MERCHANT SERVICES PROCESSING AGREEMENT

Transcription

1 This MERCHANT SERVICES PROCESSING AGREEMENT, which includes the MERCHANT APPLICATION ("Agreement") is entered into by and between Umpqua Bank ( Bank ), located at 111 N. Wall St. Spokane, WA and the business indicated on the Merchant Application ( Merchant ). Bank is engaged in the general banking business, including, but not limited to, providing settlement services to merchants that accept a valid credit card or valid off-line debit card bearing the service mark of VISA, U.S.A. Inc., ("Visa") or MasterCard International, Inc., ("MasterCard"), and DFS Services LLC ( Discover, each a Card Organization ) for payment for Products. Merchant desires to use the Services provided by Bank to authorize, process and settle Transactions with Cardholders. The signature on the Merchant Application does not constitute an approval by Bank of this Agreement and this Agreement is not effective until it has been approved by Bank. Such approval, if given, shall be evidenced by the signature of an authorized representative of Bank on the Merchant Application and the issuance of an approved Merchant Account Number by Bank. In consideration of the representations, covenants and/or promises made in this Agreement, the parties agree as follows. 1. Use of Bank Services. Merchant desires to accept Cards validly issued by members of the Card Organizations. The category of card acceptance that Merchant has indicated on the Application will be referred to as Card or Cards. If Merchant elects to accept only one of the card acceptance categories but later submits a Transaction from a card in a different category, Bank may process the Transaction and assess the appropriate fee, and all terms of this Agreement will apply to that Transaction. Use of the Services by Merchant constitutes acceptance of the terms and conditions contained in this Agreement, whether or not Merchant executes the Merchant Application. Merchant may use special services or software provided by a third party to assist it in processing Transactions, including Authorizations, settlements, or accounting functions. Merchant is responsible for ensuring compliance with the requirements of any third party in using their products, and for the third party s compliance with this Agreement and the Rules. This includes making sure Merchant has and complies with any software updates. 2. Honoring Cards. Credit Cards. Merchant shall follow the procedures for Card acceptance set forth in this Agreement in connection with each Transaction and shall comply with all applicable Rules. If Bank becomes aware of Merchant s noncompliance with any Rule, Bank may notify Merchant, and Merchant shall discontinue the noncompliant practice. A notification by Bank with respect to any one location of Merchant requires Bank to ensure that Merchant is in compliance with the Rules at all locations of Merchant. Merchant may steer customers to use a particular network brand, such as Visa or MasterCard; to a type of payment card, such as a "non-reward" credit card; or to another preferred form of payment. Merchant may also encourage a customer who initially presents a brand of card to use a payment card with a different network brand, a different type of payment card, or a different form of payment. Merchants may engage in any of the following steering activities: (a)offering a customer a discount or rebate, including an immediate discount or rebate at the point of sale; (b)offering a free or discounted product; (c) Offering a free or discounted or enhanced service; (d) Offering the customer an incentive, encouragement or benefit; (e) Expressing a preference for the use of a particular brand or type of general purpose card or a particular form of payment; (f) Promoting a particular brand or type of general purpose card or a particular form or forms of payment through posted information, through the size, prominence or sequencing of payment choices, or through other communications to a customer; (g) Communicating to a customer the reasonably estimated or actual costs incurred by the merchant when a customer uses a particular brand or type of general purpose card or a particular form of payment or the relative costs of using different brands or types of general purpose cards or different forms of payment; or (h) Engaging in any other practices substantially equivalent to these. Merchant: (a) shall honor all valid Cards when properly presented as payment by a bona fide Cardholder for a bona fide Transaction and shall honor Discover Card checks and Merchant will handle these card checks like any other personal check drawn upon a bank.; (b) If Merchant does not deal with the public at large (e.g. private club), Merchant must honor all valid Cards of Cardholders who have purchasing privileges or memberships with Merchant; (c) unless permitted under the Rules and under State and local law, shall not impose any surcharge or fee for accepting a Card or establish any special conditions for accepting a Card; (d) Merchant must not submit for payment any Transaction that arises from the acceptance of Cards at terminals that dispense scrip; and (e) Merchant must not submit for payment any Transaction that arises from the dishonor of a Cardholder s personal check; (f) Merchant must not submit for payment any Transaction that, in the sole discretion of Bank, may damage the goodwill of Bank or reflect negatively on a Card Organization; and (g) unless permitted under the Rules, Merchant shall not require a Cardholder to provide any personal information, such as a home or business address or telephone number, or a driver's license or other proof of identification as a condition of honoring a Card, unless instructed by the Authorization Center. The exception to this is for a mail/telephone order or delivery required Transaction and zip code for a card-present key-entered Transaction in order to obtain AVS and any taxes that Merchant collects (and any other similar handling fees) must be included in the total Transaction amount and not collected separately in cash nor processed as an additional Transaction. Merchant shall adequately display the Card Organizations decals and program marks ( Marks ) on promotional materials as required by Rules. Remote services Merchants must display the Marks wherever payment options are presented. Merchant must also comply with the Card acceptance requirements set forth in section 2.1 of the MasterCard Chargeback Guide. Debit Cards. For each PIN-based Debit Card sale, the Cardholder must enter his Personal Identification Number ( PIN ) through a PIN pad located at the point of sale. Each PIN pad will be situated to permit Cardholders to input their PINs without revealing them to other persons, including Merchant personnel. Merchant will instruct personnel that they may not ask any Cardholder to disclose the PIN and that if any personnel nevertheless becomes aware of any Cardholder s PIN, such personnel will not use such PIN or create or maintain any record of such PIN, and will not disclose such PIN to any other person. The PIN message must be encrypted from the PIN pad to the point of sale device connected to a Debit Card network used to initiate transactions ( Terminal ) and from the Terminal to the Debit Card network and back so that the PIN message will not be in the clear at any point in the transaction. Merchant will comply with any other requirements relating to PIN security as required by Bank or by any Debit Card network. A transaction receipt in conformity with Regulation E and the Rules will be made available to the Cardholder. Merchant may not charge any Cardholder for the use of any Debit Card unless the Rules so permit. Merchant may not collect tax as a separate cash transaction. Debit Card terminals, including hardware and software, must be certified for use by Bank and by all of the Debit Card networks. Terminals must include encrypted PIN pads which allow entry of up to sixteen character PINs, printers and a keyboard lock function. Merchant is responsible for compliance with all Rules regarding the use of Terminals, regardless of whether such Terminals are obtained through Bank or through a third party. 3. Authorization. Merchant will obtain a prior Authorization for the total amount of a Transaction via POS device before completing any Transaction, and will not process any Transaction that has not been Authorized. Merchant will follow any instructions received during the Authorization process. Upon receipt of Authorization Merchant may consummate only the Transaction Authorized and must note on the Sales Record the Authorization number. Where Authorization is obtained, Merchant will be deemed to warrant the true identity of the customer as the Cardholder. Authorizations are not a guarantee of acceptance or payment of the Sales Record. Authorizations do not waive any provisions of 1

