Merchants Terms of Use

These business terms govern access to and use of Facilipay's payment-orchestration, point-of-sale, payment-terminal, ordering, stored-value, loyalty, membership, campaign, reporting, application, website and related technology services.

They apply only where the Merchant acts for business, trade, professional, charitable or organisational purposes and not as a consumer.

1. Contracting Parties and Business Use

1. 1.1

   These Terms form an agreement between the Merchant and Smart Points Limited, trading as Facilipay and LoyLap, an Irish company with company number 512270 and registered office at 6a Liberty Lane, Portobello, Dublin D08 FX66, Ireland ("Facilipay", "Company", "we", "our" or "us"). Our VAT number is 9831551D.

2. 1.2

   If an individual accepts these Terms, purchases Services or signs a License Contract for an organisation, that individual confirms that they have authority to bind the organisation. "You" and "your" refer to that organisation.

3. 1.3

   The Merchant confirms that it enters this Agreement wholly or mainly for business, trade, professional, charitable or organisational purposes and not as a consumer.

2. Acceptance, Term and Changes

1. 2.1

   The Merchant accepts this Agreement by signing a License Contract, accepting it electronically, registering a Merchant Account, activating or purchasing a Service, or continuing to use a Service after being given notice that the Agreement applies. Facilipay may retain an electronic record of acceptance, the version accepted and the person acting for the Merchant.

2. 2.2

   A subscription begins on acceptance or on the date stated in the License Contract or Service Activation. Unless a License Contract states otherwise, it continues for each billing cycle and renews until terminated under this Agreement.

3. 2.3

   Facilipay may amend these Terms, a Product Schedule or Published Pricing to reflect changes to Applicable Law, regulatory or third-party requirements, security, the Services or reasonable business practices. We will give existing Merchants at least 30 days' notice of a material change in a durable medium and a longer period where reasonably required to make technical or commercial adaptations.

4. 2.4

   The notice period does not apply where an urgent legal, regulatory, fraud, security or third-party requirement makes advance notice impracticable. We will give as much notice as reasonably possible.

5. 2.5

   If the Merchant objects to a material change, it may terminate the affected standard subscription before the change takes effect. Continued use after that date constitutes acceptance. A change to Published Pricing does not override a rate fixed for the current term of a License Contract unless that contract permits it or the parties agree in writing.

6. 2.6

   Previous versions of these Terms will be made available on the Website or on request.

3. Contract Documents, Priority and Service Activation

1. 3.1

   The Agreement consists of these Terms, each applicable Product Schedule, the Data Processing Schedule, the Security Schedule, Published Pricing, each Service Activation and each License Contract.

2. 3.2

   If there is a conflict: (a) a License Contract prevails for the Services and matters it expressly addresses; (b) the Data Processing Schedule prevails for processing for which Facilipay is a Processor; (c) the relevant Product Schedule prevails for that product; (d) these Terms prevail; and (e) Published Pricing and Documentation apply last. A privacy notice explains processing but does not create contractual warranties.

3. 3.3

   A License Contract overrides these Terms or Published Pricing only to the extent it expressly states a different position. Bespoke rates, allowances and payment terms apply for its stated duration; these Terms govern all other matters.

4. 3.4

   An Authorised User may request, enable or approve an additional Service or Add-On through the Merchant Account, an order, email or other written confirmation. From activation, the applicable Product Schedule and Published Pricing form part of the Agreement. A new License Contract is required only where Facilipay requires one or the parties agree bespoke rates, commitments or exceptions.

5. 3.5

   Terms contained in a Merchant purchase order, vendor portal or similar document do not apply unless Facilipay expressly agrees to them in a document signed by an authorised representative.

4. Services, Support and Service Changes

1. 4.1

   Facilipay will provide the Services with reasonable care, skill and diligence and will use reasonable endeavours to provide them substantially in accordance with the applicable Documentation and Agreement.

2. 4.2

   Support is available during the hours and through the channels published on the Website. Service levels, response times, implementation services or enhanced support apply only where stated in a License Contract or Service Activation.

3. 4.3

   The Platform may be unavailable during scheduled or emergency maintenance, because of Third-Party Services or events outside Facilipay's reasonable control. We will use reasonable endeavours to notify the Merchant in advance of scheduled maintenance.

4. 4.4

   Facilipay may update the Services to improve functionality, security, interoperability or compliance. We may modify or discontinue a material feature on at least 30 days' notice unless an urgent legal, security or third-party requirement prevents this. If a change materially reduces a paid core Service, the Merchant may terminate that affected Service before the change takes effect and receive a pro-rata credit of prepaid recurring Fees for the unused period, unless a substantially equivalent function is provided.

5. 4.5

   Beta, pilot, preview or evaluation features may be changed or withdrawn at any time, may not be supported and are provided without a service-level commitment. The Merchant must not use them for critical production activity unless expressly agreed.

5. Merchant Accounts, Authorised Users and Credentials

1. 5.1

   The Merchant must provide accurate account, ownership, contact, billing and Location information and keep it current. Facilipay may request information to verify identity, authority, business status, regulatory position or use of the Services.

2. 5.2

   The Merchant controls which Authorised Users can access its Merchant Account and is responsible for their acts and omissions. It must promptly remove access when it is no longer required and review permissions regularly.

3. 5.3

   Credentials, API keys, tokens, devices and authentication factors must be kept confidential, assigned only to authorised persons and protected using appropriate security controls. Credentials must not be shared between individuals where individual access is available.

4. 5.4

   The Merchant must notify support@facilipay.io without undue delay of suspected unauthorised access, credential compromise, fraud, device loss or other Security Incident affecting the Services.

5. 5.5

   Facilipay may rely on instructions from an Authorised User until their authority is revoked in the Merchant Account or Facilipay receives and processes written notice of revocation.

6. Merchant Responsibilities and Compliance

1. 6.1

   The Merchant is the seller, supplier, trader and, where applicable, issuer of the goods, services, Gift Cards, memberships, Rewards, vouchers, tickets and other offers it makes available through the Platform. Except where expressly disclosed otherwise, Facilipay supplies technology and is not a party to the contract between the Merchant and a Member.

2. 6.2

   The Merchant is responsible for the description, price, availability, legality, safety, accessibility, quality, delivery and fulfilment of its offers and for customer service, refunds, cancellations, chargebacks, taxes, receipts and warranties relating to them.

3. 6.3

   The Merchant must comply with Applicable Law and binding industry requirements, including consumer, tax, VAT, voucher, advertising, ePrivacy, food-safety, product-safety, age-restriction, accessibility, sanctions and licensing requirements applying to its business.

4. 6.4

   Where the Merchant accepts card payments, it must maintain required arrangements with its Payment Provider and comply with applicable provider terms, card-scheme rules and PCI DSS obligations. The Merchant is responsible for verifying that its equipment, network, point of sale and configuration are compatible.

