IBM Payments Gateway

Transcription

1 IBM Terms of Use SaaS Specific Offering Terms IBM Payments Gateway The Terms of Use ("ToU") is composed of this IBM Terms of Use SaaS Specific Offering Terms ("SaaS Specific Offering Terms") and a document entitled IBM Terms of Use General Terms ("General Terms") available at the following URL: In the event of a conflict, the SaaS Specific Offering Terms prevail over the General Terms. By ordering, accessing or using the IBM SaaS, Client agrees to the ToU. The ToU is governed by the IBM International Passport Advantage Agreement, the IBM International Passport Advantage Express Agreement, or the IBM International Agreement for Selected IBM SaaS Offerings, as applicable ("Agreement") and together with the ToU make the complete agreement. 1. IBM SaaS Descriptions The following IBM SaaS offerings are covered by these SaaS Specific Offering Terms: IBM Payments Gateway (IPG) IBM Payments Gateway API Payment IBM Payments Gateway Hosted-Page Payment IBM Payments Gateway Advanced API Payment IBM Payments Gateway Settlement IBM Payments Gateway PG 0 Payments IBM Payments Gateway PG 1 Payments IBM Payments Gateway Payments Reconciliation IBM Payments Gateway Stored Value Payments IBM Payments Gateway IBM Pay Transactions IBM Payments Gateway Premium Account Support 2. Charge Metrics The IBM SaaS is sold under one of the following charge metric(s) as specified in the Transaction Document: a. Instance is a unit of measure by which the IBM SaaS can be obtained. An Instance is access to a specific configuration of the IBM SaaS. Sufficient entitlements must be obtained for each Instance of the IBM SaaS made available to access and use during the measurement period specified in Client's Proof of Entitlement (PoE) or Transaction Document. b. Thousand Events is a unit of measure by which the IBM SaaS can be obtained. Thousand Events entitlements are based on the number of occurrences of a specific event related to the use of the IBM SaaS, measured in packs of one thousand. Thousand Events entitlements are specific to the IBM SaaS and the type of event may not be exchanged, interchanged, or aggregated with other Thousand Events entitlements of another IBM SaaS or type of event. Sufficient entitlements must be obtained to cover every event that occurs during the measurement period specified in Client's PoE or Transaction Document. For this IBM SaaS, an Event is defined as a Master Transaction, counted in packs of one thousand. A Master Transaction is a set of instructions initiated from an application external to the program (for example, business banking web channel or manual message entry channel) or triggered by an event in the program (for example, recurring payment or time of day to start bulk processing). The Master Transaction manages the related business activity and logical unit of work including all updates and events associated with the various processing steps and ending when the final instruction is sent to an external application or the processing lifecycle is complete. A Master Transaction will initiate underlying transactions during its processing lifecycle. c. Engagement is a unit of measure by which the services can be obtained. An Engagement consists of professional and/or training services related to the IBM SaaS. Sufficient entitlements must be obtained to cover each Engagement. i (12/2016) Page 1 of 12

