Terms and Conditions for Electronic Data Transmission (EDT) using bankline ( bankline Terms and Conditions )

Transcription

1 Terms and Conditions for Electronic Data Transmission (EDT) using bankline ( bankline Terms and Conditions ) 1 Scope of services (1) Deutsche Bank (the Bank ) is available to its Customers, and/or Customer Affiliate(s) within the meaning of section 15 of these Terms and Conditions, for EDT using bankline ( bankline Service ). A prerequisite is the conclusion of a valid Agreement on the Use of Electronic Data Transmission using bankline ( Agreement ) and where applicable, the conclusion of a bankline Accession Agreement by the Customer Affiliate. The Customer and each Customer Affiliate are referred to in the following either individually or jointly as Account Holder. The bankline Service comprises placing orders and exchanging data (transmission of orders and retrieval of information). In accordance with section 14 (2) of these Terms and Conditions, the Bank is hereby authorised and mandated to forward orders and transmit such orders for processing to its relevant branch or subsidiary bank where the relevant account/s is/are held (account maintaining unit). An account held at a subsidiary bank of the Bank as the account maintaining unit can only be admitted to the bankline Service after the Bank has received a duly countersigned confirmation from this subsidiary bank by way of the Form for Agreement with Account Maintaining Unit. (2) The Bank will notify the Customer of the types of services which the Account Holder may use within the scope of the bankline Service. The retrieval rights and disposal limits set out by the Customer in the Agreement apply to the use of the bankline Service. If a User is allocated the right to retrieve the Online Account Statement Information or one of the business transaction codes to retrieve account information (e.g. the business transaction code STA ), they are given access to the account information relating to all of the accounts held by every Account Holder included in the bankline Service and the account information pertaining to all of these accounts is made available to them. To this end, the respective User is authorised explicitly by each Account Holder to retrieve this account information. Each Account Holder shall explicitly consent to this process and release the Bank from its duties arising out of the obligation to maintain banking secrecy to the extent that this is required to exercise the aforementioned retrieval rights. (3) EDT is established via the bankline connection (Appendix 1). (4) The structure of data records and files for the transmission of orders and for the retrieval of information is set out in the specification of data formats (Appendix 3). (5) Accounts held at a financial institution which does not belong to Deutsche Bank Group (third-party bank) can only be admitted to the bankline Service if the Bank receives sufficient written confirmation from the third-party bank that the Account Holder (i) has authorised the third-party bank to carry out instructions forwarded by the Bank in accordance with these bankline Terms and Conditions and (ii) has concluded a separate agreement with the third-party bank in order to ensure that the Bank receives the account information for the account in question. 2 Users, identification media and security procedures (1) Orders for included accounts may only be placed via the bankline Service by individuals who have been authorised to do so by the respective Account Holder and who have been activated by the Bank ( Users ). For the authorisation of the order data transmitted via the bankline Service, each User requires individual identification media activated by the Bank. In addition, each User must perform the corresponding security procedures for accessing the bankline Service. The requirements for identification media and the duties in connection with the security procedure are defined in Appendix 1. If agreed with the Bank, in exceptional cases, order data transmitted via bankline may be authorised by a duly signed accompanying note. (2) Identification media are payment authentication instruments within the meaning of section 1 (5) of the Payment Services Regulation Act (Zahlungsdiensteaufsichtsgesetz / ZAG). 3 Procedural requirements (1) The bankline Service agreed between the Account Holders and the Bank will be subject to the requirements described in Appendix 1 and in the specification of data formats (Appendix 3). With effect from 1 February 2014, the Account Holder is obliged to only submit credit transfers and direct debit orders for payments in euro within the European Economic Area in the ISO format as set out in Appendix 3. For direct debit orders for payments initiated by the use of a payment card at a point of sales, resulting in a direct debit from a domestic payment account (section 7 c (1) ZAG) the ISO format does not become mandatory until 1 February (2) Each Account Holder is obliged to ensure that the Users observe the requirements for the bankline Service and the relevant specifications and duties that apply in their case. (3) Data field configuration is governed by the rules for configuration and stipulations of the format used in each case (Appendix 3). (4) The User must correctly state the account identification code (account number or IBAN) of the payee or the payer and as far as required the payments service provider identification code (bank sort code or BIC) of the payee s payments service provider or the payer s payments service provider (paying agent). The payment service providers involved in the settlement of the payment order are authorised to process the transaction exclusively on the basis of the account identification code and if stated the payments service provider identification code. Payment orders may be misdirected if the Customer enters incorrect or incomplete information. Any disadvantages or damages incurred as a result must be borne by the respective Account Holder. 1 / 9