2 this Agreement or otherwise validate a fraudulent Transaction or a Transaction involving the use of an expired Card. Merchant may not attempt to obtain multiple Authorizations for a single Transaction; Authorizations cannot be forced in by reducing the Transaction amount to find an approved authorized amount. Once a Transaction is declined, Merchant must wait for next day availability. If the POS device fails, an Authorization must be obtained through voice back up. For Cards other than Visa, Discover and MasterCard (if any, that Bank have expressly approved for the Services), Merchant must follow the procedures and Rules for Authorization and acceptance for each such other Card Organization. Travel & Entertainment (T&E) and Restaurant Pre-Authorization: If Merchant provides travel and/or entertainment services (e.g. car rentals, hotels, motels, etc.) or it is in the restaurant business, and engages in the practice of "pre-authorization" then the following apply: (i) if Merchant's business is travel and/or entertainment services, lodging (hotel or motel) or car rental it may obtain an estimated Authorization at the time of check-in; (ii) if Merchant's business is a restaurant it may obtain a "pre-authorization" for an amount which includes anticipated gratuities; (iii) regardless of the terms and conditions of any written pre-authorization agreement between Merchant and Cardholder, the Sales Record amount of any lodging or vehicle rental Transaction which has been pre-authorized shall include only that portion of the Transaction amount, including any applicable taxes, and shall not include any consequential charges in connection with the rental of vehicles, the preauthorized amount may not include any amounts to cover potential vehicle damage or insurance deductibles when insurance has been waived at the time of rental by the Cardholder; (iv) Merchant must notify the Cardholder of the dollar amount it intends to "pre-authorize"; and (v) if the final amount charged to the Cardholder exceeds the estimated pre-authorized amount by more than fifteen percent (15%) (for lodging or car rental) or twenty percent (20%) (for bars, restaurants and nightclubs), Merchant must authorize any additional amounts. Nothing herein is intended to restrict Merchant from enforcing the terms and conditions of any pre-authorization agreement with its customer through means other than a Transaction. Delayed Delivery or Deposit Balance Transaction Authorization. If Merchant engages in the practice of delayed delivery or accepting deposits then the following apply: (i) where merchandise is to be shipped or services provided at a later date, an Authorization is considered to be valid if (1) the product shipping date is within seven (7) calendar days of the date Authorization was obtained or the services are provided; and (2) the Transaction amount does not exceed the authorized amount plus fifteen percent (15%), representing shipping costs. In any case, all Transactions with an Authorization dated more than twenty-five (25) days prior to the shipping date or date services are rendered are subject to an increased risk of Chargeback. 4. Cash Payments; Cash Advances. Merchant shall not receive any payments from a Cardholder resulting from the use of any Card, nor receive any payments from a Cardholder to prepare and present a credit slip. Unless authorized in writing by Bank, Merchant shall not make any cash advance to a Cardholder. Money orders sent by wire, contributions to charitable and political organizations, tax payments, insurance premium payments, alimony and child support payments, and court costs and fines shall not be considered cash advances or withdrawals. 5. Use of Trademarks. Merchant s use of the Card Organizations and Debit Card network Marks will fully comply with the Rules. Merchant s use of the Card Organizations promotional materials will not indicate, directly or indirectly, that the Card Organizations endorse any Products other than their own and Merchant may not refer to any Card Organization in stating eligibility for its Products. Upon termination of this Agreement or upon notification by a Card Organization and Debit Card network Merchant s use of such marks must terminate. Merchant shall have no right to use the proprietary name and/or symbol of Bank, Visa, Discover or MasterCard, unless the materials containing such are provided to Merchant by Bank and/or are approved in advance by Bank, and, in either event, only while this Agreement is in effect, or until Merchant is notified by Bank or by a Card Organization to cease usage. Merchant may not indicate that any Card Organization endorses Merchant's Products. Merchant shall not use the Marks in such a way that customers could believe that the Products offered by Merchant are sponsored or guaranteed by the owners of the Marks. The use or display of any Marks does not give Merchant any ownership or interest in the Marks. Merchant shall not assign to any third party any of the rights to use the Marks. 6. Card Acceptance. Merchant shall not accept any Card that is not valid or has expired, and must verify that such Card is not stolen, fraudulent or counterfeit. Merchant will comply with the following: (a) It shall use due diligence to verify that a Cardholder is authorized to use the Card presented and at the point of sale must (i) carefully examine the signature on every Card presented and carefully compare the signature on the Card to the Sales Record; (ii) check the expiration date; (b) For Card present Transactions when the signature panel for a Visa Card is not signed Merchant shall in addition to requesting an Authorization: (i) review positive identification bearing the Cardholder's signature (such as a passport or driver's license that has not expired) to validate the Cardholder's identity, (ii) indicate the positive identification, including any serial number and expiration date, on the Transaction receipt, and (iii) require the Cardholder to sign the signature panel of the Card prior to completing the Transaction; (c) When the signature panel is not signed and the Cardholder refuses to sign the Card, Merchant shall not accept it for a Transaction. If the Cardholder is willing to sign the Card in the presence of Merchant, Merchant shall request two pieces of valid and current identification (e.g., driver's license, another bankcard, etc.); and (d) For Visa and MasterCard, a signature panel bearing the words "See "I.D." or equivalent language shall be deemed to be blank. In either case, if such identification is uncertain, or if Merchant questions or the validity is suspicious, Merchant shall contact Bank's designated Authorization Center for instructions. If Merchant is directed by the Authorization Center to retain a Card, or has reasonable grounds to believe that a Card is lost, stolen, fraudulent or counterfeit, Merchant shall use its best efforts to retain the Card by peaceful means and notify the appropriate authorities. Merchant is not authorized to commit any breach of the peace or to cause any personal injury to any person, or to injure or destroy any property in connection with such Card recovery actions. 7. Completion of Sales and Credit Records. Merchant shall use a POS device for transmission of all Transaction data; to record each Transaction by "swiping" the Card through the correctly programmed POS device whenever a Card is present, or if a Card cannot be electronically read, the Card number and expiration date must be manually entered into the POS device. Each outlet, retail location or business entity is required by Bank to have its own POS device, and sale Transactions authorized at one location cannot be processed through a terminal at another location unless authorized by Bank. In connection with the completion of Sale Records and/or Credit Records the following apply: (a) In the event of a breakdown of the POS device or other system failure, Merchant must (i) call customer service for assistance; (ii) imprint each Sales Record with the embossed data on each Card and Merchant's plate on an imprinter and call the Authorization Center for a voice Authorization and obtain Cardholder's signature; (iii) "key-in" the Transaction data to the POS device as soon thereafter as the POS device and/or the system becomes operational; and (iv) if Merchant uses an electronic printer connected to the POS device, Merchant shall also obtain the Cardholder's signature on the printed Sales Record; (b) All items, goods, and services purchased, or rented, in a single Transaction shall be included in the total amount of a Sales Record; (c) The following information must be included on the Sales Record:(i) A clear imprint of the Card on each Sales Record with the embossed data on each Card and Merchant's plate on an imprinter; and (ii) the Cardholder's account number and expiration date; and (iii) obtain the Cardholder's signature. The term "imprint" refers to the process of using a manual imprinting machine to make an impression of the Card on a Sales Record, it does not include the printout from a roll printer attached to 2

3 an electronic device. If Merchant uses the printout of a roll printer attached to a POS device (e.g., authorization/draft capture terminal, cash register, etc.) and "swipes" the Card to read and capture the Card information via the magnetic stripe, Merchant does not have to imprint the Card. The Cardholder's account number located on the Cardholder's receipt must be masked so that only the last four digits appear; (d) When imprinting Sales Records, Merchant shall not alter the Cardholder account number, circle or underline any information on the Sales Record, or alter a Sales Record in any way after the Transaction has been completed and signed. Stray marks and other alterations on a Sales Record may render it electronically unscannable or unreadable/illegible and may result in a Chargeback to Merchant's Account; (e) The Sales Record must contain Merchant's doing business as ("D/B/A") name and address location (city and state required) as shown on the face of this Agreement (Merchant Application); (f) The Sales Record must contain the date of the Transaction; (g) The Sales Record must contain a brief description of the Products involved in the Transaction (if there are too many items, combine them into one description, e.g. "clothing" instead of "one pair of pants, one shirt"). Merchant shall not carry information onto a second Sales Record; (h) The Sales Record must contain a valid Authorization code number; (i) The Sales Record must contain the total amount of the Transaction (including all applicable state, federal and local taxes, except for partial payments or deposits, in which case: (A) where the amount to be charged is a partial payment and the balance is paid in cash or by check at the time of the Transaction; or (B) the amount to be charged if a partial payment is made as a deposit in cases of delayed delivery Transaction; or as an installment payment or, as the final amount of the balance owing after a deposit has been made; and (C) the words "deposit", "delayed delivery", "installment", or "balance", if full payment is to be made in this manner in various times, respectively, and each partial payment or deposit shall be evidenced on a separate Sales Record; (j) A copy of the completed Sales Record must be given to the Cardholder at the time of the Transaction, and to Bank no later than three (3) Business Days after the Transaction date. Merchant's copy must include the full Cardholder account number, and (k) For telephone order Transactions, the letters "TO" shall be typed or legibly printed on the signature line, and for mail order Transactions, the letters "MO" shall be typed or legibly printed on the signature line, and for E-Commerce (Internet) order Transactions, the letters "IO" shall be typed or legibly printed on the signature line, and for Recurring Transactions, the words "Recurring Transaction" (and "PO" for MasterCard Transactions) shall be typed or legibly printed on the signature line. Merchant must not deposit a Transaction receipt until it (a) completes the Transaction, (b) ships or provides the goods, (c) performs the purchased service, or (d) obtains the Cardholder s consent for a recurring Transaction. Merchant may deposit a prepayment, within the time limits specified in the Rules, if Merchant advises the Cardholder of the immediate billing at the time of the Transaction for (1) prepayment services, excluding estimates for services to be provided, or (2) full prepayment of custom-ordered Products, manufactured to Cardholder s specifications. For prepayment of services, the Transaction date is considered to be the date of Cardholder prepayment. 8. Mail, Telephone and E-Commerce (Internet) Transactions. Mail, Telephone and E-Commerce (Internet) orders and Transactions have substantially higher risk of Chargeback and Cardholder dispute than Card "present" (e.g. in a face-to-face) Transactions, as Merchant will not have an imprinted or magnetically "swiped" Transaction with the Cardholder's signature on the Sales Record. Merchant will be assuming a greater risk associated with accepting Card "not present" Transactions, including Mail, Telephone and E-Commerce (Internet) Transactions. Merchant may engage in Mail, Telephone and E-Commerce (Internet) Transactions, only if requested in the Merchant Application, or as may otherwise have been approved in writing by Bank. Sales Records submitted for Mail, Telephone, Recurring Transactions, Pre-Authorized Orders and E-Commerce (Internet) Transactions are subject to Bank's increased risk management and security review procedures and may result in delays or holds of funds being released to Merchant. All mail order Transactions, telephone order Transactions, Recurring Transactions, Pre-authorized order Transactions and E-Commerce (Internet) Transactions are difficult to defend against Chargeback and it shall take reasonable precautions to protect against Chargebacks, including, but not limited to the following (a) Delivering merchandise only to the Cardholder's billing address where the Issuing Bank sends the Cardholder's billing statement; (b) Using a delivery service that maintains shipping logs and requires signatures by a person receiving merchandise; (c) Using AVS and not processing sales unless all information matches the AVS; (d) Obtaining CVV2/CVC2 verification from the Issuing Bank; (e) Obtaining the expiration date of the Card; and (f) on the Sales Record, clearly print the Cardholder's account number; effective and expiration dates; date of Transaction; description of the Products; amount of the Transaction (including shipping, handling, insurance, etc.); Cardholder's name, billing address and shipping address; Authorization code; and Merchant's name and address (city and state required). 9. Recurring Transactions and Pre-Authorized Orders. If Merchant processes Recurring Transactions (e.g., monthly insurance premiums, yearly subscriptions, annual membership fees, etc.) Merchant must comply with the following: (a) have the Cardholder complete and deliver to Merchant a written request for such Products to be charged to Cardholder's account, and the written request must at least specify the Transaction amounts, the frequency of recurring charges and the duration of time for which the Cardholder's permission is granted and be provided promptly in response to a Cardholder's request for copy; (b) If the Recurring Transaction is renewed, the Cardholder must complete and deliver to Merchant a subsequent written request for the continuation of such Products to be charged to the Cardholder's account; (c) Merchant may not complete a Recurring Transaction after receiving a cancellation notice from the Cardholder or Issuing Bank or after a request for Authorization has been denied; (d) Merchant must obtain an Authorization for each Transaction and in lieu of the Cardholder's signature and must provide both an invoice number and the appropriate Recurring Transaction indicator must be included in each Authorization request; (e) Merchant must perform an AVS inquiry for at least the first Transaction and then annually thereafter, if applicable, penalties can be assessed by the Card Organizations for failure to use the Recurring Transaction indicator; (f) A Recurring Transaction or Pre-Authorized Order may not include partial payments for Products purchased in a single Transaction; and (g) No finance charge may be imposed in connection with a Recurring Transaction or Pre-Authorized Order. In any case, all Transactions with an Authorization date more than thirty (30) days prior to shipping date or date services are rendered are subject to a greater risk of possible Chargeback. 3