2 3. Charges and Billing The amount payable for the IBM SaaS is specified in a Transaction Document. 3.1 Partial Month Charges A partial month charge as specified in the Transaction Document may be assessed on a pro-rated basis. 3.2 Overage Charges If Client's actual usage of the IBM SaaS during the measurement period exceeds the entitlement stated on the PoE, then Client will be invoiced for the overage, as set forth in the Transaction Document. 3.3 Set-up Charges An initial one-time setup fee applies at the rate and billing term specified in the Transaction Document. 3.4 Remotely Delivered Charges Remote s will be billed at the rate specified in the Transaction Document and will expire after the number of days specified in the service's description from date of purchase regardless of whether all hours have been used 4. Term and Renewal Options The term of the IBM SaaS begins on the date IBM notifies Client of their access to the IBM SaaS, as documented in the PoE. The PoE will specify whether the IBM SaaS renews automatically, proceeds on a continuous use basis, or terminates at the end of the term. For automatic renewal, unless Client provides written notice not to renew at least 90 days prior to the term expiration date, the IBM SaaS will automatically renew for the term specified in the PoE. For continuous use, the IBM SaaS will continue to be available on a month to month basis until Client provides 90 days written notice of termination. The IBM SaaS will remain available to the end of the calendar month after such 90 day period. 5. Technical Support Technical support for the IBM SaaS is provided via and telephone. Any enhancements, updates, and other materials provided by IBM as part of any such technical support are considered to be part of the IBM SaaS and therefore governed by this ToU. Technical support is included with the IBM SaaS and is not available as a separate offering. More information about hours of availability, addresses, online problem reporting systems, and other technical support communication vehicles and processes are described in the IBM Software as a Support Handbook. Severity Severity Definition Response Time Objectives Response Time Coverage 1 Critical business impact/service down: Business critical functionality is inoperable or critical interface has failed. This usually applies to a production environment and indicates an inability to access services resulting in a critical impact on operations. This condition requires an immediate solution. 2 Significant business impact: A service feature or function is severely restricted in its use or Client is in jeopardy of missing business deadlines. 3 Minor business impact: Indicates the service or functionality is usable and it is not presenting a critical impact on operations. 4 Minimal business impact: An inquiry or non-technical request. Notification of Client within 15 minutes Notification of Client within 15 minutes No notification required No notification required 24x7 M-F local business hours M-F local business hours M-F local business hours i (12/2016) Page 2 of 12

3 6. IBM SaaS Offering Additional Terms 6.1 General Client agrees IBM may publicly refer to Client as a subscriber to the IBM SaaS offerings in a publicity or marketing communication. 6.2 Data Privacy IBM and Client are each responsible for complying with their respective obligations under the applicable data protection laws governing the personal data (as defined in the applicable data protection laws) that is stored or processed by IBM for Client under this Agreement ("Client Data"). By executing this Agreement, Client appoints IBM as a data Processor of Client Data. Client remains solely responsible for determining the purposes and means of IBM's processing of Client Data under this Agreement, including that such processing in accordance with Client's instructions will not place IBM in breach of the applicable data protection laws. IBM and Client each acknowledge that it is not investigating the steps the other is taking to comply with applicable data protection laws. Nothing in this Agreement prevents IBM or Client from taking the steps it deems necessary to comply with applicable data protection laws. Client acknowledges it is solely responsible for determining that the security measures specified in this Agreement constitute appropriate technical and organizational measures to protect Client Data as required by the applicable data protection laws. IBM is not required to perform or adhere to any security measures concerning Client Data other than those specified in this Agreement and as a Processor of Client Data; IBM will process Client Data as specified in this Agreement, and as IBM reasonably considers necessary or appropriate to perform the services. Client is solely responsible for determining that any transfer by IBM or Client of Client Data across a country border under this Agreement complies with the applicable data protection laws. 6.3 Personal Information and Regulated Content The IBM SaaS will enable Client to input and manage content containing the following information which may be considered personal or sensitive information under applicable privacy laws: Contact Information including name, address, phone number, address End customer payment credential information The communication, storage, and use of this data is governed and audited on a yearly basis to conform with Payment Card Industry Data Security Standards (PCI-DSS). 6.4 Derived Benefit Locations Where applicable, taxes are based upon the location(s) Client identifies as receiving benefit of the IBM SaaS. IBM will apply taxes based upon the business address listed when ordering an IBM SaaS as the primary benefit location unless Client provides additional information to IBM. Client is responsible for keeping such information current and providing any changes to IBM. 6.5 Statement of Security Practices IT system security involves protecting systems and information through prevention, detection, and response to improper access from within and outside Client's enterprise. Improper access can result in information being altered, destroyed, or misappropriated or can result in misuse of your systems to attack others. Without a comprehensive approach to security, no IT system or product should be considered completely secure and no single product or security measure can be completely effective in preventing improper access. IBM systems and products are designed to be part of a comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products, or services to be most effective. IBM does not warrant that systems and products are immune from the malicious or illegal conduct of any party. 6.6 Level Objectives level objectives are a goal and do not constitute a warranty to a Client. There is no refund, credit, or remedy available to Client in the event IBM does not meet the service level objectives. Batch Processing Turn- Around-Time Objective 90% of all transaction batches will be processed to completion in less than 60 minutes from receipt. i (12/2016) Page 3 of 12

