DisputeHelp Seller Data Processing Policy

DisputeHelp Reseller Data Processing Agreement

Last Updated: November 12, 2021

This reseller data processing agreement (“DPA”) is an agreement between you and the entity you represent or have authority to bind that entity to this agreement (“Reseller” or “you”), and DisputeHelp, LLC, a California limited liability company (“DHLLC”). This DPA forms part of any written or electronic agreement between you and DHLLC under which DHLLC Processes Personal Information on behalf of Reseller’s third-party customers for Services (each, a “Participating Seller”) (each, an “Agreement”), except with respect to any Agreement under which you and DHLLC have entered into data processing terms that address the subject matter of this DPA. Capitalized terms used here but not defined in this DPA will have the meanings given to them in the Agreement.

Processing of Participating Sellers Personal Information

Processor designation. The parties acknowledge that DHLLC will Process Personal Information of Reseller’s Participating Sellers to provide the Services (as defined in the Agreement), which Processing may include, by way of example and for illustrative purposes, the Processing detailed on Details of Processing Seller Personal Information (Exhibit 2). For the purposes of the Applicable Data Protection Laws and the provisions of this Agreement, the Reseller’s Participating Sellers shall be considered as controllers (or equivalent term under Applicable Data Protection Laws), Reseller shall be considered a data processor, and DHLLC (as the “Sub-Processor” in this DPA) shall be considered a sub-processor engaged by Reseller to carry out specific processing activities for Reseller’s Participating Sellers.
Authorization to Process. Reseller instructs Sub-Processor to Process Seller Personal Information to provide those Services, and Sub-Processor is authorized to Process Seller Personal Information solely in connection with the following activities:

Under the applicable Agreement(s), including, without limitation, any exhibits, schedules, and applicable price schedule(s), to provide the Services, and any Processing required under applicable law or regulations;
Based on the instructions of Reseller and in its use of the Services, Sub-Processor transfers Seller Personal Information to Participating Sellers’ Data Subjects, acquiring banks, issuing banks, payment processors providing services on behalf of acquiring banks, credit/debit card companies, or service providers performing Services used by Reseller’s customers; and
As reasonably necessary to enable Sub-Processor to comply with any other directions or instructions provided by Reseller on behalf of Reseller’s Participating Sellers.

Compliance with Law. Reseller shall, in its use of the Services, Process Seller Personal Information under the requirements of Applicable Data Protection Laws. Sub-Processor shall, in its provision of the Transaction Services, Process Seller Personal Information under the requirements of Applicable Data Protection Laws.
Reseller obligations. With respect to the Processing of Seller Personal Information by Sub-Processor under this Schedule and Agreement, Reseller shall ensure that its Participating Sellers shall:

provide its Data Subject(s) with all privacy notices, information, and any necessary choices under Applicable Data Protection Laws with respect to the use of Seller Personal Information in connection with the Transaction Services as set out in the Agreement and this DPA, including providing information to Data Subjects for fair, lawful, and transparent Processing of Seller Personal Information when required and shall obtain any necessary consents to enable the parties to comply with Applicable Data Protection Law;
promptly inform Sub-Processor when Seller Personal Information must be corrected, updated, or deleted, where required by Applicable Data Protection Law;
ensure that at the point of transferring Seller Personal Information to Sub-Processor, the Seller Personal Information is adequate, relevant, and limited to what is necessary in relation to the Processing envisioned under the Agreement and this DPA; and
Reseller shall comply (and ensure that its third-party auditors comply) with Sub-Processor’s relevant security policies and appropriate confidentiality obligations as set out in the Agreement.

Sub-Processor obligations

Applicable Data Protection Law. To the extent necessary to enable Reseller’s Participating Sellers to comply with their obligations under Applicable Data Protection Law, Sub-Processor shall comply with any required provisions of the GDPR Schedule and CCPA Schedule, each, to the extent applicable.
Data Subject Rights. Sub-Processor shall, to the extent legally permitted, provide reasonable assistance to Reseller to respond to requests from Data Subjects to exercise their rights under Applicable Data Protection Law with respect to Seller Personal Information (e.g., rights to access or delete Seller Personal Information) in a manner that is consistent with the nature and functionality of the Services. Reseller shall submit those requests for assistance to Sub-Processor. Where Sub-Processor receives any such request, it shall notify Reseller without undue delay and Reseller shall ensure that its Participating Sellers are responsible for handling those requests by a Data Subject under Applicable Data Protection Law.
Engaging with Sub-Processors. Sub-Processor shall ensure that when engaging with another data processor including any Affiliates (a “Sub-Sub-Processor”) for the purposes of carrying out specific Processing activities related to Reseller’s Participating Sellers, there is a written contract in place between Sub-Processor and the relevant Sub-Sub-Processor. Those written contracts, to the extent applicable to the nature of the Services provided by the relevant Sub-Sub-Processor, shall provide at least the same level of protection for Seller Personal Information as set out in this DPA.
Staff. Sub-Processor shall ensure that persons authorized to Process Seller Personal Information have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
Security of Processing. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Sub-Processor shall implement technical and organizational measures to ensure a level of security appropriate to that risk. In assessing the appropriate level of security, Sub-Processor shall, in particular, take into account the sensitivity of the Personal Information and the risks that are presented by the Processing, in particular from unauthorized or unlawful Processing, accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Seller Personal Information transmitted, stored, or otherwise Processed. Sub-Processor shall provide reasonable assistance to Reseller in ensuring Reseller meets its own compliance obligations with respect to these same security measures.
Security Breach