5. 6.5

   The Merchant authorises Facilipay, solely as its technology provider and limited agent where necessary, to display its Content, transmit orders and technical instructions, communicate confirmations and perform configured actions on the Merchant's behalf. This does not transfer title to goods, make Facilipay the merchant of record or transfer the Merchant's liabilities unless expressly stated in separate terms.

6. 6.6

   The Merchant must maintain appropriate procedures for fraud, refunds, restricted products, age checks, order disputes and Member complaints and must provide information reasonably requested to investigate them.

7. Multi-Location, Franchise and Group Merchants

1. 7.1

   The Merchant may manage Locations and Authorised Users through its Merchant Account. Plan Fees may apply to each Billable Location even where Locations share branding, ownership, administration or integrations.

2. 7.2

   A separate legal owner must accept the Agreement or be expressly included as a contracting party in a License Contract before it operates a Location. A group administrator confirms that it is authorised to access data, configure Services and give instructions for each entity it administers.

3. 7.3

   Each legal owner remains responsible for its Transactions, Members, balances, Content, compliance and Fees unless a License Contract expressly provides for consolidated responsibility or invoicing.

4. 7.4

   Where Gift Cards or stored value are accepted across more than one Location or legal entity, the Merchant must ensure that Member terms clearly identify the issuer and participating locations. Allocation, settlement and reconciliation between group entities are their responsibility unless Facilipay expressly agrees otherwise.

5. 7.5

   A Location sale, transfer, closure or change of operator does not transfer a Merchant Account or outstanding Member liability without Facilipay's written approval and an agreed migration or continuity plan.

8. Content, Merchant Branding and Publicity

1. 8.1

   The Merchant must keep its Content accurate, current and lawful. It confirms that it owns the applicable Intellectual Property Rights or has all permissions required for Facilipay to use the Content as contemplated.

2. 8.2

   The Merchant grants Facilipay a non-exclusive, worldwide, royalty-free licence during the Agreement to host, copy, adapt, transmit and display Content only as necessary to provide, secure and support the Services, operate configured Member-facing listings or white-label interfaces and comply with Applicable Law.

3. 8.3

   Facilipay may identify the Merchant within a public Facilipay or LoyLap network where the Merchant enables public discovery or ordering. Other use of the Merchant's name or logo in advertising, press releases or case studies requires the Merchant's prior consent.

4. 8.4

   Facilipay is not required to monitor Content but may investigate, remove, restrict or preserve Content that it reasonably believes breaches the Agreement, infringes rights, presents a safety or security risk or is unlawful.

9. Hardware and Materials

1. 9.1

   Hardware and Materials may be supplied under an order, Service Activation or License Contract. Delivery dates are estimates unless expressly guaranteed. Risk in purchased Hardware passes on delivery and title passes when paid in full.

2. 9.2

   Loaned, rented or subsidised Hardware remains Facilipay's or the relevant supplier's property. The Merchant must keep it secure, use it only for the Services, prevent tampering and return it in reasonable condition, fair wear and tear excepted.

3. 9.3

   Facilipay warrants that Hardware supplied by it will be free from material defects for 12 months after delivery. The warranty excludes misuse, accident, neglect, theft, unauthorised repair or modification, normal wear and tear, network or power problems and use contrary to instructions.

4. 9.4

   To make a claim, the Merchant must notify support@facilipay.io during the warranty period and follow the return procedure. Facilipay may repair or replace defective Hardware or, if neither is reasonably practicable, refund its original price.

5. 9.5

   Third-party manufacturer warranties apply subject to their terms. The Merchant is responsible for consumables, routine maintenance, internet connectivity, power, secure installation and loss or damage after risk passes.

10. Fees, Invoicing and Taxes

License Contracts and Published Plans

1. While a License Contract remains in force, its agreed commercial terms prevail over Published Pricing for the Services and period it expressly covers. A Service or Add-On not included or priced in it is charged at the separately agreed rate or, if none, the applicable Published Pricing.

2. Where no current License Contract exists, the terms and rates for the Merchant's selected Plan apply. Plan Fees are charged per Billable Location and remain payable whether or not Transactions are processed.

3. Facilipay will use reasonable endeavours to notify the Merchant at least 30 days before a License Contract expires. If it expires without renewal, extension, replacement or termination, the Merchant automatically moves to the then-current Facilipay Pro Plan on the following day while it continues using the Platform. The Pro Plan's rates, features, allowances and billing terms then apply, and features outside that Plan may be disabled.

4. Facilipay may offer an eligible Merchant a time-limited trial of a specified Plan (a Free Trial) at its discretion. Eligibility, duration, Services, features and any usage limits will be stated at sign-up. Unless Facilipay agrees otherwise, a Merchant may receive only one Free Trial. Unless the trial offer expressly states otherwise, no Plan Fee or Platform Transaction Fee applies during the Free Trial, but all other Fees, including Payment Activity Fees, Online Processing Fees, Add-On Fees, API Charges and third-party charges, remain payable. Unless the Merchant cancels before the Free Trial ends, the Published Pricing for its selected Plan applies immediately when the Free Trial ends.

5. Fees are stated and invoiced in the currency shown for the Merchant's billing region in Published Pricing or a License Contract. Where these Terms state a fixed amount in euro, the equivalent amount in the Merchant's billing currency, as shown in Published Pricing or on the invoice, applies to Merchants billed in another currency.

Invoicing and Payment

1. All Fees exclude VAT and other applicable taxes unless expressly stated otherwise.

2. Unless a License Contract or Published Pricing states otherwise, recurring and usage Fees are invoiced monthly in arrears and are payable on the Payment Date. The Merchant must maintain a valid payment card, direct-debit mandate or bank account where required.

3. If an automatic collection fails, the Merchant must pay the outstanding amount within 30 days. Facilipay may recover reasonable third-party bank charges and a published administration fee reflecting the cost of the failed collection.

4. Overdue amounts may bear simple interest at the European Central Bank main refinancing rate applicable on 1 January or 1 July, as relevant, plus eight percentage points per annum, calculated daily. Facilipay may also claim statutory compensation and reasonable recovery costs to the extent permitted by law.

5. Facilipay's Transaction, activation and API records are prima facie evidence of usage, subject to correction where the Merchant demonstrates an error. An invoice dispute must be raised in reasonable detail within 30 days after the invoice date. Undisputed amounts remain payable.

6. The Merchant may not withhold, deduct or set off an amount except where required by law. If withholding tax is required, the Merchant must provide appropriate evidence and cooperate so that available relief or credit can be claimed.

7. Fees properly incurred are non-refundable following a later refund, cancellation, reversal or chargeback unless the Agreement expressly provides otherwise or the Fee resulted from a Facilipay error.

Changes to Published Pricing

1. Facilipay may change Published Pricing on at least 30 days' written notice. A change does not affect a rate fixed for the current term of a License Contract unless that contract permits it or the parties agree in writing.

