Cybersource Data Processing Agreement

This Data Processing Agreement (“DPA”) is an agreement between you and the entity you represent (“Customer” or “you”), on the one hand, and Cybersource Corporation and/or any other applicable affiliated Cybersource contracting entity(ies) ("Cybersource”), on the other hand.  It forms part of any written or electronic agreement between you and Cybersource (each, an “Agreement”) under which Cybersource Processes Personal Information (“Customer Personal Information”), except with respect to any Agreement under which you and Cybersource have entered data processing terms that address the subject matter hereof.

General Terms
1. Definitions.  Unless otherwise defined in the Agreement (including this DPA), all terms in this DPA shall have the definitions given to them in Applicable Data Protection Law.

2. Processing of Customer Personal Information. The parties acknowledge and agree that under Applicable Data Protection Law, that Cybersource may act in various data processing roles. To enable each party to comply with its obligations under Applicable Data Protection Law, each party further agrees to comply with any required provisions of Schedule A: U.S. State Privacy Laws and/or Schedule B: General Data Protection Regulation, each, to the extent applicable. 

2.1 GDPR. Where the General Data Protection Regulation (Regulation (EU) 2016/679 (the “GDPR”) applies to your use of Transaction Services or if Applicable Data Protection Law imposes a comparable requirement, the parties acknowledge and agree that with respect to the Customer Personal Information that Cybersource Processes, that:

2.1.1 Cybersource is a “processor” or such equivalent term under Applicable Data Protection Law, if any (referred to as “Processor” for purposes of this DPA) for the “Processor Services”. Such Processor Services include, by way of example and for illustrative purposes the Processing detailed on Details of Processing (Exhibit 2, section 1); and

2.1.2 both Customer and Cybersource are “joint controllers”, or such equivalent term under Applicable Data Protection Law, if any, for the “Controller Services”. Such Controller Services include the Processing detailed on Details of Processing (Exhibit 2, section 2).

2.1.3 Cybersource is a “controller”, or such equivalent term under Applicable Data Protection Law, if any, for any other Processing permitted under this Agreement.

2.2 Other Applicable Data Protection Law. Where section 2.1 does not apply, the parties acknowledge and agree that Cybersource is a Processor or “Service Provider” as defined in applicable U.S. State Privacy Laws for all Transaction Services.

3 Compliance with law.  Each of Cybersource, in its provision of Transaction Services to Customer, and Customer, in its use of the Transaction Services, shall Process Customer Personal Information in accordance with Applicable Data Protection Law. 

4 Privacy Notice. Customer shall provide its End-User(s) with all privacy notices, information and any necessary choices and shall obtain any necessary consents to enable the parties to comply with Applicable Data Protection Law with respect to the Transaction Services.

5 Authorization to Process. Cybersource will Process Personal Information on behalf of Customer to provide Transaction Services, and Customer authorizes Cybersource to Process Customer Personal Information in connection with the following activities:

5.1 In accordance with the applicable Agreement(s), including, without limitation, any exhibits, schedules, and applicable price schedule(s), to provide the Transaction Services, and any Processing required under applicable law or regulations;

5.2 Based on the instructions of Customer and in its use of the Transaction Services, Processor transfers Personal Information to acquiring banks, issuing banks, payment processors providing services on behalf of acquiring banks, credit/debit card companies, or service providers performing payer authentication services used by Customer, such as Verified by Visa and MasterCard Identity Check (ID Check);

5.3 Providing customer support; performing internal analysis to maintain the quality of Transaction Services and systems reliability; to detect, prevent, and/or address technical errors, security vulnerabilities, and fraudulent or illegal actions from disrupting or impairing intended functionality of Transaction Services.

5.4 As reasonably necessary to enable Cybersource to comply with any other directions or instructions provided by Customer in the provision of Processor Services.

6 Cybersource may use Customer Personal Information in Cybersource’s capacity as an independent controller to evaluate, analyze, develop, improve, and enhance the fraud, risk and identity capabilities and offerings of Cybersource and/or its Affiliates, including to enable technical or operational features that support the above purpose(s) in Section 5.

