Tasks for which the efaktura connection unit is responsible are performed by Nets Norway AS (Nets) on behalf of the bank.

Transcription

1 A. Introductory provisions 1. Brief description of the service efaktura B2C is a service for the electronic transmission and presentation of payment claims and invoices in the invoice recipient s (payer s) online banking system. The transmission of payment claims and invoice specifications is conditional on the invoice recipient and their bank being connected to the efaktura B2C service. Tasks for which the efaktura connection unit is responsible are performed by Nets Norway AS (Nets) on behalf of the bank. 2. Agreement conclusion and scope This agreement is concluded between the invoice issuer and the bank. This agreement is conditional on the completion of the Bank customer registration form, where the selected invoice hotel is specified. The user documentation is part of this agreement. The invoice issuer must familiarise themselves with the user documentation before starting to use the service, and must abide by the instructions specified therein. Updated user documentation to supplement this agreement can be obtained on application to the bank. The current user documentation can also be downloaded from In the event of discrepancies between this agreement and the user documentation, the information in the user documentation shall apply. To receive electronic return information about credits to their account (OCR giro or EDIFACT-based notification), the invoice issuer must conclude a separate agreement with the bank. The agreement does not apply to the technical implementation of the solution for the invoice issuer or the relationship between the selected invoice hotel and the invoice issuer (see also part C on invoice hotel requirements). 3. Test The invoice issuer must conclude an agreement on efaktura B2C with the bank before using the service. The invoice issuer s technical solution, including the invoice specification, shall be tested before entering into production. The planning, implementation and approval of this test must be carried out as described in the user documentation. 4. Consent for the transfer of information The invoice issuer permits information about the invoice issuer such as name and account number to be sent to other banks, payment centres and other parties to the extent deemed necessary for the bank to be able to perform the service. 5. Subcontractors Each party is responsible for their own subcontractors as if they themselves were performing the service. 6. Prices The costs of establishing, having and using efaktura B2C shall be specified in the bank s current price list, account information and/or made known by other means unless the parties have agreed special prices for the service. Unless otherwise agreed between the bank and customer, the prices may be amended by the bank two weeks after written notice is sent to the customer. The invoice issuer consents to the bank charging the account specified, cf. the Bank customer registration form. Page 1 of 8

2 B. Performance of the service 7. Marketing The invoice issuer must make their customers aware that they offer efaktura B2C and provide the invoice recipient s efaktura reference number on their paper invoices. The bank recommends that the invoice issuer uses the efaktura logo in their marketing to ensure efficient and recognisable communication. The correct logo design is shown in the brand manual at 8. Registration and deregistration of the invoice recipient The invoice issuer s customers (i.e. current invoice recipients) must actively notify the invoice issuer via the current registration solutions that they wish to use efaktura B2C before the invoice issuer can send the payment claim and invoice information using the efaktura B2C solution. Registrations shall be made electronically available to the invoice issuer for verification and approval, and saved in a central connection register. The invoice issuer must process registrations and deregistrations before the deadline specified in the efaktura B2C user handbook. The invoice issuer must be notified of deregistration of an invoice recipient, i.e. when the invoice recipient no longer wishes to receive invoices electronically via their online banking system, in the same way that they are notified of invoice recipient registrations. The invoice issuer must maintain an overview of all invoice recipients receiving electronic invoices at any given time. 9. Responsibility for invoice content The invoice issuer is responsible for the design and content of the electronic invoice. The invoice issuer is also responsible for ensuring that the content complies with the legislation and regulations applicable for this area at any given time. An efaktura must always contain an actual invoice, and the invoice recipient must always receive this invoice before any other content. An invoice issuer subject to the requirements in the PCI 1 standard must not enter credit card numbers (PAN Primary Account Number) in clear text in the efaktura B2C solution, e.g. in the KID field. However, an abbreviated PAN is permitted (6 first + any other 4 characters in clear text). 10. Processing of personal information Roles and responsibilities when processing personal information in the efaktura B2C service are specified in Issuer s roles and responsibilities when processing personal information in the efaktura B2C connection unit, see Appendix 2 of this document. If the invoice issuer or an invoice hotel for which the issuer is responsible knows that the personal information for which the issuer is responsible has been or may be compromised, the issuer must notify the Norwegian Data Protection Authority of this in accordance with sections 2 6, paragraph 3 of the Norwegian Personal Data Regulations. If the deviation has consequences for the efaktura B2C service, notification must also be sent to the bank and/or the bank s employees. The invoice issuer must disclose the notification points that the bank and its employees must use when sending deviation notifications or if personal information has been or may be compromised. 11. Documentation and archiving obligation The bank is not responsible for ensuring that the legally-required documentation and archiving obligation is satisfied for the invoice issuer and/or payer. 1 PCI is Payment Card Industry Page 2 of 8