4 10. E-Commerce (Internet) Merchants. If Merchant is an E-Commerce (Internet) Merchant, and accepts orders via the Internet, Merchant shall comply with the following: (a) post its privacy and security policies on its websites, where such policies shall be clearly marked for consumers to see and review; (b) its websites must include all the following information in a prominent manner: (i) The name of Merchant and the address of its permanent establishment; (ii) A statement identifying the name of Merchant as displayed on the website as both Merchant and the name that will appear on the Cardholder statement; (iii) Merchant information as prominently displayed as any other information depicted on the website, other than images of the Products being offered for sale; (iv) Complete description of the Products offered; (v) Returned Products and refund policy; (vi) Method for the Cardholder to acknowledge their acceptance of the terms and conditions for returned Products or for the refund policy and this acknowledgment should be in a form that complies with Card Organization guidelines for proper disclosure; (vii) Customer service contact, including address and/or telephone number; (viii) Transaction currency must be U.S. dollars, unless written permission is otherwise received from Bank; (ix) Any applicable export or legal restrictions; (x) Delivery policy; (xi) Consumer data privacy policy, Merchant s security capabilities and policy for transmission of payment card details; (xii) A description of the Transaction security used on Merchant's website; (xiii) If a Cardholder is linked to a payment facilitator s website from a sub-merchant s website for payment, the name of the payment facilitator must appear in conjunction with the name of the sub-merchant; (xiv) If a Cardholder accesses a payment facilitator s website directly, and its name is visible to the Cardholder throughout the Transaction from selection of goods and/or services to the completion of the checkout process, then the payment facilitator s name may appear in DE 43 without the name of the Sub-Merchant; (xv) For Card-present Transactions, both the Payment Facilitators name and the Sub-Merchant name must appear on the DE 43, unless only the name of the Payment Facilitator is known to the Cardholder. The Electronic Commerce Indicator must be used to identify E-Commerce Transactions in the Authorization request and clearing record penalties can be assessed for failure to use the correct Electronic Commerce Indicator; (xvi) Merchant must not refuse to complete an E-Commerce Transaction solely because the Cardholder does not have a digital certificate or other secured protocol. Merchant must also offer Cardholders a data protection method such as 3-D Secure or Secure Sockets Layer, and must abide by the provisions of the Visa International Operating Regulations regarding 3-D Secure and Verified by Visa. 11. Code 10 Authorizations. Under any of the following circumstances, Merchant shall not honor the Card, shall use its best efforts, through reasonable and peaceful means, to retain or recover the Card, and shall call Bank's "Code 10" operator to advise it of the pickup and receive mailing and other instructions: (a) the account number embossed on the face of the Card is not the same as any account number printed or encoded elsewhere on the Card; (b) the four-digit number printed above the embossed account number is not the same as the first four digits of the account number; (c) the account number embossed on the face of the Card is not the same as the account number displayed by any pointof-transaction terminal used in connection with the Transaction; (d) the customer's signature on the sales slip does not appear to match the signature on the Card; (e) the Cardholder's photograph on the Card does not seem to match the appearance of the customer; (f) the Card does not have an appropriate hologram, or other appropriate card security features, in the appropriate place; (g) Merchant has reasonable grounds to believe that the Card is counterfeit, fraudulent, or stolen; or (h) there are other unusual or suspicious circumstances surrounding the Transaction. The obligation of Merchant to retain or recover a Card imposed by this or any other section of this Agreement does not authorize a breach of the peace or any injury to person or property, and Merchant will hold Bank harmless from any claim arising from any injury to person or property or other breach of the peace. 12. Approved Monthly Sales Processing Volume Limit. Bank, at its own discretion, may determine the Approved Monthly Sales Processing Volume Limit. If the Approved Monthly Sales Processing Volume Limit is different from the amount indicated in the Merchant Application, Bank will notify Merchant of the amount of the revised Approved Monthly Sales Processing Volume Limit. If the Monthly Sales Volume Limit is exceeded, Bank in its sole discretion, without limitation to its other rights, may: (a) Charge an over-limit fee; (b) Suspend processing Services; (c) Divert all funds from the over-limit processed Transactions into the Reserve Account; (d) Charge the applicable higher Discount Fee; and/or (e) Terminate this Agreement. If the Approved Monthly Sales Processing Volume Limit is exceeded it may also cause a new underwriting review of the approved terms. Bank on ten (10) days prior written notice, may in its sole discretion, reduce the Approved Monthly Sales Processing Volume Limit. 13. DDA and Settlement. DDA. Merchant shall maintain the DDA, which Bank will use to debit and/or credit funds on a daily or monthly basis. Merchant shall be bound by the terms of the operating rules of the National Automated Clearing House Association. Merchant authorizes Processor and/or Bank to initiate credit and/or debit entries and adjustments to the DDA for amounts due under this Agreement and under any agreements with Bank or its affiliates for any related services, as well as for any credit entries in error, including but not limited to Discount Fees, deficiencies, overages, fees, fines, charges, and pending Chargebacks, or may deduct such amounts from settlement funds due to Merchant. This authorization is irrevocable and is coupled with an interest, and shall remain in full force and effect until the later of the date this Agreement is terminated or any amounts owed by Merchant are paid in full. Bank may debit or credit Merchant's DDA for any Merchant authorizes Bank at its sole discretion, to debit any other banking account maintained by Merchant for any and all such amounts. Alternatively, Bank may invoice Merchant for any such amounts, net due 30 days after the invoice date or on such earlier date as may be specified. The Discount Fee is earned at the time of the Transaction and is not subject to refund. Not all fees will be debited on a daily basis, but may be subject to a month end debit to the DDA or other available funds. Settlement. Settlements for Transactions may be net of credits/refunds, adjustments, and amounts due to Bank under this Agreement. All credits to Merchant's DDA or other payments to Merchant are provisional and are subject to final audit by Bank, and amounts owed to Bank under this Agreement. Final credit for those conditional funds will be granted within Bank s sole discretion. Bank may refuse to accept any Sales Record, and Bank may revoke prior acceptance of a Sales Record if: (i) the transaction giving rise to the Sales Record was not made in compliance with this Agreement, the Laws or the Rules; (ii) the Cardholder disputes his liability to Bank or the Issuing Bank; or (iii) the transaction giving rise to the Sales Record was not directly between Merchant and the Cardholder. Merchant will pay Bank any amount previously credited for a Sales Record not accepted by Bank or where accepted, is revoked by Bank. Bank cannot guarantee the timeliness with which any payment may be credited by Bank. Bank will not be liable for any delays in receipt of funds or errors in debit and credit entries caused by third parties, by Processor and/or Bank, including but not limited to any Card Organization. The funds due for Visa and MasterCard Transactions will generally be processed and transferred to Merchant's DDA within two (2) Business Days from the time a Batch is closed. Bank reserves the right to divert and hold all funds when Bank is investigating the breach of any warranty, covenant, representation, or agreement by Merchant or has reasonable cause to believe that Merchant may have violated this Agreement, the Rules and/or is engaged in illegal, fraudulent or suspicious activity. 14. Retrieval and Storage of Sales Records, Credit Records, Transaction Data and Information. Merchant shall store and maintain copies of sales Transactions and will forward such information within twenty four (24) hours of request. Failure to respond to such a retrieval request is a 4