In the event of an actual Security Breach affecting Seller Personal Information contained in Sub-Processor’s systems, Sub-Processor shall (i) investigate the circumstances, extent, and causes of the Security Breach and report the results to Reseller and continue to keep Reseller informed on a regular basis of the progress of Sub-Processor’s investigation until the issue has been effectively resolved; and (ii) cooperate with Reseller in any legally required notification by Reseller’s Participating Sellers of affected Data Subjects.
Sub-Processor shall notify Reseller without undue delay on Sub-Processor or any Sub-Sub-Processor becoming aware of an actual Security Breach affecting Seller Personal Information, providing Reseller with sufficient information and reasonable assistance to allow Reseller’s customers to meet its obligations under Applicable Data Protection Law to (i) notify a Supervisory Authority (as defined under Applicable Data Protection Law) of the Security Breach; and (ii) communicate the Security Breach to the relevant Data Subjects.
Except as required by applicable law or regulation, the notifying party shall not make (or permit any third party to make) any statement concerning the Security Breach that directly or indirectly references the other party, unless the other party provides its explicit written authorization.
To the extent that a Security Breach was caused by Reseller, Reseller’s Participating Sellers, or Data Subjects, Reseller shall be responsible for the costs arising from the Sub-Processor’s provision of assistance under this clause 4.6.

Deletion and Retention. Sub-Processor shall, at Reseller’s option, delete or return all Seller Personal Information on termination of the Agreement and delete existing copies unless storage is required by applicable law.

Miscellaneous. The terms of this DPA shall apply only to the extent required by Applicable Data Protection Law. To the extent not inconsistent with this DPA, the applicable provisions of the Agreement(s) (including without limitation, indemnifications, limitations of liability, enforcement, and interpretation) shall apply to this DPA. In the event of any conflict between this DPA and the terms of an applicable Agreement, the terms of this DPA shall control solely with respect to data processing terms where required by Applicable Data Protection Law, and, in all other respects, the terms of the applicable Agreement shall control. Notwithstanding any term of the DPA, the DPA does not apply to any data or information that does not relate to one or more identifiable individuals, which has been aggregated or de-identified under Applicable Data Protection Law, or to the extent that Sub-Processor and Reseller have entered separate data processing terms that address the subject matter of this DPA.
Definitions. Unless otherwise defined in the Agreement (including this DPA), all terms in this DPA have the definitions given to them in Applicable Data Protection Law.

