Data processing agreement

Updated: June 28, 2023

This Data Processing Agreement (“DPA”) is an agreement between you and the entity you represent (“Customer” or “you”), on the one hand, and Authorize.net LLC (“Authorize.net”), on the other hand. It forms part of any written or electronic agreement between you and Authorize.net (each, an “Agreement”) under which Authorize.net Processes Personal Information on your behalf (“Customer Personal Information”), except with respect to any Agreement under which you and Authorize.net have entered data processing terms that address the subject matter hereof. This DPA forms a part of the Services Documentation, defined in the Agreement.

1 Processing of Customer Personal Information

1.1 Processor designation. The parties acknowledge and agree that with respect to the Customer Personal Information that Authorize.net Processes to provide the Transaction Services, which Processing may include, by way of example and for illustrative purposes the Processing detailed on Details of Processing Customer Personal Information (Exhibit 2), that Authorize.net is a “processor” or “service provider” under Applicable Data Protection Laws acting on Customer's instructions (referred to as “Processor” for purposes of this DPA).

1.2 Authorization to Process. Processor will Process Customer Personal Information to provide such Transaction Services, and Processor is authorized to Process Customer Personal Information solely in connection with the following activities:

1.2.1 In accordance with the applicable Agreement(s), including, without limitation, any exhibits, schedules, and applicable price schedule(s), to provide the Transaction Services, and any Processing required under applicable law or regulations;

1.2.2 Based on the instructions of Customer and in its use of the Transactions Services, Authorize.net will transfer Customer Personal Information to acquiring banks, issuing banks, payment processors providing services on behalf of acquiring banks, credit/debit card companies, or service providers performing payer authentication services used by Customer, such as Verified by Visa and Mastercard Identity Check (ID Check);

1.2.3 As reasonably necessary to enable Authorize.net to comply with any other directions or instructions provided by Customer; and

1.2.4 To support the creation of models for Authorize.net’s security and fraud prevention tools for use by the Customer and/or any other customer of Authorize.net. These models ensure Customer is provided with the most up to date scoring as part of the Transaction Services.

2 Compliance with Law

Each of Authorize.net, in its provision of services to Customer, and Customer, in its use of the services, shall Process Customer Personal Information in accordance with Applicable Data Protection Law.

3 Customer obligations

3.1 Customer shall provide its End-User(s) with all privacy notices, information and any necessary choices and shall obtain any necessary consents to enable the parties to comply with Applicable Data Protection Law;

3.2 Where required by Applicable Data Protection Law, Customer shall promptly inform Processor when Customer Personal Information must be corrected, updated, and/or deleted;

3.3 Customer shall ensure that at the point of transferring Customer Personal Information to Processor, the Customer Personal Information is adequate, relevant and limited to what is necessary in relation to the Processing envisaged under the Agreement and this DPA; and

3.4 Customer shall comply (and ensure that its third party auditor’s comply) with Processor’s relevant security policies and appropriate confidentiality obligations as set out in the Agreement.

4 Authorize.net obligations

4.1 Applicable Data Protection Law. To the extent necessary to enable Customer to comply with its obligations under Applicable Data Protection Law, Authorize.net further agrees to comply with any required provisions of the GDPR Schedule (other than when acting in accordance with Section 1.2 (Authorization to Process) of this DPA) and/or CCPA Schedule, each, to the extent applicable.

4.2 Data Subject Rights. Processor will, to the extent legally permitted, provide reasonable assistance to Customer to respond to requests from End-Users to exercise their rights under Applicable Data Protection Law (e.g., rights to access or delete Personal Information) in a manner that is consistent with the nature and functionality of the Transaction Services. Where Authorize.net receives any such request, it shall notify Customer and the Customer is responsible for handling such requests by an End User in accordance with Applicable Data Protection Law.

4.3 Engaging with Sub-Processors. Processor shall ensure that when engaging with another data processor including any Affiliates (a “Sub-Processor”) for the purposes of carrying out specific Processing activities on behalf of Customer, there is a written contract in place between Processor and the relevant Sub-Processor. Such written contracts, to the extent applicable to the nature of the Transaction Services provided by the relevant Sub-Processor, will provide at least the same level of protection for Customer Personal Information as set out in this DPA.