2 (5) Prior to the transmission of order data to the Bank, a record must be produced of the full content of the files to be transmitted for order data generated in external programs. Unless otherwise agreed, each Account Holder must store this record for a minimum period of 30 calendar days from the date of execution in such a form that it can be made available to the Bank again at short notice at its request. (6) Any data which the Bank makes available to an Account Holder on payment orders whose settlement is not yet final merely constitute non-binding information. These data will be specifically marked as such. (7) The order data must be authorised either by means of an electronic signature ( Electronic Signature or ES ) or, if agreed with the Bank, the signed accompanying note. This order data will be effective as an order a) for data submitted with an Electronic Signature provided: all necessary Electronic Signatures of the Users have been supplied via EDT within the agreed time frame and the Electronic Signatures could be successfully verified by using the agreed keys; or b) for data submitted with an accompanying note, provided: the Bank received the accompanying note within the agreed time frame and the accompanying note was signed according to the authorisation to operate the account. 4 Duties of care with respect to handling identification media that are required to authorise orders (1) Each Account Holder is obliged to ensure that the Users observe the procedure on the handling of identification media set out in Appendix 1. (2) Users can issue orders by using identification media activated by the Bank. Each Account Holder must ensure that each User takes precautions against any other person obtaining possession of their identification medium (e. g. smart card) or gaining knowledge of the password protecting it. This is because any other person in possession of the device or a copy thereof can misuse the agreed services in conjunction with the corresponding password. In particular, the following must be observed in relation to maintaining the confidentiality of the identification media: data verifying the identity of the User must not be stored outside of the identification medium, e.g. on the computer s hard drive; the identity verification device must be removed from the reading device after use of the bankline Service and stored under lock and key; the password protecting the identity verification device must not be noted down anywhere or saved electronically; and it must be ensured that others are not able to spy out the password when it is being entered. 5 Duties of care with respect to security procedures required for the exchange of data Each Account Holder is obliged to ensure that the Users observe the procedure on the handling of security procedures set out in Appendix 1. Moreover, each Account Holder is obliged to ensure that each User that they have authorised takes the necessary measures to prevent any other person from gaining access to and using the bankline Service through the use of their User ID and password. This is because any other person can misuse the bankline Service if they gain access to it. 6 Suspending access to bankline (1) If the identity verification devices are lost or security procedures are infringed, passwords are divulged to other persons or there is suspicion that this information has been divulged or that misuse has occurred, the relevant Account Holder or User must have the User s access to bankline suspended by the Bank without delay. The Account Holder or User can also submit a suspension request to the Bank by using the contact details provided separately. (2) The Customer can have a User s access to bankline or all access to the bankline Service suspended also by using the suspension facility of which the Bank has provided information separately. (3) The Bank will suspend the User s access to bankline if the password is entered incorrectly five times in a row when logging on to bankline. In this case, the relevant Account Holder or User should contact the Bank as quickly as possible. (4) The Bank will suspend all access to bankline if it has reason to suspect or if there is a risk that the access to it is being improperly used. The Bank will inform the Customer (acting on its own behalf and on behalf of the Customer Affiliates) accordingly outside the bankline Service. The suspension cannot be lifted via bankline. 2 / 9