7 Staff.  Cybersource shall ensure that persons authorized to Process Customer Personal Information have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

8 Security of Processing. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Cybersource shall implement technical and organizational measures to ensure a level of security appropriate to that risk. In assessing the appropriate level of security, Cybersource shall, in particular, take into account the sensitivity of the Personal Information and the risks that are presented by the Processing, in particular from unauthorized or unlawful Processing, accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Information transmitted, stored or otherwise Processed.  Cybersource shall provide reasonable assistance to Customer in ensuring Customer meets its own compliance obligations with respect to these same security measures. The parties shall also comply with PCI-DSS as set out in the Agreement.

8.1 Security Breach. A party shall promptly and thoroughly investigate all allegations of unauthorized access to, use or disclosure of Customer Personal Information. In the event of an actual Security Breach (defined below) affecting Customer Personal Information the parties shall cooperate and assist one another in good faith as needed to comply with Applicable Data Protection Laws including as applicable, notifying a Supervisory Authority of the Security Breach and communicating the Security Breach to the relevant Data Subjects.

8.2 In the event of an actual Security Breach (defined below) affecting Customer Personal Information contained in:

8.2.1 Cybersource’s systems, Cybersource shall notify Customer of the Security Breach without undue delay and continue to keep Customer informed on a regular basis of the progress of investigation and remediation efforts. Notice in accordance with this section shall be made by sending an email and/or text message to the email address and/or mobile phone number registered by Customer in the Business Center. For Controller Services, Customer shall cooperate and assist Cybersource as necessary for Cybersource to communicate the Security Breach to the relevant Supervisory Authorities.

8.2.2 Customer’s systems, Customer may elect to notify Cybersource of the Security Breach, and such notice should be made by sending an email to vsirt@visa.com. Cybersource shall cooperate and assist Customer as necessary for Customer to communicate the Security Breach to the relevant Supervisory Authorities.

8.2.3 Customer shall be responsible for communicating any Security Breach to End Users if notice is required under Applicable Data Protection Laws.

8.2.4 Except as required by applicable law or regulation, neither party will make (or permit any third party to make) any statement concerning the Security Breach that directly or indirectly references the other party, unless the other party provides its explicit written authorization.

8.2.5 To the extent that a Security Breach was caused by Customer or Customer’s End Users, Customer shall be responsible for the costs arising from the Processor’s provision of assistance under this section 8.

9 Audit Cybersource shall make available to Customer all information necessary to demonstrate compliance with its obligations under this DPA and allow for (and contribute to) audits, including inspections conducted by Customer or another auditor under the instruction of the Customer for the same purposes of demonstrating compliance with obligations set out in this DPA.

9.1 Customer’s right under this section 9 is subject to the following: If Cybersource can demonstrate compliance with its obligations set out in this DPA by adhering to an approved code of conduct, by obtaining an approved certification or by providing Customer with an audit report issued by an independent third party auditor (provided that Customer will comply with appropriate confidentiality obligations as set out in the Agreement and shall not use such audit report for any other purpose), Customer agrees that it will not conduct an audit or inspection under this section 9;

9.2 In acknowledgement of the time, expense and disruption to business associated with performing audits and inspections involving interviews and onsite visits, Customer agrees to only conduct such audits and inspections on condition that Customer can demonstrate such audit, or inspection is necessary beyond the information made available by Cybersource under section 9.1 above. Such audits and inspections, shall be at reasonable intervals (but not more than once per year) upon not less than 60 days' notice and at a date mutually agreed by the Parties, provided that the audit will (i) not disrupt Cybersource's business; (ii) be conducted during business hours and at the Customer’s expense; (iii) not interfere with the interests of Cybersource’s other customers; and (iv) not exceed a period of two successive business days.

10 Deletion and Retention.  Cybersource shall, at the direction of Customer, delete or return all Customer Personal Information upon termination of the provision of Transaction Services and delete existing copies in accordance with its global Records and Information Management (RIM) policy, unless storage is required by applicable law.

