Payment Policy as per "Stripe Policy"

Last updated: August 22, 2022

These Stripe Payments Company Terms (“SPC Terms”) form a legal agreement between Stripe Payments Company (“SPC”) and the entity or sole proprietor on whose behalf a Stripe account is created (“you” and “your”). SPC is a U.S. state-licensed money transmitter and federally registered money services business. These SPC Terms are effective upon the date you first access or use the SPC Services and continue until these SPC Terms terminate.

Certain Services may involve regulated money transmission under U.S. Law. To the extent your use of the Services involves money transmission or other regulated services under U.S. Law, those services are the “SPC Services” and are provided to you by SPC, not by Stripe or any other Stripe Affiliate, unless applicable Services Terms specify otherwise. These SPC Terms state the terms and conditions that apply to your use of the SPC Services.

1. Relationship to Stripe Services Agreement.

In addition to these SPC Terms, you must also have a Stripe Services Agreement in place with Stripe for technology services that enable instructions to be relayed to SPC. SPC will not charge you fees for the provision of the SPC Services; fees payable for the Services (including technology services related to the SPC Services) will be determined under the Stripe Services Agreement.

1.1 Terms that Apply to You.

You expressly agree to the terms and conditions of these SPC Terms, the Stripe Services Agreement, and any updates or modifications to either of those documents made from time to time by SPC or Stripe. Undefined capitalized terms used in these SPC Terms have the meanings given to them in the Stripe Services Agreement. You represent as of the Effective Date, and warrant at all times during the Term, that all of the information that you provide to SPC directly or through your use of the Services is accurate and complete, and that you are authorized to agree to these SPC Terms.

1.2 Incorporation of Stripe Services Agreement.

These SPC Terms are Financial Services Terms under the Stripe Services Agreement. These SPC Terms incorporate by this reference the terms of the Stripe Services Agreement, including the terms incorporated within the Stripe Services Agreement; except, for purposes of the SPC Services, each reference to "Stripe" in the Stripe Services Agreement will be read as a reference to SPC, each reference to “Agreement” in the Stripe Services Agreement will be read to include these SPC Terms, and the incorporated terms will be limited to the SPC Services. All other parts of the Services will remain governed by the Stripe Services Agreement between you and Stripe.

1.3 Inconsistency.

To the extent there is a conflict between the Stripe Services Agreement and these SPC Terms, these SPC Terms will prevail with respect to the SPC Services. In addition, to the extent there is a conflict between applicable Services Terms and these SPC Terms with respect to the SPC Services, the applicable Services Terms will prevail.

2. The SPC Services.

2.1 Ability to Instruct SPC.

By using the Stripe API or your Stripe Dashboard, you may use the Services to send instructions to SPC to add funds to and redeem funds from accounts that you maintain with SPC and to transfer funds to third parties or to yourself.

2.2 Adding funds.

(a) Methods of Adding Funds. You may add funds to accounts you maintain with SPC from User Bank Accounts or accounts you maintain with SPC or its Affiliate through one or more methods. Depending on the Services available to you, these methods may include bank transfers, payment cards, transfers from other accounts you maintain with Stripe or its Affiliate, or other methods we may make available. You may pass information to SPC and its Affiliates for purposes of adding funds to accounts that you maintain with SPC, including bank account information, payment card numbers, cardholder names, or other applicable information. When you provide this information, you represent as of the date you provide it, and warrant at all times during the Term, that the information is correct and that you are authorized to access and transmit those funds. You authorize SPC and its Affiliates to use this information to initiate debits to your User Bank Accounts or accounts you maintain with SPC or its Affiliate.

(b) Debit Authorizations. With respect to bank transfers, you authorize SPC and its Affiliates to debit each User Bank Account without separate notice, and according to the applicable User Bank Account Debit Authorization, to add or transfer funds to accounts you maintain with SPC. SPC and its Affiliates may rely on this authorization to make one or more debits to add or transfer funds. This debit authorization will remain in full force and effect until all of the accounts you maintain with SPC are closed. If applicable debit scheme authorization rules grant you the right to revoke your debit authorization, then to the extent Law permits, you waive that right.