“Applicable Data Protection Law” means any law or regulation pertaining to data protection, privacy, or the Processing of Personal Information, to the extent applicable in respect of a party’s obligations under the Agreement and this DPA. For illustrative purposes only, Applicable Data Protection Laws include, without limitation, and to the extent applicable, the General Data Protection Regulation (Regulation (EU) 2016/679 (the “GDPR”)), the UK Data Protection Act 2018, the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq. (“CCPA”), and any associated regulations or any other legislation or regulations that transpose or supersede the above.
“Data Subject” means any consumer that buys goods or services of Reseller’s Participating Sellers, and whose information is submitted by Reseller’s Participating Sellers to DHLLC during the course of Reseller’s Participating Sellers using the Services under the Agreement.
“EEA Standard Contractual Clauses” means the Standard Contractual Clauses set out in the European Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679, as amended or replaced from time to time by a competent authority under the Applicable Data Protection Law.
“Personal Information” means all data or information, in any form or format, that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Data Subject or household or that is regulated as “personal data,” “personal information,” or otherwise under Applicable Data Protection Law, including any information relating to a Data Subjects as defined in the Agreement.
“Process” or “Processed” or “Processing” means any operation or set of operations that is performed on Personal Information, whether or not by automatic means, such as access, collection, recording, organization, storage, adaptation or alteration, retrieval, disclosure or otherwise making available, duplication, transmission, combination, blocking, redaction, erasure, or destruction.
“Security Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information. A Security Breach includes a “personal data breach” (as defined in the GDPR), a “breach of security of a system,” or similar term (as defined in any other applicable privacy laws) as well as any other event that compromises the security, confidentiality, or integrity of Personal Information.
“Seller Personal Information” means Personal Information originating from the Reseller’s Participating Sellers or their Data Subjects and provided to or accessed by DHLLC under the Agreement.
“Swiss DP Laws” means the Federal Act on Data Protection of June 19, 1992 (as updated, amended, and replaced from time to time), including all implementing ordinances.
“Transfer” means to transmit or otherwise make Seller Personal Information available across national borders in circumstances that are restricted by Applicable Data Protection Law.
“UK Data Protection Laws” means the GDPR as transposed into United Kingdom national law by operation of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (“UK GDPR“), together with the Data Protection Act 2018, the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019, and other data protection or privacy legislation in force from time to time in the United Kingdom. In this DPA, in circumstances where and solely to the extent that the UK GDPR applies, references to the GDPR and its provisions shall be construed as references to the UK GDPR and its corresponding provisions.
“UK Standard Contractual Clauses” means, together: the controller to processor standard contractual clauses as set out in Commission Decision C(2010)593 dated 5 February 2010 made under Directive 95/46/EC of the European Parliament and of the Council (“UK C2P SCCs”) and the controller to controller standard contractual clauses (adopted by Commission Decision 2004/915/EC dated 27 December 2004 made under Directive 95/46/EC of the European Parliament and of the Council as amended or superseded from time to time) (“UK C2C SCCs“).

Schedule A
California Consumer Privacy Act

This CCPA Schedule applies in addition to any terms set out in the body of the DPA (and is incorporated in it) when the CCPA applies to Reseller’s use of DHLLC Services on behalf of its Participating Sellers, or to the extent Applicable Data Protection Law imposes a comparable requirement outlined under Schedule A. Capitalized terms not defined here have the meaning assigned to them under the DPA. To the extent there are any conflicts between this CCPA Schedule and the DPA, this CCPA Schedule will prevail.

DHLLC shall not:

sell Seller Personal Information; or

retain, use, or disclose Seller Personal Information other than as set out in the body of the DPA, except as required or permitted by Applicable Data Protection Law.

When providing or making available Personal Information to DHLLC, Reseller shall ensure that its Participating Sellers shall only disclose or transmit that Personal Information that is necessary for DHLLC to perform its obligations under the applicable Agreement(s).

To the extent required by Applicable Data Protection Law, this CCPA Schedule constitutes its certification to the Processing restrictions here.

Schedule B

General Data Protection Regulation

This GDPR Schedule applies in addition to any terms set out in the body of the DPA (and is incorporated in it) when the GDPR applies to Reseller’s Participating Sellers’ use of DHLLC Services, or to the extent Applicable Data Protection Law imposes a comparable requirement outlined under Schedule B. Capitalized terms not defined here have the meaning assigned to them under the DPA. To the extent there are any conflicts between this GDPR Schedule and the DPA, this GDPR Schedule will prevail.

Sub-Processor Obligations

Processing of Seller Personal Information. Sub-Processor shall Process Seller Personal Information only on documented reasonable instructions from Reseller (including instructions with respect to transfers of Seller Personal Information to a third country or territory, if applicable) unless required to do so by Applicable Data Protection Law. In those circumstances, Sub-Processor shall inform Reseller of that legal requirement before processing, unless that law prohibits that information on important grounds of public interest. Sub-Processor shall immediately inform Reseller if, in Sub-Processor’s opinion, Reseller’s instructions would be in breach of Applicable Data Protection Law. Reseller acknowledges that Sub-Processor shall be under no obligation to take actions designed to form any such opinion.

Use of Sub-Sub-Processor

Sub-Processor reserves the right to maintain its Sub-Sub-Processor list through means such as publication of its Sub-Sub-Processor list online and also update it accordingly. Under Section 1.2(a) of this GDPR Schedule, Reseller provides authorization for Sub-Processor to engage with the Sub-Sub-Processors listed. Sub-Processor currently engages the Sub-Sub-Processors listed in Exhibit 3 to this DPA.

Sub-Processor shall inform Reseller of any intended changes concerning the addition or replacement of other Sub-Sub-Processors to give Reseller the reasonable opportunity to object to those changes. In the event Reseller objects to Sub-Processor’s change or addition of Sub-Sub-Processor, Reseller shall promptly notify Sub-Processor of its objections in writing within 10 business days after receipt of Sub-Processor’s notice of that change or addition.