4 Objective Responsiveness 95% of sent to IBM's shared support mailbox will be answered within 24 business hours. 24x7 Help Desk Call Answer Response Time Security Management Pre-Production system availability IBM's 24x7 Help Desk will answer phone calls in less than 60 seconds. IBM's PCI-DSS Level 1 Certification will be renewed at least once per annum. IBM will remediate High severity security vulnerabilities within 10 days. IBM will remediate Low severity security vulnerabilities within 30 days. Available for client testing 24x7 Pre-Production system is unattended outside normal Central European work hours. Pre-Production system incidents will, by default, be handled as severity 3. i (12/2016) Page 4 of 12

5 IBM Terms of Use IBM SaaS Specification 1. IBM SaaS Description 1.1 IBM Payments Gateway Appendix A IBM Payments Gateway is a SaaS payment solution. The IBM SaaS, using a PCI-compliant environment, connects to Client systems to collect and process payment information from end customers. 2. Additional Offerings Client must purchase IBM Payments Gateway along with at least one (1) of the following IBM SaaS Payment offerings: 2.1 IBM Payments Gateway API Payment Functionality includes: Transactions which are transmitted through an API that consists of a set of web services designed to facilitate integration with Client systems. The API provides a single interface to global payments across banks and processors in a large number of countries and currencies. 2.2 IBM Payments Gateway Hosted-Page Payment Functionality includes: Transactions which are transmitted through the Hosted Payment Page (HPP), a payment collection and wallet management GUI that is designed to be integrated into websites, mobile commerce sites, Smart Phone apps, call center applications, and back-office collection systems. The Hosted Payment Page is designed to be delivered in an HTML inline frame (iframe). 2.3 IBM Payments Gateway Advanced API Payment Functionality includes: Transactions which are transmitted through the JavaScript Object Notation (JSON) interface which is designed to facilitate development of payment functions in native smart phone applications. The JSON interface offers a set of payment APIs that are performed using HTTP methods on the related URL, with data delivered in the JSON format. 2.4 IBM Payments Gateway Price Group (PG) 0 Payments Functionality includes: Transactions in the form of authorization or payment requests which are transmitted through the Hosted Payment Page (HPP) or through an API interface, to one of the banks/processors listed in the IBM Payments Gateway PG 0 acquirers document, available at the product website. 2.5 IBM Payments Gateway Price Group (PG) 1 Payments Functionality includes: Transactions in the form of authorization or payment requests which are transmitted through the Hosted Payment Page (HPP) or through an API interface, to one of the banks/processors listed in the IBM Payments Gateway PG 1 acquirers document, available at the product website. 2.6 IBM Payments Gateway Stored Value Payments The Stored Value Payments offering processes transactions which are initiated from a Client's stored value account and accepted by a merchant inside a marketplace. This part facilitates this value transfer inside this closed loop marketplace structure. 2.7 IBM Payments Gateway IBM Pay Transactions IBM Pay Transactions are transactions accepted by merchants from the merchant application in a rich mobile checkout scenario. This offering includes an orchestration function, which allows interaction between CRM, POS, and token vault systems; the IBM token vault, which allows Clients to save and then access payment methods in a PCI-compliant data vault; and a connection to a payment switch, which allows those transactions to go out for processing. i (12/2016) Page 5 of 12