3 12. Transfer of efaktura information When using efaktura B2C, the invoice issuer must transfer the payment claim and Internet address (URL) belonging to the invoice specification to the efaktura connection unit. The invoice issuer must also have transferred the invoice specification to the selected invoice hotel prior to this. The connection unit sends the payment claim and Internet address to the invoice recipient s bank. The invoice recipient s bank shall give the invoice recipient access to the payment claim and invoice specification in the online banking system with the option of paying using existing payment services. The invoice issuer is responsible for ensuring that the efaktura B2C connection unit has the necessary information to make the invoice specification available to the invoice recipient (cf. the efaktura user handbook). 13. Communication Transfer of data files from the invoice issuer to the efaktura B2C connection unit shall be carried out using the format and transfer protocol that was agreed and approved. The payment claim and Internet address for the invoice specifications based on the information given to the connection unit must then be made available to the invoice recipient through their online banking system. The invoice issuer cannot expect a payment claim and invoice information to be stopped after the data file has been received by the connection unit. The invoice issuer must ensure that no malicious software is transmitted (viruses, trojans and similar). 14. Transfer of liability The bank is responsible for transmitting the payment claim and Internet address for the invoice specification to the invoice recipient s bank when the efaktura B2C connection unit has sent the invoice issuer a receipt for the received data file. 15. Operational requirements The invoice issuer must meet the requirements for uptime, availability, response times, deviation management and customer service specified in the user documentation. Incorrect data from the invoice issuer which gives rise to production problems for the efaktura B2C connection unit must be corrected immediately and may lead to temporary lockout from the service until the incorrect data is corrected. C. Invoice hotel 16. Selection of invoice hotel The invoice issuer can choose whether they want to perform the invoice hotel s tasks or engage a subcontractor (invoice hotel). If the invoice issuer chooses to purchase this service from the bank, the terms and conditions in Appendix 1 of this document apply. If the invoice issuer assigns the task to an invoice hotel that is not the one the bank offers, it is the responsibility of the invoice issuer to ensure that the invoice hotel meets the requirements of this agreement and the user information. A list of current invoice hotels with solutions offered in the market can be found at or requested from the bank. 17. Storage of invoice specification The invoice specifications must be kept available to the invoice recipient for an agreed period after it is sent by the invoice issuer. This applies regardless of whether the payment claim has been paid or not. The agreed period is defined in the efaktura B2C user handbook. The invoice specification must be archived as specified in the efaktura B2C user handbook as it was originally presented. The requirement for storing invoice specifications applies even if the invoice issuer changes invoice hotel or stops using efaktura B2C. Page 3 of 8

4 18. Security solution The invoice issuer or/or its employees must use the approved security solutions described in the user documentation. 19. Requirements for agreements with invoice hotels The invoice issuer must conclude a data processing agreement with an invoice hotel that satisfies the Norwegian Data Protection Authority s requirements, see One such invoice hotel that the invoice issuer may use is specified in Appendix 3 of this document. The invoice issuer must, in the data processing agreement with the invoice hotel, ensure that the bank and/or the bank s data processor for the efaktura joint service is entitled to block access to the efaktura B2C connection unit if Nets receives notification of errors in the invoice hotel s systems that have led to or shall lead to personal information being compromised. D. Final provisions 20. Amendments to the agreement The bank must notify the invoice issuer of amendments to the agreement/service including the user information. The invoice issuer must be informed of any amendments that shall impact significantly on them at least 14 days in advance. The invoice issuer must normally be informed of amendments that shall impact on their operating procedures and systems six months before they enter into force. The invoice issuer must make adjustments for the amendment no later than six months after they receive written notification of the amendment. Nets shall send a notification on behalf of the bank to the contact person the invoice issuer specified in the Bank customer registration form. 21. Compensation liability The parties are liable for any direct and foreseeable financial losses suffered by the other party as a result of breach of this agreement or other liability-incurring acts. The parties are not liable providing the breach is due to circumstances outside of the parties control that the parties cannot reasonably be expected to have foreseen at the time of agreement, or cannot reasonably be expected to have avoided or overcome the consequences thereof. Parties are only liable for indirect losses suffered by the other party if the loss is a result of gross negligence or wilful misconduct on their part. In the event of an unusual situation arising which is outside of the parties control and which makes compliance with this agreement very difficult (force majeure), the parties obligations shall lapse for as long as the situation lasts. 22. Termination of the agreement The invoice issuer can terminate their agreement with the bank with one day s written notice. The bank may terminate the agreement with four weeks written notice to the invoice issuer. Each party is entitled to terminate the agreement with immediate effect in the event of a material breach on the part of the other party. The bank must specify the reason for termination. If the invoice issuer closes the invoice account linked to the efaktura B2C agreement, this agreement shall be automatically terminated. If the efaktura B2C agreement is terminated, the bank will normally still send and present payment claims already submitted. Page 4 of 8

