableformalloranypartoftheSoftwareand/orSolutionnorattempttodoanysuchthingexcepttotheextentthat(byvirtueofsections50Band296AoftheCopyright,DesignsandPatentsAct1988)suchactionscannotbeprohibitedbecausetheyarenecessarytodecompiletheSoftwareand/orSolutiontoobtaintheinformationnecessarytocreateanindependentprogramthatcanbeoperatedwiththeSoftwareand/orSolutionorwithanotherprogram(“Permitted Objective”),andprovidedthattheinformationobtainedbyyouduringsuchactivities:

• isnotdisclosedorcommunicatedwithoutourpriorwrittenconsenttoanythirdpartytowhomitisnotnecessarytodiscloseorcommunicateitinordertoachievethePermittedObjective;

• isnotusedtocreateanysoftwarethatissubstantiallysimilarinitsexpressiontotheSolution;

• iskeptsecure;and

• isusedonlyforthePermittedObjective;

68 www.elavon.co.uk

(e) Publish, sell, distribute, broadcast, transmit, communicate, transfer, rent, lease, assign, display,disclose,pledge,share,licenceorotherwisecommerciallyexploittheSolution;

(f) GrantanythirdpartyaccesstooruseoftheSolution;and/or

(g) AccessoruseSecuredEncryptotherthaninaccordancewiththisSchedule6,theothertermsofyourAgreementoranytermsofusesetoutontheWebsiteorotherwisemadeavailabletoyou.

3. ByusingtheSolutionyou:

(a) Confirm that the Solution may include recommendations in relation to: software installation,configurationorupdates;operatingsystemupdatesorconfiguration;amendmentstoDevice,router,firewallorsecuritysettingsorconfiguration;passwordresetoramendment;orremoval,amendmentoralterationofdatastoredonyourDevices;

(b) Confirmthatwemayremoveandinstallsoftware,changeDevicesettingsandotherwiseconfigureyourDevices;

(c) AcknowledgeandagreethatwemayrunsecurityscansagainstyourDevices;

(d) AcknowledgeandagreethatwemayfromtimetotimeprovideUpdateswithoutrequestingorobtainingyourseparateconsent;

(e) AcknowledgeandagreethatyoumaynotbeabletouseSecuredEncryptorpartofthisSolutionunlessyouusethelatestUpdateswehaveprovided;

(f) AuthoriseustodownloadandinstallonyourDevicessoftwareprogramsthatenableustoaccessandcontrolyourDevicesremotely;and

(g) Acknowledgeandagreethatweshallnotbe liableunderanycircumstancesforanydamage, loss,alterationorcorruptionofanydata,information,software,filesoranyDeviceresultingfromyouruseoftheSolution.

4. Fortheavoidanceofdoubt,theSolutiondoesnotaffectyourresponsibilitytocomplywithPCIDSS.

69 www.elavon.co.uk

Elavon Secured Pro

Set Up Description Technical Details

PCIDSSExternalVulnerabilityScan

Outboundcall*madebyElavontoconfigurethescanwithcustomerandwalkthroughSAQ

Thepurposeofthisscanistoidentifyiftherearevulnerableentrypointstoyourbusinessnetworkbyscanningallpossiblepointsofentry.

•Scansagainsttwo(2)IPaddresses perMIDonly

•UnlimitedscanningonthosetwoIPs

•RequiredonaquarterlybasisforPCIDSScompliance

•Scanreportcomplianceremediationrecommendations

NetworkPerimeterScan

Outboundcall*madebyElavontoconfigurethescanwiththecustomer

TheNetworkPerimeterScanchecksforpossibleentrypointsinyourbusinessnetworkthatcouldallowhackerstogainaccesstoyourbusinesses,potentiallystealingyourcustomers’paymentcardinformationandothersensitivedata.

•Nosoftwareinstallisrequired•AnAssurancebadgewillbeavailable todisplayonyourwebsite

•Scansagainsttwo(2)IPaddresses perMIDonly

POSApplicationDiscovery

Outboundcall*madebyElavontoconfigurewiththecustomer

Whenrunonaregularreoccurrence,thisscancrosschecksandverifiesyourPOSApplicationagainstthePCISecurityCouncillistofapprovedPOSApplicationstoensureyourcomplianceforrequirements6.1and11.2.1.

•DeliveredviaSysnetProtectApp –thisneedstobedownloaded tothedevice

•RunsonWindows•Scansagainsttwo(2)Devices perMIDonly

DeviceSecurityScan

Outboundcall*madebyElavontoconfigurewiththecustomer

TheDeviceSecurityScancanbeusedacrossPCsandlaptopsrunningWindowsorOS/XoperatingsystemsandmobiledevicesrunningiOSorAndroidoperatingsystems.Thescandetectsanystoredcustomercardinformationanditalsoanalysesthesystemforanycurrentcyber-threats,virusesandmalware.Thescanwillalsochecktheoverallcomputersecuritypatchlevelswithintheoperatingsystemandmajorsoftwareapplications.