5 violation of this Agreement which may result in a Chargeback, a Chargeback fee and/or establishing a Reserve Account. Merchant shall preserve all records pertaining to Sales and Credit Records for at least twenty four (24) months for Visa Transactions and for Interchange Information Documents (TIDs) for MasterCard, and for all other documents, at least three (3) years, starting from the date of the document. All media containing Card account numbers must be stored for eighteen (18) months in an area limited to selected personnel until discarded and then must be destroyed in a manner that will render the data unreadable and unusable. Merchant must inform Bank promptly of the identity of any data storage entity ( DSE ) or agent that Merchant intends to afford access to Card account, Cardholder, or Transaction information. Bank will promptly register each entity with Visa, Discover and MasterCard that does or will provide DSE services to any of the Merchants. All shopping cart applications and payment gateways must be approved by Bank and registered with the Card Organizations. Merchant shall reimburse Bank for any Chargebacks, return items, or other losses resulting from Merchant's failure to produce a Transaction record requested by Bank within the applicable time limits. 15. Cardholder Information and Security Requirements. Merchant must comply with the Rules, including without limitation, those relating to Cardholder information security issues, non-disclosure of Cardholder information and Transaction documents, retention and storage of Cardholder and Transaction information and other security procedures adopted by the Card Organizations. Merchant confirms its agreement to abide by and fully comply with such Rules, and is responsible for demonstrating compliance by its agents with such Rules, including without limitation the Rules and procedures described below: Cardholder Information Security. Merchant represents and warrants that it shall comply with all Cardholder Information Security Program (CISP), Site Data Protection (SDP), and Payment Card Industry Standard (PCI) requirements, as amended from time to time. Merchant has reviewed the CISP requirements as set forth at and the Site Data Protection requirements set forth at and the PCI requirements as set forth at Where applicable, Merchant must: install and maintain a firewall configuration to protect data; not use vendor-supplied defaults for system passwords and other security parameters; protect stored data; encrypt transmission of cardholder data and sensitive information across public networks; use and regularly update anti-virus software; keep security patches up-to-date; develop and maintain secure systems and applications; restrict access to data by business need-to-know; assign a unique ID to each person with computer access; restrict physical access to cardholder data; track and monitor all access to network resources and cardholder data; regularly test security systems and processes; maintain a policy that addresses information security. When outsourcing administration of information assets, networks, or data Merchant must retain legal control of proprietary information and use limited need-to-know access to such assets, networks or data. If Merchant processes E- Commerce Transactions or process Transactions through an IP connected POS, or upon Bank s request, Merchant must complete a PCI compliance questionnaire and system perimeter scan performed by a qualified data security company approved by Visa and MasterCard at Merchant s expense, and Merchant must attain such PCI compliance certification. Merchant will provide the results of its compliance questionnaires and system perimeter scans to Bank within 10 days. Merchant must ensure that each Service Provider (as defined in the Rules), Payment Application (as defined in the Rules), or other vendor Merchant contracts with complies with the PCI rules. Failure to comply with this paragraph will result in termination. Merchant shall hold harmless Bank, its employees, officers, and directors for failure of Merchant to comply with current and future PCI requirements and guidelines. These guidelines include, but are not limited to: (a) Securing Cardholder data, whether electronic, paper, or other formats. This data includes card numbers, expiration dates, names, and authorization codes. (b) Never storing, keeping, or recording the V Code or three-digit security number found on the back of the card. (c) Never storing magnetic stripe data. Merchant may be liable for fines, fees, and restitution expenses associated with failure to comply with PCI and any current and future Cardholder security guidelines. Transaction Information. The sale or disclosure of databases containing Cardholder account numbers, personal information, or other Transaction information to third parties is strictly prohibited by the Rules. Unless Merchant obtains consent from Bank, and each applicable Card Organization, Issuing Bank and Cardholder, Merchant must not use, disclose, sell or disseminate any Cardholder information obtained in connection with a Transaction (including without limitation, the names, addresses and Card account numbers of Cardholders, copies of imprinted Sales Records and/or Credit Records, mailing lists, tapes or other media obtained in connection with a Sales Record and/or Credit Record) except for purposes of Authorizing, completing and settling Transactions and resolving any Chargebacks, retrieval requests or similar issues involving Transactions, other than as required by law. Merchant shall use proper controls for, limit access to, and render unreadable prior to discarding all records containing Cardholder account numbers and Card imprints. Merchant may not retain or store magnetic stripe data after a Transaction has been authorized. If Merchant stores any electronically captured signature of a Cardholder, Merchant may not reproduce such signature except upon the specific request of Bank. Merchant shall store all media containing Cardholder names, Cardholder account information, and other personal information, as well as Card imprints (such as Sales Records and Credit Records, auto rental agreements, and carbons) in an area limited to selected personnel and, prior to discarding any such information, destroy it in a manner that renders the data unreadable. In the event of Merchant s failure, including bankruptcy, insolvency, or other suspension of business operations, it will not sell, transfer, or disclose any materials that contain Cardholder account numbers, personal information, or Transaction information to third parties, and shall return the information to Bank and provide acceptable proof of destruction to Bank. 16. Returns and Credits. If, with respect to any Transaction, any Products are accepted for return or are refunded, terminated or canceled, or any price adjustment is allowed by Merchant (other than involuntary refunds by airlines or other carriers when required by applicable tariffs and except where otherwise required by law or governmental regulations) Merchant shall not make any cash refund to the Cardholder during the term of this Agreement, but Merchant shall utilize a Credit Record evidencing such refund or adjustment. Merchant must process the Credit Record Transaction within three (3) Business Days. Merchant shall date each Credit Record with the Transaction date and include a brief description of the Products canceled or adjustment made and the amount of the credit in sufficient detail to identify the Transaction. One completed copy of the Credit Record shall be delivered to the Cardholder at the time of each return or cancellation of a Transaction. Every credit issued will be subject to Transaction Fees and Discount Fee and there shall be no refund of any fees or charges associated with the original Transaction. With proper disclosure at the time of the Transaction, Merchant may: (a) Refuse to accept goods in return or exchange and refuse to issue a refund to a Cardholder; or (b) Accept returned goods in exchange for Merchant's promise to deliver Products of equal or greater value available from Merchant at no additional cost to Cardholder. Proper disclosure shall be deemed to have been given only if, at the time of the Transaction (which is evidenced with an acknowledged Cardholder signature), the following notice appears on all copies of the Sales Record (or disclosure if Card is not present) in legible letters at least one-quarter (1/4) inch high and in close proximity to the space provided for the Cardholder's signature stating "NO REFUND" or "EXCHANGE ONLY" or "IN STORE CREDIT ONLY" as applicable, or equivalent language, although compliance with this paragraph does not guarantee avoidance of a Chargeback. 17. Merchant Warranties; Prohibitions. 5

6 Representations and Warranties. Merchant represents and warrants to Bank at the time of execution and during the term of this Agreement all of the following: Merchant is a corporation, limited liability company, partnership or sole proprietorship validly existing and organized in the United States. All information contained on the Application or any other document submitted to Bank is true and complete and properly reflects the business, financial condition, and principal partners, owners, or officers of Merchant. Merchant is not engaged or affiliated with any businesses, products or methods of selling other than those set forth on the Application, unless Merchant obtains the prior written consent of Bank. Merchant and the person signing this Agreement have the authority to execute and perform this Agreement. This Agreement will not violate any law, or conflict with any other agreement to which Merchant is subject. There is no action, suit or proceeding pending or to Merchant s knowledge threatened which if decided adversely would impair Merchant s ability to carry on Merchant s business substantially as now conducted or which would adversely affect Merchant s financial condition or operations. Merchant have never entered into an agreement with a third party to perform credit or debit card processing which has been terminated by that third party. All Transactions are bona fide. No Transaction involves the use of a Card for any purpose other than the purchase of Products from Merchant nor does it involve a Cardholder obtaining cash from Merchant unless allowed by the Rules and agreed in writing with Bank. Merchant will comply with the all relevant laws and Rules. Transaction Warranties. Merchant specifically represents and warrants that: (i) each Transaction is valid in form and has been completed in accordance with all applicable requirements and the Rules; (ii) Merchant has delivered the goods to the Cardholder or completed the service described on the Sales Record in accordance with Merchant's agreement with the Cardholder, and that Merchant has, in inventory, the Products sold if not delivered at the time of sale; (iii) each Sales Record represents the Cardholder's indebtedness for the total amount shown; (iv) the Cardholder has no defense right of offset or counterclaim against Merchant in connection with the purchases of the Products; (v) Merchant has not charged Cardholder directly or indirectly any separate or additional fee(s) such as a surcharge or portion of any discount or charge imposed upon Merchant by this Agreement in connection with the Transaction other than as may be permitted under the Rules and under State and local law (this paragraph shall not, however, be construed as prohibiting discounts to customers or for charges that are charged to the Cardholder regardless of the form of payment; (vi) each Transaction was placed by a person who is the Cardholder of the Card; (vii) it has included all items of Products purchased in a single Transaction and the total amount on a single Sales Record; (viii) the Transaction does not represent the refinancing of an existing obligation of the Cardholder (including any obligation owed to Merchant or arising from the dishonor of a personal check); (ix) the Transaction is not a "cash advance"; and (x) Merchant shall never accept or deposit, or enter into Merchant's POS device, a sale made by any other merchant. Violation of any of the foregoing shall be an Event of Default, and may cause this Agreement to be immediately terminated, or subject to termination, have all funds placed into a Reserve Account, and result in Merchant and each Guarantor placed on the Combined Terminated Merchant File ( CTMF ) or MATCH File pursuant to Paragraph 25. Prohibited Transactions. Merchant shall not knowingly submit (and Bank must not knowingly accept from Merchant) any Transaction that is illegal or that Merchant should have known was illegal. Merchant will not change the nature of its business modify the ownership of the business without Bank s prior written consent. The percentage of mail and/or telephone order sales shall not exceed five percent (5%) of all sales made by Merchant, unless specifically disclosed in the Merchant Application. Merchant offers no enticements or incentives to Cardholders in connection with the sale of Products. Merchant will not use any personal Card owned by Merchant or any guarantor. Merchant will use both the name and address shown on the Merchant Application on all Sales Records and Credit Records and will not use any other name (unless a descriptor is used to further identify the Transaction and agreed to by Bank) and will prominently and unequivocally inform the Cardholder of the identity of Merchant at all points of interaction, so that the Cardholder can readily distinguish Merchant from any other party. Merchant will not engage in the practice of "split-ticket" sales, will not submit any Transaction that was previously charged back or declined, and is responsible for ensuring that the Cardholder understands that Merchant is responsible for the Transaction, including delivery or provision of the Products, and for related customer service and dispute resolution. Merchant shall not, without the Cardholder's prior written consent, sell, purchase, provide or exchange Card account information in the form of Sales Records, mailing lists, tapes or any other media obtained by reason of a Transaction to any third party other than Merchant's agents for the purpose of assisting Merchant in its business to Bank or pursuant to any lawful government demand. If undergoing a forensic investigation at the time the Agreement is signed, Merchant must fully cooperate with the investigation until it is completed. 18. Chargebacks. Merchant is responsible for Transactions returned for whatever reason, otherwise known as Chargebacks, as well as Card Organization fines, assessments and fees related to or arising out of such Chargebacks, and will pay Bank, upon demand, the amount of any Chargebacks. Authorization is granted to offset from incoming Transactions and to debit the DDA, the Reserve Account or any other account held at Bank or at any other financial institution the amount of all Chargebacks. Merchant will fully cooperate in complying with the Rules regarding Chargebacks. If there are any counterfeit or fraud incidences Merchant may, in addition to other remedies of Bank, be charged back for all Transactions. Bank will assess a Chargeback Fee for each Chargeback. If the actual Card is "not present", Merchant bears one hundred percent (100%) of the risk of Chargeback under the Rules, for all Transactions and any fees resulting from such Card "not present" Transactions and agrees, without limiting any other provisions in this Agreement, to hold Bank harmless from any losses, claims, and costs arising from or associated with all such Transactions, including any Authorizations. 19. Reserve Account. Merchant will establish and maintain a non-interest bearing deposit account ("Reserve Account") at Bank initially or at any time in the future as requested by Bank, with sums sufficient to satisfy Merchant s current and future obligations as determined by Bank. Merchant authorizes Bank to debit the DDA or any other account Merchant has at Bank or any other financial institution to establish or maintain funds in the Reserve Account. Bank may deposit into the Reserve Account funds it would otherwise be obligated to pay Merchant, for the purpose of establishing, maintaining or increasing the Reserve Account in accordance with this Section, if it determines such action is reasonably necessary to protect its interests. Bank may, without notice to Merchant, apply deposits in the Reserve Account against any outstanding amounts Merchant owes under this Agreement or any other agreement between Merchant and Bank. Also, Bank may exercise its rights under this Agreement against the Reserve Account to collect any amounts due to Bank under this Agreement including, without limitation, rights of set-off and recoupment. Funds in the Reserve Account will remain in the Reserve Account until 270 calendar days following the later of termination of this Agreement or Merchant s last transmission of Transactions to Bank, provided, however, that Merchant will remain liable to Processor and Bank, for all liabilities occurring beyond such 270 day period. After the expiration of such 270 day period Merchant must provide Processor with written notification indicating Merchant desire a release of any funds remaining in the Reserve Account in order to receive such funds. Merchant agrees that Merchant will not use these funds in the Reserve Account for any purpose, including but not limited to paying chargebacks, fees, fines or other amounts Merchant owes Bank under this Agreement. Bank (and not Merchant) shall own and have sole control of the Reserve Account. In the event of a bankruptcy proceeding and the determination by the court that this Agreement is assumable under Bankruptcy Code 365, as amended from time to time, Merchant must establish or maintain a Reserve Account in an amount satisfactory to Bank. 6