Sub-Processor may, at its option, undertake reasonable efforts to make available to Reseller a change in the Services or recommend a commercially reasonable change to Reseller’s configuration or use of the Services to avoid Processing of Seller Personal Information by the objected-to new Sub-Sub-processor. If Sub-Processor is unable to make available that change within a reasonable period, which shall not exceed 30 days, Reseller may terminate the Agreement with respect to only those aspects of the Services that cannot be provided by Sub-Processor without the use of the objected-to new Sub-Sub-Processor by providing written notice to Sub-Processor. If the Services as a whole cannot be performed without the objected-to new Sub-Sub-Processor, Reseller may terminate the entire Agreement, on condition that Reseller’s objections to the new Sub-Sub-Processor are commercially reasonable.

Sub-Processor shall not impose a penalty for any termination under Section 1.2(c) of this GDPR Schedule on Reseller.

Data Protection Impact Assessments and Prior Consultation with Regulator. Sub-Processor shall provide reasonable assistance to Reseller with any legally required (i) data protection impact assessments; and (ii) prior consultations initiated by Reseller with its regulator in connection with those data protection impact assessments. That assistance shall be strictly limited to the Processing of Seller Personal Information by Sub-Processor on behalf of Reseller’s Participating Sellers under the Agreement taking into account the nature of the Processing and information available to Sub-Processor.

Demonstrating Compliance with this DPA

Sub-Processor shall make available to Reseller all information necessary to demonstrate compliance with its obligations under this DPA and allow for (and contribute to) audits, including inspections conducted by Reseller or another auditor under the instruction of the Reseller for the same purposes of demonstrating compliance with obligations set out in this DPA.

Reseller’s right under Section 2.1 of this GDPR Schedule is subject to the following:

if Sub-Processor can demonstrate compliance with its obligations set out in this DPA by adhering to an approved code of conduct, by obtaining an approved certification, or by providing Reseller with an audit report issued by an independent third-party auditor (on condition that Reseller shall comply with appropriate confidentiality obligations as set out in the Agreement and shall not use that audit report for any other purpose), Reseller shall not conduct an audit or inspection under Section 2.1 above; and

in acknowledgement of the time, expense, and disruption to business associated with performing audits and inspections involving interviews and onsite visits, Reseller shall only conduct those audits and inspections on condition that Reseller can demonstrate that audit or inspection is necessary beyond the information made available by Sub-Processor under Section 2.1 above. Those audits and inspections shall be at reasonable intervals (but not more than once per year) on not less than 60 days’ notice and at a date mutually agreed by the parties, on condition that the audit shall (i) not disrupt Sub-Processor’s business; (ii) be conducted during business hours and at the Reseller’s expense; (iii) not interfere with the interests of Sub-Processor’s other customers; and (iv) not exceed a period of two successive business days.

With regard to Section 2.1 of the GDPR Schedule, Sub-Processor shall immediately inform Reseller if, in Sub-Processor’s opinion, Reseller’s instructions would be in breach of Applicable Data Protection Law. Reseller acknowledges that Sub-Processor shall be under no obligation to take actions designed to form any such opinion.

Cross-Border Transfers

Sub-Processor shall comply with Reseller’s documented instructions concerning the Transfer of Seller Personal Information to a third country.

The Sub-Processor shall only Transfer any Seller Personal Information outside the Seller’s applicable jurisdiction or the Data Subjects’ resident jurisdiction, including, without limitation, outside the European Economic Area (“EEA”), the UK, or Switzerland, only in compliance with the Applicable Data Protection Law.

Reseller acknowledges that Sub-Processor transfers and stores certain Seller Personal Information (including relating to individuals located in the EEA, Switzerland, or the UK) in the United States.

Transfers subject to the GDPR or Swiss DP Laws. Module 3 (transfer processor to processor) of the EEA Standard Contractual Clauses shall apply with respect to any Transfer of Seller Personal Information from the EEA or Switzerland to DHLLC and any of its affiliated entities in the United States or other third countries (“DHLLC Entities”). The parties acknowledge that Module 3 (transfer processor to processor) of the EEA Standard Contractual Clauses is incorporated by reference and:

Reseller and any of its commonly owned or controlled affiliates that have signed an Agreement for DHLLC Products and Services (“Reseller Entities”) shall be deemed to be “data exporters” and the DHLLC Entities shall be the “data importers;”

Clause 7 — Docking clause applies;

Clause 9 — Use of subprocessors Option 2 applies and the “time period” is 10 business days;

Clause 11(a) — Redress the optional language does not apply;

Clause 13(a) — Supervision

Where the data exporter is established in an EU Member State the following shall apply: “The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority;”

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of the GDPR the following shall apply: “The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority;”

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of the GDPR, the following shall apply: “The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority;”

Clause 17 — Governing law Option 1 applies and the “Member State” is Romania;

Clause 18 — Choice of forum and jurisdiction the Member State is Romania; and

the information in Exhibit 1 (Table 1) of this GDPR Schedule is incorporated into Annexes 1, 2, and 3 of the EEA Standard Contractual Clauses.