3 7 Processing of incoming order data by the Bank (1) The order data transmitted to the Bank via bankline are processed during the normal course of business. (2) The Bank will verify the identity of the User(s) and the authorisation of the order data transmitted via bankline by means of the Users Electronic Signatures generated by the identity verification devices or by means of the transmitted accompanying note and will also verify the conformity of the order data records with the provisions set out in Appendix 3. If this verification procedure reveals any discrepancies, the Bank will not process the order data in question and will notify the Customer thereof immediately. The Bank is entitled to delete any order data that have not been fully authorised within the time limit. (3) If errors are revealed in files or data records by the Bank s verification procedure pursuant to Appendix 3, the Bank will indicate in an appropriate form which files or data records are incorrect and inform Users of this immediately. The Bank is entitled to exclude incorrect files or data records from further processing if a proper execution of the order cannot be ensured. (4) The Bank is obliged to document these procedures (see Appendix 1) as well as the forwarding of orders for processing in the Customer s electronic protocol. Each Account Holder is in turn obliged to retrieve the electronic protocol promptly and to obtain information on the processing status of the order. If the Account Holder detects any discrepancies, it must contact the Bank. (5) Special features applicable to urgent payments: For accounts under this Agreement, in accordance with the provisions of this paragraph, the Bank will execute both eurodenominated domestic payment orders and foreign payment orders as urgent provided these are marked by the business transaction code used for urgent orders and have an Electronic Signature. The same applies to regional holidays, i.e. holidays that are not TARGET holidays. For euro-denominated foreign payment orders, special configuration guidelines are outlined in Appendix 3, specification of data formats. The Account Holder is obliged to retrieve the report on the urgent payment orders directly after they have been issued. The Bank will arrange for same-day settlement and forwarding to the Deutsche Bundesbank s Target2 clearing system with specification of same-day value provided it has received properly issued urgent domestic payment orders by 2 p.m. The Bank will endeavour to carry out transmission with same-day value dates if it receives such orders between 2 p.m. and 4.30 p.m. In accordance with Deutsche Bundesbank cut-off times for same-day processing via its Target2 clearing system, as of October 2008, all orders received by the Bank after 4.30 p.m. will not be processed until the following business day. In the case of urgent foreign payment orders in euro, the Bank will arrange for same-day settlement and forwarding to the payee s bank s clearing system with specification of sameday value provided it has received properly issued orders by 3.30 p.m. If the Bank receives such orders between 3.31 p.m. and 4.30 p.m., it will endeavour to carry out transmission with same-day value dates, although this can no longer be assured. Euro-denominated urgent payments that the Bank receives after 4.30 p.m. will not be executed until the following business day. In each case, the prerequisite is that the payee s bank clearing system is open and that the payee s bank is connected to an open clearing system. If these criteria are not met, the Bank can process the payment at its own discretion using the DTAZV format SWIFT urgent payment type. The Bank will settle urgent domestic payment orders and urgent foreign payment orders in euro as individual transactions. 8 Recall (1) The Account Holder can delete the file before the order data are fully authorised in bankline. Changes to individual order data can only be made by recalling the entire file and then resubmitting it. (2) The possibility to revoke an order is subject to the special conditions that apply to each specific type of order (e.g. Conditions for Credit Transfers). Orders can only be revoked by a means outside of the bankline procedure. To do so, the Account Holder must inform the Bank of the individual details contained in the original order. The Bank can accept a revocation only if it receives it in time for it to be carried out within the normal course of banking business. 9 Execution of orders (1) The Bank will execute orders provided all of the following conditions are fulfilled: the order data submitted have been authorised as set out in section 3 (7) of these bankline Terms and Conditions the data have been provided in the format specified in Appendix 3 the credit limit has not been exceeded the execution requirements have been met for the respective type of order in accordance with the applicable special conditions (e.g. sufficient account balance in accordance with the Conditions for Credit Transfers) (2) If the conditions set out in paragraph (1) above are not met, the Bank will not execute the order and will inform the Account Holder thereof in the agreed form without delay. As far as possible, the Bank will inform the Account Holder of the reasons or errors that led to the order not being executed and explain how these can be remedied. 3 / 9

