Applicant information. Business ID Telephone Fax. EMVCo Letter of Approval - Terminal Level 1. Approval number:

Transcription

1 Applicant information Company name Contact person Business ID Telephone Fax Address Billing address, if different from applicant's Type of payment terminal Make and model of payment terminal Name and version of software Make and model of Contactless reader Name and version of Contactless software EMVCo Letter of Approval - Terminal Level 1 EMVCo Letter of Approval - Terminal Level 2 Visa PED /PCI POS PED Security Requirements and Evaluation Program Visa International VCPS approval reference for Contactless MasterCard Terminal Quality Management Reference

2 MasterCard PayPass Vendor Product - Letter of Approval (LoA) AMEX certification Yes No Place and date Signature

3 Appendix 1 1. APPLICATION OF CONTRACT TERMS These general terms of certification are applied to the Contractual relationship between the payment terminal and/or cash register system supplier (hereafter Supplier) and Inspecta Sertifiointi Oy, (hereafter Certification Provider), by which the Certification Provider will sell payment terminal and cash register system certification services applied for by the Supplier. These general terms take effect on 1 April By signing the certification application the Supplier commits to adhere to these general terms (Appendix 1) and the requirements of Nets Oy (Appendix 2). The certification contract (hereafter Contract) constituted by this application and these general terms take effect when the Certification Provider has received the Supplier's certification application. 2. CERTIFICATION PRINCIPLES "Certification" refers to the comparison of the functional specifications of credit/debit card transactions handled by payment terminals and cash register systems against a list of test transactions. The Certification Provider has authorised Nets Oy to act as the EMV Certification Provider for payment terminals and cash register systems in Finland. American Express... Federation of Finnish Financial Services... The Supplier sells and markets payment terminals and/or cash register systems in Finland. The Supplier is responsible for ensuring that the terminals and/or systems it sells comply with current international credit/debit card system requirements and have been tested in an environment which complies with these requirements. The Supplier is responsible for certification, re-certification and functional inspection. 3. SUPPLIER'S RESPONSIBILITIES 3.1. Application for certification or functional specification inspection and its appendices Before submitting a system or device to the Certification Provider for certification the Supplier must fill out an application form for the product and deliver the signed form, with appendices, to the Certification Provider s unit in charge of payment terminal certifications no later than one month before the certification date requested. The following must be appended to the certification application: EMV Level I and II certificates issued by a laboratory approved by EMVCo; Implementation Conformance Statement pertaining to the EMVCo Level II certificate; Visa and/or MasterCard security certification for the PIN code input keyboard; and MasterCard Terminal Quality Management Reference number or a sufficient explanation of how the process to obtain one is being implemented. Appendices to the application must be submitted to the Certification Provider in electronic form Submission of payment terminals and cash register systems for inspection The Supplier will bring the payment terminals and/or cash register systems it wants certified to a location designated by the Certification Provider prior to the certification date, and will pick them up when the Certification Provider has notified the Supplier that the inspection has been completed. If necessary the parties may also agree separately that the Certification Provider will perform the inspection at the Supplier's location Responsibility for notification of changes If changes are made or features added to payment terminals and/or cash register systems sold or marketed by the Supplier which may affect certified functional specifications, the Supplier must inform the Certification Provider. Resulting necessary measures and possible re-certification will be agreed upon separately. Certification by Nets Oy will be performed as specified in Appendix PAYMENT TERMINAL CERTIFICATE Obtaining a payment terminal certificate is based on meeting the requirements of an inspection requested by the Supplier in which the Certification Provider inspects the Supplier's payment terminal and/or cash register system to the following extent: Does the unit being inspected comply with the functional specifications and test transaction list in effect in Finland at that time? Does the unit being inspected comply with the EMV payment terminal specifications in effect in Finland at that time? Is the unit being inspected approved by EMVCo to the extent required? and Does the unit being inspected pass tests of international credit/debit card issuers and credit/debit card systems as required at that time? Certification does not verify that the terminal or system is functioning correctly. The Supplier is responsible for ensuring correct functioning of the terminal or system. After approving the Supplier's payment terminal and/or cash register system, the Certification Provider will grant it a seal of acceptance and send the certificate to the Supplier. The Certification Provider is not responsible for errors which are the fault of the Supplier or the Supplier's payment terminal or for ensuring that products or services sold by the Supplier are free of faults. The Supplier is responsible for ensuring that no demands for damages or other financial compensation are made to the Certification Provider as a result of damages to third parties caused by the Supplier's manufacturing methods, products or services. 5. PAYMENTS The Certification Provider will charge the Supplier as specified in this Contract for certification of payment terminals and cash register systems as well as for cancelled or unused certification times according to the price list in effect at the time. If an inspection is performed at the Supplier's location, the Certification Provider will also charge the Supplier for travel time as well as travel and lodging costs. The price list is found in Appendix 3 of this Contract. 6. INTANGIBLE RIGHTS The parties do not relinquish to each other any patents, copyrights, brand names or other intangible rights by entering into this agreement. 7. CHANGES TO GENERAL TERMS The Certification Provider has the right to change the general terms by posting them on its website or providing written notification to the Supplier at least one (1) month before the change takes effect. The Certification Provider may also make notification of a new URL for its