5 Appendix 1 Template agreement when using the invoice hotel provided by Nets Norway AS (Nets) The terms and conditions in this Appendix 1 apply if the invoice issuer chooses to use the invoice hotel provided by the banks operator Nets Norway AS (Nets) for efaktura B2C. 1. Requirements for Nets invoice hotel Nets invoice hotel must satisfy all the invoice hotel requirements specified in the agreement between the bank and the invoice issuer and by the user documentation. The bank is responsible for ensuring that Nets invoice hotel satisfies these requirements. 2. Invoice issuer s options If the invoice issuer uses Nets invoice hotel, they can choose whether to use the standard or custom invoice template. If using a custom invoice template, they must use a separate test procedure from Nets. 3. Completion of the Bank customer registration form The invoice issuer must specify that they have selected Nets invoice hotel in the Bank customer registration form and type solution, cf. section Amendments When the invoice hotel has been tested and entered into production, the parties must keep each other informed of any amendments as follows: The bank (or Nets on behalf of the bank) must inform the invoice issuer of amendments that may impact on the invoice issuer no later than four weeks before the amendment enters into force. The invoice issuer must inform the bank and/or Nets of relevant amendments that shall impact on the performance of the service no later than four weeks before the amendments enters into force. 5. Invoice templates The invoice issuer owns all rights to custom invoice templates that they have paid for and saved in Nets invoice hotel. The invoice issuer may, on agreement, amend existing templates in the invoice hotel. 6. Processing of personal information The invoice issuer must conclude a data processing agreement with Nets invoice hotel which satisfies the Norwegian Data Protection Authority s requirements, see One such invoice hotel that the invoice issuer may use is given in Appendix Functionality and technical documentation A more detailed description of the functionality and technical documentation is available at 8. Prices and invoicing for using the banks invoice hotel The price for using Nets invoice hotel shall be agreed with the bank. 9. Termination of the agreement The invoice issuer can terminate their agreement with Nets invoice hotel with one day s written notice. The bank may terminate the agreement with four weeks written notice to the invoice issuer. Each party is entitled to terminate the agreement with immediate effect in the event of a material breach on the part of the other party. The bank must specify the reason for termination. If the invoice issuer closes the account connected to the efaktura B2C agreement, this agreement shall be terminated automatically. Page 5 of 8

6 Appendix 2 Issuer s roles and responsibilities when processing personal information in the efaktura B2C connection unit 1. General efaktura B2C is a service offered by the banks to invoice issuers ( issuer ) and their customers ( payer ). An issuer is a company or organisation (legal entity) that makes an invoice electronically available to a payer. Issuers are also called invoice issuers in the user documentation for the efaktura B2C service. When using the efaktura service, the payment claim is transferred from the issuer to a connection unit, which makes it available to the payer s bank(s). The invoice must be made available as a link to the e-invoice or by forwarding a data file. The payer can then bring up a collective overview of their payment claims in the online banking system(s), with the option of clicking on an icon to view the underlying invoice specification saved in the invoice hotel. The payer shall also have the option of paying using existing payment services in the online banking system. If the payer is a customer at several banks, the payer s e-invoices will be visible in all the online banking systems for which they have agreements, and they may choose the online banking system and account from which they wish to pay the invoice. The efaktura connection unit is a joint function for all banks that use the efaktura service. The function was developed by Nets Norway AS (hereinafter referred to as Nets) and is a standardised operating solution offered to all banks in Norway in accordance with the agreement with Finance Norway (FNO). 2. Agreements between the parties The issuer concludes an agreement with a bank for invoices and payment claims (hereinafter referred to as invoices ) to be sent electronically from the issuer to the payer. The payer concludes an agreement with the bank for the invoice to be presented in their own online banking system. The aim is to enable efaktura to be integrated with the payment services that are offered by each individual online banking system at any given time. The issuer must conclude an agreement with an approved invoice hotel on storing and presenting invoice information. The payer, via the payment claim in the efaktura connection unit, shall be able to gain access to their invoice information in the online banking system(s) for which they have concluded agreements with the bank(s) to use. The bank(s) shall conclude a service agreement with Nets on access to the efaktura service (including the connection unit) for customers with their own online banking systems and requirements for an agreement between the bank and issuer as well as between the issuer and invoice hotel. Nets shall also conclude a collaboration agreement with current invoice hotels on e.g. the implementation and operation of the efaktura service and notification of amendments to invoice hotels already in production. 3. Data controller for personal information The issuer is the data controller for personal information made available to the banks operator of the efaktura connection unit and the banks customers in the online banking system, cf. section 2(4) of the Norwegian Personal Data Act. An invoice hotel can only process personal information in accordance with a data processing agreement concluded with the invoice issuer, cf. sections 8, 13 and 15 of the Norwegian Personal Data Act. Each bank is responsible for processing information on its own invoice recipients for physical persons and for the accuracy of the information the bank has entered in the registers in the connection unit. The bank is also responsible for processing information that the bank, in accordance with the rules here, has received from the registers in the connection unit. However, the bank is not responsible for the accuracy of the claim the invoice issuer claims to have and as specified in the e-invoice and/or the electronic payment claim, including the invoice recipient that the invoice issuer believes the claim can be raised against or sent to. When the electronic payment claim has been processed in a bank s online banking system, it is this bank that is then responsible for processing information relating to this payment claim. Page 6 of 8