4.4 Staff. Processor shall ensure that persons authorized to Process Customer Personal Information have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.5 Security of Processing. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor shall implement technical and organizational measures to ensure a level of security appropriate to that risk. In assessing the appropriate level of security, Processor shall, in particular, take into account the risks that are presented by the Processing, in particular from unauthorized or unlawful Processing, accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Information transmitted, stored or otherwise Processed. Processor shall provide reasonable assistance to Customer in ensuring Customer meets its own compliance obligations with respect to these same security measures.

4.6 Security Breach

4.6.1 In the event of an actual Security Breach (defined below) affecting Customer Personal Information contained in Processor’s systems, Processor shall (i) investigate the circumstances, extent and causes of the Security Breach and report the results to Customer and continue to keep Customer informed on a regular basis of the progress of Processor’s investigation until the issue has been effectively resolved; and (ii) cooperate with Customer in any legally required notification by Customer of affected End-Users. The obligations herein shall not apply to Security Breaches caused by Customer or Customer’s End-Users.

4.6.2 Processor shall notify Customer without undue delay upon Processor or any Sub-Processor becoming aware of an actual Security Breach affecting Customer Personal Information, providing the Customer with sufficient information and reasonable assistance to allow Customer to meet its obligations under Applicable Data Protection Law to (i) notify a Supervisory Authority (as defined under Applicable Data Protection Law) of the Security Breach; and (ii) communicate the Security Breach to the relevant Data Subjects.

4.6.3 Notice to Customer in accordance with Section 4.6.2 of this Agreement shall be made by sending an email and/or text message to the email address and/or mobile phone number registered by Customer in the Authorize.net Merchant Interface.

4.6.4 Except as required by applicable law or regulation, the notifying party will not make (or permit any third party to make) any statement concerning the Security Breach that directly or indirectly references the other party, unless the other party provides its explicit written authorization.

4.7 Deletion and Retention. Processor shall, at the choice of Customer, delete or return all Customer Personal Information upon termination of the Agreement and delete existing copies unless storage is required by applicable law.

5 Miscellaneous. The terms of this DPA shall apply only to the extent required by Applicable Data Protection Law. To the extent not inconsistent herewith, the applicable provisions of the Agreement(s) (including without limitation, indemnifications, limitations of liability, enforcement, and interpretation) shall apply to this DPA. In the event of any conflict between this DPA and the terms of an applicable Agreement, the terms of this DPA shall control solely with respect to data processing terms where required by Applicable Data Protection Law, and, in all other respects, the terms of the applicable Agreement shall control. Notwithstanding any term or condition of the DPA, the DPA does not apply to any data or information that does not relate to one or more identifiable individuals, that has been aggregated or de-identified in accordance with Applicable Data Protection Law, or to the extent that Authorize.net and you have entered separate data processing terms that address the subject matter hereof.

6 Definitions. Unless otherwise defined in the Agreement (including this DPA), all terms in this DPA shall have the definitions given to them in Applicable Data Protection Law.

SCHEDULE A

CALIFORNIA CONSUMER PRIVACY ACT

This CCPA Schedule applies in addition to any terms set forth in the body of the DPA (and is incorporated therein) when the CCPA applies to your use of Transaction Services or if Applicable Data Protection Law imposes a comparable requirement outlined under Schedule A. Capitalized terms not defined herein have the meaning assigned to them under the DPA. To the extent there are any conflicts between this CCPA Schedule and the DPA, this CCPA Schedule shall prevail.

1 Authorize.net shall not:

(i) sell, or share for cross-contextual behavioral advertising, Customer Personal Information;
(ii) combine Customer Personal Information with personal information obtained from different sources;
(iii) retain, use, or disclose Customer Personal Information other than for the specific purposes set forth in the body of the DPA; or
(iv) where applicable, use any Sensitive Personal Information received from Customer other than to assist the Customer in purposes authorized by Customer instruction; in each case, except as required to perform a business purpose defined in this Agreement or as permitted by Applicable Data Protection Law.