4 website by posting the information on its website mentioned above. Unless the Supplier has terminated the Contract in writing before the changes take effect, the Supplier is considered to have accepted the change and these terms become binding on the Supplier to the extent that they apply to certified terminals and/or systems sold or marketed by the Supplier. 8. TRANSFER OF THE CONTRACT products covered by a certificate. The register is available on the Certification Provider's website ( and can also be ordered from the Certification Provider. Inspecta Sertifiointi Oy PL 1000 (Sörnäistenkatu 2) HELSINKI Phone The Supplier does not have the right to transfer its rights or responsibilities under this Contract. The Certification Provider has the right to transfer its rights and responsibilities under this Contract by notifying the Supplier in writing of such a transfer. 9. PERIOD OF VALIDITY OF THE CONTRACT 9.1. Effective date and termination of the Contract These general terms become binding on the Supplier when the Supplier provides the Certification Provider with a signed certification application. These general terms will remain in force until further notice. Each party to the Contract may terminate the Contract in writing with one month's notice Termination of the Contract The Certification Provider has the right to terminate the Contract effective immediately and to remove the certified terminal and/or system sold or marketed by the Supplier from the list of certified terminals and systems if: The Supplier intentionally or grossly breaches its responsibilities under this Contract, or The Supplier files for bankruptcy, corporate reorganisation or liquidation. 10. LIMITS OF LIABILITY Liability for damages In addition to what is specified in Appendix 1 regarding the Supplier's liability for damages in case of errors the parties are liable to each other within the limits specified in Section 10.2 below for damages caused by intentional or negligent breaches of the terms of this Contract Limits of liability The parties are not responsible for damages resulting from force majeure or comparable situations which unreasonably hinder their operations. This limit of liability does not release either party from its responsibility to adhere to standard practices with regard to preventing, limiting and correcting damage. 11. APPLICABLE LAW AND RESOLUTION OF DISPUTES Finnish law will be applied to these terms and to the Contractual relationship specified in the certification Contract. An effort will be made to resolve disputes among the parties through negotiations. If a resolution cannot be reached through negotiations, disputes will be resolved in Helsinki District Court. 12. PUBLIC INFORMATION After a certificate is granted the Supplier's contact information and the information recorded on certificates will become public information. The Certification Provider maintains a register of holders of payment terminal certificates and of the

5 APPENDIX 2 1. NETS OY S REQUIREMENTS FOR PAYMENT TERMINALS AND/OR CASH REGISTER SYSTEMS SUBMITTED FOR CERTIFICATION OR FUNCTIONAL INSPECTION These requirements are applied in addition to the general terms to the contractual relationship between Suppliers of payment terminals and/or cash register systems and Inspecta Sertifionti Oy (hereafter Certification Provider), when the certification or functional specification inspection involves EMV terminals and/or cash register systems used by one of Nets Oy's merchant customers. take the following steps as a result of its negligence under this Section: have the terminal and/or system's EMV functional specifications acceptably tested and/or obtain a new certification for the terminal and/or system and/or cease sale of the terminal and/or system and recall the altered terminals and/or systems. 2. Marketing, sale and installation of certified payment terminals and/or cash register systems The Supplier has the right to market and sell certified payment terminals and/or cash register systems only with the software version and configuration certified, only for the use intended and as the type of payment terminal for which the Certification Provider granted the certification or which have been altered after certification only in a manner approved by the Certification Provider. When delivering a certified terminal or system to a customer, the Supplier commits to perform the installation and configuration in compliance with payment terminal specifications in effect in Finland at that time, applicable international credit/debit card issuers' regulations and instructions as well as guidelines provided by Nets Oy under separate cover. If a Supplier, customer or other party identifies a malfunction in a terminal or system, the Supplier must report the malfunction to Nets Oy immediately (within no more than 24 hours) after being notified of the malfunction and take measures to correct it. The Supplier must also immediately notify customers to whom it has sold a defective terminal or system of the malfunction. The Supplier must advise the customers to cease use of defective terminals or devices, and as possible offer alternative solutions for use by customers to minimise damages from errors in payment transactions caused by the malfunction. The Supplier is not responsible for ensuring that customers adhere to such advice. If the Supplier breaches its responsibilities specified in this Section, Nets Oy has the right to demand that the Certification Provider cancel the certification of the terminal and/or system in question and remove it from the certification register immediately after being notified of the breach and without prior notification to the Supplier. If so demanded, the Supplier is also responsible for compensating the Certification Provider and/or Nets Oy for costs and damages caused by the Supplier's breach of its responsibilities specified in this Section. 3. Assessment of need for re-certification If a change is made or features added to a payment terminal and/or cash register system sold or marketed by the Supplier, its EMV functional specifications must always be verified with appropriate and sufficient testing before it is put into use. If a change or new feature has an effect on EMV functional specifications, the Supplier must, at its own expense, ensure that the terminal and/or system are re-certified. In assessing whether re-certification is necessary the Supplier must comply with Finnish payment terminal system specifications as well as EMVCo's and international credit/debit card-issuers' guidelines and specifications in effect at that time. These guidelines can be found in EMVCo's bulletin Type Approval Bulletin No. 11, "Major and Minor Change Definitions." EMVCo is a joint venture owned by Visa, MasterCard, American Express and JCB International, and establishes international EMV regulations. In unclear situations the Certification Provider will work in collaboration with the Supplier at the Supplier's request to assess the need for re-certification. The Supplier is responsible for all costs of assessing the need for re-certification. If the Certification Provider and/or Nets Oy has reason to suspect that changes have been made or features added after certification to payment terminals and/or cash register systems sold or marketed by the Supplier and the Supplier is continuing to sell or market them as products certified by the Certification Provider, Nets Oy and/or the Certification Provider have the right to demand that the Supplier