2.3 Transferring or redeeming funds.

You may instruct SPC to redeem funds from accounts you maintain with SPC and to transfer funds to third parties or to yourself. Depending on the Services available to you, you may transfer or redeem funds from User Bank Accounts or accounts you maintain with SPC or its Affiliate. You may provide transfer or redemption instructions to SPC and its Affiliates, including information to identify your intended recipient, the date on which you would like your transfer or redemption to occur, and the currency amount of the transfer or redemption. SPC will use this information to attempt to complete the requested transfer or redemption.

2.4 SPC's obligation to transfer or redeem funds.

SPC will attempt to transfer or redeem funds as you instruct. SPC will return to you any funds that cannot be transferred or redeemed per your instructions, subject to the following conditions. Depending on the information you provide, and your other use of the SPC Services and the Services, you agree to allow SPC to pause or terminate any transfers or redemptions for illegal activity, fraud, risk or compliance purposes, which may include (a) withholding funds to offset chargeback or other fraud losses owed to SPC or its Affiliate; (b) interdicting funds for legal or compliance purposes, such as to comply with U.S. sanctions obligations; and (c) suspending your use of the SPC Services.

2.5 Pooled Accounts.

SPC will hold all funds it receives from you for the purpose of adding funds to accounts you maintain with SPC or transferring funds to third parties or to yourself, together with funds SPC holds for other users and will credit your funds to pooled accounts at one or more Financial Partners. SPC will hold your funds for your benefit, and neither SPC nor Stripe will voluntarily make those funds available to creditors in the event of bankruptcy. Depending on where your business is headquartered, additional protections may apply to the funds under your state’s money transmission laws.

2.6 Investment of Funds.

To the extent Law, the applicable Financial Services Terms and applicable Services Terms permit: (a) SPC may invest the funds that it holds in pooled accounts into liquid investments; (b) SPC owns the earnings from these investments; and (c) you irrevocably assign to SPC all rights you have (if any) to earnings from these investments.

2.7 Your use of SPC Services.

You may not use the SPC Services for illegal activities or for any of the business activities found on the Restricted Business List.

2.8 SPC privacy practices.

SPC will receive data when you use the SPC Services. SPC will treat your data and protect your privacy according to Stripe's Privacy Policy.

3. SPC Services not available for personal, family, or household use.

You may not use the SPC Services for personal, family, or household use, unless applicable Services Terms specify otherwise. By using the SPC Services, you represent as of the Effective Date and warrant at all times during the Term that you are a legal entity or a sole proprietor.

4. Allocation of liability and dispute resolution.

Without limiting the general incorporation of the Stripe Services Agreement, please ensure that you carefully review the following provisions:

(a) Sections 5, 10, 11 and 12 of the General Terms, which allocate responsibility and liability between you and SPC with respect to matters arising under these SPC Terms; and

(b) Section 13 of the General Terms, which provides that a dispute, claim or controversy arising out of or relating to statutory or common law claims, the breach, termination, enforcement, interpretation or validity of any provision of these SPC Terms, and the determination of the scope or applicability of your agreement to arbitrate any dispute, claim or controversy originating from these SPC Terms, but specifically excluding any dispute principally related to either party's IP Rights (which will be resolved in litigation before the United States District Court for the Northern District of California), will be determined by arbitration in San Francisco, California before a single arbitrator.

5. Termination.

These SPC Terms automatically terminate if the Stripe Services Agreement terminates for any reason.

6. Contact and complaints.

You can contact SPC at https://stripe.com/contact or by mail to Stripe Payments Company, 354 Oyster Point Boulevard, South San Francisco, California, 94080. SPC may provide you with information and notifications in relation to the SPC Services via your Stripe Dashboard.