7 20. Special Merchant Categories. Health Care Merchant. If Merchant offers health care products or services and participates in Visa s Health Care Eligibility Service, then Merchant must comply with all of the provisions of the Health Care Eligibility Service Implementation Guide and with the requirements for Preauthorized Health Care Transactions. If Merchant participates in auto-substantiation Transactions, Merchant must comply with the Visa Healthcare Auto-Substantiation Transaction Service Description and Implementation Guide.. These guides may be found at or will be provided by Bank to Merchant upon request. Car Rental Reservation Merchant. If Merchant is a car rental company participating in the Visa Reservation Service, Merchant must comply with the requirements of the Visa Reservation Service requirements, attached to this Agreement as Exhibit A. Merchants that Guarantee Hotel Reservations. If Merchant provides central reservation services, Merchant must comply with the requirements of the Advanced Deposit Service requirements, attached to this Agreement as Exhibit D. If Merchant guarantees hotel reservations, Merchant must comply with the requirements of the Hotel Reservation Service requirements, attached to this Agreement as Exhibit E. 21. Termination. Bank may terminate this Agreement without prior notice in the event Merchant is or becomes bankrupt or is unable to pay its debts as they become due, or if Bank reasonably determines that Merchant has violated this Agreement, or if Bank determines in its sole discretion that Merchant has abused its privileges under this Agreement. The Agreement may be terminated by Bank or Merchant by giving 30 days written notice. Further, this Agreement may be terminated at any time with or without notice and with or without cause by Bank. Processing under a particular Debit Card network may be suspended or terminated (without terminating this entire Agreement) if the Debit Card network determines to suspend or terminate processing; or automatically, upon termination or expiration of Merchant s access to such Debit Card network whether caused by termination or expiration of Bank s agreement with such Debit Card network or otherwise. Neither Bank, nor any Debit Card network will have any liability to Merchant as a result of any such suspension or termination. All Merchant obligations regarding accepted Transactions will survive termination. Merchant must maintain in the DDA and the Reserve Account enough funds to cover all Chargebacks, deposit charges, refunds and fees incurred by Merchant for a reasonable time, but in any event not less than the time specified in this Agreement. If the amount in the DDA or Reserve Account is not adequate, Merchant will pay Bank the amount Merchant owes upon demand, together with all costs and expenses incurred to collect that amount, including reasonable attorneys' fees. The Card Organizations have the right to limit or terminate this Agreement. Notice of termination due to breach by Merchant may be given orally, in writing or by closing Merchant's POS device or payment gateway at the discretion of Bank. 22. Combined Terminated Merchant File or Match File. Bank is required to report Merchant s business name and the name of Merchant's principals to Visa and MasterCard when Merchant is terminated due to the reasons listed in the Rules. 23. Security Interest; Right of Setoff. To secure Merchant's obligations to Bank and its affiliates under this Agreement and any other agreement for the provision of related equipment or related services ("Obligations"), Merchant grants Bank a first priority lien and security interest in and to the Reserve Account and in any of Merchant's funds pertaining to the Transactions contemplated by this Agreement now or hereafter in Bank possession, whether now or hereafter due or to become due to Merchant. In addition to any rights granted under applicable law, Bank is authorized (any related notice and demand are expressly waived), to set off, recoup and to appropriate and to apply any and all such funds and amounts in the Reserve Account against and on account of the Obligations, whether such Obligations are liquidated, unliquidated, fixed, contingent, matured or unmatured. Merchant shall execute and deliver to Bank such instruments and documents as may be reasonably requested to perfect and confirm the lien, security interest, right of set off, recoupment and subordination set forth in this Agreement. Bank has the right of setoff. This means that Bank may offset against any outstanding/uncollected amounts owed to Bank by Merchant from: (a) any amounts it would otherwise be obligated to deposit into the DDA, (b) any other amounts Bank may owe Merchant under this Agreement or any other agreement, and (c) any funds in the DDA or Reserve Account. Merchant acknowledges that in the event of a bankruptcy proceeding, in order to provide adequate protection under Bankruptcy Code 362 to the Bank, Merchant must create or maintain the Reserve Account as required by Bank, and Bank must have the right to offset against the Reserve Account for any and all obligations which Merchant may owe to Bank, without regard to whether the obligations relate to Sales Records initiated or created before or after the filing of the bankruptcy petition. 24. Indemnification and Limited Liability. Merchant shall indemnify and hold Bank harmless from and against any Card Organization fines or fees and all losses, liabilities, damages and expenses (including attorney's fees and collection costs) resulting from any breach of any warranty, covenant or agreement or any misrepresentation by Merchant under this Agreement (including, without limitation, a violation of the Rules), or arising out of Merchant's or Merchant's employees' negligence or willful misconduct, in connection with Transactions or otherwise arising from Merchant's provision of Products to Cardholders. Bank agrees to indemnify and hold Merchant harmless from and against all losses, liabilities, damages and expenses resulting from any breach of any warranty, covenant or agreement or any misrepresentation by Bank under this Agreement or arising out of Bank's or its employees' gross negligence or willful misconduct in connection with this Agreement. THIS AGREEMENT IS A SERVICE AGREEMENT. BANK DISCLAIMS ALL OTHER REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, MADE TO MERCHANT OR ANY OTHER PERSON, INCLUDING WITHOUT LIMITATION, ANY WARRANTIES REGARDING QUALITY, SUITABILITY, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR OTHERWISE OF ANY SERVICES OR ANY GOODS PROVIDED INCIDENTAL TO THE SERVICES PROVIDED UNDER THIS AGREEMENT. NOTWITHSTANDING ANYTHING IN THIS AGREEMENT TO THE CONTRARY, IN NO EVENT SHALL BANK OR ITS AFFILIATES OR ANY OF THEIR RESPECTIVE DIRECTORS, OFFICERS, EMPLOYEES, AGENTS OR SUBCONTRACTORS, BE LIABLE UNDER ANY THEORY OF TORT, CONTRACT, STRICT LIABILITY OR OTHER LEGAL THEORY, FOR LOST PROFITS, LOST REVENUES, LOST BUSINESS OPPORTUNITIES, EXEMPLARY, PUNITIVE, SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES, EACH OF WHICH IS EXCLUDED BY AGREEMENT OF THE PARTIES, REGARDLESS OF WHETHER SUCH DAMAGES WERE FORESEEABLE OR WHETHER ANY PARTY OR ANY ENTITY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. NOTWITHSTANDING ANYTHING IN THIS AGREEMENT TO THE CONTRARY, BANK'S CUMULATIVE LIABILITY FOR ALL LOSSES, CLAIMS, SUITS, CONTROVERSIES, BREACHES OR DAMAGES FOR ANY CAUSE WHATSOEVER (INCLUDING, BUT NOT LIMITED TO, THOSE ARISING OUT OF OR RELATED TO THIS AGREEMENT) AND REGARDLESS OF THE FORM OF ACTION OR LEGAL THEORY SHALL NOT EXCEED (a) $50,000; OR (b) THE AMOUNT OF FEES RECEIVED BY BANK PURSUANT TO THIS AGREEMENT FOR SERVICES PERFORMED IN THE IMMEDIATELY PRECEDING TWELVE (12) MONTHS, WHICHEVER IS LESS. 25. Service Fees, Discount Fees, and Transaction Fees. Merchant will pay Bank fees for Services, forms and equipment in accordance with the rates set forth on the Application. Such fees will be calculated and debited from the DDA once each Business Day or month for the previous 7