6 2.8 IBM Payments Gateway Payments Reconciliation This offering provides reports which track expected settlement transactions and amounts, and compares them to actual settlements, highlighting for resolution the problematic individual transactions. 2.9 IBM Payments Gateway Settlement Functionality includes: Transactions which are transmitted from a seller to a buyer's financial institution that contain payment information to enable transaction settlement to be completed IBM Premium Account Support The Payments Gateway Premium Account Support service package provides an extended ongoing service solution utilizing best practices and project guidance to our clients. The service includes the production management best practices up to 10 hours per month from a s Delivery manager. The service is delivered remotely and includes operational reviews including metrics, upcoming event & change control review and issues escalation review. Unused hours do not roll over month to month. 3. Setup s 3.1 IBM Payments Gateway Basic Payments Setup The IBM Payments Gateway Basic Payments Setup is a self-services onboarding solution that enables a Client to setup one merchant account with one acquirer for multiple payment methods. This package includes one project ID for the merchant account in one country. The package includes up to 6 hours of assistance via thru the client portal and expires 90 days from the date Client is notified by IBM that access to the IBM SaaS is available regardless of whether all hours have been 3.2 IBM Payments Gateway Payments Reconciliation Setup The IBM Payments Gateway Payments Reconciliation Setup is a service to configure the Payments Reconciliation module. The service includes the setup of one Merchant Account (i.e. Project Code), including pre-enabled acquirers, in the defined countries. The Client will provide the accounting reconciliation setup detail including the settlement and reconciliation flow, and accounting details used to configure the module. This service includes 46 hours of configuration. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been 3.3 IBM Payments Gateway Stored Value Payments Setup Stored Value Payments Setup service is an optional package for the configuration of the Stored Value module. The stored value scheme is set up with multiple participating merchants, tax and fee accounts including e-vouchers and stored value account balanced for individual end users. The Client will provide details on the accounting setup and acquiring bank account information to enable the stored value feature. Each stored value scheme is owned by a specific merchant and has a single currency. This service includes 12 hours of configuration expertise. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client regardless of whether all hours have been 3.4 IBM Payments Gateway IBM Pay Transactions Setup IBM Pay Transactions Setup gives Clients access to the IBM Pay orchestration function, access to the PCI-compliant token vault, and the ability to communicate transaction details between the point of sale, the token vault, and the designated payment switch. This setup service is required to enable Client's subscription to the IBM Pay Transactions service. 4. Remotely Delivered s 4.1 IBM Payments Gateway Premium Payments Configuration Remotely Delivered The IBM Payments Gateway Premium Payments Configuration service includes best practices, project guidance, and access to a subject matter expert to facilitate the provisioning of the IBM Payments Gateway service. This package includes up to 27 hours of access to the SME. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been i (12/2016) Page 6 of 12