Last updated: December 15, 2023

This Data Processing Agreement (“DPA”) is subject to and forms part of the Agreement and governs Stripe’s and its Affiliates’ Processing of Personal Data.

1. Structure.

If your Stripe Account is located in North America or South America, you enter this DPA with Stripe, Inc. (“SINC”). If your Stripe Account is located elsewhere, you enter this DPA with Stripe Payments Europe, Limited (“SPEL”). Accordingly, references in this DPA to “Stripe” mean SINC or SPEL, as applicable.

2. Stripe as Data Processor and Data Controller.

3. Stripe Obligations when Acting as a Data Processor.

3.1 Obligations.

When Stripe is acting as a Data Processor for you, Stripe will:

(a) Process Personal Data on your behalf and according to your Instructions. Stripe will inform you if, in its opinion, Instructions violate or infringe DP Law;

(b) ensure that all persons Stripe authorizes to Process Personal Data are granted access to Personal Data on a need-to-know basis and are committed to respecting the confidentiality of that Personal Data;

(c) to the extent required by DP Law, inform you of each request Stripe receives from Data Subjects (including "verifiable consumer requests" as defined under the CCPA) exercising their rights under DP Law to (i) access (e.g., right to know under the CCPA) their Personal Data; (ii) have their Personal Data corrected or erased; (iii) restrict or object to Stripe’s Processing; or (iv) data portability (collectively “Data Subject Request”). Other than to request further information, identify the Data Subject, and, if applicable, direct the Data Subject to you as Data Controller, Stripe will not respond to these requests unless you instruct Stripe in writing to do so. Taking into account the nature of the Processing, Stripe will assist you by appropriate technical and organisational measures, insofar as this is possible, to enable you to meet your obligation to respond to a Data Subject Request;

(d) to the extent required by DP Law, inform you of each law enforcement request Stripe receives from a Governmental Authority requiring Stripe to disclose Personal Data or participate in an investigation requiring Stripe to disclose Personal Data, unless prohibited by Law;

(e) to the extent required by DP Law, provide you with reasonable assistance, following your written request, to help you comply with your obligations under DP Law and, taking into account the nature of the Processing and the information available to Stripe, Stripe will provide reasonable information to help you conduct a data protection impact assessment or consult with a Supervisory Authority. If you request assistance from Stripe that goes beyond Stripe’s obligations under DP Law or this Agreement, Stripe may charge you a reasonable fee;

(f) if Stripe experiences a Data Incident, notify you without undue delay, which for Data Incidents affecting Personal Data Subject to the GDPR or UK GDPR will be no later than 48 hours, in each case after becoming aware of the Data Incident. To the extent known to Stripe, Stripe’s notification to you will describe in reasonable detail (i) the type of Personal Data that was the subject of the Data Incident, (ii) the categories and potential number of individuals or records affected (including their countries), and (iii) the status of Stripe’s investigation and current or planned remediation. Following the notification, Stripe will provide relevant updates to assist you in complying with your obligations under DP Law;

(g) to the extent required by DP Law and following your written request, contribute to audits or inspections by making audit reports available to you. Following this request, and no more frequently than once annually, Stripe will promptly provide documentation or complete a written data security questionnaire of reasonable scope and duration regarding Stripe’s and its Affiliates’ Processing of Personal Data. All reports and documentation provided, including any response to a security questionnaire, are Stripe’s confidential information; and

(h) at your choice, delete or return to you all Personal Data Processed in connection with the Services, and delete existing copies, following termination of the Agreement, except that Stripe will not be required to delete or return that Personal Data, or delete existing copies, to the extent that Stripe’s storage of that Personal Data or those copies is (i) required by Stripe to exercise its rights and perform its obligations under this Agreement; or (ii) required or authorized by DP Law for a longer period.

