Verifi – ISSUER – CDRN DATA PROCESSING AGREEMENT
Updated: June 1, 2023
This Issuer Data Processing Agreement (“DPA”) is an agreement between you and the entity you represent or have the authority to bind such entity hereto (“Issuer” or “you”), on the one hand, and Verifi, Inc., a California corporation (“Verifi”), on the other hand. It forms part of any written agreement between you and Verifi under which Verifi Processes Personal Information on your behalf (each, an “Agreement”), except with respect to any Agreement under which you and Verifi have entered data processing terms that address the subject matter hereof. Capitalized terms used herein but not defined in this DPA will have the meanings given to them in the Agreement. Each of Verifi and Issuer are referred to herein as a “party” and collectively as the “parties.”
- Processing of Issuer Personal Information.
- Processor designation. The parties acknowledge and agree that Verifi Processes on behalf of Issuer, Personal Information in order to provide Verifi Services (as defined in the Agreement), which Processing may include, by way of example and for illustrative purposes, the Processing detailed on the Details of Processing Issuer Personal Information (Exhibit 2), and that Verifi is a “processor” or “service provider” under Applicable Data Protection Law acting on Issuer’s instructions (referred to as “Processor” for purposes of this DPA).
- Authorization to Process. Processor will Process Issuer Personal Information on behalf of Issuer to provide Verifi Services, and Processor is authorized to Process Issuer Personal Information solely in connection with the following activities:
- In accordance with the applicable Agreement(s), including, without limitation, any statement of works, exhibits, schedules, to provide Verifi Services, and any Processing required under applicable laws or regulations.
- Issuer obligations
- Issuer shall provide its Data Subjects with all privacy notices, information and any necessary choices and shall obtain any necessary consents to enable Verifi to comply with Applicable Data Protection Law;
- Where required by Applicable Data Protection Law, Issuer shall promptly inform Processor when Issuer Personal Information must be corrected, updated, and/or deleted;
- Issuer shall ensure that at the point of transferring Issuer Personal Information to Processor, the Issuer Personal Information is adequate, relevant and limited to what is necessary in relation to the Processing contemplated under the Agreement and this DPA; and
- Issuer shall comply (and as applicable, ensure that its third party auditor’s comply) with Processor’s relevant security policies and appropriate confidentiality obligations as set out in the Agreement.
- Verifi obligations
- Applicable Data Protection Law. To the extent necessary to enable Issuer to comply with its obligations under Applicable Data Protection Law, Verifi further agrees to comply with any required provisions of the GDPR Schedule (other than when acting in accordance with Section 1.2 of this DPA) and/or CCPA Schedule, each to the extent applicable.
- Data Subject Rights. Processor will, to the extent legally permitted, provide reasonable assistance to Issuer to respond to requests from Data Subjects to exercise their rights under Applicable Data Protection Law (e.g., rights to access or delete Personal Information) in a manner that is consistent with the nature and functionality of Verifi Services. In the event that Verifi receives any such request, it shall notify the Issuer and the Issuer is responsible for handling such requests by a Data Subject in accordance with Applicable Data Protection Law.
- Engaging with Sub-Processors. Processor shall ensure that when engaging with another data processor (a “Sub-Processor”) for the purposes of carrying out specific Processing activities on behalf of Issuer, there is an agreement between Processor and the relevant Sub-Processor that provides at least the same level of protection for Issuer Personal Information as set forth in this DPA.
- Staff. Processor shall ensure that persons authorized to Process Issuer Personal Information are under an appropriate obligation of confidentiality in accordance with applicable laws or regulations governing the same.
- Security of Processing. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk to the rights and freedoms of natural persons, Processor will implement technical and organizational measures to ensure a level of security appropriate to that risk. In assessing the appropriate level of security, Processor shall, in particular, take into account the risks that are presented by the Processing, in particular from unauthorized or unlawful Processing, accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Issuer Personal Information transmitted, stored or otherwise Processed. Processor shall provide reasonable assistance to Issuer in ensuring Issuer meets its own compliance obligations with respect to these same security measures.