2. The detailed charge triggers and exclusions are set out in Schedule 1, including the Charging Summary.

11. Payment, Settlement and Stored-Value Roles

1. 11.1

   Facilipay supplies payment-orchestration, messaging and technical integration services. Where Facilipay generates or transmits a Payment Instruction, it does so as a technical service on the Merchant's behalf to the Merchant's selected Payment Provider.

2. 11.2

   Unless separate regulated terms expressly identify an appropriately authorised entity and service, Facilipay does not provide acquiring, operate a payment account, hold or safeguard customer payment funds, provide payment-initiation services from a Member's bank account or settle Transaction proceeds.

3. 11.3

   Payments settle under the Merchant's arrangements with its Payment Provider. Facilipay does not guarantee authorisation, settlement timing, funding, chargeback outcomes or the continued availability of a Payment Provider.

4. 11.4

   The Merchant remains responsible for refunds, reversals, disputes, chargebacks, fraud and reconciliation. It authorises Facilipay to send configured technical instructions and exchange necessary data with the relevant Payment Provider.

5. 11.5

   The Merchant is the issuer of Gift Cards, wallets and other stored-value products offered for its business and owes the corresponding liability to Members. Neither recording a balance nor transmitting a redemption instruction transfers that liability to Facilipay.

6. 11.6

   Each party is responsible for determining and complying with regulatory obligations applying to its own activities. The Merchant must not expand a stored-value product to additional issuers, legal entities or an unrestricted acceptance network without prior written notice to Facilipay and any approvals or notifications required by law.

12. Data Protection and Privacy

1. 12.1

   Each party must comply with Applicable Data Protection Law.

2. 12.2

   Where Facilipay processes Personal Data on documented instructions from the Merchant, the Merchant is the Controller and Facilipay is the Processor, and Schedule 3 applies.

3. 12.3

   Facilipay acts as an independent Controller for Personal Data it determines is necessary for account administration, billing, security, fraud prevention, legal compliance, service communications and its own legitimate business operations. The Merchant acts as an independent Controller for Personal Data it uses for its business, customer service, fulfilment, marketing and legal obligations.

4. 12.4

   Where a LoyLap or Facilipay Member account is operated across participating merchants, the applicable privacy notice will describe Facilipay's Controller role and the information shared with the Merchant. A joint-controller arrangement applies only where separately identified and documented.

5. 12.5

   The Merchant must provide Members with required privacy information and lawful marketing choices and must not instruct Facilipay to process Personal Data unlawfully. Once data is exported, the Merchant is responsible for its security and use.

13. Security, Merchant Data and Service Data

1. 13.1

   Each party must implement technical and organisational measures appropriate to the risks within its control.

2. 13.2

   Facilipay will maintain the measures described in Schedule 4 and may update them to reflect technology, threats and service changes, provided the overall level of security is not materially reduced.

3. 13.3

   As between the parties, the Merchant retains its rights in Merchant Data. The Merchant grants Facilipay a non-exclusive right to host, copy, transmit, transform and otherwise process Merchant Data as necessary to supply, secure and improve the Services, comply with law and exercise rights under the Agreement.

4. 13.4

   Facilipay may generate Service Data concerning performance, security, support, configuration and use of the Services. Facilipay may use Service Data to operate, secure, analyse and improve the Services, provided that any disclosure outside Facilipay and its service providers is aggregated or de-identified so that it does not identify a Merchant or Member.

5. 13.5

   Facilipay will not use Merchant Personal Data or Confidential Information to train a general-purpose third-party AI model unless the processing is permitted by Applicable Data Protection Law and disclosed or agreed with the Merchant.

14. Intellectual Property Rights

1. 14.1

   All Intellectual Property Rights in the Services, Platform, software, Documentation, integrations, templates, analytics and technology developed or supplied by Facilipay remain owned by Facilipay or its licensors.

2. 14.2

   During the subscription, Facilipay grants the Merchant a limited, non-exclusive, non-transferable right to use the Services for its internal business and to make configured Member-facing functions available to Members. This right may be suspended or terminated only in accordance with the Agreement.

3. 14.3

   The Merchant must not copy, modify, reverse engineer, decompile, seek source code, circumvent technical controls, transfer or sublicence the Services, except to the limited extent a restriction is prohibited by law. It must not use the Services or non-public Documentation to build or benchmark a competing product.

4. 14.4

   Third-party and open-source components remain subject to applicable licence terms. Facilipay may provide required notices through the Platform or Documentation.

5. 14.5

   If the Merchant provides suggestions or feedback, it grants Facilipay a worldwide, perpetual, irrevocable, royalty-free right to use and incorporate that feedback without restriction, provided Facilipay does not publicly identify the Merchant without consent.

15. Confidentiality

1. 15.1

   Each party must protect the other's Confidential Information using at least reasonable care, use it only for the Agreement and disclose it only to personnel, professional advisers and subcontractors who need it and are bound by appropriate confidentiality obligations.

2. 15.2

   Confidentiality does not apply to information that becomes public without breach, was already lawfully known without restriction, is independently developed without use of the Confidential Information or is lawfully received from a third party without restriction.

3. 15.3

   A party may disclose Confidential Information where required by law, regulation or court order, but where lawful it must give reasonable advance notice and disclose only what is required.

4. 15.4

   On request or termination, each party must return or destroy the other's Confidential Information, except for copies required by law or retained in secure backups under normal retention controls.

5. 15.5

   These obligations continue for five years after termination and indefinitely for trade secrets and Personal Data for so long as the information remains protected by Applicable Law or retains its confidential character.

16. Warranties and Disclaimers

1. 16.1

   Each party warrants that it has authority to enter the Agreement. Facilipay warrants that it will provide the Services with the reasonable care and skill stated in the Services clause.

2. 16.2

   Except as expressly stated and to the maximum extent permitted by law, the Services are provided on an as-available basis. Facilipay does not warrant uninterrupted or error-free operation, that every Third-Party Service will remain available, or that the Services will meet requirements not recorded in the Agreement.

3. 16.3

   Reports, analytics, recommendations, forecasts and AI Outputs are informational. The Merchant is responsible for reviewing them and for business, financial, legal, tax, employment, marketing and operational decisions made using them.

4. 16.4

   Nothing excludes a condition, warranty or remedy that cannot lawfully be excluded. Any exclusion or limitation is subject to the requirements of reasonableness and fairness that apply under Applicable Law.

17. Liability

1. 17.1

   Nothing in the Agreement excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, wilful misconduct, or any liability that cannot lawfully be excluded or limited.

2. 17.2

   Subject to the preceding clause, Facilipay's total aggregate liability arising from or relating to the Agreement in any rolling 12-month period will not exceed the Fees paid or payable by the Merchant for the affected Services during the 12 months preceding the first event giving rise to liability.

3. 17.3

   For Facilipay's breach of confidentiality, Applicable Data Protection Law or its intellectual-property indemnity, the cap in the preceding clause is increased to 200% of those Fees. This enhanced cap does not apply where the ordinary cap is required by a License Contract to apply to that liability.