8 Business Day's or month's activity or will be netted out from the funds due Merchant under this Agreement. Merchant is obligated to pay all taxes, and other charges imposed by any governmental authority on the Services provided under this Agreement. The fees are based upon the qualification of Merchant's Transactions for certain reduced Interchange Fees as set by the applicable Card Organization. If Merchant's Transactions fail to qualify for the reduced Interchange Fees, Bank will process such Transactions at the higher applicable Interchange Fees and Merchant shall be charged the higher Discount Fee for each non-qualifying (or mid-qualification, if applicable) Transaction, as set out in the Merchant Application. The fees for Services set forth in this Agreement are based upon assumptions associated with the information provided by Merchant on the Merchant Application. If any of that information is not true or if Merchant significantly alters Merchant's method of doing business, Bank may adjust the fees without prior notice. The fees set forth in the Merchant Application may be adjusted to reflect increases or decreases by Card Organizations or to pass through increases charged by third parties. All such adjustments shall become effective upon the date any such change is implemented by the applicable Card Organization or third party. Bank may also change or increase the fees for Services for any other reason by notifying Merchant ten (10) days prior to the effective date of any such change. The Discount Fee may be increased if Merchant does not use the correct POS device/pc software application or does not close Batches at least once every Business Day. Bank may assess a monthly statement fee on a monthly basis. Additional fees may also be assessed for processing of sales or credit Transactions emanating from foreign Cardholders. Merchant will pay fees to reimburse Bank s research costs due to Merchant moving to an undisclosed location. Merchant is required to inform Bank in writing of Merchant's business location. 26. Fines and Excessive Chargebacks. If Merchant's Chargeback or retrieval percentage for any line of business exceeds the estimated industry Chargeback percentage, Merchant shall pay Bank an excessive Chargeback fee for all Chargebacks occurring in such month. Each estimated industry Chargeback percentage is subject to change from time to time by Bank. Upon the occurrence of excessive activity, Bank may take any action it deems necessary including but not limited to suspension or termination of processing privileges or creation or maintenance of a Reserve Account. Bank may also assess Merchant a fee for processing any fines or penalties that may be charged by the Card Organizations. 27. Requests for Adjustments or Refunds. If Merchant believes any adjustments should be made with respect to Merchant's DDA, Merchant must notify Bank in writing within 45 days after any debit or credit is or should have been effected. If Merchant notifies Bank after such time period, Bank may, in its discretion, assist Merchant, at Merchant's expense, in investigating whether any adjustments are appropriate and whether any amounts are due to or from other parties, but Bank shall not have any obligation to investigate or effect any such adjustments. Any voluntary efforts by Bank to assist Merchant in investigating such matters shall not create any obligation to continue such investigation or any future investigation. 28. Force Majeure. No party shall be liable for any default or delay in the performance of its obligations under this Agreement if and to the extent such default or delay is caused, directly or indirectly, by (a) fire, flood, elements of nature or other acts of God; (b) any outbreak or escalation of hostilities, war, riots or civil disorders in any country; (c) any act or omission of the other party or any government authority; (d) any labor disputes (whether or not employees' demands are reasonable or within the party's power to satisfy); or (e) the nonperformance by a third party for any similar cause beyond the reasonable control of such party, including without limitation, failures or fluctuations in telecommunications or other equipment. In any such event, the non-performing party shall be excused from any further performance and observance of the obligations so affected only for as long as such circumstances prevail and such party continues to use commercially reasonable efforts to recommence performance or observance as soon as practicable. 29. Notices. Any written notice under this Agreement will be deemed received upon the earlier of: (a) actual receipt or (b) five calendar days after being deposited in the United States mail, and addressed to the last address shown on the records of the sender, with a copy by facsimile or other electronic means of communication. If Bank gives notice by facsimile or other electronic communication to Merchant, service shall be deemed to have been duly given on the day of transmission (with receipt acknowledged). Notices may further be provided by Bank via posting of said notice on Bank's online account reporting system and such posted notice shall be effective as of the date it is posted by Bank. 30. Severability. If any provision of this Agreement is illegal, the invalidity of such provision will not affect any of the remaining provisions, and this Agreement will be construed as if the illegal provision is not contained in the Agreement. This Agreement will be deemed modified to the extent necessary to render enforceable the provisions hereunder. 31. Waiver. No failure or delay on the part of any party in exercising any right under this Agreement will operate as a waiver of that right, nor will any single or partial exercise of any right preclude any further exercise of that right. 32. Assignment and Delegation. Any transfer or assignment of this Agreement by Merchant, without the prior written consent of Bank, by operation of law or otherwise, is voidable by Bank. Furthermore, Merchant shall indemnify and hold Bank harmless from all liabilities, Chargebacks, expenses, costs, fees and fines arising from such transferee's or assignee's submission of Transactions to Bank for processing. For purposes of this Paragraph, any transfer of voting control shall be considered an assignment or transfer hereof. Upon notice to Merchant, another Card Organization member may be substituted for Bank. Upon substitution, such other Card Organization member shall be responsible for all obligations required of Bank. Subject to the Rules, Bank may assign or transfer this Agreement and its rights and obligations hereunder and/or may delegate its duties hereunder, in whole or in part, to any third party without notice to or consent of Merchant. 33. Merchant s Employees. Merchant shall be responsible for the actions of all its employees while in its employment. 34. Governing Law and Venue. This Agreement shall be governed by and construed in accordance with the laws of the State of Washington (without regard to its choice of law provisions). In performing its obligations under this Agreement; each party agrees to comply with all laws and regulations applicable to it. The exclusive venue for any actions or claims arising under or related to this Agreement shall be in the appropriate state or federal court located in Spokane County, Washington. Merchant irrevocably consents to the jurisdiction of said courts. ALL PARTIES IRREVOCABLY WAIVE ANY AND ALL RIGHTS THEY MAY HAVE TO A TRIAL BY JURY IN ANY JUDICIAL PROCEEDING INVOLVING ANY CLAIM RELATING TO OR ARISING UNDER THIS AGREEMENT. 35. Financial and Other Information. Upon request, Merchant will provide Bank quarterly financial statements within forty-five (45) days after the end of each fiscal quarter and annual audited financial statements within ninety (90) days after the end of each fiscal year. Such financial statements shall be prepared in accordance with generally accepted accounting principles, consistently applied. Merchant will also provide such other financial statements and other information concerning Merchant's business and its compliance with the terms and provisions of this 8

9 Agreement as Bank may reasonably request. Merchant authorizes Bank to obtain from third parties financial and credit information relating to Merchant in connection with their determination whether to accept this Agreement and Bank's continuing evaluation of the financial and credit status of Merchant. Bank may also access and use information which Merchant has provided to Bank for any other reason. Upon request, Merchant shall provide to Bank or their representatives reasonable access to Merchant's facilities and records for the purpose of performing any inspection and/or copying of Merchant's books and/or records deemed appropriate. Merchant will provide Bank with written notice of any judgment, writ, warrant of attachment, execution or levy against any substantial part (fifteen percent (15%) or more in value) of Merchant's total assets not later than three (3) days after Merchant becomes aware of same. 36. Amendments. In addition to changes to fees as set forth in Section 25, this Agreement may be amended by Bank from time to time upon ten (10) days written notice. Any amendment to this Agreement shall be effective on the effective date specified in the notice to Merchant. Notice of amendment by Bank of this Agreement may be provided in any manner allowed hereunder, including but not limited to posting the amendment on Bank's online account reporting system. 37. Survival. All representations, warranties, covenants and indemnities of Merchant shall survive the expiration or termination of this Agreement. All obligations of any party to this Agreement to pay funds to another shall survive any expiration or termination of this Agreement. 38. Construction. The captions contained in this Agreement are for the convenience of the parties and shall not be construed or interpreted to limit or otherwise define the scope of this Agreement. The rights and remedies conferred upon Bank in this Agreement, at law or in equity, are not intended to be exclusive of each other. Rather, each and every right of Bank under this Agreement, at law or in equity, will be cumulative and concurrent and in addition to every other right. 39. Counterparts. This Agreement may be executed in one or more counterparts, each of which shall be deemed to be an original, and such counterparts shall together constitute one and the same instrument. The signatures to this Agreement may be evidenced by facsimile copies or PDF copies reflecting the party s signature, and any such facsimile copy or PDF copy shall be sufficient to evidence the signature of such party as if it were an original signature. 40. Entire Agreement. This Agreement (including the Merchant Application portion) signed and submitted by Merchant and the CONTINUING PERSONAL GUARANTY constitute and express the entire understanding between Merchant and Guarantor(s), individually and jointly, on the one hand, and Bank on the other hand, with respect to the subject matter hereof and supersede all prior and contemporaneous agreements and understandings, inducements, or conditions by Bank, and any other sales representative, whether express or implied, oral or written. 41. Legal Fees and Costs. Merchant shall pay the legal fees and costs Bank incurs in seeking legal advice in matters not in the ordinary course of the Services relationship established under this Agreement, including, without limitation, contract disputes, legal procedures, bankruptcy or similar events, whether the fees or costs are incurred during or after the Term of this Agreement. 42. Recitals and Defined Terms. Merchant acknowledges and affirms each of the Recitals contained above, which are incorporated herein by reference and made a part of this Agreement. Capitalized terms used in this Agreement shall have the meanings set forth herein, including the following capitalized terms set forth below: "Approved Monthly Sales Processing Volume Limit" or "Approved Monthly Sales Volume Limit" means the maximum Monthly Sales Processing Volume or maximum Monthly Sales Volume that Merchant is approved to process during a calendar month pursuant to this Agreement. "Authorization" means approval by, or on behalf of, the Issuing Bank to validate a Transaction for a merchant or another affiliate bank. An Authorization indicates only the availability of the Cardholder's credit limit at the time the Authorization is requested and is not a guarantee that a Transaction is valid. "Authorization Center" means a department or service provider to be contacted by Merchant to obtain Authorization codes on Transactions from the Issuing Bank and which transmits such Authorization to Merchant via electronic equipment or by voice Authorization. "Authorization Fee" means the charge Merchant is billed each time an Authorization is performed. "AVS" means the process by which Merchant verifies the address of a Cardholder as part of the Authorization. "Batch" means usually a day's worth of Transactions, including Sales Records and Credit Records, to be processed by the Card Processor. "Business Day" means any day on which Bank is open for business, other than Saturdays, Sundays or holidays. "Card" has the meaning ascribed in Section 1 of this Agreement. "Cardholder" means the individual whose name is embossed on a valid Card and any authorized user of such Card. "Card Organization" means any entity formed to administer and promote Cards (including without limitation Visa, Discover and MasterCard). CVV2 means card verification value. CVC2 means card verification code. "Chargeback" means the procedure by which a Sales Record or other indicia of a Transaction (or disputed portion thereof) is denied or returned to Bank or the Issuing Bank after it was entered into the appropriate settlement network for payment, in accordance with the Rules, for failing to comply with the Rules including, without limitation from Cardholder disputes, the liability of which is Merchant's responsibility. Credit Card means all cards issued by a non-u.s. bank and all Visa, Discover or MasterCard cards other than Debit Cards. "Credit Record" means all documents or the Electronic Record of such documents used to evidence any refund or price adjustment given by Merchant to a Cardholder for a previous sale Transaction, which must conform to the Rules. The format for each Credit Record must be approved by Bank or supplied by Processor. "DDA" means a demand deposit account at Bank designated by Merchant as the account to be debited and credited by Processor or Bank for Transactions, and by Processor and Bank for fees, Chargebacks, and other amounts due under or in connection with this Agreement (i.e. fines, penalties, attorney's fees, etc). Debit Card means any Visa, Discover or MasterCard cards issued by a non- U.S. bank, any Visa, Discover or MasterCard card that accesses a consumer s asset account within 14 days of purchase, including but not limited to stored value, prepaid, payroll, EBT, gift and Visa consumer check cards, and debit cards validly issued by the debit card networks. "Discount Fee" means the amount charged to Merchant for processing its daily credit Transactions, which is computed as a percentage of the gross amount of Merchant s Sales Records and Credit Records. Discover Program Marks mean the brands, emblems, trademarks, and/or logos that identify Discover Cards. "Electronic Record" means data which is transcribed in a form acceptable to Processor and suitable for electronic processing. 9