- PCI Compliance. Processor’s storage, processing, and transmission of any payment instrument data shall comply with the Payment Card Industry (PCI) Security Standard, and Processor shall regularly validate its compliance as determined by its status as a Service Provider (as Service Provider is defined in the PCI Security Standard). Upon Issuer request, Verifi shall provide Issuer with written confirmation of its PCI compliance status.
- Security Breach
- In the event of an actual Security Breach (defined below) affecting Issuer Personal Information contained in Processor’s systems, Processor shall (i) investigate the circumstances, extent and causes of the Security Breach and report the results to Issuer and continue to keep Issuer informed on a regular basis of the progress of Processor’s investigation until the issue has been effectively resolved; and (ii) cooperate with Issuer in any legally required notification by Issuer to affected Data Subjects. The obligations herein shall not apply to Security Breaches caused by Issuer or Issuer Data Subjects.
- Processor shall notify Issuer without undue delay upon Processor or any Sub-Processor becoming aware of an actual Security Breach affecting Issuer Personal Information, providing the Issuer with sufficient information and reasonable assistance to allow Issuer to meet its obligations under Applicable Data Protection Law to (i) notify a Supervisory Authority (as defined under Applicable Data Protection Law) of the Security Breach; and (ii) communicate the Security Breach to the relevant Data Subjects.
- Except as required by applicable law or regulation, Processor will not make (nor permit any third party to make) any statement concerning the Security Breach that directly or indirectly references Issuer, unless Issuer provides its explicit written authorization.
- Deletion and Retention. Processor shall, at the choice of Issuer, delete all Issuer Personal Information upon termination of the Agreement and delete existing copies unless storage is required by applicable law.
- Miscellaneous. The terms of this DPA shall apply only to the extent required by Applicable Data Protection Law. To the extent not inconsistent herewith, the applicable provisions of the Agreement(s) (including without limitation, indemnifications, limitations of liability, enforcement, and interpretation) shall apply to this DPA. In the event of any conflict between this DPA and the terms of an applicable Agreement, the terms of this DPA shall control solely with respect to data processing terms where required by Applicable Data Protection Law, and, in all other respects, the terms of the applicable Agreement shall control. Notwithstanding any term or condition of this DPA, this DPA does not apply to any data or information that does not relate to one or more identifiable individuals, that has been aggregated or de-identified in accordance with Applicable Data Protection Law, or to the extent that Processor and you have entered separate data processing terms that address the subject matter hereof.
- Definitions. Unless otherwise defined in the Agreement (including this DPA), all terms in this DPA shall have the definitions given to them in Applicable Data Protection Law.
- “Applicable Data Protection Law” means any law or regulation pertaining to data protection, privacy, and/or the Processing of Personal Information, to the extent applicable in respect of a party’s obligations under the Agreement and this DPA. For illustrative purposes only, “Applicable Data Protection Laws” include, without limitation, and to the extent applicable, the General Data Protection Regulation (Regulation (EU) 2016/679 (the “GDPR”), UK Data Protection Laws, the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq. (“CCPA”), Swiss DP Laws and any associated regulations or any other legislation or regulations that transpose or supersede the above;
- “EEA Standard Contractual Clauses” means the Standard Contractual Clauses set out in the European Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, as amended or replaced from time to time by a competent authority under the Applicable Data Protection Law.
- “Personal Information” means all data or information, in any form or format, that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer (“Data Subject”) or household or that is regulated as “personal data,” “personal information,” or otherwise under Applicable Data Protection Law. For the avoidance of doubt, this includes any information relating to a Data Subjects as defined in the Agreement;
- “Process” or “Processed” or “Processing” means any operation or set of operations which is performed upon Personal Information, whether or not by automatic means, such as access, collection, recording, organization, storage, adaptation or alteration, retrieval, disclosure or otherwise making available, duplication, transmission, combination, blocking, redaction, erasure or destruction;
- “Security Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information. A Security Breach includes a “personal data breach” (as defined in the GDPR), a “breach of security of a system” or similar term (as defined in any other applicable privacy laws) as well as any other event that compromises the security, confidentiality, or integrity of Personal Information.