4. 17.4

   Neither party is liable for loss of profit, revenue, business, anticipated savings, goodwill, reputation or opportunity, or for indirect, special or consequential loss, whether or not foreseeable. This does not prevent Facilipay recovering Fees, stored-value liabilities, chargebacks or third-party amounts that the Merchant is expressly required to pay.

5. 17.5

   Facilipay is not liable for the Merchant's goods or services, Member disputes, Merchant Content, incorrect configuration or data, the Merchant's failure to fulfil an order or balance, or a Third-Party Service outside Facilipay's reasonable control.

6. 17.6

   The limitations apply to the fullest extent permitted by law regardless of the legal theory and in aggregate across claims arising from the same or related events. Each party must take reasonable steps to mitigate loss.

18. Indemnities and Third-Party Claims

1. 18.1

   The Merchant will indemnify Facilipay and its officers, employees and contractors against third-party claims, losses, damages, penalties and reasonable professional costs arising from: (a) the Merchant's goods, services, Content or Member contract; (b) Gift Cards, stored value, Rewards or outstanding Member balances; (c) the Merchant's breach of Applicable Law, Payment Provider terms or the Agreement; (d) tax, product-safety, food-safety, marketing, privacy or consumer claims attributable to the Merchant; or (e) use of the Services through the Merchant Account contrary to the Agreement.

2. 18.2

   Facilipay will defend the Merchant against a third-party claim that the unmodified Platform, when used as authorised, infringes that third party's Intellectual Property Rights. Facilipay may procure continued use, modify or replace the affected element, or terminate it and refund prepaid recurring Fees for the unused period.

3. 18.3

   The preceding Facilipay indemnity does not apply to a claim caused by Merchant Content, a Merchant or third-party modification, combination with an item not supplied or approved by Facilipay, continued use after notice, or use outside the Agreement or Documentation.

4. 18.4

   An indemnified party must give prompt notice, reasonable cooperation and control of the defence to the indemnifying party. No settlement may admit liability or impose a non-monetary obligation on the indemnified party without its consent, not to be unreasonably withheld.

19. Suspension and Termination

1. 19.1

   Unless a License Contract states otherwise, either party may terminate a standard subscription or individual Service on 30 days' written notice. The Merchant may also use an available cancellation function in its Merchant Account.

2. 19.2

   A License Contract applies for its stated term and is subject to its renewal and termination provisions. If it expires while the Merchant continues using the Services, the Facilipay Pro Plan transition described in the Fees clause applies.

3. 19.3

   Either party may terminate immediately where the other commits a material breach that cannot be remedied, fails to remedy a remediable breach within 14 days after notice, enters insolvency or analogous proceedings, ceases business or is prohibited by law from performing.

4. 19.4

   Facilipay may restrict or suspend an Account or Service where reasonably necessary because of non-payment, material breach, Prohibited Activity, suspected fraud or dishonesty, a Security Incident, missing verification information, risk to Members or the Platform, a Payment Provider or scheme requirement, or Applicable Law.

5. 19.5

   Where practicable, Facilipay will limit a suspension to the affected Service, give notice and reasons, and allow a reasonable opportunity to remedy. Prior notice is not required where it would undermine fraud prevention, security, legal compliance or protection of the Platform or Members.

6. 19.6

   The Merchant may challenge a restriction, suspension or termination through support@facilipay.io. Where Applicable Law requires a statement of reasons, complaint process or advance termination notice, Facilipay will provide it subject to lawful exceptions.

7. 19.7

   On termination: licences and access rights end; outstanding Fees and third-party amounts become due; prepaid Fees are not refunded except where expressly stated; each party must deal with Confidential Information as required; and the Exit and Data Portability clause applies.

8. 19.8

   Termination does not affect accrued rights or provisions intended to survive, including payment, stored-value responsibility, data protection, confidentiality, intellectual property, liability, indemnities, dispute and general provisions.

20. Exit, Data Portability and Member Balance Continuity

1. 20.1

   While the Merchant Account is active, the Merchant may export available Merchant Data using Platform tools. The Merchant should regularly export records required for tax, accounting, Member balances and business continuity.

2. 20.2

   On request or termination, Facilipay will make exportable Merchant Data available in a commonly used, machine-readable format, subject to identity verification, security, third-party rights, Applicable Law and the exclusions below.

3. 20.3

   Exportable data ordinarily includes Merchant profile and catalogue data, order and Transaction records, Gift Card and stored-value balances, loyalty records, Member data processed for the Merchant and reasonably portable configuration data. It excludes Platform software, internal security information, Facilipay trade secrets, data relating solely to internal service operation and data Facilipay must not disclose.

4. 20.4

   Where the EU Data Act switching requirements apply, the Merchant may request switching or export on no more than two months' notice. Facilipay will use reasonable endeavours to complete a technically feasible transition within 30 calendar days after that notice period while maintaining appropriate continuity and security. If technically infeasible, Facilipay may extend the transition as permitted by law after giving timely reasons.

5. 20.5

   Where those requirements apply, exportable data will remain retrievable for at least 30 calendar days after the transition. Switching charges will not exceed directly attributable costs before 12 January 2027 and will not apply from that date, except to the extent Applicable Law permits otherwise. Additional professional services requested by the Merchant may be charged separately.

6. 20.6

   After the applicable retrieval period, Facilipay may delete or irreversibly anonymise Merchant Data, subject to legal retention, security logs, dispute requirements and secure backup cycles.

7. 20.7

   Termination does not extinguish a Member's Gift Card, voucher, wallet, Reward or other entitlement. Before closure, the Merchant must export outstanding balances, make appropriate arrangements for continued redemption or refunds and notify Members where required. Redemption-only access or transition assistance may be agreed for an additional Fee.

21. Acceptable Use

1. 21.1

   The Merchant and its Authorised Users must use the Services only for lawful, authorised business purposes.

2. 21.2

   The Merchant must not use the Services to:

• commit or facilitate fraud, unlawful activity, sanctions evasion or infringement of third-party rights;

• sell unlawful, counterfeit, unsafe or prohibited goods or services or operate without required licences;

• upload malicious code, interfere with security or availability, probe vulnerabilities without written permission or obtain unauthorised access;

• scrape, mine or extract data except through an authorised API and in accordance with Documentation, rate limits and usage allowances;

• send unsolicited or unlawful marketing, disregard suppression choices or process Personal Data without an appropriate lawful basis;

• misrepresent identity, Merchant status, products, prices, charitable status or the source or destination of funds; or

• use the Services in a way that creates a material safety, legal, security or reputational risk for Facilipay, a Payment Provider, a Member or another merchant.

  1. 21.3

     Facilipay may maintain a reasonable prohibited-business or acceptable-use policy on the Website. Material changes will be notified under the Changes clause, except where immediate changes are required by law, a Payment Provider or card scheme.

22. Third-Party Services and Integrations

1. 22.1

   Third-Party Services are governed by their providers' terms. The Merchant is responsible for establishing and maintaining required accounts, approvals, connectivity, credentials and contracts with those providers.