11 Cross-Border Transfers. Any cross-border transfer between Cybersource and Customer shall be made in accordance with Applicable Data Protection Law, by incorporating, without limitation, the Standard Contractual Clauses and other applicable transfer mechanisms set forth in Schedule B: General Data Protection Regulation of this DPA, and/or other applicable information provided in Exhibit 1 of this DPA. Where a transfer pertains to a jurisdiction not covered by the mechanisms referenced above, the Parties shall work in good faith to enter into terms that implement appropriate safeguards providing an adequate level of protection in accordance with Applicable Data Protection Law, including by incorporating the information provided under Schedule B (GDPR) or Exhibit 1 (Standard Contractual Clauses), and, where applicable, other regional transfer clauses which may be attached hereto.

12 Miscellaneous.  To the extent not inconsistent herewith, the applicable provisions of the Agreement(s) (including without limitation, indemnifications, limitations of liability, enforcement, and interpretation) shall apply to this DPA.  In the event of any conflict between this DPA and the terms of an applicable Agreement, the terms of this DPA shall control solely with respect to data processing terms where required by Applicable Data Protection Law, and, in all other respects, the terms of the applicable Agreement shall control.  Notwithstanding any term or condition of the DPA, the DPA does not apply to: (1) any data or information that Customer inputs into any software, tool, or service outside of the Transaction Services covered in this Agreement, including Customer’s use of any chatbots in the Enterprise Business Center, product demos, sandbox, pilots, or previews; and (2) any data or information that does not relate to one or more identifiable individuals under Applicable Data Protection Law, such as data that has been aggregated, de-identified or anonymized, or to the extent that Cybersource and you have entered separate data processing terms that address the subject matter hereof. Cybersource shall have the right to analyze and aggregate Customer Information relating to the provision, use, and performance of the Services including information relating to, derived from, or generated from Customer Information to enable, improve, and optimize the Services and Cybersource products, and to support the creation and enhancement of security and fraud prevention tools and models.

Schedule A
U.S. STate law privacy compliance

This U.S. State Privacy Law Schedule applies in addition to any terms set forth in the General Terms of the DPA (and is incorporated therein) when your use of Transaction Services is subject to the California Consumer Privacy Act of 2018 and its implementing regulations, as amended or superseded from time to time (California Civil Code §§ 1798.100 to 1798.199) (collectively, the “CCPA”) or similar state laws (“U.S. State Privacy Laws”), or if Applicable Data Protection Law imposes a comparable requirement outlined under Schedule A. 

1. APPLICATION

1.1 This Schedule is applicable solely to the extent that any Customer Personal Information Processed by Cybersource while performing the Transaction Services is subject to applicable U.S. State Privacy Laws. Nothing in this Schedule indicates acknowledgement by either party that it is subject to the applicable U.S. State Privacy Laws for any purpose, including the provision of Transaction Services, nor does anything in this Schedule waive either party’s right to object to application of the U.S. State Privacy Laws. Notwithstanding anything else to the contrary, the parties agree that this Schedule does not apply to any information that is collected, processed, or disclosed by the parties subject to the Gramm Leach Bliley Act (“GLBA”).

1.2 Capitalized terms used but not defined in this Schedule shall have meaning assigned to such terms in the DPA or, if not defined therein, in the applicable U.S. State Privacy Laws. In the event of a conflict between this Schedule and the Agreement, this Schedule will control, to the extent necessary to ensure compliance with U.S. State Privacy Laws. The foregoing recitals are hereby incorporated by reference into this Schedule.

2. DATA PRIVACY ROLES AND OBLIGATIONS

2.1 For purposes of this Schedule, the parties acknowledge that, with respect to Customer Personal Information Cybersource processes on behalf of Customer under the Agreement that is not processed pursuant to GLBA (a) Customer acts as a Business and Cybersource acts as a Service Provider as those terms are defined under the CCPA; and (b) Customer acts as a Controller and Cybersource acts as a Processor within the meanings provided by other applicable U.S. State Privacy Laws.