- “Swiss DP Laws” means the Federal Act on Data Protection of June 19, 1992 (as updated, amended and replaced from time to time), including all implementing ordinances;
- “Transfer” means to transmit or otherwise make Issuer Personal Information available across national borders in circumstances which are restricted by Applicable Data Protection law;
- “UK Data Protection Laws” means the GDPR as transposed into United Kingdom national law by operation of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (“UK GDPR“), together with the Data Protection Act 2018, the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 and other data protection or privacy legislation in force from time to time in the United Kingdom. In this DPA, in circumstances where and solely to the extent that the UK GDPR applies, references to the GDPR and its provisions shall be construed as references to the UK GDPR and its corresponding provisions;
- “UK IDTA” means, the International Data Transfer Addendum to the EEA Standard Contractual Clauses issued by the UK Information Commissioner under section 119A(1) Data Protection Act 2018.
California Consumer Privacy Act
This CCPA Schedule applies in addition to any terms set forth in the body of the DPA (and is incorporated therein) when the CCPA applies to your use of Verifi Services. Capitalized terms not defined herein have the meaning assigned to them under the DPA. To the extent there are any conflicts between this CCPA Schedule and the DPA, this CCPA Schedule shall prevail.
- Verifi shall not:
- sell Issuer Personal Information; or
- retain, use or disclose Issuer Personal Information other than as set forth in the body of the DPA, except as required or permitted by applicable Data Protection Law; or
- When providing or making available Personal Information to Verifi, Issuer shall only disclose or transmit that Personal Information which is necessary for Verifi to perform its obligations under the applicable Agreement(s).
- To the extent required by Applicable Data Protection Law, this CCPA Schedule constitutes its certification to the Processing restrictions herein.
General Data Protection Regulation
This GDPR Schedule applies in addition to any terms set forth in the body of the DPA (and is incorporated therein) when the GDPR applies to your use of Verifi Services. Capitalized terms not defined herein have the meaning assigned to them under the DPA. To the extent there are any conflicts between this GDPR Schedule and the DPA, this GDPR Schedule shall prevail.
- Processor Obligations
1.1 Processing of Issuer Personal Information. Verifi shall Process Issuer Personal Information pursuant only to documented reasonable instructions from Issuer (including instructions with respect to transfers of Issuer Personal Information to a third country, if applicable) unless required to do so by Applicable Data Protection Law. In such circumstances, Processor shall inform Issuer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
1.2 Use of Sub-Processor
1.2.1 Processor reserves the right to maintain its Sub-Processor list through means such as publication of its Sub-Processor list online and also update it accordingly. In accordance with section 1.2.2 of this GDPR Schedule, Issuer provides authorization for Processor to engage with those Sub-Processors. Processor currently engages the Sub-Processor as listed at Exhibit 3 to this DPA.
1.2.2 Processor shall inform Issuer of any intended changes concerning the addition or replacement of other Sub-Processors to give Issuer the reasonable opportunity to object to such changes. In the event Issuer objects to Processor’s change or addition of Sub-Processor, Issuer shall promptly notify Processor of its objections in writing within ten (10) business days after receipt of Processor’s notice of such change or addition.
1.2.3 Processor may, at its option, undertake reasonable efforts to make available to Issuer a change in Verifi Services or recommend a commercially reasonable change to Issuer’s configuration or use of Verifi Services to avoid Processing of Issuer Personal Information by the objected-to new Sub-processor. If Processor is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Issuer may terminate the Agreement with respect to only those aspects of Verifi Services, which cannot be provided by Processor without the use of the objected-to new Sub-Processor by providing written notice to Processor.
- Data Protection Impact Assessments and Prior Consultation with Regulator
- Processor shall immediately inform Issuer if, in Processor’s opinion, Issuer’s instructions would be in breach of Applicable Data Protection Law. Issuer agrees that Processor shall be under no obligation to take actions designed to form any such opinion.
- Processor shall provide reasonable assistance to Issuer with any legally required (a) data protection impact assessments; and (b) prior consultations initiated by the Issuer with its regulator in connection with such data protection impact assessments. Such assistance shall be strictly limited to the Processing of Issuer Personal Information by Processor on behalf of Issuer under the Agreement taking into account the nature of the Processing and information available to Processor.