7 4.2 IBM Payments Gateway Virtual Account Payment Configuration Remotely Delivered The IBM Payments Gateway Virtual Account Payment Configuration is an optional service to configure a range of virtual collection accounts, for one pre-enabled collections bank in one country, including automated receipt and processing of bank statements, policies for automated matching, rules for deallocation of virtual account numbers, and reports and notifications to merchant. The Virtual Account Payments is only pre-enabled for a predetermined list of collections banks. Some collections banks do not offer virtual account facilities at all. Other collections banks will require a separate "Electronic Payment Advise" connection to be established. Please consult the IBM Payment Gateway Acquirer List for further information. The Client will provide IBM with the merchant account information for processing the virtual account payments. This service includes 9 hours of configuration. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been 4.3 IBM Payments Gateway Data File Transaction Configuration Remotely Delivered The IBM Payments Gateway Data File Transaction Configuration package is a service to configure one directory for storage of Client's data files. Access to the directories provided for a specific set up subaccounts or project codes. The Client will provide the data to be stored via a web services request. This service includes 5 hours of configuration. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been 4.4 IBM Payments Gateway New Payment Method Configuration Remotely Delivered The IBM Payments Gateway New Payment Method Configuration service is an optional service enabling the specified payment method for the defined acquirer in the deployment country. The Client will provide IBM with the merchant ID setup information to configure the IBM SaaS solution. The Client will then perform a sales country acceptance test to validate the configuration prior to the move to production. This service excludes any fees that the acquirer may charge to the Client for delivery, connection or transaction fees. This service includes 4 hours of configuration time. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been 4.5 IBM Payments Gateway Additional Project Codes Remotely Delivered The IBM Payments Gateway Additional Project Codes provide for additional (priced in packs of one or ten) merchant ID account(s) on the Payments Gateway solution. Each merchant ID represents a unique project code in the solution. This option allows the Client to request a new or additional merchant ID/project code to be added to the IBM SaaS. The number of merchant ID/project codes that may be requested depends upon the number of additional project codes purchased. Each additional project code(s)/merchant ID is utilized under the master project code, and existing connectivity and certificate. The Client is responsible for providing the merchant ID information to IBM for configuration. Each priced project code addition service includes up to 7 hours of configuration time. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been 4.6 IBM Payments Gateway Account Updater Configuration Remotely Delivered The IBM Payments Gateway Account Updater Configuration service is available for the Client to manage several acquirers. Once configured by IBM and the specific acquirer, the Account Updater will automatically retrieve information about replacement cards and bank accounts for the cards and accounts stored in IBM's Wallet. This service excludes any fees that the acquirer(s) may charge to the Client for delivery, connection or transaction fees. This service includes 89 hours of remote service. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been i (12/2016) Page 7 of 12

8 4.7 IBM Payments Gateway New card Acquirer CnP connection (Auth & Settle) Remotely Delivered The IBM Payments Gateway New card Acquirer CnP connection (Auth, Settle) service builds and certifies an Acquirer connection to the Payments Gateway base service, including a business and technical review of the acquirer specifications, mapping to the IBM SaaS solution, and certification with the acquirer to support authorization for card not present transactions. E-commerce, MOTO, Recurring MCC code and support for 3DSecure are included if available through the requested acquirer using the public internet. This service excludes any fees that the acquirer may charge to the Client for delivery, connection or transaction fees. The Client is responsible for the introduction of IBM to the acquirer and assisting with the relationship management of establishing the new connection. This service includes 219 hours of remotely delivered design and implementation services for the defined acquirer. The Remote expires 180 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been 4.8 IBM Payments Gateway New card Acquirer CnP connection (Auth, Settle & EPA) Remotely Delivered The IBM Payments Gateway New card Acquirer CnP connection (Auth, Settle & EPA) service package is an optional service to build and certify an acquirer connection to the IBM SaaS service. The package includes business and technical review of the acquirer specifications, mapping to the IBM SaaS solution, certification with the acquirer to support authorization, settlement and electronic payment advice (EPA) for card not present transactions. E-commerce, MOTO, Recurring MCC code and support for 3DSecure are included if available thru the requested acquirer. This service excludes any fees that the acquirer may charge to the Client for delivery, connection or transaction fees. The Client is responsible for the introduction of IBM to the acquirer and assisting with the relationship management of establishing the new connection. This service includes 223 hours of remotely delivered design and implementation for the defined acquirer. The Remote expires 180 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been 4.9 IBM Payments Gateway New Electronic Payment Advise (EPA only) Remotely Delivered The IBM Payments Gateway New Electronic Payment Advise (EPA only) service is an optional service to build and certify an acquirer to the IBM SaaS service. The Electronic Payment Advise (EPA) is used to provide electronic payment data in the payment reconciliation process reporting. This service excludes any fees that the acquirer may charge to the Client for delivery, connection or transaction fees. The Client is responsible for the introduction of IBM to the acquirer and assisting with the relationship management of establishing the new connection. This service includes 223 hours of remotely delivered design and implementation for the defined acquirer. The Remote expires 180 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been 4.10 IBM Payments Gateway Payment Architecture Consulting Remotely Delivered The IBM Payments Gateway Payment Architecture Consulting service assists the Client with the establishment of an overview of all integration points and system interfaces for the payment solution. The service includes a review of the Client integration points, including payment channels, call center, credit management, fraud management, and financial systems. The approach includes a review and recommendation for the IBM APIs to use with the defined integration point. The service includes 15 hours of remotely delivered services. The service expires 90 days from the date IBM confirms the order for the service with Client, regardless of whether all hours have been 4.11 IBM Payments Gateway Online Payment Solution Design Consulting Remotely Delivered IBM Payments Gateway Online Payment Solution Design Consulting assists Client in the integration of the IPG Hosted Payment Page API into the Client's existing web infrastructure. The service includes a review of the web interface, page sequencing, split payments, payment policies and configuration considerations. i (12/2016) Page 8 of 12