2.2 Each party shall comply with its obligations under the applicable U.S. State Privacy Laws in respect of any Customer Personal Information Processed under this Schedule. Customer specifically acknowledges and agrees that its use of the Services will not violate the rights of any Consumer, including those that have opted-out from sales or other disclosures of Customer Personal Information, to the extent applicable under the U.S. State Privacy Laws. 

3. CYBERSOURCE OBLIGATIONS

3.1 In its role as a Service Provider or Processor, Cybersource:

a) Will ensure Customer Personal Information is used consistently with applicable U.S. State Privacy Laws;

b) Will Process Customer Personal Information for the business purposes set forth in the DPA;

c) Will not:

 i. sell or share for cross-contextual behavioral advertising Customer Personal Information

 ii. retain, use, or disclose Customer Personal Information for any purpose other than as necessary to fulfill the business purposes set forth in the DPA, including retaining, using, or disclosing Customer Personal Information for a commercial purpose other than the business purpose set forth in the DPA or outside of the direct business relationship between Cybersource and Customer;

 iii. combine the Customer Personal Information with Customer Personal Information that it receives from or on behalf of any other person(s) or entity(ies), or collects from its own interaction with an individual, except as otherwise permitted by U.S. State Privacy Laws;

 iv. where applicable, use any Sensitive Customer Personal Information received from Customer other than to assist the Customer in purposes authorized by Customer instruction.

Each, except as permitted by U.S. State Privacy Laws or as required to perform business purpose(s) defined in the DPA.

d) Will implement reasonable security procedures and practices, appropriate to the nature of the Customer Personal Information, to protect the Customer Personal Information from unauthorized or illegal access, destruction, use, modification, or disclosure;

e) Will immediately notify Customer of any material changes in Cybersource’s ability to meet its obligations under the applicable U.S. State Privacy Laws, including but not limited to any determination that Cybersource can no longer meet its obligations under this Schedule;

f) Will ensure that Cybersource personnel involved in the processing of Customer Personal Information are subject to a duty of confidentiality and ensure that Cybersource’s agreement with any sub-processors used to Process Customer Personal Information complies with U.S. State Privacy Laws, including, without limitation, the contractual requirements for Service Providers and Contractors;

g) Will provide reasonable cooperation to Customer, upon request, to enable Customer to comply with consumer requests made pursuant to the applicable U.S. State Privacy Laws;

h) Will provide reasonable information necessary for Customer to conduct and document data protection assessments;

i) Grants Customer the right to take reasonable and appropriate steps in accordance with section 9 of the DPA General Terms to ensure that Cybersource uses Customer Personal Information in a manner consistent with Customer’s obligations under the applicable U.S. State Privacy Laws;

j) Grants Customer the right, upon notice, and in accordance with the Agreement to take reasonable and appropriate steps to stop and remediate Cybersource’s unauthorized use of Customer Personal Information; and

k) Will delete Customer Personal Information of the Customer at the end of the provision of Services under the Agreement, unless retention of the Customer Personal Information is required or authorized under the Agreement or U.S. State Privacy Laws.

Cybersource certifies that it understands its obligations, including restrictions, imposed upon it by CCPA with respect to Customer Personal Information and will comply with them.

3.2 Notwithstanding the above, Cybersource may retain, use or disclose Customer Personal Information as permitted under the applicable U.S. State Privacy Laws, including:

a) For its internal use to build or improve the quality of the Services, provided that Cybersource does not use the Customer Personal Information to perform services on behalf of another person;

b) To prevent, detect, or investigate data security incidents or protect against malicious, deceptive, fraudulent or illegal activity;

c) For the purposes enumerated in California Civil Code § 1798.145(a)(1) through §1798.145(a)(7); and/or

d) For any other purpose expressly contemplated or permitted by U.S. State Privacy Laws or other Applicable Data Protection Law.

SCHEDULE B
GENERAL DATA PROTECTION REGULATION

This GDPR Schedule applies in addition to any terms set forth in the body of the DPA (and is incorporated therein) when the GDPR applies to your use of Transaction Services or if Applicable Data Protection Law imposes a comparable requirement outlined under Schedule B.  Capitalized terms not defined herein have the meaning assigned to them under the DPA.  To the extent there are any conflicts between this GDPR Schedule and the DPA, this GDPR Schedule shall prevail.