4 10 Security of the Customer s system Each Account Holder must ensure that the systems used for purposes are sufficiently protected (e.g. by means of a firewall, up-to-date virus scanner, etc.). 11 Liability 11.1 Liability of the Bank for unauthorised transactions via EDT or for the non-execution or incorrect execution of a transaction via EDT The Bank s liability for an unauthorised transaction via EDT or a transaction via EDT that was not performed or was incorrectly executed is subject to the provisions of the special conditions applicable to the respective type of order (e.g. Conditions for Credit Transfers) Liability of the Account Holder for misuse of identity verification devices or infringement of security procedures Liability of the Account Holder for unauthorised payment transactions before the suspension request (1) If unauthorised payment transactions, before the suspension request, are based on the use of a lost, stolen or otherwise misplaced identity verification device, the Account Holder is liable for the damages that the Bank hereby incurs up to the amount of 150, regardless of whether the User is at fault for the loss, theft or other misplacement of the identity verification device. (2) If, before the suspension request, unauthorised payment transactions take place as a result of a fraudulent use of an identity verification device, without this having been lost, stolen or misplaced in some other way, the Account Holder is liable for the damages the Bank hereby incurs, up to the amount of 150, should the User be at fault for breaching its duty to keep the identity verification device stored securely. (3) For damages resulting from unauthorised payment transactions exceeding the liability limit of 150 stipulated in (1) and (2) above, the Customer is liable notwithstanding section 675v German Civil Code (BGB) if the User has negligently or intentionally acted in breach of their contractual duties of conduct and care Liability of the Account Holder for other unauthorised payment transactions before the suspension request If unauthorised transactions that are not payment transactions take place before the suspension request and result from the use of a lost or stolen identity verification device or infringement of security procedures or other inappropriate use of the bankline Service and the Bank incurs damages as a result, the principles of contributory negligence will determine the extent to which the Bank and the Customer are liable Liability of the Bank after the request for suspension Once it has received a suspension request pertaining to a User, the Bank shall bear all further losses resulting from unauthorised bankline transactions. This does not apply if a User acted with fraudulent intent Disclaimer Liability claims are excluded if the reasons establishing the claim are based on an unusual and unforeseeable event over which the relevant party has no influence and the consequences of which could not have been avoided despite their exercising the appropriate degree of care. 12 Third-party banks; services provided by third parties (1) If accounts held at third-party banks are covered by the bankline Service, the relevant Account Holder will conclude separate agreements for each account with these third-party banks, outlining the type and scope of the bankline Service. (2) If one of the Parties makes recourse to services from third parties within the scope of the bankline Service, it shall be liable to the other party for all actions, errors or acts of omission by this third party to the same extent as if it had performed the actions itself or were itself responsible for the acts of omission. For the purposes of this Agreement, the third party will be deemed to be acting on behalf of the party that commissioned it. (4) The Account Holder is not required to reimburse damages pursuant to paragraphs 1, 2 and 3 above if they were unable to submit the suspension request in accordance with section 6 (1) above because the Bank did not ensure that it was able to receive the suspension request and the damages were incurred as a result. (5) The liability for damages caused during the effective term of a drawing limit is restricted to the drawing limit agreed in each case. 4 / 9

5 13 Term; termination (1) This Agreement will take effect as of the day the Bank processes the first order, whereupon the Customer s order is conclusively accepted. It will have an indefinite term. The Bank will inform the Customer if it declines to register an account or a User. (2) Both the Customer (for itself and for every Customer Affiliate) and the Bank may terminate this Agreement with a period of notice of at least thirty (30) calendar days by sending a written statement to the other party. (3) Both the Customer (for itself and for every Customer Affiliate) and the Bank may terminate this Agreement with immediate effect in writing if after having given due consideration to the legitimate concerns of the other party reasonable cause exists which makes it unacceptable for the terminating party to continue the business relationship. (4) In accordance with section 13 (2) and/or (3), every Customer Affiliate may terminate this Agreement for itself and the Bank may also terminate this Agreement in relation to one or more Customer Affiliates (which must be stipulated as such as in the notice of termination). 