3.2 Sub-processors.

(a) Stripe engages Sub-processors as necessary to perform the Services. Stripe’s list of Sub-processors, which may also include Stripe Affiliates, is located at stripe.com/service-providers/legal (“Stripe Sub-processors List”). You consent to Stripe’s use of its existing Sub-processors and grant Stripe a general written authorisation to engage Sub-processors as necessary to perform the Services. If you subscribe to email notifications at the Stripe Sub-processors List, then Stripe will notify you via email if Stripe intends to add one or more Sub-processors to that list at least 30 days before the changes take effect. You may reasonably object to a change on legitimate grounds within 30 days after you receive notice of the change. You acknowledge that Stripe’s Sub-processors are essential to provide the Services and that if you object to Stripe’s use of a Sub-processor, then notwithstanding anything to the contrary in the Agreement (including this DPA), Stripe will not be obligated to provide you the Services for which Stripe uses that Sub-processor.

(b) Stripe will enter into a written agreement with each Sub-processor that imposes on that Sub-processor obligations comparable to those imposed on Stripe under this DPA, including the obligation to implement appropriate Data Security Measures. If a Sub-processor fails to fulfill its data protection obligations under that agreement, Stripe will remain liable to you for the acts and omissions of its Sub-processor to the same extent Stripe would be liable if performing the relevant Services directly under this DPA.

3.3 CCPA.

If the CCPA applies and Stripe is acting as a Data Processor, Stripe will not: (a) sell or share (as defined under the CCPA) Personal Data; (b) retain, use or disclose Personal Data outside of its direct business relationship with you other than to provide Stripe’s products and services and as required to comply with Law; and (c) combine Personal Data received from or through you with Personal Data received from or on behalf of an individual or collected from Stripe's own interactions with the individual, except to provide Stripe’s products and services and as permitted by Law. Stripe certifies that it understands and will comply with the requirements in this DPA relating to the CCPA and will provide the same level of privacy protection to Personal Data as required by the CCPA. Stripe will inform you if it determines that it can no longer meet its obligations under the CCPA and will take reasonable and appropriate steps to remediate any unauthorized Processing of Personal Data.

3.4 Disclaimer of Liability.

Notwithstanding anything to the contrary in the Agreement, including this DPA, Stripe and its Affiliates will not be liable for any claim made by a Data Subject arising from or related to Stripe’s or any of its Affiliates’ acts or omissions, to the extent that Stripe was acting in accordance with your Instructions.

4. Your obligations when acting as a Data Controller.

You must:

(a) only provide Instructions to Stripe that are lawful;

(b) comply with and perform your obligations under DP Law, including with regard to Data Subject rights, data security and confidentiality, and ensure you have an appropriate legal basis for the Processing of Personal Data as described in the Agreement, including this DPA; and

(c) provide Data Subjects with all necessary information (including by means of offering a transparent and easily accessible public privacy notice)and, where required by DP Law, obtain all necessary consents, regarding Stripe’s and your Processing of Personal Data for the purposes described in the Agreement, including this DPA.

5. Stripe’s obligations when acting as a Data Controller.

Stripe must comply with and perform its obligations under DP Law when Processing Personal Data.

6. Data transfers.

6.1 Cross-border data transfers by you.

You acknowledge that in order for Stripe to provide the Services, you transfer Personal Data to Stripe, Inc. (“SINC”) in the United States. If the transfer comprises Personal Data that requires a Data Transfer Mechanism, the Data Transfers Addendum, which is incorporated into this DPA, will apply.

6.2 Cross-border data transfers by Stripe.

Stripe and its Affiliates may transfer Personal Data on a global basis as necessary to provide the Services. In particular, Personal Data may be transferred to SINC in the United States and to Stripe’s Affiliates and Sub-processors in other jurisdictions.

7. Conflict.

If there is any conflict between:

(a) the provisions of this DPA and any provision of the Agreement regarding Personal Data Processing, the provisions of this DPA will prevail; and

(b) the provisions of this DPA and any provision of the Data Transfers Addendum, the provisions of the Data Transfers Addendum will prevail.

8. Definitions.

Capitalized terms not defined in this DPA have the meanings given to them in the Agreement.