Transfers subject to the UK GDPR. The UK C2P SCCs shall apply with respect to any Transfer of Seller Personal Information from the UK to DHLLC Entities. The parties acknowledge that:

the UK C2P SCCs are incorporated by reference;

Reseller, signing on behalf of Participating Seller and any of their commonly owned or controller affiliates that have signed an Agreement for DHLLC Product and Services (“Participating Seller Entities”) shall be deemed to be “data exporters” and the DHLLC Entities shall be the “data importer.” Reseller represents that it has appropriate legal authority from Participating Seller Entities to enter on their behalf into UK Standard Contractual Clauses with DHLLC Entities;

The information in Exhibit 1 (Table 2) of this GDPR Schedule is incorporated into Appendices 1 and 2 of the UK C2P SCCs; and

If and when the UK government or the Information Commissioner approves the use of the EEA Standard Contractual Clauses for the purposes of the UK GDPR, the EEA Standard Contractual Clauses shall instead apply as provided for under Section 3.4 (Transfers subject to the GDPR or Swiss DP Laws) above (but shall be deemed to incorporate any modifications required under the UK GDPR or recommended by the Information Commissioner, and the competent supervisory authority is the UK Information Commissioner’s Office and the governing law is England & Wales).

If there is any conflict or inconsistency between a term in the body of this DPA, an Agreement, and a term in Module 3 (Transfer processor to processor) of the EEA Standard Contractual Clauses (or, as applicable the UK C2P SCCs), incorporated into this DPA, the term in Module 3 (Transfer processor to processor) of the EEA Standard Contractual Clauses (or, as applicable, the UK C2P SCCs) shall take precedence.

Exhibit 1

Information Required for the EEA and UK Standard Contractual Clauses

Table 1

Information to be incorporated into the EEA Standard Contractual Clauses

Annex I A. List of Parties

Data EXPORTER identity and contact details

Name

Reseller Entities

Address

To be provided on request

Contact person’s name, position and contact details:

To be provided on request

Activities relevant to the data transferred under these Clauses:

As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing.”

Role (controller/processor):

Processor

Data IMPORTER identity and contact details

Name

DHLLC Entities

Address

7360 El Camino Real, Suite A

Atascadero, California 93422

U.S.A.

Contact person’s name, position and contact details:

privacy@chargebackhelp.com

Activities relevant to the data transferred under these Clauses:

As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing.”

Role (controller/processor):

Processor

Annex I B. Description of Transfer

Categories of data subjects whose personal data is transferred

As set out in the table in Exhibit 2 under “Categories of Data Subjects.”

Categories of personal data transferred

As set out in the table in Exhibit 2 under “Types of Personal Information.”

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

Not Applicable

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Continuous

Nature of the processing

As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing.”

Purpose(s) of the data transfer and further processing

As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing.”

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Personal data will be retained under DHLLC’s retention policies, for only as long as is required to meet DHLLC’s legal, regulatory, and operational requirements and as necessary to perform services.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing.”

Annex I C. Competent Supervisory Authority

Competent supervisory authority/ies

To be provided by the data exporter on request.

Annex II Technical and Organisational Measures Including Technical and Organisational Measures to Ensure the Security of The Data

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

As set out in Table 2 of this Exhibit 1 under “Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached).”

For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter

In respect of Transaction Services: initiatives, products, processes, and supporting technology are assessed from a data privacy perspective, allowing DHLLC to embed privacy controls to mitigate risks at early stages (privacy by design). DHLLC has a robust privacy risk assessment framework, embedding this process in our change vehicles across the business, to ensure that both new and changed personal data processing activities are reviewed. Where Customer requires specific assistance, it may submit those requests for assistance to privacy@chargebackhelp.com .

Annex III List of Sub-Processors

The controller has authorised the use of the following sub-processors:

As set out in Exhibit 3 of this DPA.

Table 2

Information to be incorporated in the UK C2P SCCs

Information to be incorporated into Appendix 1 of the UK C2P SCCs

Category of Information Required by Appendix 1 of the UK C2P SCCs

Information agreed by the parties

Data Exporter

Reseller on behalf of Participating Seller Entities

Data Importer

DHLLC Entities

Data Subjects

As set out in the table in Exhibit 2 under “Categories of Data Subjects.”

Categories of Data

As set out in the table in Exhibit 2 under “Types of Personal Information.”

Special Categories of Data

Not Applicable

Processing Operations

As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing.”