14 Validity of account agreements with account maintaining units (1) Without prejudice to expressly deviating provisions, all Account Holder regulations with an account maintaining unit remain unaffected by these Terms and Conditions. (2) The Account Holders agree and ensure that each account maintaining unit that is a branch, office or subsidiary of the Bank (i) is authorised and instructed in accordance with these Terms and Conditions to process and execute all orders submitted to it by the Bank, (ii) is furthermore entitled to treat such orders as though they had been submitted directly by persons authorised to issue orders on behalf of the holder of the account in question, (iii) may therefore assume that such orders were duly issued by the Account Holder and are, as such, binding, (iv) is moreover authorised to provide the Bank with all information relating to accounts governed by these Terms and Conditions and (v) in consideration of its confidential actions in relation to regulations (i) to (iv) above, will appoint the Bank as beneficiary to the limitations of liability and claims for damages as set out in section Extending the Agreement to additional companies; appointment of agent (1) In order to extend the bankline Service to additional companies, the company in question must accede to this Agreement by means of a separate Accession Agreement. (2) Upon acceding to this Agreement, the company in question will become a Customer Affiliate and an Account Holder within the meaning of this Agreement and will appoint the Customer as its agent for issuing and receiving all declarations and for performing all actions set out in this Agreement or actions considered necessary or expedient in connection with the Agreement. In connection with this appointment, the Account Holders hereby assure and guarantee the Bank that they have taken all actions, made any disclosures and given any consent necessary to release the Customer from any restrictions pertaining to contracting with itself or similar statutory restrictions that would otherwise render actions on behalf of the Customer Affiliate invalid. 16 Applicable law (1) These Terms and Conditions are governed by the laws of the Federal Republic of Germany. (2) The place of jurisdiction for all disputes arising from or in connection to this Agreement is Frankfurt am Main, Germany. Nevertheless, legal actions against a party to this Agreement may also be brought by any responsible court in the place of domicile of the respective party. 17 Final provisions The Appendices described in these Terms and Conditions form part of the Agreement: Annex 1: bankline connection Annex 2: Presently empty Annex 3: Specification of data formats 5 / 9

6 Annex 1: bankline connection 1 Identity verification and security procedures Each Account Holder will provide the Bank with the names of the Users and their authorisations within the scope of the bankline Service. The following identity verification and security procedures are used as part of the bankline Service: User ID and password Electronic Signature Encryption of communications 1.1 Security procedures: User ID and password To initialise the bankline connection, the Bank will provide all Users designated by an Account Holder with the following data: the Bank s URL or IP address Customer ID User ID initial password other specific User authorisation information The Bank issues each User allocated to an Account Holder a User ID clearly identifying the User and an initial password. The initial password facilitates a password change only. Each User must change the initial password into a personal password known only to them. Changing the password will generate an access initialisation letter. This must be printed out, signed by the User personally and sent to the Bank. The Bank verifies the User s signature on the access initialisation letter. After successful verification, the Bank will activate the User in question for the agreed order types User ID and password Access to the bankline Service is permitted for registered Users only; however, they may be situated in any location that has internet access. Once a User has successfully identified themselves using their User ID and password, the functions to which this User has access rights ( User Rights ) are made available to them. The User Rights are set out in the Agreement Automatic deregistration The activity by Users is constantly verified while they are using the bankline Service. As soon as a User has been inactive for fifteen minutes, i.e. no data have been sent or retrieved in this time, they will be automatically logged off from the bankline Service. 1.2 Identity verification procedure: Electronic Signature To create an Electronic Signature (ES), each User must set up an individual electronic key pair, consisting of a private and a public key. For a User to be initialised at the Bank, they must transmit their public key via two separate communication channels to the Bank: by means of automatic transmission via bankline while the key pair is being generated and by means of an initialisation letter signed by the User. To activate a User, the Bank verifies the public key transmitted via bankline using the signed initialisation letter as a basis. The initialisation letter for each public key contains the following data: the supported version for each key pair specification of the exponent length exponent of the public key in hexadecimal representation specification of the modulus length modulus of the public key in hexadecimal representation hash value of the public key in hexadecimal representation The Bank verifies the User s signature on the initialisation letter and will check the conformity of the hash values of the User s public key that have been transmitted via bankline and those provided in writing. After successful verification, the Bank will activate the