•DeviceSecurityScanisdeliveredviatheSysnetProtectAppthedesktopversionwillbeemailedtoyouandthemobileversioncanbedownloadedfromiTunesorGooglePlayStore

•Scansyourdevicesforvulnerabilities•Assessthreatsandvulnerabilitiesforoperatingsystem(OS)versionsaswellasotherapplicationsonyourDevice

•Scansthefollowingforunencryptedcardholderdatatogreatlyreducetheriskofadatabreach:Deviceandlocalmemory,filecontents

•Scansmanyfiletypes,including.xls(x),.doc(x),.ppt(x),.pst,.pdf,.zip,.txt,.csv,.html,.xml,.rtf,.odt,.sxw,.sql.and.pdf

•Windows,MacOSXandLinux•MobileDeviceSecurityScanisiOSandAndroidcompatible

•Scansagainsttwo(2)Devicesper MIDonly

*Outboundcallswillbemadeapproximately15daysfromElavon’sacceptanceofyourApplication.

ANNEX B: SET UP, DESCRIPTION AND TECHNICAL DETAILS

70 www.elavon.co.uk

Elavon Secured Pro

Set Up Description Technical Details

CardholderDataScan

Outboundcall*madebyElavontoconfigurewiththecustomer

TheCardholderDataScan,willhelpyoufindunencryptedcreditcardnumbers(alsoknownasPrimaryAccountNumbers‘PAN’)oncomputers,laptopsandtabletsandotherconnecteddevices.ThisdramaticallyreducesthescopeofyourPCIDSSassessmentbyidentifyingwhereyoustorepaymentcarddatasothatyoucansecurelyremoveit.

•DeliveredviaSysnetProtectApp–needstobedownloadedtodevice

•Lowsystemimpact•DisplaysfilesandfolderscontainingsuspectedPANdata

•Scansawidevarietyoffiletypes,including.xls(x),.doc(x),.ppt(x),.pst,.pdf,.zip,.txt,.csv,.html,.xml,.rtf,.odt,.sxw,.sql.and.pdf

•Windows,MacOSXandLinux•Scansagainsttwo(2)Devices perMIDonly

AntivirusProtection

Outboundcall*madebyElavontoconfigurewiththecustomer

Ensureyourdevicesarenotinfectedwithvirusesandothermalwarewhichcandisruptandpotentiallydamageyourbusiness.Protectagainstarangeofproblemsfrominconvenientmalwarewhichcanslowsystemstopreventingagainsthackersandphishingofyourdevices.

•Installedfromalinkthatwillbe emailedtoyou

•SupportforoneDeviceperMIDonly•Windows(allversions,MacOS (allversions),LinuxorAndroidoperatingsystems

ANNEX B (CONTINUED)

*Outboundcallswillbemadeapproximately15daysfromElavon’sacceptanceofyourApplication.

71 www.elavon.co.uk

SCHEDULE 7. CUSTOMER’S REPRESENTATIONS FOR CYBER SECURITY TOOLS

YouacknowledgeandconfirmthatonandfromtheCommencementDate:

1. Youwillnot,andwillnotpermitanythirdpartyto:useanyCyberSecurityToolforinfringetheprivacyorintellectualpropertyrightsofathirdparty;

2. Youwillnot,andwillnotpermitanythirdpartyto:useanyCyberSecurityTooltodistributeortransmitanyfilethatcontainsmalwareorinanymannerthatisnotlawful;

3. Youwillnot,andwillnotpermitanythirdpartyto:exportorre-exporteitherdirectlyorindirectly,anyCyberSecurityTooltoanycountryorentityunderUnitedStates,UnitedKingdomorEuropeanUnionrestrictionsortoanycountryorentitysubjecttoapplicabletradesanctionsandyourepresentthatyouarenotlocatedinanysuchcountry;and

4. Youhavethenecessaryrightsandlicencestoanyfilessubmittedtousforscanning.Youalsorepresentthatyoursubmissiontousofanyfileswillnotviolateanythird-partyrightstosuchfiles,includingintellectualpropertyrightsandrightstoprivacy.

ElavonFinancialServicesDACRegisteredinIrelandwithCompaniesRegistrationOffice.Theliabilityof themember is limited.UnitedKingdombranch registered inEnglandandWalesunderthenumberBR022122.

Elavon Financial Services DAC, trading as Elavon Merchant Services is authorised andregulatedbytheCentralBankofIreland.AuthorisedbythePrudentialRegulationAuthorityandwithdeemedvariationofpermission.SubjecttoregulationbytheFinancialConductAuthorityand limited regulation by the Prudential Regulation Authority. Details of the TemporaryPermissionsRegime,whichallowsEEA-basedfirmstooperateintheUKforalimitedperiodwhileseekingfullauthorisation,areavailableontheFinancialConductAuthority’swebsite.

ELAVONTOS–UK(CCA)04/2021