- Demonstrating Compliance with this DPA
- Processor shall make available to Issuer information necessary to demonstrate compliance with its obligations under this DPA and allow for (and contribute to) audits, including inspections conducted by Issuer or another auditor under the instruction of the Issuer for the same purposes of demonstrating compliance with the obligations set out in this DPA.
- Issuer’s right under Section 3.1 of this GDPR Schedule is subject to the following:
3.2.1 If requested by Issuer, on no more often than an annual basis during the term of the Agreement, Verifi shall (i) provide Issuer with a copy of the result of its annual SOC 2, Type II audit within a reasonable period after receiving the report from its auditor; and (ii) provide Issuer with a copy of the Attestation of Compliance resulting from its annual PCI audit within a reasonable period after receiving the report from its Qualified Security Assessor.
To the extent that Processor can demonstrate compliance with its obligations set out in this DPA by adhering to an approved code of conduct, by obtaining an approved certification or by providing Issuer with an audit report issued by an independent third party auditor (provided that Issuer will comply with appropriate confidentiality obligations as set out in the Agreement and shall not use such audit report for any other purpose), Issuer agrees that it will not conduct an audit or inspection under Section 3.1 above.
- Cross-Border Transfers
- Processor shall comply with Issuer’s documented instructions concerning the transfer of Issuer Personal Information to a third country.
- The Processor shall only Transfer any Issuer Personal Information outside the European Economic Area (“EEA”), the UK or Switzerland, in compliance with the Applicable Data Protection Law.
- Issuer agrees and acknowledges that Processor transfers and stores certain Issuer Personal Information (relating to individuals located in the EEA, Switzerland and/or the UK) in the United States.
- Transfers subject to the GDPR, UK GDPR, or Swiss DP Laws: Module 2 (transfer controller to processor) of the EEA Standard Contractual Clauses shall apply with respect to any transfer of Issuer Personal Information from the EEA, UK, or Switzerland to Verifi and any of its affiliated entities in the United States or other third countries (“Verifi Entities“). The parties acknowledge and agree that Module 2 (transfer controller to processor) of the EEA Standard Contractual Clauses is hereby incorporated by reference and;
- Issuer and any of its commonly owned or controlled affiliates that have signed an Agreement for Verifi Product and Services (“Issuer Entities“) shall be deemed to be “data exporters” and the Verifi Entities shall be the “data importer”;
- Clause 7 – Docking clause shall apply;
- Clause 9 – Use of subprocessors Option 2 shall apply and the “time period” shall be 10 business days;
- Clause 11(a) – Redress the optional language shall not apply;
- Clause 13(a) – Supervision
- Where the data exporter is established in an EU Member State the following shall apply: “The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.”
- Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of the GDPR the following shall apply: “The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.”
- Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of the GDPR, the following shall apply: “The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.”
- Clause 17 – Governing law Option 1 shall apply and the “Member State” shall be Ireland;
- Clause 18 – Choice of forum and jurisdiction the Member State shall be Ireland; and
- the information in Exhibit 1 (Table 1) of this GDPR Schedule is incorporated into Annexes 1, 2 and 3 of the EEA Standard Contractual Clauses.
- Transfers subject to the UK GDPR where the Transfer is subject to the UK GDPR, the EEA Standard Contractual Clauses shall be read in accordance with, and deemed amended by, the provisions of Part 2 (Mandatory Clauses) of the UK IDTA. For the purposes of Table 4 in Part 1 (Tables) of the UK IDTA, the parties select the “neither party” option.Otherwise, the Parties confirm that the information required for the purposes of Part 1 (Tables) of the UK IDTA is set out in Exhibit 1.
- If there is any conflict or inconsistency between a term in the body of this DPA, an Agreement and a term in Module 2 (transfer controller to processor) of the EEA Standard Contractual Clauses, incorporated into this DPA, the term in Module 2 (transfer controller to processor) of the EEA Standard Contractual Clauses shall take precedence.