Information to be incorporated into Appendix 2 of the C2P Standard Contractual Clauses

Category of Information Required by Appendix 1 of the C2P Standard Contractual Clauses

Information agreed by the parties

Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached)

DHLLC is certified as compliant with all standards established by the Payment Card Industry Data Security Standards (together with any successor organization to it, “PCI DSS”) that are applicable to DHLLC and its affiliates (those standards, “PCI Standards”). As evidence of compliance, DHLLC will provide its current Attestation of Compliance signed by a Payment Card Industry Qualified Security Assessor on Seller’s written request.

DHLLC maintains and enforces commercially reasonable information security and physical security policies, procedures, and standards, that are designed (i) to insure the security and confidentiality of Seller’s records and information, (ii) to protect against any anticipated threats or hazards to the security or integrity of those records, and (iii) to protect against unauthorized access to or use of those records or information that could result in substantial harm (“DHLLC Information Security Program”). At a minimum, the DHLLC Information Security Program is designed to align with the standards set out in ISO 27002 published by the International Organization for Standardization, as well as any revisions, versions, or other standards or objectives that supersede or replace the foregoing.

DHLLC engages its independent certified public accountants to conduct a review of DHLLC’s operations and procedures at DHLLC’s cost. The accountants conduct the review under the American Institute of Certified Public Accounts Statement on Standards for Attestation Engagements No. 18 SOC I Type II (“SSAE 18”) and record their findings and recommendations in a report to DHLLC. On request, and subject to standard confidentiality obligations, DHLLC will provide its most recent SSAE 18, and, in DHLLC’s reasonable discretion, additional information reasonably requested to address questions or concerns regarding the SSAE 18’s findings.

Exhibit 2

Details of Processing Seller Personal Information

Service

Nature and purpose of the processing

Types of personal information

Categories of data subjects to whom the personal information relates to

Order Insight

Issuers access detailed transaction information from Participating Sellers via a global data-sharing network to prevent disputes at first Consumer inquiry.

Consumers access and view detailed transaction information from Participating Sellers via Issuers in the Issuer mobile app or online banking website for the Consumer, to prevent disputes at first Consumer inquiry.

DHLLC transfers (according to the instructions of the Controller) Seller Personal Information to issuing banks, payment processors providing services on behalf of acquiring banks, credit/debit card companies, or service providers providing the Order Insight service used by Participating Sellers.

If the Participating Seller opts to use the Order Insight service, DHLLC will use required transaction information, including, without limitation, transaction information and order detail information necessary for Processing the Order Insight request with the issuer.

Further detail is included in the applicable Services Documentation provided at the time of implementation of the Service.

Participating Seller’s employees, agents, advisors, or representatives; or

Consumers.

CDRN

CDRN allows Participating Sellers to actively process non-fraud and confirmed fraud pre-dispute cases with a refund or cancellation avoiding a Dispute.

If the Participating Seller opts to use CDRN, DHLLC will use required transaction information, including, without limitation, transaction information and order detail information necessary for Processing the Participating Seller’s decisioning as it relates to a pre-dispute case to Issuer.

Further detail is included in the applicable Services Documentation provided at the time of implementation of the Service.

Participating Seller’s employees, agents, advisors, or representatives; or

Consumers.

RDR (Rapid Dispute Resolution)

RDR allows Participating Sellers to process non-fraud and confirmed fraud pre-dispute with an acquirer-initiated funds reversal based on the rules set by Participating Sellers.

If the Participating Seller opts to use RDR, DHLLC will use required transaction information, including, without limitation, transaction information and order detail information necessary for Processing the Participating Sellers automatic rules as it relates to a Dispute to Issuer.

Further detail is included in the applicable Services Documentation provided at the time of implementation of the Service.

Participating Seller’s employees, agents, advisors, or representatives; or

Consumers.

Fraud and Dispute Services

Fraud and Dispute Services provides a Participating Seller with direct delivery of fraud and dispute notifications to reduce payment risk.

If the Participating Seller opts to use the Fraud and Dispute service, DHLLC will use required transaction information, to provide real-time, transaction level notification, to enhance and inform fraud detection and modeling to the Participating Seller. Participating Sellers can also stop order fulfillment/shipment when possible.

Further detail is included in the applicable Services Documentation provided at the time of implementation of the Service.

Participating Seller’s employees, agents, advisors, or representatives; or

Consumers.

Ethoca Alerts

DHLLC performs monitoring, reporting, data analysis, and data aggregation for the purpose of providing Alerts.

If the Participating Seller opts to use Ethoca Alerts, the type of Personal Data being processed includes transaction-related information, such as card or account number, transaction amount, transaction date and time, and merchant identifier and the type of Personal Data listed in the agreement.