9 This service includes 24 hours of remote expertise. The Remote expires 90 days from the date IBM confirms the order for the Remote s with Client, regardless of whether all hours have been 4.12 IBM Payments Gateway Client Wallet Solution Design Consulting Remotely Delivered The IBM Payments Gateway Client Wallet Solution Design Consulting service assists the Client in documenting the payment checkout solution for their web sites, m-commerce sites and smart phone applications. The offering reviews the wallet instruments including cards, bank accounts, PayPal and Stored Value. The solution documents common use cases, such as one click payment in ecommerce and smartphone applications, wallet management in the my account settings, Auto Pay sign up and Automatic payments. The service includes 19 hours of remote services. The Remote expires 90 days from the date IBM confirms the order for the Remote s with Client, regardless of whether all hours have been 4.13 IBM Payments Gateway Order Management Solution Design Consulting Remotely Delivered The IBM Payments Gateway Order Management Solution Design Consulting service assists the Client with documenting the order confirmation and order fulfilment processes. IBM will review with Client order confirmation practices, including offline payments, handling declined payments, and split payments. Specifically, the solution includes a review of: the order release process, including risk management and assumed approval processing; and the capture process, including one step payment, and two step payments, online transaction capture (OLTC), split shipments and amount deviations as well as the long fulfilment cycle and expired authorization processes. The service includes 40 hours of remote services. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been 4.14 IBM Payments Gateway Call Center Payments Solution Design Consulting Remotely Delivered The IBM Payments Gateway Call Center Payments Solution Design Consulting service helps the Client design their payment solution for a Client call center environment. The service includes a review of: manual payment processes using the IBM Payments Gateway Virtual Terminal and Integration of the IBM Hosted Payment Page into a call center environment; and the payment methods available in the Client call center. The service includes 15 hours of remote services. The Remote expires 90 days from the date IBM confirms the order for the Remote s with Client, regardless of whether all hours have been 4.15 IBM Payments Gateway Payment Reconciliation Solution Design Consulting Remotely Delivered The IBM Payments Gateway Payment Reconciliation Consulting service is an optional service that provides a reconciliation expert to help the Client design a straight-through-processing of payments using IBM's Payment Reconciliation service. The consulting service includes a review of automated matching of offline payments, straight through processing data feeds, and settlement operational reporting. This service includes 40 hours of remote expertise to facilitate, design and document the use of the Payment Reconciliation. The Remote expires 90 days from the date IBM confirms the order for the Remote s with Client, regardless of whether all hours have been i (12/2016) Page 9 of 12

10 4.16 IBM Payments Gateway Stored Value Solution Design Consulting Remotely Delivered The IBM Payments Gateway Stored Value Solution Design Consulting service helps Client design and implement prepaid or post-paid stored value solutions, using IBM's Stored Value Host. The solution includes a review of: the configuration of schema and Stored Value Host accounts, user accounts, merchant accounts, authentication, stored payments, vouchers and risk management; and the blocking, unblocking of user and merchant accounts, reporting and data feeds. The service includes 34 hours of remote services. The Remote expires 90 days from the date IBM confirms the order for the Remote s with Client, regardless of whether all hours have been i (12/2016) Page 10 of 12