1 Processor Obligations.  Processor shall Process Customer Personal Information only on documented reasonable instructions from Customer (including instructions with respect to transfers of Customer Personal Information to a third country, if applicable) unless Processor is required to otherwise Process Customer Personal Information by Applicable Data Protection Law.  In such circumstances, Processor shall inform Customer of that legal requirement before Processing, unless prohibited from doing so by applicable law, on important grounds of public interest. Processor shall immediately inform Customer if, in Processor’s opinion, Customer’s instructions would be in breach of Applicable Data Protection Law.  Customer agrees that Processor shall be under no obligation to take actions designed to form any such opinion. Notwithstanding the foregoing, Customer acknowledges and agrees that Cybersource may perform certain Processing activities on Customer Personal Information in Cybersource’s capacity as an independent controller as described in section 6 of the General Terms.

2 Use of Sub-Processor

2.1 Customer provides authorization for Processor to engage with the Sub-Processors listed in the Business Center. Processor reserves the right to maintain its Sub-Processor list through means such as publication of its Sub-Processor list online.

2.2 Processor shall inform Customer of any intended changes concerning the addition or replacement of other Sub-Processors to give Customer a reasonable opportunity to object to such changes.  In the event Customer objects to Processor’s change or addition of a Sub-Processor, Customer shall promptly notify Processor of its objections in writing within 10 business days after receipt of Processor’s notice of such change or addition. 

2.3 Processor may, at its option, undertake reasonable efforts to make available to Customer a change in the Transaction Services or recommend a commercially reasonable change to Customer’s configuration or use of the Transaction Services to avoid Processing of Customer Personal Information by the objected-to new Sub-Processor.  If Processor is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may terminate the Agreement with respect to only those aspects of the Transaction Services, which cannot be provided by Processor without the use of the objected-to new Sub-Processor by providing written notice to Processor. If the Transaction Services as a whole cannot be performed without the objected-to new Sub-Processor, Customer may terminate the entire Agreement.

2.4 Processor agrees not to impose a penalty on Customer for any termination under this section 2.

3 Data Protection Impact Assessments and Prior Consultation with Regulator. Processor shall provide reasonable assistance to Customer with any legally required (i) data protection impact assessments; and (ii) prior consultations initiated by the Customer with its regulator in connection with such data protection impact assessments.  Such assistance shall be strictly limited to the Processing of Customer Personal Information by Processor on behalf of Customer under the Agreement taking into account the nature of the Processing and information available to the Processor.

4 Cross-Border Transfers for Processor Services. Processor shall comply with Customer’s documented instructions concerning the Transfer of Customer Personal Information to a third country. The Processor shall only Transfer any Customer Personal Information outside the Customer’s applicable jurisdiction or the End-User’s resident jurisdiction, including, without limitation, outside the European Economic Area (“EEA”), the UK or Switzerland, in compliance with the Applicable Data Protection Law. Customer agrees and acknowledges that Processor Transfers and stores certain Customer Personal Information (including relating to individuals located in the EEA, Switzerland and/or the UK) in the United States.

5 Transfers subject to the GDPR, UK GDPR or Swiss DP Laws. Module 2 (Transfer controller to processor) of the EEA Standard Contractual Clauses shall apply with respect to any Transfer of Customer Personal Information from the EEA, UK or Switzerland to Cybersource and any of its affiliated entities in the United States or other third countries ("Cybersource Entities"). The parties acknowledge and agree that Module 2 (Transfer controller to processor) of the EEA Standard Contractual Clauses is hereby incorporated by reference and;

5.1 Customer and any of its commonly owned or controlled affiliates that have signed an Agreement for Processor Services ("Customer Entities") shall be deemed to be “data exporter” and the Cybersource Entities shall be the "data importer";

5.1.1 Clause 7 – Docking clause shall apply;

5.1.2 Clause 9 – Use of subprocessors Option 2 shall apply and the “time period” shall be 10 business days;

5.1.3 Clause 11(a) – Redress the optional language shall not apply;

5.1.4 Clause 13(a) – Supervision

5.1.5 Where the data exporter is established in an EU Member State the following shall apply: “The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C , shall act as competent supervisory authority.”