Participating Seller’s employees, agents, advisors, or representatives; or

Consumers.

Consumer Clarity Solution

The facilitation of the transfer of Consumer Clarity Data by Ethoca to Participating Issuers / Cardholders for purposes of answering Cardholder queries in respect of Identified Transactions or the investigation of Identified Transactions to confirm whether they are in fact fraudulent or to resolve disputes (and any other purposes as set out in the agreement or as agreed in writing between the parties from time to time).

If the Participating Seller opts to use Consumer Clarity Solution, the type of Personal Data being processed includes, without limitation, the following pieces of information in respect of Identified Transactions (which alone, or in combination, may constitute Personal Data):

Cardholder name;

Cardholder address;

Information contained in a Digital Receipt;

History of the account;

Transaction amount;

Transaction date/time; and

Names of products purchased in the transaction.

Participating Seller’s employees, agents, advisors, or representatives; or

Consumers.

Exhibit 3

List of Sub-Sub Processors

Company

Functions Performed

Location

Applicable Service

Verifi, Inc.

Service Provider

U.S.A.

Order Insight

CDRN

RDR

Fraud and Dispute Services

Ethoca Limited

Service Provider

Canada

Ethoca Alerts

Consumer Clarity Solution

Annex I A. List of Parties
Data EXPORTER identity and contact details
Name	Reseller Entities
Address	To be provided on request
Contact person’s name, position and contact details:	To be provided on request
Activities relevant to the data transferred under these Clauses:	As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing.”
Role (controller/processor):	Processor
Data IMPORTER identity and contact details
Name	DHLLC Entities
Address	7360 El Camino Real, Suite A Atascadero, California 93422 U.S.A.
Contact person’s name, position and contact details:	privacy@chargebackhelp.com
Activities relevant to the data transferred under these Clauses:	As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing.”
Role (controller/processor):	Processor
Annex I B. Description of Transfer
Categories of data subjects whose personal data is transferred	As set out in the table in Exhibit 2 under “Categories of Data Subjects.”
Categories of personal data transferred	As set out in the table in Exhibit 2 under “Types of Personal Information.”
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.	Not Applicable
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).	Continuous
Nature of the processing	As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing.”
Purpose(s) of the data transfer and further processing	As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing.”
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period	Personal data will be retained under DHLLC’s retention policies, for only as long as is required to meet DHLLC’s legal, regulatory, and operational requirements and as necessary to perform services.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing	As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing.”
Annex I C. Competent Supervisory Authority
Competent supervisory authority/ies	To be provided by the data exporter on request.
Annex II Technical and Organisational Measures Including Technical and Organisational Measures to Ensure the Security of The Data
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.	As set out in Table 2 of this Exhibit 1 under “Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached).”
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter	In respect of Transaction Services: initiatives, products, processes, and supporting technology are assessed from a data privacy perspective, allowing DHLLC to embed privacy controls to mitigate risks at early stages (privacy by design). DHLLC has a robust privacy risk assessment framework, embedding this process in our change vehicles across the business, to ensure that both new and changed personal data processing activities are reviewed. Where Customer requires specific assistance, it may submit those requests for assistance to privacy@chargebackhelp.com .
Annex III List of Sub-Processors The controller has authorised the use of the following sub-processors:
As set out in Exhibit 3 of this DPA.

Information to be incorporated into Appendix 1 of the UK C2P SCCs
Category of Information Required by Appendix 1 of the UK C2P SCCs	Information agreed by the parties
Data Exporter	Reseller on behalf of Participating Seller Entities
Data Importer	DHLLC Entities
Data Subjects	As set out in the table in Exhibit 2 under “Categories of Data Subjects.”
Categories of Data	As set out in the table in Exhibit 2 under “Types of Personal Information.”
Special Categories of Data	Not Applicable
Processing Operations	As set out in the table in Exhibit 2 under “Nature and Purpose of the Processing.”
Information to be incorporated into Appendix 2 of the C2P Standard Contractual Clauses
Category of Information Required by Appendix 1 of the C2P Standard Contractual Clauses	Information agreed by the parties
Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached)	DHLLC is certified as compliant with all standards established by the Payment Card Industry Data Security Standards (together with any successor organization to it, “PCI DSS”) that are applicable to DHLLC and its affiliates (those standards, “PCI Standards”). As evidence of compliance, DHLLC will provide its current Attestation of Compliance signed by a Payment Card Industry Qualified Security Assessor on Seller’s written request. DHLLC maintains and enforces commercially reasonable information security and physical security policies, procedures, and standards, that are designed (i) to insure the security and confidentiality of Seller’s records and information, (ii) to protect against any anticipated threats or hazards to the security or integrity of those records, and (iii) to protect against unauthorized access to or use of those records or information that could result in substantial harm (“DHLLC Information Security Program”). At a minimum, the DHLLC Information Security Program is designed to align with the standards set out in ISO 27002 published by the International Organization for Standardization, as well as any revisions, versions, or other standards or objectives that supersede or replace the foregoing. DHLLC engages its independent certified public accountants to conduct a review of DHLLC’s operations and procedures at DHLLC’s cost. The accountants conduct the review under the American Institute of Certified Public Accounts Statement on Standards for Attestation Engagements No. 18 SOC I Type II (“SSAE 18”) and record their findings and recommendations in a report to DHLLC. On request, and subject to standard confidentiality obligations, DHLLC will provide its most recent SSAE 18, and, in DHLLC’s reasonable discretion, additional information reasonably requested to address questions or concerns regarding the SSAE 18’s findings.