2. 22.2

   The Merchant authorises Facilipay to exchange data and technical instructions with a Third-Party Service it selects or connects. The Merchant is responsible for the lawfulness and accuracy of that instruction and for permissions required from the provider.

3. 22.3

   Facilipay is not responsible for a Third-Party Service's performance, security, pricing, settlement, changes or discontinuance outside Facilipay's reasonable control. Facilipay will use reasonable care in operating integrations it controls.

4. 22.4

   An integration may be modified or withdrawn where the provider changes or discontinues its interface, terms or approval. Facilipay will give reasonable notice where practicable and may offer an alternative integration.

23. Online Platform Compliance, Notices and Complaints

1. 23.1

   Where a Service enables Members to discover a Merchant or conclude a distance contract, the Merchant must provide complete and accurate trader identity, contact, registration, licence, payment and product information requested by Facilipay and must keep it current.

2. 23.2

   The Merchant confirms that products and services offered to Members comply with Applicable Law and that required pre-contract, pricing, cancellation, refund, safety, accessibility and after-sales information is available to Members.

3. 23.3

   Facilipay may verify trader information, request supporting documents, display legally required information and suspend a listing that cannot be verified. The Merchant must cooperate with notices, recalls, authority requests and investigations of allegedly illegal content or products.

4. 23.4

   Reports of illegal Content or products may be sent through an available reporting function or support@facilipay.io. Facilipay may remove or restrict affected Content and, where required, provide a statement of reasons and an appeal mechanism.

5. 23.5

   Where ranking, recommendations, differentiated treatment or access to data is subject to a legal transparency requirement, the principal parameters and applicable data-access position will be described in the Platform, Documentation or a Website transparency notice.

6. 23.6

   A Merchant may submit a Service complaint to support@facilipay.io. Facilipay will handle it within a reasonable period and will identify available mediation or other redress mechanisms where required by Applicable Law.

24. Artificial Intelligence Features

1. 24.1

   A Service may use artificial intelligence to generate forecasts, segment Members, draft content, recommend actions, detect anomalies or prepare Campaigns and other outputs ("AI Outputs"). AI Outputs may be incomplete, inaccurate or unsuitable for a particular purpose.

2. 24.2

   The Merchant must review AI Outputs before relying on or sending them. Facilipay will require an Authorised User's confirmation before an AI feature sends an external Campaign, issues value, changes a price or performs another material external action, unless the Merchant has expressly configured an automated workflow to do so.

3. 24.3

   The Merchant is responsible for prompts, source data, instructions, recipients, legal bases, approvals and decisions made using AI Outputs. It must not submit sensitive or restricted information unless the feature and Agreement permit it.

4. 24.4

   AI Outputs are not legal, tax, financial, medical, employment or other professional advice and may not be unique. The Merchant must apply appropriate human oversight and comply with laws governing automated decisions, transparency, marketing and discrimination.

5. 24.5

   Facilipay may use specialist AI service providers as subprocessors or Third-Party Services subject to the Data Processing and Security Schedules. Data use for model improvement is subject to the Merchant Data and Service Data clause.

25. Force Majeure

1. 25.1

   Neither party is liable for delay or failure caused by a Force Majeure Event, provided it gives notice where practicable and uses reasonable endeavours to mitigate the effect. A Force Majeure Event does not excuse payment of amounts already due.

2. 25.2

   If a Force Majeure Event materially prevents an affected Service for more than 60 consecutive days, either party may terminate that Service on written notice without liability other than accrued obligations.

26. General

1. 26.1

   The Agreement is the entire agreement concerning the Services and replaces prior proposals, discussions and statements on its subject matter. Each party acknowledges that it has not relied on a statement not recorded in the Agreement, without limiting liability for fraud.

2. 26.2

   If a provision is invalid or unenforceable, it will be modified or severed to the minimum extent necessary and the remainder continues.

3. 26.3

   A delay or failure to exercise a right is not a waiver. A waiver is effective only in writing for the particular circumstance.

4. 26.4

   The Merchant may not assign or transfer the Agreement without Facilipay's written consent. Facilipay may assign it to an affiliate or in connection with a merger, reorganisation, financing, acquisition or sale of the relevant business or assets. Facilipay may use subcontractors but remains responsible for its contractual obligations.

5. 26.5

   The parties are independent contractors. Nothing creates a partnership, joint venture, employment or fiduciary relationship. An agency exists only to the limited extent expressly stated for configured technical actions.

6. 26.6

   Notices must be in writing. Notices to Facilipay may be sent to support@facilipay.io or its registered office. Notices to the Merchant may be sent to its registered email address or Merchant Account. A notice is deemed received when delivered, or on the next Business Day after email transmission unless a delivery failure is received.

7. 26.7

   The Merchant agrees to receive agreements, notices, invoices and disclosures electronically. Electronic signatures and records have the same effect as paper equivalents to the extent permitted by Applicable Law.

8. 26.8

   A person who is not a party has no right to enforce the Agreement, except an indemnified person may rely on an indemnity expressed for its benefit.

9. 26.9

   The Agreement and non-contractual obligations arising from it are governed by Irish law. Before commencing proceedings, a party should give notice of the dispute and allow 20 Business Days for good-faith escalation, unless urgent relief is required. The courts of Ireland have exclusive jurisdiction.

27. Definitions

Add-On means an optional module, feature or service selected by or for the Merchant.

Agreement means the contract documents identified in the Contract Documents, Priority and Service Activation clause.

AI Output means an output generated by an artificial-intelligence feature of the Services.

API Call means a request made to a Facilipay application programming interface by or for the Merchant.

Applicable Data Protection Law means the GDPR, Data Protection Act 2018, applicable ePrivacy rules and other privacy law applying to processing.

Applicable Law means a law, regulation, regulatory requirement, court order or binding rule applying to a party, Service or Transaction.

Authorised User means a person permitted by the Merchant to access or instruct the Services.

Billable Location means a Location activated for a paid Plan or Service, including a Location identified as billable in a License Contract or Published Pricing.

Bundle means a prepaid package of goods, services or entitlements offered by a Merchant through the Platform.

Business Day means Monday to Friday excluding Irish public holidays.

Campaign means a marketing, promotional, loyalty or customer-engagement communication or workflow operated through the Platform.

Confidential Information means non-public commercial, financial, operational, technical, security or other information identified as confidential or reasonably understood to be confidential.

Content means business information, trade marks, logos, images, product information, menus, prices, text and other material supplied by or for the Merchant.

Controller means a controller as defined in the GDPR.

Data Processing Schedule means Schedule 3 to these Terms.

Documentation means the then-current user, technical and API documentation made available by Facilipay.

Fees means all amounts payable for Services, Hardware, Materials, Transactions, usage or other items under the Agreement.

Force Majeure Event means an event beyond a party's reasonable control, including natural disaster, epidemic, war, civil disorder, governmental action, widespread utility or communications failure, or industrial action not limited to that party's workforce.