10 "Event of Default" means those events listed in Paragraph 24. "Interchange Fee" means the fee which is paid daily by Bank to a Card Organization for entering Sales Records and Credit Records into their respective settlement networks. "Issuing Bank" means the Cardholder's bank, or the bank which has issued a Card to an individual. "Merchant" means the person or entity named in this Agreement and, if approved by Bank, who enters into this Agreement with Bank. "Merchant Account Number" means the number assigned and issued by Bank to Merchant, if and only if, Merchant is approved and this Agreement is accepted by Bank, that numerically identifies Merchant to Processor and Bank for accounting, billing, customer service and other related purposes in connection with the Services. Issuance of the approved Merchant Account Number to Merchant will evidence the acceptance and approval of Merchant for the Services under this Agreement. "Monthly Sales Processing Volume" or "Monthly Sales Volume" means the gross dollar amount of Card Sales Records, before return, refund, or exchange that are generated by Merchant and processed by Processor during a calendar month pursuant to this Agreement. POS device means an electronic device, computer, telephone, or related equipment approved by the Bank for transmission of Transaction data. "Processor" means an entity engaged in the business of processing and transmitting electronic data exclusively of a financial, banking or economic nature, including but not limited to Transactions. Processor initially means Vital Processing Services. For purposes of this Agreement, any reference to Processor shall also mean the provider(s) of services in replacement of Vital PS, selected from time to time by Bank, to provide certain services on behalf of Bank in connection with the Services provided under this Agreement. "Products" means goods and/or services sold, rented or rendered by Merchant. "Recurring Transaction" means a Transaction whereby Merchant charges a Cardholder's Card periodically for recurring goods or services (e.g., monthly insurance premiums, yearly subscriptions, annual membership fees, etc.) which are to be delivered or performed periodically. "Reserve Account" means an account established at and managed by Bank for the deposit of funds received from Merchant pursuant to this Agreement as collateral to protect Bank against actual or contingent liability or losses (i.e. reserves) that might be incurred by Bank should Merchant be unable or fail to pay Chargebacks, adjustments, fees and other charges and obligations due to Bank under this Agreement. "Rules" means the written rules and regulations, system manuals, procedures and requirements, releases and interpretations thereof and other requirements (whether contractual or otherwise) imposed or adopted by any Card Organization as the same may be amended from time to time. "Sales Record" means all documents or the Electronic Record of such documents used to evidence the sale of Products through the use of Cards. The format for each Sales Record must be approved by Bank or supplied by Processor. "Services" means the collective activities undertaken by Bank and Processor (including by or through authorized third party service providers) to authorize, process and settle United States denominated Visa, Discover and MasterCard Transactions undertaken by Cardholders at Merchant's location in the United States and all other activities necessary for Processor and Bank to perform the functions required by this Agreement for all other Cards, if any, that may be covered by this Agreement. "Transaction" means the initiation of a sale inquiry or a consummation of a sale/rental of Products or of a credit to a Cardholder by Merchant by means of a Sales Record or Credit Record, respectively, as well as a Batch closing to Processor. "Transaction Fee" means the cost charged to Merchant on a per Transaction basis. 10

11 Exhibit B Car Rental Reservation Merchants Capitalized terms used in this Exhibit shall have the meaning set forth in the Rules. A car rental company participating in the Visa Reservation Service must accept all Visa Cards in its category of acceptance for reservations. For a Specialized Vehicle or Peak Time reservation, a car rental company must obtain the Cardholder name, account number, and expiration date as displayed on the Visa Card or Visa Electron Card. If a Cardholder reserves a vehicle during Peak Time, the car rental company must inform the Cardholder that the reservation is within a Peak Time period and explain the meaning of Peak Time and may be cancelled without penalty any time up to 8 hours before the scheduled rental time. If a Cardholder is traveling to a car rental location by airline and the flight is cancelled or the airport is closed, the Cardholder may cancel the Peak Time reservation without penalty up to one hour before the scheduled rental time. A car rental company must advise the Cardholder that a "no-show" fee for Peak Time reservations may be billed if the Cardholder has neither rented the vehicle by the end of the guarantee period nor properly cancelled the reservation. The "no-show" fee must not exceed one day's rental plus applicable taxes. If a Cardholder reserves a Specialized Vehicle, the car rental company must inform the Cardholder that the reservation will be held until the scheduled pick-up time, unless cancelled, may be cancelled without penalty up to 72 hours before the scheduled rental time. If the reservation is made within 72 hours of the scheduled rental time, may be cancelled without penalty up to 8 hours before the scheduled rental time. A car rental company must advise the Cardholder that a "no-show" fee for a Specialized Vehicle reservation may be billed if the Cardholder has neither rented the Specialized Vehicle by the end of the guarantee period nor properly cancelled the reservation. The "no show" fee must not exceed 2 days' rental. For a reservation made with at least 72 hours' notice, a car rental company must send the Cardholder a written confirmation containing: Cardholder name, Account Number, and expiration date as displayed on the Visa Card or Visa Electron Card, Name and exact street address of the Merchant Outlet, confirmation code, rate, Cardholder obligations, cancellation and any other service details. For reservations made with less than 72 hours' notice, the car rental company must mail a confirmation only on Cardholder request. A car rental company must accept a reservation cancellation request if made by the specified time and provide a cancellation code and advise the Cardholder to retain it in case of dispute. A car rental company must not require more than 72 hours' reservation cancellation notification before the scheduled rental date of a Specialized Vehicle. If the Cardholder makes the reservation within 72 hours of the scheduled rental date, the cancellation deadline must be 12 hours before the scheduled rental time on the scheduled pick-up date. If requested, a car rental company must provide the Cardholder with a written reservation confirmation that contains the following information: Cardholder name, account number, Card expiration date as displayed on the Visa Card, cancellation code and cancellation details. A car rental company must hold a Specialized Vehicle according to the reservation if the Cardholder has not claimed or properly canceled the reservation by the specified time. The car rental company may then prepare a Transaction receipt with the following information: No-Show Transaction fee plus tax, as applicable (the amount of the No-Show Transaction must not exceed the value of: 2 days' rental, including tax, for a Specialized Vehicle reservation, one day's rental, including tax, for a Peak Time reservation), Cardholder name, account number, and expiration date as displayed on the Card and the words "No-Show" on the signature line of the Transaction receipt. If a vehicle guaranteed as a Peak Time reservation is unavailable, the car rental company must provide the Cardholder with a comparable vehicle no later than one hour from the scheduled rental time. If a comparable vehicle cannot be provided within one hour, the car rental company must provide the following services at no charge to the Cardholder: transportation to the Cardholder's destination, delivery of a comparable vehicle to the Cardholder's destination within 8 hours from the scheduled rental time and transportation, vehicle delivery, and one day's car rental. If a reserved Specialized Vehicle is unavailable, a car rental company must provide the following services at no charge to the Cardholder: comparable vehicle at another car rental establishment for the reservation period and transportation to the alternate car rental establishment. 11