2 To the extent required by Applicable Data Protection Law, this CCPA Schedule constitutes its certification to the Processing restrictions herein to enable Customer to:

(i) ensure Customer Personal Information is used consistent with Applicable Data Protection Law;
(ii) stop and remediate unauthorized use of Customer Personal Information, and
(iii) to conduct reasonable assessments of Authorize.net’s policies and technical and organizational measures. Authorize.net grants Customer the rights set forth in Schedule B, Section 4 for the purposes of Section 2(iii) of this Schedule.

3. Sub-processor obligations pursuant to the CCPA shall be governed by Section 4.3 of the DPA.

Each of Authorize.net and Customer shall comply with applicable provisions of the CCPA, including, in the case of the Customer, to provide required notices and disclosures with respect to the obligations of the business under the CCPA; and in the case of Authorize.net, to notify Customer promptly (and, in any event, within any period required by law) upon making a determination that it can no longer meet its obligations with respect to Customer Personal Information under the CCPA

SCHEDULE B

GENERAL DATA PROTECTION REGULATION

This GDPR Schedule applies in addition to any terms set forth in the body of the DPA (and is incorporated therein) when the GDPR applies to your use of Transaction Services. Capitalized terms not defined herein have the meaning assigned to them under the DPA. To the extent there are any conflicts between this GDPR Schedule and the DPA, this GDPR Schedule shall prevail.

1 Processor Obligations

1.1 Processing of Customer Personal Information. Processor shall Process Customer Personal Information only on documented reasonable instructions from Customer (including instructions with respect to transfers of Customer Personal Information to a third country, if applicable) unless required to do so by Applicable Data Protection Law. In such circumstances, Processor shall inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

1.2 Use of Sub-Processor

1.2.1 In accordance with Section 1.2.1 of this GDPR Schedule, Customer provides authorization for Processor to engage with the Sub-Processors listed in the Authorize.net Merchant Interface. Processor reserves the right to maintain its Sub-Processor list through means such as publication of its Sub-Processor list online.

1.2.2 Processor shall inform Customer of any intended changes concerning the addition or replacement of other Sub-Processors to give Customer the reasonable opportunity to object to such changes. In the event Customer objects to Processor’s change or addition of Sub-Processor, Customer shall promptly notify Processor of its objections in writing within 10 business days after receipt of Processor’s notice of such change or addition.

1.2.3 Processor may, at its option, undertake reasonable efforts to make available to Customer a change in the Transaction Services or recommend a commercially reasonable change to Customer’s configuration or use of the Transaction Services to avoid Processing of Customer Personal Information by the objected-to new Sub-processor. If Processor is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may terminate the Agreement with respect to only those aspects of the Transaction Services, which cannot be provided by Processor without the use of the objected-to new Sub-processor by providing written notice to Processor. If the Transaction Services as a whole cannot be performed without the objected-to new Sub-Processor, Customer may terminate the entire Agreement.

1.2.4 Processor agrees not to impose a penalty for any termination under Section 1.2.3 of this GDPR Schedule on Customer.

2 Data Protection Impact Assessments and Prior Consultation with Regulator

2.1 Processor shall immediately inform Customer if, in Processor’s opinion, Customer’s instructions would be in breach of Applicable Data Protection Law. Customer agrees that Processor shall be under no obligation to take actions designed to form any such opinion.

2.2 Processor shall provide reasonable assistance to Customer with any legally required (a) data protection impact assessments; and (b) prior consultations initiated by the Customer with its regulator in connection with such data protection impact assessments. Such assistance shall be strictly limited to the Processing of Customer Personal Information by Processor on behalf of Customer under the Agreement taking into account the nature of the Processing and information available to the Processor.

3 Demonstrating Compliance with this DPA

3.1 Processor shall make available to Customer all information necessary to demonstrate compliance with its obligations under this DPA and allow for (and contribute to) audits, including inspections conducted by Customer or another auditor under the instruction of the Customer for the same purposes of demonstrating compliance with obligations set out in this DPA.