7 Appendix 2 - continue Issuer s roles and responsibilities when processing personal information in the efaktura B2C connection unit Nets must, in accordance with the agreement with the bank, ensure that a valid link leading to the invoice information is made available to the bank and payer, but Nets is not responsible for the content of the link (i.e. the invoice information). If, in its link, an invoice hotel indicates another person s invoice, Nets is not responsible for this. Nets is also responsible for ensuring that approved information fields are linked to the correct personal identification number when information is sent from the issuer register, receiver register or payment claim database. Nets is not, however, responsible for the content of these fields. If the bank or issuer enters incorrect information, the bank and/or issuer is responsible for any errors that arise as a result of this. 4. Information made available in the efaktura connection unit Below is an overview of the personal information processed when using the efaktura B2C connection unit operated by Nets and the exchange of information between the parties in different stages of the process. Issuer agreement This agreement is concluded between the issuer and bank, and the technical registration information is sent from the bank to Nets for entry into the issuer register. The agreement contains the following minimum information: Issuer s business registration number Issuer s name Issuer s address Issuer s selection of invoice hotel Status of the agreement Issuer s contact information Information on various technical options User agreement This agreement is concluded between the user (payer) and their bank. The agreement information for the payer that is sent from the bank to the agreement register in the connection unit (at Nets) is as follows: Issuer ID=business registration no (of the issuer with which the user wishes to conclude an agreement) Users: o Address o Telephone (optional) o efaktura reference o Agreement information (optional payer s free text) o First name o Surname o Personal identification number or Business registration number o Means of notification (none, text message, ) Agreement information, user (payer) Information sent to the issuer in files must be approved by the payer and contain the following information: Issuer ID = business registration number efaktura reference First name (optional) Surname Address Personal identification number, if the issuer is authorised in accordance with sections 8, 9, 11 and 12 of the Norwegian Personal Data Act (only a few issuers receive this), or business registration number The issuer approves or rejects agreements, and this is communicated to the connection unit. Page 7 of 8

8 Appendix 2 continue Issuer s roles and responsibilities when processing personal information in the efaktura B2C connection unit Payment claims The company (issuer) sends the payment claims it has on file to the connection unit. The payment claims contain the following information: Creditor s account number Issuer s business registration number efaktura reference KID (optional) Amount Due date URL for invoice information Payment type (efaktura or combination efaktura or AvtaleGiro) Issuer s name 5. Deviations If the issuer or an invoice hotel for which the issuer is responsible knows a deviation has resulted in the unauthorised transmission of personal information for which the issuer is responsible and for which confidentiality is necessary, the issuer must notify the Norwegian Data Protection Authority of this in accordance with sections 2-6, paragraph 3 of the Norwegian Personal Data Regulations. If this deviation has consequences for the efaktura service, notification must also be sent to the bank and/or the bank s employees to the notification points the bank has specified. The issuer must disclose the notification points that the bank and its employees must use when sending deviation notifications. The issuer must, in the data processing agreement with the invoice hotel, ensure that the bank and/or the bank s data processor for the efaktura joint service, Nets Norway AS (Nets), is entitled to block access to the efaktura connection point if Nets receives notification of errors in the invoice hotel s systems that have led to or shall lead to personal information being compromised. See also the agreement terms and conditions for efaktura between the invoice issuer and the bank and Agreement outline data processing agreement in accordance with the Norwegian Personal Data Act between the invoice issuer and the invoice hotel. Page 8 of 8