GDPR means Regulation (EU) 2016/679.

Gift Card means physical or digital stored value issued by a Merchant and recorded through the Platform.

Hardware means terminals, point-of-sale equipment, printers, scanners or other physical equipment supplied by Facilipay.

Intellectual Property Rights means patents, copyright, database rights, trade marks, designs, trade secrets, know-how and similar rights, registered or unregistered.

License Contract means a separate commercial agreement signed by Facilipay and the Merchant setting out selected Services, duration, rates, billing, payment terms, allowances, commitments or exceptions.

Location means a separate physical or virtual trading location configured in the Merchant Account or identified in a License Contract.

Materials means cards, tags, printed items, consumables and other physical materials supplied by Facilipay.

Member means a customer, donor, guest or other person who interacts with a Merchant through the Services.

Merchant means the person or organisation that accepts the Agreement, enters a License Contract or uses the Services.

Merchant Account means the Merchant's registered account for accessing and administering the Services.

Merchant Data means Content, Transaction records, Member data, configuration and other data submitted to or generated for the Merchant through the Services, excluding Service Data.

Online Ordering means functionality enabling Members to order or purchase a Merchant's goods or services online.

Online Transaction means a payment submitted through a Facilipay-operated online checkout or payment-link channel.

Payment Date means the due date stated in the applicable License Contract, Published Pricing or invoice.

Payment Instruction means an electronic instruction to authorise, capture, refund, reverse, tokenise or otherwise process a payment credential or a configured stored-value redemption.

Payment Provider means an acquirer, gateway, payment service provider, bank, card scheme or other regulated or third-party payment provider used by the Merchant.

Personal Data means personal data as defined in the GDPR.

Plan means a bundle of Services, features, allowances and Fees identified in Published Pricing or a License Contract.

Platform means the applications, Website, Merchant dashboard, APIs and related Facilipay or LoyLap technology through which Services are provided.

Platform Transaction means a transaction identified in Schedule 1 as attracting a Platform Transaction Fee.

Premises means a physical business location operated by or for a Merchant.

Processor means a processor as defined in the GDPR.

Product Schedule means a schedule or product-specific set of terms applying to an activated Service, including Schedule 2.

Prohibited Activity means an activity prohibited by the Acceptable Use clause or an applicable Website policy.

Published Pricing means the then-current standard plans, rates, allowances and charging terms published at facilipay.io/pricing or another location identified by Facilipay.

Reward means a loyalty stamp, point, credit, discount, benefit or other reward offered by a Merchant.

Security Incident means an actual or reasonably suspected event compromising the confidentiality, integrity or availability of the Services, credentials, Merchant Data or Personal Data.

Service Activation means an order, dashboard activation, email confirmation or other record by which a Service or Add-On is enabled for the Merchant.

Service Data means technical, performance, usage, security, support and diagnostic data generated in operating the Services, excluding Merchant Data in identifiable form.

Services means the software, payment-orchestration, ordering, loyalty, stored-value, membership, reporting, support and other services supplied through the Platform.

Third-Party Service means a service, software, hardware, network, gateway, acquiring service or website supplied by a person other than Facilipay.

Transaction means a sale, order, payment, redemption, prepayment, donation or other commercial interaction between a Merchant and a Member.

Website means facilipay.io, loylap.com, the Merchant dashboard and any replacement or related website operated by Facilipay.

SCHEDULE 1

Fees and Payment Events

Types of Charge

Facilipay may apply the following charges under Published Pricing or a License Contract:

Charge	Basis	Trigger
Plan Fee	Recurring, per Billable Location	Access to the Platform and included Services
Payment Activity Fee	Fixed fee per event	Each payment event initiated by Facilipay under section 2
Online Processing Fee	Fixed fee per event	Each Online Transaction submitted for processing
Platform Transaction Fee	Percentage of applicable Transaction Value	Each completed Platform Transaction
Add-On Fee	As published or agreed	Activation or use of an Add-On
API Charge	Usage based	API Calls exceeding the included allowance

1. The Payment Activity Fee and Online Processing Fee are mutually exclusive for the same payment. Other charges may apply together where their separate triggers occur.

Payment Activity Fee

1. The Payment Activity Fee applies only where Facilipay generates and transmits the Payment Instruction that causes the payment activity to occur. This includes where Facilipay: (a) operates as the payment terminal or terminal application connected to the Merchant's point of sale; (b) operates as the Merchant's point of sale and initiates the payment; or (c) initiates a payment through a payment gateway on the Merchant's behalf, including a payment used to load a Gift Card or other stored value.

2. Only one Payment Activity Fee applies where Facilipay performs more than one of these roles for the same event.

3. No Payment Activity Fee applies where Facilipay does not generate and transmit the Payment Instruction. In particular, no such fee applies where the Merchant's point of sale, terminal, gateway or other payment system generates and transmits the Payment Instruction. This remains the case where Facilipay only: (a) operates as an app or module on that system while that system processes its own payments; (b) receives, records or reconciles information; (c) loads, updates or redeems stored value in response to that system; (d) records payment taken by cash, transfer, invoice or another system; or (e) records funds, stamps, points, discounts or Rewards.

4. Use of a Facilipay web or smartphone application does not by itself attract a Payment Activity Fee. The fee applies only if Facilipay generates and transmits the Payment Instruction. For example, loading value through a Facilipay web or smartphone application does not attract a Payment Activity Fee where the Merchant's own payment system generates and transmits the Payment Instruction. A Platform Transaction Fee may still apply under its separate trigger in this Schedule.

5. A distinct sale, authorisation-only request, separately requested capture, incremental authorisation, reversal, void, tokenisation request, Refund or Facilipay-initiated stored-value Redemption is a separate chargeable event. Authorisation and capture messages automatically exchanged to complete one sale request count as one event; a capture submitted later as a separate Merchant request counts separately. For example, an ordinary purchase where authorisation and capture are processed together in one flow attracts one Payment Activity Fee, while a pre-authorisation followed by a later capture is two chargeable events.

6. An event is chargeable once Facilipay transmits the relevant instruction to the intended endpoint, whether or not it is approved, completed or settled. A duplicate, internal lifecycle message or technical retry caused solely by a Facilipay fault is not separately chargeable.

Platform Transaction Fee

1. The Platform Transaction Fee applies to: (a) the issue, sale, loading or top-up of a Gift Card, wallet, account or other stored-value product; (b) an online order, experience, Bundle, ticket, membership or other purchase identified in Published Pricing; and (c) a payment collected through a Facilipay payment link.

2. The Platform Transaction Fee applies regardless of how the payment is processed. Where Facilipay initiates the payment outside a Facilipay-operated online checkout and loads value, the Payment Activity Fee also applies. For a Facilipay-operated online checkout, the Online Processing Fee applies instead of the Payment Activity Fee. If another system processes the payment and Facilipay loads value, only the Platform Transaction Fee applies. If Facilipay initiates a payment but no Platform Transaction occurs, only the Payment Activity Fee applies.