5.1.6 Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of the GDPR the following shall apply: “The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.”

5.1.7 Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of the GDPR, the following shall apply: “The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.”

5.1.8 Clause 17 – Governing law Option 1 shall apply and the “Member State” shall be Ireland;

5.1.9 Clause 18 – Choice of forum and jurisdiction the Member State shall be Ireland; and

5.1.10 the information in Exhibit 1 (Table 1) of this GDPR Schedule is incorporated into Annexes 1, 2 and 3 of the EEA Standard Contractual Clauses.

6 Transfers subject to the UK GDPR: where the Transfer is subject to the UK GDPR, the EEA Standard Contractual Clauses and section 5.1 of this Schedule B shall be read in accordance with, and deemed amended by, the provisions of Part 2 (Mandatory Clauses) of the UK IDTA. For the purposes of Table 4 in Part 1 (Tables) of the UK IDTA, the parties select the “neither party” option. Otherwise, the Parties confirm that the information required for the purposes of Part 1 (Tables) of the UK IDTA is set out in Exhibit 1. If there is any conflict or inconsistency between a term in the body of this DPA, an Agreement and a term in Module 2 (Transfer controller to processor) of the EEA Standard Contractual Clauses, incorporated into this DPA, the term in Module 2 (Transfer controller to processor) of the EEA Standard Contractual Clauses shall take precedence.

7 Transfers subject to Swiss DP Laws: Where the Transfer is subject to the Swiss DP Laws, the EEA Standard Contractual Clauses and Clause 5 of this Schedule B shall be read in accordance with section 10.4 of Schedule B to this DPA.

8 Use of third parties in Controller Services. Cybersource may share certain Personal Information received from Customer with third parties who use that Personal Information to help Cybersource to detect and prevent fraud. These third parties are responsible for their own use of your End User’s Personal Information as described in their notices included in Exhibit 3.

9 Controller Services.

9.1 Joint Controller Arrangement The obligations in this DPA, including those set out below in this GDPR Schedule, shall constitute the written arrangement allocating responsibilities between joint controllers required under Article 26 of the GDPR with respect to the Controller Services.

9.1.1 Reasonable Assistance. With respect to the Controller Services, each party shall assist the other party as reasonably required, in meeting any regulatory obligations in relation to data security, notification of a Security Breach, and data protection impact assessments for the Controller Services.

9.1.2 Notice. With respect to the Controller Services, Customer shall provide its End-User(s) with all privacy notices, information and any necessary choices and shall obtain any necessary consents to enable the parties to comply with Applicable Data Protection Law and shall inform its users of the Processing described in section 6 of the DPA.

9.1.3 Data Subject Rights. The parties agree that the Customer shall be the designated point of contact for the Data Subject with respect to Data Subject Rights requests for Controller Services, and Cybersource shall reasonably cooperate with and assist Customer in the execution and fulfilment of its obligations under Applicable Data Protection Laws in relation to such requests.

9.1.4 Supervisory Authority. The parties shall without undue delay notify each other upon receipt of any correspondence from a Supervisory Authority in respect of the Controller Services where and to the extent permitted by applicable law.

9.1.5 Security of Processing. Each party shall be responsible for ensuring adequate security in respect of processing of Personal Information for Controller Services that takes place within that party’s own systems.

9.1.6 Security Breach. For the avoidance of doubt, in the event of a Security Breach related to Controller Services, section 8.1 of the DPA General Terms shall govern.