11 IBM Terms of Use Level Agreement Appendix B IBM provides the following availability service level agreement ("SLA") for the IBM SaaS as specified in a PoE. The SLA is not a warranty. The SLA is available only to Client and applies only to use in production environments. 1. Availability Credits Client must log a Severity 1 support ticket with the IBM technical support help desk within 24 hours of first becoming aware of an event that has impacted the IBM SaaS availability. Client must reasonably assist IBM with any problem diagnosis and resolution. A support ticket claim for failure to meet an SLA must be submitted within three business days after the end of the month. Compensation for a valid SLA claim will be a credit against a future invoice for the IBM SaaS based on the duration of time during which production system processing for the IBM SaaS is not available ("Downtime"). Downtime is measured from the time Client reports the event until the time the IBM SaaS is restored and does not include time related to a scheduled or announced maintenance outage; causes beyond IBM's control; problems with Client or third party content or technology, designs or instructions; unsupported system configurations and platforms or other Client errors; or Client-caused security incident or Client security testing. IBM will apply the highest applicable compensation based on the cumulative availability of the IBM SaaS during each month, as shown in the table below. The total compensation with respect to any month cannot exceed 10 percent of one twelfth (1/12th) of the annual charge for the IBM SaaS. 2. Levels The Client may only make a claim against one of the following service level obligations in a month. * If the IBM SaaS was acquired from an IBM Business Partner, the monthly subscription fee will be calculated on the then-current list price for the IBM SaaS in effect for the contracted month which is the subject of a claim, discounted at a rate of 50%. IBM will make a rebate directly available to Client. 2.1 Availability of the IBM SaaS during a month IBM's Web s, Hosted Payment Page and Virtual Terminal interfaces will be available to the Client at least 99.95% of the time during a month. Availability during a contracted month Compensation (% of monthly subscription fee* for contracted month that is the subject of a claim) < 99.95% 2% < 99.80% 4% < 99.60% 6% < 99.30% 8% < 99.00% 10% Availability, expressed as a percentage, is calculated as: the total number of minutes in a month that IBM's Web s, Hosted Payment Page and Virtual Terminal are available and responding to Client's requests, divided by the total number of minutes in a month, multiplied by IBM Web Response Time during a month IBM offers two Response Time SLAs as follows: Median IBM Web Response Time The median IBM Response Time for CheckoutStartSession and CardAuthorize Web s will be less than 100 milliseconds. The IBM Response Time for a given Web is measured as the elapsed time from when the Web request is received at the entry point to IBM's system, until IBM's web service response is sent back to the Client, minus any time IBM's system has spent waiting for responses from downstream Third Party Processors. i (12/2016) Page 11 of 12

12 The service level target is calculated as the median IBM Response Time for CheckoutStartSession and CardAuthorize Web s respectively, across all such Web requests in a given month. Median Response Time (during a contracted month) Compensation (% of monthly subscription fee* for contracted month that is the subject of a claim) > 100 ms 2% > 500 ms 6% > 1 second 10% % IBM Web Response Time 99% of CheckoutStartSession and CardAuthorize Web s will have an IBM response time of less than 1 second. The IBM Response Time is calculated the same as defined above for the Median IBM Web Response Time. The service level target is calculated as the 99 percentile IBM Response Time for CheckoutStartSession and CardAuthorize Web s respectively, across all such Web requests in a given calendar month. 99% Response Time (during a contracted month) Compensation (% of monthly subscription fee* for contracted month that is the subject of a claim) > 1 second 2% > 5 seconds 6% > 10 seconds 10% 3. Exclusions If Client reports Downtime related to: a. Web s, Hosted Payment Page and Virtual Terminal occurring simultaneously; or b. CheckoutStartSession and CardAuthorize Web s Response Time occurring simultaneously, IBM will treat the overlapping periods of Downtime as a single period. Client may not submit a claim for a Response Time SLA when an availability service level outage has been recorded for the same period of time. i (12/2016) Page 12 of 12