User in question for the agreed order types. The following signature classes are defined for Users Electronic Signatures (ES): individual signature (E) first signature (A) second signature (B) An order may require several signatures by different Users. bankline can generate a range of messages (e.g. domestic and foreign payment orders, retrieval of account and transaction information, etc.). The Bank will inform the Customer which message types can be used and which ES type is to be used in each case Electronic Signature with private/public key pair Each User must set up their private and public keys. The public key is transmitted automatically via the HTTPS connection to the Bank s server. The private key is stored in encrypted form and password protected. It may be employed by the User exclusively to authorise orders in accordance with the User Rights set out in the Agreement. Each message received by the server and the related authorisation is compared with the public key stored on the server for each User. The message will be forwarded to the relevant system for further processing only if the authorisation is positively verified as attributable to the respective public key and is within the authorisation limits for the User stipulated in the Agreement Removable storage devices for private keys Private keys may never be stored on a fixed disk drive. Instead, each User-specific private key is stored on a removable storage device (e.g. smart card), i.e. on their identity verification device. The devices remain in the User s possession. Even if an unauthorised person gains knowledge of the password protecting the private key, they will not be able to authorise an order without having access to the removable storage device on which the private key is stored. 6 / 9

7 1.3 Security procedures: Encryption of communications The bankline Service employs the following mechanisms to promote a secure, confidential and authentic transmission of the orders to the bankline server: HTTPS communications Communication for the bankline connection takes place by URL (Uniform Resource Locator). Alternatively, the Bank's IP address can be used. The Bank will inform the Customer of the URL or IP address upon conclusion of the Agreement. Bankline employs a secure socket layer with a key length of 128 bit (SSL128). Accessing the bankline website automatically establishes a communication protocol that encrypts all data exchanged between the Customer's web browser and the bankline server Server certificates The bankline server owns a certificate issued by an accredited third-party certification body which allows the User to receive a verification that they are connecting to bankline. 2 Placing orders with the Bank The User shall verify the correctness of the order data and ensure that precisely these verified data are signed electronically by Electronic Signature. Upon initialisation of communication, the Bank first carries out participant-related authorisation verifications, such as the verification of order type authorisations. The relevant Account Holder is informed of the results of such verifications as limit checks or account authorisation verifications in the subsequent Customer report. The order may be deleted by a User authorised to do so until such time as all of the required Electronic Signatures are received. If the order has been fully authorised, it can only be recalled in accordance with section 8 of the bankline Terms and Conditions. 2.1 Identity verification by the Bank The Bank will only execute the submitted order data as an order once it has successfully verified the required Electronic Signatures or, if applicable, the signed accompanying note has been received and is also verified. 2.2 Customer reports The Bank will document the following transactions in reports: transmission of order data to the Bank s system processing of orders where these involve verification of signatures The User must obtain the results of verifications carried out by the Bank by retrieving the Customer s electronic log promptly. Section 7 (3) of the bankline Terms and Conditions outlines how to proceed if the verification of the Electronic Signature was not successful. 3 Security requirements The security of any online banking system is impacted directly by the conduct of its Users. Therefore, Users must ensure the confidentiality and protection of their personal data by following the security guidelines set out below: each User must ensure the confidentiality of its password at all times each User must always keep its digital signature device (and private key) in a secure place and never permit any other person to gain access to them each User must always log out from the bankline Service once it has finished using it or when it leaves the PC unattended each time a User logs on to the bankline Service, it must check if the details concerning the last login provided on the main menu screen are correct Each Account Holder shall do everything in its power to protect its own computers and operating systems and shall take all feasible security measures and safeguards to ensure that every User designated by it observes all of the security requirements set out in this Agreement. Each Account Holder must ensure that its security standards are adequate in all respects to prevent (i) individuals other than Users from gaining access to the bankline server, (ii) messages being