10 Cross border transfers for Controller Services

10.1 Transfers subject to the GDPR, UK GDPR or Swiss DP Laws: Module 1 (transfer controller to controller) of the EEA Standard Contractual Clauses shall apply with respect to any Transfer of Customer Personal Information from the EEA, UK or Switzerland to Cybersource Corporation in the United States, solely when Cybersource Corporation is acting as a controller for the purposes of the Controller Services. The parties acknowledge and agree that Module 1 (transfer controller to controller) of the EEA Standard Contractual Clauses is hereby incorporated by reference and;

10.1.1 Customer and any Customer Entities shall be deemed to be “data exporters” and the Cybersource Entities shall be the "data importer";

10.1.2 Clause 7 – Docking clause shall apply;

10.1.3 Clause 11(a) – Redress the optional language shall not apply;

10.1.4 Clause 13(a) – Supervision

(a) Where the data exporter is established in an EU Member State the following shall apply: “The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C , shall act as competent supervisory authority.”

(b) Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of the GDPR the following shall apply: “The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.”

(c) Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of the GDPR, the following shall apply: “The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.”

10.1.5 Clause 17 – Governing law Option 1 shall apply and the “Member State” shall be Ireland;

10.1.6 Clause 18 – Choice of forum and jurisdiction the Member State shall be Ireland;

10.1.7 the information in Exhibit 1 (Table 1) of this GDPR Schedule is incorporated into Annexes 1, 2 and 3 of the EEA Standard Contractual Clauses.

10.2 Transfers subject to the UK GDPR: where the Transfer is subject to the UK GDPR, the EEA Standard Contractual Clauses and Clause 10.1 of this Schedule B shall be read in accordance with, and deemed amended by, the provisions of Part 2 (Mandatory Clauses) of the UK IDTA. For the purposes of Table 4 in Part 1 (Tables) of the UK IDTA, the parties select the “neither party” option. Otherwise, the Parties confirm that the information required for the purposes of Part 1 (Tables) of the UK IDTA is set out in Exhibit 1.

10.3 If there is any conflict or inconsistency between a term in the body of this DPA, an Agreement and a term in Module 1 (transfer controller to controller) of the EEA Standard Contractual Clauses incorporated into this DPA, the term in the EEA Standard Contractual Clauses shall take precedence.

10.4 Transfers subject to the Swiss DP Laws: to the extent the Swiss DP Laws are applicable to a data export under the EEA Standard Contractual Clauses set forth in this DPA, the Parties agree on the following amendments to the EEA Standard Contractual Clauses and Clause 10.1 of this Schedule B:

10.4.1 The term "Member State" according to Clause 18 (c) of the EEA Standard Contractual Clauses shall not be interpreted in a such a way that data subjects in Switzerland are excluded from exercising their rights, if any, at their place of habitual residence;

10.4.2 The supervisory authority pursuant to Clause 13 of the EEA Standard Contractual Clauses is the Swiss Federal Data Protection and Information Commissioner;

10.4.3 The law applicable to the EEA Standard Contractual Clauses pursuant to Clause 17 of the EEA Standard Contractual Clauses shall be Swiss DP Laws;

10.4.4 The place of jurisdiction under Clause 18 (b) of the EEA Standard Contractual Clauses shall be the courts of the city of Zurich;

10.4.5 Where the EEA Standard Contractual Clauses include references to the GDPR, such references shall be understood as references to the Swiss DP Laws.

EXHIBIT 1

INFORMATION REQUIRED FOR CROSS-BORDER TRANSFER CLAUSES

Part 1: EEA STANDARD CONTRACTUAL CLAUSES, UK IDTA, SWISS DP LAWS, AND OTHER REGIONAL TRANSFER CLAUSES)

EXHIBIT 2
DETAILS OF PROCESSING CUSTOMER PERSONAL INFORMATION

1. Details of Processing in respect of the Processor Services 
The table below includes certain details of the Processing of Customer Personal Information in respect of the Processor Services as required by Article 28(3) of the GDPR. Each of the service descriptions below apply to the extent that Customer uses such service under the Agreement.

2. Details of Processing in respect of the Controller Services 
The table below includes certain details of the Processing of Customer Personal Information in respect of the Controller Services. Each of the service descriptions below apply to the extent that Customer uses such service under the Agreement.

EXHIBIT 3
THIRD PARTY FRAUD PROVIDER PRIVACY NOTICES