3. For stored value, Transaction Value is the monetary value credited, excluding promotional value funded solely by the Merchant without Member payment unless Published Pricing states otherwise. For an order or purchase, it is the gross amount charged after discounts, including VAT, service charges, tips, delivery and other amounts collected. For a payment link, it is the amount successfully collected.

4. No Platform Transaction Fee applies to redemption of previously loaded value, loyalty activity, Campaigns, donations or balance enquiries.

5. Once a Platform Transaction is completed, a later refund, reversal or chargeback does not refund the Platform Transaction Fee unless a License Contract states otherwise or the Fee resulted from a Facilipay error.

Online Processing Fee and Payment Links

1. The Online Processing Fee applies where a payment is submitted through a Facilipay-operated online checkout or payment-link channel. It applies when submitted for processing whether approved or declined, except for a duplicate or failure caused solely by a Facilipay fault.

2. A digital Gift Card sale, online order, experience, Bundle, ticket or membership purchase through Facilipay checkout ordinarily attracts both the Online Processing Fee and Platform Transaction Fee.

3. A payment link attracts the Online Processing Fee, Platform Transaction Fee and applicable payment-link Add-On Fee. A cap on a payment-link Add-On Fee applies only to that fee and does not limit the Platform Transaction Fee.

API Charges

1. The Merchant's Plan or License Contract includes the stated monthly API Call allowance. Calls above that allowance are charged at the applicable excess-usage rate.

2. An API Call counts when authenticated and accepted for processing. Calls rejected because of invalid authentication, rate limiting or a Facilipay fault do not count. A request containing multiple operations may be counted by operation where the Documentation or Published Pricing says so.

3. Usage alerts are informational. Failure to send or receive an alert does not affect properly incurred API Charges. Facilipay may rate-limit or suspend excessive or unsafe API use.

Charging Summary

Activity	Payment Activity	Online Fee	Platform Transaction	Add-On
Facilipay terminal initiates an ordinary payment for a Merchant POS	Yes	No	No	No
Facilipay POS initiates an ordinary payment	Yes	No	No	No
Merchant system initiates payment while a Facilipay app is present	No	No	If value is loaded	No
Gift Card load; Facilipay initiates payment outside online checkout	Yes	No	Yes	No
Gift Card is loaded and paid through the Merchant's system	No	No	Yes	No
Gift Card is loaded and paid by cash, transfer or invoice	No	No	Yes	No
Gift Card redeemed through separate POS or Facilipay web/mobile app	No	No	No	No
Facilipay POS or gateway initiates a Gift Card redemption	Yes	No	No	No
Web/app load; Merchant system generates and transmits the Payment Instruction	No	No	Yes	No
Digital Gift Card or online order is purchased through Facilipay checkout	No	Yes	Yes	No
Payment link	No	Yes	Yes	Yes
Loyalty, donation, Campaign or balance enquiry	No	No	No	No

1. The Plan Fee applies throughout the subscription. API Charges and third-party charges apply separately.

SCHEDULE 2

Product-Specific Terms

Online Ordering and Payment Links

1. The Merchant is the seller and is responsible for product and menu information, allergens, prices, taxes, availability, acceptance or rejection, fulfilment, delivery, cancellations, refunds and customer support.

2. The Merchant must publish or provide Member terms, privacy information and cancellation and refund rights required by law. Facilipay may transmit an order and confirmation but does not guarantee that the Merchant will accept or fulfil it.

3. A payment link must describe the underlying purpose accurately and must not be used to collect payment for a prohibited, misleading or non-existent transaction. The Merchant remains responsible for the underlying obligation and any refund or dispute.

Gift Cards, Wallets and Stored Value

1. The Merchant is the legal issuer and debtor for stored value issued for its business. Member-facing terms must identify the issuer, participating Locations, validity, redemption, refund and contact arrangements.

2. The Merchant must comply with applicable minimum validity periods, partial-redemption rights, use of multiple vouchers, disclosure rules, VAT classification and accounting. For Irish Gift Cards covered by the Consumer Protection (Gift Vouchers) Act 2019, this includes the applicable five-year minimum validity and statutory redemption rights.

3. The Merchant must maintain accurate financial records and prudent provision for outstanding balances. Funds received for Gift Cards or stored value belong to and are the responsibility of the Merchant and are not safeguarded by Facilipay.

4. The Merchant may not make a Gift Card transferable between unrelated issuers or materially expand its acceptance network without Facilipay's approval and any regulatory analysis, approval or notification required by law.

5. The Merchant is responsible for lost-card policy, suspected fraud, duplicate issue, expiry, refunds and Member communications. Facilipay may place a technical hold where reasonably necessary to investigate fraud or protect balances.

Experiences, Bundles, Tickets and Memberships

1. The Merchant must provide the experience, admission, membership benefit, goods or services as described and is responsible for capacity, booking conditions, cancellations, changes, refunds and lawful expiry or event-date restrictions.

2. Where an experience, Bundle or voucher is sold through the Platform, the Member-facing journey and receipt must accurately identify the contracting supplier. The Merchant must not describe Facilipay as the supplier or issuer unless separately agreed.

Loyalty, Rewards and Campaigns

1. The Merchant determines and funds its loyalty programme, Reward values, eligibility, expiry and fulfilment. It must publish clear rules and must not retrospectively remove an accrued Member entitlement except where permitted by those rules and law.

2. The Merchant is responsible for the lawful basis, content, recipients and timing of Campaigns and for honouring consent withdrawals and suppression choices. It must not re-upload or target a person it knows has opted out where marketing would be unlawful.

3. Facilipay may suppress a communication to protect deliverability, comply with law or honour a recorded opt-out. This does not relieve the Merchant of its own compliance obligations.

Donations

1. A Merchant collecting donations must accurately state the beneficiary, purpose, charitable status, tax-relief or Gift Aid position, use of funds and refund policy. Facilipay does not verify charitable status unless expressly agreed.

2. Donation funds settle under the Merchant's Payment Provider arrangements. The Merchant is responsible for donor receipts, regulatory reporting, restricted donations and use of the funds.

Self-Checkout and Restricted Products

1. The Merchant is responsible for pricing, product mapping, stock, customer information, theft controls, receipts and consumer compliance in self-checkout use.

2. The Merchant must implement appropriate human or technical controls for alcohol, tobacco, medicines, age-restricted goods and other regulated products and must not rely solely on Facilipay unless a specific compliance feature is expressly agreed.

White-Label Services

1. The Merchant grants Facilipay the branding and Content rights required to operate an agreed white-label application, domain, wallet pass or interface. The Merchant is responsible for brand approvals and the accuracy and legality of Member-facing Content.

2. App-store, domain, messaging and third-party platform requirements apply. Facilipay does not guarantee approval or continued distribution by a third-party platform but will use reasonable endeavours to maintain an agreed white-label Service.