12 Terms used in this Exhibit shall have the meaning set forth in the Rules. Exhibit C Hotel Reservation Service Merchants A hotel or its third-party booking agent must obtain the Cardholder name, account number, and Card expiration date displayed on the Card for each reservation. A hotel or its third-party booking agent accepting a reservation must quote the reserved accommodation rate and the exact name and physical address of the establishment. A hotel or its third-party booking agent must inform the Cardholder that one night's lodging will be billed if the Cardholder has not either: registered by check-out time the day following the scheduled arrival date or properly canceled the reservation. A hotel or its third-party booking agent must provide a reservation confirmation code and advise the Cardholder to retain it in case of dispute. A hotel or its third-party booking agent must provide to the Cardholder reservation information and, if requested, a written confirmation with the following information: cardholder name, account number, and Card expiration date, confirmation code, exact physical address of the establishment, Hotel Reservation Service provisions relating to the Cardholder's obligations and any other reservation details. A Hotel or its third-party booking agent must accept all reservation cancellations before the specified notification time. The Hotel or its third-party booking agent must not require cancellation notification more than 72 hours before the scheduled arrival date. If a Cardholder makes the reservation within 72 hours of the scheduled arrival date, the cancellation deadline must be no earlier than 6:00 p.m. Merchant outlet time on the arrival date or date guaranteed. If the hotel or its third-party booking agent requires that a Cardholder cancel before 6:00 p.m. Merchant outlet time on the date guaranteed, the hotel or its third-party booking agent must mail the cancellation policy, including the date and time that cancellation privileges expire, to the Cardholder. A hotel or its third-party booking agent must provide a reservation cancellation code (if the reservation is properly cancelled) and advise the Cardholder to retain it in case of dispute. If requested by the Cardholder, a hotel or its third-party booking agent must mail a confirmation of cancellation. The confirmation must include the following: cardholder name, account number, and Card expiration date, cancellation code and any other cancellation details. If a Cardholder has not claimed or cancelled the Hotel Reservation Service accommodations by the specified time, the hotel or its third-party booking agent must hold the reserved rooms available until check-out time the following day. The Hotel or its third-party booking agent may then complete a Transaction Receipt that must contain: amount of one night's lodging plus applicable tax, cardholder name, account number, and Card expiration date and the words "No-Show" on the signature line of the Transaction receipt. If the accommodations guaranteed by the Hotel Reservation Service are unavailable, the hotel must provide the Cardholder with the following services at no charge: comparable accommodations for one night at another establishment, if requested, a 3-minute telephone call and message forwarding to the alternate establishment and transportation to the alternate establishment. A lodging Merchant participating in the Visa Reservation Service must accept all Visa Cards in its category of acceptance for reservations. 12

13 Exhibit D Advance Deposit Service Merchants Capitalized terms used in this Exhibit shall have the meaning set forth in the Rules. A Merchant participating in the Advance Deposit Service must obtain from the Cardholder: Cardholder name, account number, and expiration date as displayed on the Visa Card or Visa Electron Card, telephone number and mailing address, scheduled date of arrival for a hotel, or embarkation for a cruise line and intended length of stay or voyage. A Merchant participating in the Advance Deposit Service must determine the Advance Deposit Transaction amount, not to exceed the following: for lodging accommodations, the cost of the intended length of stay (not to exceed 14 nights), and cost of the cruise. The deposit amount must be applied to the total obligation. A Merchant participating in the Advance Deposit Service must inform the Cardholder of the following, as applicable: reserved accommodation rate and the Transaction amount, exact Merchant name and location, name of the cruise ship and point of embarkation, Merchant's intention to hold the accommodation for the number of nights paid for and Merchant cancellation policy. A Merchant participating in the Advance Deposit Service must provide a confirmation code, and advise the Cardholder to retain it, advance deposit requirements, cancellation policy requirements, and the actual date and time that the cancellation privileges expire. Merchant must advise the Cardholder that it will hold the accommodations according to the reservation and provide written confirmation of a Cardholder reservation change if requested. A Merchant participating in the Advance Deposit Service must advise the Cardholder that it will retain the entire Advance Deposit Transaction amount or the amount specified in Merchant's stated policy if the Cardholder has not: registered by check-out time the day following the specified last night of lodging for a hotel (the Cardholder will lose the unused amount of the reservation), checked in by embarkation time for a Cruise Line, canceled the reservation within the time limit specified by Merchant under the Advance Deposit Service, a Merchant must not charge the Cardholder for a No-Show Transaction. A Merchant participating in the Advance Deposit Service must complete a Transaction receipt with the following information: Advance deposit amount, Cardholder name and Account Number, Cardholder telephone number and mailing address, the words "Advance Deposit" on the Transaction receipt signature line, confirmation code, scheduled check-in or embarkation date, date and time that cancellation privileges (if any) expire without deposit forfeiture for unused accommodations. Merchant must mail the Transaction receipt copy and cancellation policy to the Cardholder within 3 business days of the Transaction date. A Merchant participating in the Advance Deposit Service must accept all Cardholder cancellations within the time limits specified the by Merchant. Merchant must provide a cancellation code and advise the Cardholder to retain it in case of dispute. A Merchant participating in the Advance Deposit Service must complete a Transaction receipt, including all of the following: Transaction amount, Cardholder name, Account Number, and expiration date as displayed on the Visa Card or Visa Electron Card, Cardholder mailing address, cancellation code and the words "Advance Deposit" on the Transaction receipt signature line. Within 3 business days of the Transaction date on the Credit Transaction receipt, a Merchant participating in the Advance Deposit Service must: deposit the Credit Transaction receipt, mail the Cardholder's copy to the Cardholder, deposit the Credit Transaction receipt within 5 calendar days of the Transaction date and mail the Cardholder's copy to the Cardholder within 3 calendar days of the Transaction date of the Credit Transaction receipt. If hotel accommodations reserved under the Advance Deposit Service are unavailable, Merchant must provide the Cardholder with the following services without charge and credit refund for the entire Transaction amount. Merchant must provide the Credit Transaction receipt copy to the Cardholder. Merchant must provide comparable accommodations at an alternate establishment for the number of nights specified in the reservation (not to exceed 14 nights) or until the reserved accommodations become available at the original establishment. If requested, 2 3-minute telephone calls and message forwarding to the alternate establishment and transportation to the alternate establishment's location and return to the original establishment. If requested, Merchant must provide daily transportation to and from the alternate establishment. If cruise line accommodations reserved under the Advance Deposit Service are unavailable, and no comparable accommodations are available on the ship, Merchant must offer the Cardholder a comparable cruise of similar itinerary and embarkation date at no additional cost to the Cardholder. If the Cardholder accepts the alternate accommodations, Merchant must provide either of the following services without charge: an additional night's accommodation, airfare to a different port city. If the Cardholder declines the alternate accommodations, Merchant must provide a credit refund for the entire Advance Deposit Transaction amount. Merchant must provide a copy of the Credit Transaction receipt to the Cardholder. In addition, Merchant must provide the Cardholder all of the following without charge: one night's Hotel accommodation, if the Cardholder requests it transportation to the hotel and airport, airline transportation to the airport nearest the Cardholder's residence and reasonable out-of-pocket expenses incurred by the Cardholder. 13

14 Exhibit E PCI Compliance Are You Adequately Protecting Your Customer s Data? Don t answer yes too quickly! Most merchants have found there is room for improvement and the consequences for not adequately protecting customer information can be devastating! Massive fines, loss of customers and loss of reputation are all at risk. Every merchant, regardless of size, retains some sort of sensitive customer data. This data can exist in written or electronic formats and ranges from credit card or customer receipts to purchase orders, databases, customer profiles, web pages and much more. Recently, we have seen a large increase in criminal elements targeting smaller businesses, including retailers and restaurants, using processing methods identical to yours. When these criminals are successful and data breach occurs, the results are generally catastrophic to the businesses. We want to help ensure your business is adequately protecting data and help identify the areas to improve. Upon issuance of a merchant number, you will receive information on how to ensure your compliance by enrolling in our PCI compliance program at Don t put your livelihood at risk! This program provides you with tools to help you validate compliance and protect your business for long-term data security, including: Access to the Trustwave TrustKeeper compliance portal for PCI DSS validation services, featuring the PCI Wizard to help identify your business steps for compliance Access to the Security Policy Advisor to help you both comply with PCI DSS policy requirements, and develop your own unique internal best practices Access to the TrustKeeper Agent, to simplify the process and provide ongoing compliance monitoring On-line help text, tutorials and education An additional benefit of this program is to provide your business with protection in the event of a card data compromise. Breach Coverage provides you with up to $25,000 per MID to help cover such costs as forensic investigation expenses, card reissuance and monitoring costs, card brand fines and other associated costs. Once you have activated your account in TrustKeeper, you are automatically enrolled. Frequently Asked Questions: Q: Is PCI compliance required? A: Yes, all merchants are required to certify compliance. All merchants need to register and complete the questionnaire to make sure they are compliant and storing customer s cardholder information in a safe and secure manner. All merchants must complete the SAQ annually. A vulnerability scan, depending on processing, business and sales methods may also be required. Larger merchants have had a much more rigorous requirement for some time. For additional information on keeping your business safe and secure, visit the MasterCard and Visa Merchant Risk Council site at: or Q: What if I just completed a certification? Do I have to complete a new one with you? A: If you currently have a PCI certification certificate, provide us with a copy and we will honor it until the expiration date printed on the certificate. At that time you will need to register with Trustwave. Q: Do I have to register with and complete the SAQ before you ll open my account? A: No, however we request that you register with our industry leading program and complete the certification steps within 30 days of opening your merchant account. Q: Will you close my account if I don t pass the questionnaire? A: No, we will not close your account. The SAQ is designed to assist you in finding potential liabilities, weaknesses or holes in your process. Once found, Trustwave will work with you to correct them or provide access to additional resources. However, failure to take action puts both our businesses at risk and may result in future closure of your account. Q: How much time does this take? A: The time it takes to complete registration and SAQ varies based on your business and sales methods. Regardless of the time or money, if you do not take a few moments to review your data security against the set standard, you may be putting your entire business at risk. 14