3.2 Customer’s right under Section 3.1 of this GDPR Schedule is subject to the following:

3.2.1 if Processor can demonstrate compliance with its obligations set out in this DPA by adhering to an approved code of conduct, by obtaining an approved certification or by providing Customer with an audit report issued by an independent third party auditor (provided that Customer will comply with appropriate confidentiality obligations as set out in the Agreement and shall not use such audit report for any other purpose), Customer agrees that it will not conduct an audit or inspection under Section 3.1 above;

3.2.2 in acknowledgement of the time, expense and disruption to business associated with performing audits and inspections involving interviews and onsite visits, Customer agrees to only conduct such audits and inspections on condition that Customer can demonstrate such audit or inspection is necessary beyond the information made available by Processor under Section 3.1 above. Such audits and inspections, shall be at reasonable intervals (but not more than once per year) upon not less than 60 days' notice and at a date mutually agreed by the Parties, provided that the audit will not disrupt Processor's business; (ii) be conducted during business hours and at the Customer’s expense; (iii) not interfere with the interests of Processor’s other customers; and (iv) not exceed a period of two successive business days.

4 Cross-Border Transfers

4.1 Processor shall comply with Customer’s documented instructions concerning the transfer of Customer Personal Information to a third country.

4.2 The Processor shall only Process or otherwise transfer any Customer Personal Information outside the European Economic Area (“EEA”), the UK or Switzerland in compliance with the Applicable Data Protection Law.

4.3 Customer agrees and acknowledges that Processor transfers and stores certain Customer Personal Information (relating to individuals located in the EEA, Switzerland and/or the UK) in the United States.

4.3.1 Transfers subject to the GDPR, UK GDPR or Swiss DP Laws: Module 2 (Transfer controller to processor) of the EEA Standard Contractual Clauses shall apply with respect to any Transfer of Customer Personal Information from the EEA, UK or Switzerland to Authorize.net and any of its affiliated entities in the United States or other third countries ("Authorize.net Entities"). The parties acknowledge and agree that Module 2 (Transfer controller to processor) of the EEA Standard Contractual Clauses is hereby incorporated by reference and:

4.3.1.1 Customer and any of its commonly owned or controlled affiliates that have signed an Agreement for Transaction Services ("Customer Entities") shall be deemed to be “data exporters” and the Authorize.net Entities shall be the "data importer";

4.3.1.2 Clause 7 – Docking clause shall apply;

4.3.1.3 Clause 9 – Use of subprocessors Option 2 shall apply and the “time period” shall be 10 business days;

4.3.1.4 Clause 11(a) – Redress the optional language shall not apply;

4.3.1.5 Clause 13(a) – Supervision

(i) Where the data exporter is established in an EU Member State the following shall apply: “The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C , shall act as competent supervisory authority.”
(ii) Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of the GDPR the following shall apply: “The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.”
(iii) Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of the GDPR, the following shall apply: “The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.”

4.3.1.6 The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C , shall act as competent supervisory authority.

4.3.1.7 Clause 17 – Governing law Option 1 shall apply and the “Member State” shall be Ireland;

4.3.1.8 Clause 18 – Choice of forum and jurisdiction the Member State shall be Ireland; and

4.3.1.9 the information in Exhibit 1 (Table 1) of this GDPR Schedule is incorporated into Annexes 1, 2 and 3 of the EEA Standard Contractual Clauses.

4.3.1.10 Transfers subject to the UK GDPR. Where the Transfer is subject to the UK GDPR, the EEA Standard Contractual Clauses shall be read in accordance with, and deemed amended by, the provisions of Part 2 (Mandatory Clauses) of the UK IDTA. For the purposes of Table 4 in Part 1 (Tables) of the UK IDTA, the parties select the “neither party” option. Otherwise, the Parties confirm that the information required for the purposes of Part 1 (Tables) of the UK IDTA is set out in Exhibit 2.

4.3.2 If there is any conflict or inconsistency between a term in the body of this DPA, an Agreement and a term in Module 2 (Transfer controller to processor) of the EEA Standard Contractual Clauses ), incorporated into this DPA, the term in Module 2 (Transfer controller to processor) of the EEA Standard Contractual Clauses shall take precedence.

EXHIBIT 1

INFORMATION REQUIRED FOR THE EEA STANDARD CONTRACTUAL CLAUSES

EXHIBIT 2

DETAILS OF PROCESSING CUSTOMER PERSONAL INFORMATION