SCHEDULE 3

Data Processing Schedule

Scope and Roles

1. This Schedule applies where Facilipay processes Personal Data on behalf of the Merchant in providing the Services. The Merchant is the Controller and Facilipay is the Processor for that processing.

2. Each party remains an independent Controller for processing it determines for its own purposes. This Schedule does not apply to that independent Controller processing, except for the cooperation and security obligations expressly stated.

Processing Details

Required Detail	Description
Subject matter	Hosting and processing Merchant customer, order, payment-reference, loyalty, Gift Card, membership, campaign, support and related data through the Services.
Duration	For the subscription and the applicable retrieval and retention periods, unless law requires longer.
Nature and purpose	Collection, recording, organisation, storage, retrieval, transmission, reconciliation, analysis, support, deletion and other processing needed to provide and secure configured Services.
Data subjects	Members, customers, guests, donors, recipients, Merchant personnel, Authorised Users and other individuals whose data the Merchant submits.
Personal Data	Identity and contact data; account and device identifiers; order, transaction-reference and redemption data; loyalty, membership and preference data; campaign and consent records; support communications; and other data configured by the Merchant.
Special-category data	Not intended unless expressly supported and agreed. The Merchant must not submit it without a lawful basis and appropriate written instructions.
Controller rights and duties	As set out in the Agreement, Applicable Data Protection Law and the Merchant's documented lawful instructions.

Documented Instructions

1. Facilipay will process Personal Data only on documented instructions from the Merchant, including the Agreement, configuration and lawful use of the Services, unless Union or Member State law requires otherwise. Where permitted, Facilipay will inform the Merchant before legally required processing.

2. Facilipay will inform the Merchant if it reasonably believes an instruction infringes Applicable Data Protection Law and may suspend the affected processing while the parties resolve the issue.

Personnel and Security

1. Facilipay will ensure that persons authorised to process Personal Data are subject to confidentiality obligations and receive appropriate privacy and security instructions.

2. Facilipay will implement measures meeting Article 32 GDPR and Schedule 4, taking account of the state of the art, implementation costs, the nature and risks of processing and information supplied by the Merchant.

Subprocessors

1. The Merchant gives general authorisation for Facilipay to use subprocessors to provide hosting, communications, support, analytics, payment connectivity, AI and other service functions. Facilipay will make current subprocessor information available through the Website, Platform or on request.

2. Facilipay will impose data-protection obligations materially equivalent to those in this Schedule and remains responsible for its subprocessor's performance of those obligations.

3. Facilipay will give reasonable notice of a material new subprocessor where required by law. The Merchant may object on reasonable data-protection grounds. The parties will seek a practical solution; if none is reasonably available, either party may terminate the affected Service without penalty for the unused prepaid period.

International Transfers

1. Facilipay will not transfer Merchant Personal Data outside the EEA except as permitted by Applicable Data Protection Law, including through an adequacy decision, approved standard contractual clauses or another lawful safeguard.

2. The Merchant authorises Facilipay to execute applicable transfer clauses as its agent solely where needed to implement an authorised subprocessor transfer.

Assistance and Rights Requests

1. Taking account of the nature of processing, Facilipay will provide reasonable assistance to the Merchant with data-subject requests, security, breach assessment, notifications, data-protection impact assessments and regulator consultations required under Applicable Data Protection Law.

2. If Facilipay receives a request relating to Merchant-controlled data, it will direct the requester to the Merchant or notify the Merchant, unless law prohibits this. Facilipay will not respond substantively on the Merchant's behalf without authorisation or legal obligation.

3. Assistance beyond standard Platform functionality may be charged at reasonable professional-services rates where the need is not caused by Facilipay's breach.

Personal Data Breaches

1. Facilipay will notify the Merchant without undue delay after becoming aware of a Personal Data breach affecting Personal Data processed under this Schedule. Notification will not be treated as an admission of fault or liability.

2. Facilipay will provide information reasonably available concerning the nature of the breach, affected data and individuals, likely consequences, measures taken or proposed and a contact point. Information may be supplied in phases as it becomes available.

3. The Merchant is responsible for determining whether to notify a supervisory authority or individuals and for meeting applicable deadlines. Facilipay will provide reasonable cooperation.

Return, Deletion and Audit

1. At the end of the Services, Facilipay will return or delete Personal Data in accordance with the Exit clause, unless law requires retention. Secure backups may be deleted through normal cycles and remain protected until deletion.

2. Facilipay will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR. The Merchant must first use available certifications, audit reports and written responses before requesting an on-site audit.

3. An audit must be legally required or reasonably necessary, conducted no more than once annually unless a material incident justifies more, on reasonable notice, during business hours, without access to other customers' data or unreasonable disruption, and subject to confidentiality and security controls. The Merchant bears its costs unless the audit identifies a material Facilipay breach.

Merchant Obligations and Priority

1. The Merchant warrants that its instructions, collection and use of Personal Data are lawful; required notices and lawful bases exist; data is relevant and not excessive; and it will not submit prohibited or special-category data unless expressly supported.

2. This Schedule prevails over conflicting terms concerning Processor activity. Liability remains subject to the Liability clause except to the extent Applicable Data Protection Law prohibits that limitation.

SCHEDULE 4

Security Measures

Facilipay Security Programme

1. Facilipay will maintain a risk-based information-security programme appropriate to the nature of the Services and Merchant Data. Measures may be implemented directly or through reputable hosting and service providers.

2. The programme will include, as appropriate to risk:

• access controls based on business need, account management, authentication and periodic access review;

• encryption of data in transit and, where appropriate, at rest using industry-standard methods;

• logical separation of customer environments and controls against unauthorised access;

• logging, monitoring and alerting for material security and operational events;

• backup, recovery and business-continuity measures proportionate to the Services;

• vulnerability management, security patching and periodic technical testing;

• malware protection, secure development and change-management practices where relevant;

• incident-response procedures and escalation to appropriate personnel;

• confidentiality, security awareness and role-appropriate training for personnel; and

• supplier risk management and contractual security obligations for material service providers.

Security Incidents and Resilience

1. Facilipay will investigate material Security Incidents within its control, take reasonable containment and remediation measures and communicate with the Merchant as required by the Agreement and Applicable Law.

2. No system can be guaranteed completely secure. Facilipay may take urgent protective action, including credential reset, traffic blocking, rate limiting or temporary suspension, where reasonably necessary to protect the Services or data.

Merchant Security Responsibilities

1. The Merchant must secure its devices, networks, browsers, point-of-sale systems, integrations, API clients and credentials; use supported software; apply security updates; configure permissions appropriately; and maintain its own backups of exported business records.

2. The Merchant must not disable security controls, share individual credentials, expose API keys in public code, connect an untrusted integration or permit access by a person who no longer requires it.

3. The Merchant must promptly investigate and notify Facilipay of a Security Incident within its environment that may affect the Services, cooperate with protective measures and provide accurate information reasonably required for response.

DOCUMENT CONTROL

Version: 3.1 | Effective: 20 August 2026 | Replaces: 15th May 2026 | Support: support@facilipay.io