Information Required for the EEA Standard Contractual Clauses
Table 1: Information to be incorporated into the EEA Standard Contractual Clauses
|ANNEX I A. LIST OF PARTIES|
|Data EXPORTER identity and contact details|
|Address||To be provided on request|
|Contact person’s name, position and contact details:||To be provided on request|
|Activities relevant to the data transferred under these Clauses:||As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing”.|
|Data IMPORTER identity and contact details|
|Address||900 Metro Center Boulevard|
Foster City, CA 94404
|Contact person’s name, position and contact details:||firstname.lastname@example.org|
|Activities relevant to the data transferred under these Clauses:||As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing”.|
|ANNEX I B. DESCRIPTION OF TRANSFER|
|Categories of data subjects whose personal data is transferred||As set out in the table in Exhibit 2 under “Categories of Data Subjects”.|
|Categories of personal data transferred||As set out in the table in Exhibit 2 under “Types of Personal Information”.|
|Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.||Not Applicable|
|The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).||Continuous|
|Nature of the processing||As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing”.|
|Purpose(s) of the data transfer and further processing||As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing”.|
|The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period||Personal data will be retained in accordance with Verifi’s retention policies, for only as long as is required to meet Verifi’s legal, regulatory and operational requirements and as necessary to perform services.|
|For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing||As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing”.|
|Annex I C. Competent Supervisory Authority|
|Competent supervisory authority/ies||To be provided by the data exporter on request.|
|ANNEX II TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA|
|Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.||Verifi is certified as compliant with all standards established by the Payment Card Industry Data Security Standards (together with any successor organization thereto, “PCI DSS”) that are applicable to Verifi and its affiliates (such standards, the “PCI Standards”). As evidence of compliance, Verifi will provide its current Attestation of Compliance signed by a Payment Card Industry Qualified Security Assessor upon Issuer’s written request. Verifi maintains and enforces commercially reasonable information security and physical security policies, procedures and standards, that are designed (i) to insure the security and confidentiality of Issuer’s records and information, (ii) to protect against any anticipated threats or hazards to the security or integrity of such records, and (iii) to protect against unauthorized access to or use of such records or information which could result in substantial harm (the “Verifi Information Security Program”). At a minimum, the Verifi Information Security Program is designed to align with the standards set forth in ISO 27002 published by the International Organization for Standardization, as well as any revisions, versions or other standards or objectives that supersede or replace the foregoing. Verifi engages its independent certified public accountants to conduct a review of Verifi’s operations and procedures at Verifi’s cost. The accountants conduct the review in accordance with the American Institute of Certified Public Accounts Statement on Standards for Attestation Engagements No. 18 SOC I Type II (“SSAE 18”) and record their findings and recommendations in a report to Verifi. Upon request, and subject to standard confidentiality obligations, Verifi will provide its most recent SSAE 18 and, in Verifi’s reasonable discretion, additional information reasonably requested to address questions or concerns regarding the SSAE 18’s findings.|
|For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter||In respect of Transaction Services: initiatives, products, processes and supporting technology are assessed from a data privacy perspective, allowing Verifi to embed privacy controls to mitigate risks at early stages (privacy by design). Verifi has a robust privacy risk assessment framework (including privacy impact assessments), embedding this process in our change vehicles across the business, to ensure that both new and changed personal data processing activities are reviewed. Where Customer requires specific assistance, Customer may submit such requests for assistance to email@example.com|
|ANNEX III LIST OF SUB-PROCESSORS|
The controller has authorised the use of the following sub-processors:
|As set out in Exhibit 3 of this DPA.|
Details of Processing Issuer Personal Information
|Service||Nature and purpose of the processing||Types of personal information||Categories of data subjects to whom the personal information relates to|
|CDRN||CDRN allows Issuers to submit non-fraud and confirmed fraud pre-dispute transactions (each, a “CDRN Case”) by sharing such CDRN Case with merchants and allowing such merchants to direct the resolution with a refund or cancellation pre-dispute and thereby avoiding a Dispute.||If the Issuer opts to use CDRN, Verifi will use required transaction information, including, without limitation, transaction information and order detail information relating to a CDRN Case and provided by the Issuer to submit such CDRN Cases for enrolled descriptors for merchant directed resolution. Further detail is included in the applicable Services Documentation provided at the time of implementation of the Service.||Issuer’s employees, agents, advisors, or representatives; and/or Consumers.|
EXHIBIT 3 – LIST OF SUB-PROCESSORS
|Company||Functions Performed||Location||Applicable Service|
|Visa U.S.A., Inc.||Security and fraud management||U.S.A.||All|