“Agreement” has the meaning given in the Stripe services agreement between you and Stripe located at www.stripe.com/[countrycode]/legal/ssa, where “[countrycode]” means the two-letter abbreviation for the country where your Stripe Account is located, or as otherwise agreed by the parties.

“Authorized Services” means Services that a Governmental Authority licenses, authorizes or regulates.

“CCPA” means California Consumer Privacy Act of 2018, Cal. Civ. Code Sections 1798.100-1798.199, and its implementing regulations.

“Data Controller” means the entity which, alone or jointly with others, determines the purposes and means of Processing Personal Data, which may include, as applicable, a “Business” as defined under the CCPA.

“Data Incident” means an unauthorized or unlawful Processing, use, access, loss, disclosure, destruction or alteration of Personal Data in a party’s or its Affiliate’s, or a party’s or its Affiliate’s subcontractor’s, agent’s or representative’s, possession or control.

“Data Privacy Framework” means, as applicable, the EU-US, Swiss-US or UK-US Data Privacy Framework self-certification program operated by the US Department of Commerce.

“Data Processor” means the entity that Processes Personal Data on behalf of the Data Controller, which may include, as applicable, a “Service Provider” as defined under the CCPA.

“Data Security Measures” means technical and organizational measures that are intended to secure Personal Data to a level of security appropriate for the risk of the Processing.

“Data Subject” means an identified or identifiable natural person to which Personal Data relates.

“Data Transfer Mechanism” means a transfer mechanism that enables the lawful cross-border transfer of Personal Data under DP Law, which includes transfer mechanisms that are required under DP Law in the EEA, Switzerland and the UK, such as the Data Privacy Framework, the EEA SCCs, the UK International Data Transfer Addendum and any data transfer mechanism available under DP Law that is incorporated into this DPA.

“Data Transfers Addendum” means the data transfers addendum located at www.stripe.com/legal/dta.

“DP Law” means Law that applies to Personal Data Processing under the Agreement and this DPA, including international, federal, state, provincial and local Law relating in any way to privacy, data protection or data security.

“EEA” means the European Economic Area.

“EEA SCCs” means Module 1 (Transfer: Controller to Controller) and Module 2 (Transfer: Controller to Processor) of the standard contractual clauses set out in the European Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries according to the GDPR.

“GDPR” means General Data Protection Regulation (EU) 2016/679.

“Instructions” means any communication or documentation, including that which may be provided through a Stripe API, or Stripe Dashboard, or written agreements between you and Stripe through which the Data Controller instructs a Data Processor to perform specific Processing of Personal Data for that Data Controller.

“Joint Controller” means a Data Controller that jointly determines the purposes and means of Processing Personal Data with one or more Data Controllers.

“Personal Data” means any information relating to an identifiable natural person that is Processed in connection with the Services, and includes “personal data” as defined under the GDPR and “personal information” as defined under the CCPA.

“Process” means to perform any operation or set of operations on Personal Data or sets of Personal Data, such as collecting, recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, aligning or combining, restricting, erasing or destroying, as described under DP Law.

“Sensitive Data” means, to the extent this data is treated distinctly as a special category of Personal Data under DP Law: (a) Personal Data that is genetic data, biometric data, data concerning health, a natural person's sex life or sexual orientation; (b) data about racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; (c) geolocation data; or (d) sensitive personal information as defined under the CCPA.

“Sub-processor” means an entity a Data Processor engages to Process Personal Data on that Data Processor’s behalf in connection with the Services.

“Supervisory Authority” means an independent public authority which is (i) established by a European Union member state pursuant to Article 51 of the GDPR; or (ii) the public authority governing data protection that has supervisory authority and jurisdiction over you.

“UK GDPR” means the GDPR, as transposed into United Kingdom national law by operation of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019.

“UK International Data Transfer Addendum” means the international data transfer addendum to the EEA SCCs issued by the United Kingdom’s Information Commissioner's Office.

EXHIBIT: STRIPE DATA SECURITY