authorised by individuals using a digital signature other than the Users authorised to do so, and (iii) individuals other than the Users to whom the respective digital signature device (and private key) was assigned from gaining access to such digital signature device. Each Account Holder shall prompt all of its Users to change their passwords when the following events occur: immediately after the first login to the bankline Service at the request of the Bank at regular intervals, at least every 90 days 4 Using the bankline Service For the time of the Agreement, the Bank grants the Account Holders a non-exclusive, non-transferable right to the online use of the internet-based bankline application and any materials or documentation published in this connection in accordance with the Agreement. In accordance with this right, each Account Holder is granted access to the bankline Service via the internet (HTTPS) and may use the bankline Service in accordance with the terms of the Agreement. The Bank provides the internet-based bankline application via the bankline server on the basis of the formats and modules specified in the Agreement and as described in the Terms and Conditions. The Bank provides only the most recent version of the bankline application and the most recent version of the corresponding websites. 7 / 9

8 Each Account Holder is responsible for all necessary technical requirements, in particular but without limitation to, the connection between their data-processing systems and the bankline server, as well as for all other network connections and telecommunications charges. Each Account Holder shall ensure that all of the requirements set out in the Agreement are fulfilled when using the bankline Service. Each Account Holder must comply with all of the technical and other requirements pertaining to the use of the bankline application at all times. The bankline Service shall only be used within the scope of the technical functionalities described, whereby all statutory obligations shall be observed. The Account Holders must ensure that no interference is caused to the bankline application by any of them, any of their employees, or any individual registered as a User, or any other individual directly or indirectly belonging to the sphere of each respective Account Holder, and/or by their data-processing systems. In particular, but without limitation, each Account Holder shall implement the necessary measures to prevent any computer viruses, worms or any other harmful or defective software or applications from being transmitted from their data-processing systems to the server and its supporting dataprocessing systems. 5 General points All information in connection with the bankline Service is made available to the Users on the bankline websites by which they are permitted to access said websites in accordance with their rights to use. The Bank intends to operate the websites at all times, however, it cannot guarantee the permanent or uninterrupted operation of the websites as it may be caused temporarily to restrict or interrupt access to the websites for technical reasons, e.g. in order to make changes or improvements to the technical systems, or perform maintenance, repairs or other work required for the proper operation of the websites. The Bank retains throughout the world all of its rights in all of its intellectual property rights, i.e. all intellectual property rights in the internet-based bankline application, including all upgrades, amendments and developments whatsoever shall vest and remain vested in the Bank. Each Account Holder explicitly acknowledges that they will not acquire any rights of their own in the intellectual property rights of the Bank or its suppliers and/or authorised representatives, if any. Each Account Holder shall only use the rights granted under the above right to use for their own purposes to the extent that such use is expressly permitted by such right to use and that the same is necessary to give effect to the bankline Service. Each Account Holder shall treat all information relating to the right to use as confidential. None of the Account Holders shall remove any copyright notice, trademarks, service marks, logos or other corporate identifiers of the Bank or any third party or any respective identifier of their products. Upon termination of the bankline Service, the Customer in question shall immediately at the direction of the Bank either return or expunge all applications, documents and all other materials received from or on behalf of the Bank under the Agreement, together with all copies, which are in its possession or control, or in the possession or control of any of its employees, any individual registered as a User or any other individual belonging directly or indirectly to the sphere or under the control of the Customer, and expunge all applications and all intellectual proper rights from any computer, word processor or similar device into which they were programmed by it or on its behalf or by any individual acting on its behalf. 8 / 9

9 Annex 2: Presently empty Annex 3: Specification of the data formats This specification is published at Note: All of the information mentioned on the EBICS website pertaining to EBICS applies also to electronic data transmission using bankline. This applies, in particular, to the information regarding order types, reports and EBICS specifications. 9 / 9