Service	Nature and purpose of the processing	Types of personal information	Categories of data subjects to whom the personal information relates to
Order Insight	Issuers access detailed transaction information from Participating Sellers via a global data-sharing network to prevent disputes at first Consumer inquiry. Consumers access and view detailed transaction information from Participating Sellers via Issuers in the Issuer mobile app or online banking website for the Consumer, to prevent disputes at first Consumer inquiry. DHLLC transfers (according to the instructions of the Controller) Seller Personal Information to issuing banks, payment processors providing services on behalf of acquiring banks, credit/debit card companies, or service providers providing the Order Insight service used by Participating Sellers.	If the Participating Seller opts to use the Order Insight service, DHLLC will use required transaction information, including, without limitation, transaction information and order detail information necessary for Processing the Order Insight request with the issuer. Further detail is included in the applicable Services Documentation provided at the time of implementation of the Service.	Participating Seller’s employees, agents, advisors, or representatives; or Consumers.
CDRN	CDRN allows Participating Sellers to actively process non-fraud and confirmed fraud pre-dispute cases with a refund or cancellation avoiding a Dispute.	If the Participating Seller opts to use CDRN, DHLLC will use required transaction information, including, without limitation, transaction information and order detail information necessary for Processing the Participating Seller’s decisioning as it relates to a pre-dispute case to Issuer. Further detail is included in the applicable Services Documentation provided at the time of implementation of the Service.	Participating Seller’s employees, agents, advisors, or representatives; or Consumers.
RDR (Rapid Dispute Resolution)	RDR allows Participating Sellers to process non-fraud and confirmed fraud pre-dispute with an acquirer-initiated funds reversal based on the rules set by Participating Sellers.	If the Participating Seller opts to use RDR, DHLLC will use required transaction information, including, without limitation, transaction information and order detail information necessary for Processing the Participating Sellers automatic rules as it relates to a Dispute to Issuer. Further detail is included in the applicable Services Documentation provided at the time of implementation of the Service.	Participating Seller’s employees, agents, advisors, or representatives; or Consumers.
Fraud and Dispute Services	Fraud and Dispute Services provides a Participating Seller with direct delivery of fraud and dispute notifications to reduce payment risk.	If the Participating Seller opts to use the Fraud and Dispute service, DHLLC will use required transaction information, to provide real-time, transaction level notification, to enhance and inform fraud detection and modeling to the Participating Seller. Participating Sellers can also stop order fulfillment/shipment when possible. Further detail is included in the applicable Services Documentation provided at the time of implementation of the Service.	Participating Seller’s employees, agents, advisors, or representatives; or Consumers.
Ethoca Alerts	DHLLC performs monitoring, reporting, data analysis, and data aggregation for the purpose of providing Alerts.	If the Participating Seller opts to use Ethoca Alerts, the type of Personal Data being processed includes transaction-related information, such as card or account number, transaction amount, transaction date and time, and merchant identifier and the type of Personal Data listed in the agreement.	Participating Seller’s employees, agents, advisors, or representatives; or Consumers.
Consumer Clarity Solution	The facilitation of the transfer of Consumer Clarity Data by Ethoca to Participating Issuers / Cardholders for purposes of answering Cardholder queries in respect of Identified Transactions or the investigation of Identified Transactions to confirm whether they are in fact fraudulent or to resolve disputes (and any other purposes as set out in the agreement or as agreed in writing between the parties from time to time).	If the Participating Seller opts to use Consumer Clarity Solution, the type of Personal Data being processed includes, without limitation, the following pieces of information in respect of Identified Transactions (which alone, or in combination, may constitute Personal Data): Cardholder name; Cardholder address; Information contained in a Digital Receipt; History of the account; Transaction amount; Transaction date/time; and Names of products purchased in the transaction.	Participating Seller’s employees, agents, advisors, or representatives; or Consumers.