General terms for e-commerce

1 BACKGROUND AND APPLICATION

1.1

Paytrim AB, corp. reg. no. 559155-1329 (“Paytrim”), is a company providing services within acquiring of card transactions. Paytrim has a license to provide payment services and is under the supervision of the Swedish Financial Supervisory Authority (Sw. Finansinspektionen).

1.2

These general terms for e-commerce card acquiring (the “E-commerce Terms”) apply when the Merchant, under the Agreement, accepts payment by Card for purchases of goods and/or services made at a distance via the Merchant’s Website, app or other digital sales channel approved by Paytrim, where the Card is not physically present at the time of the Transaction (“E-commerce Transactions”).

1.3

The E-commerce Terms form part of the Agreement and supplement Paytrim’s General Terms for Card Acquiring (the “General Terms”). Unless otherwise expressly stated in these E-commerce Terms, the General Terms apply in full to E-commerce Transactions, and capitalised terms used but not defined herein shall have the meaning given to them in the General Terms. In the event of any conflict in respect of E-commerce Transactions, these E-commerce Terms shall take precedence over the General Terms. The CSR shall, in accordance with Section 4.1 of the General Terms, always take precedence over the Agreement.

1.4

The Merchant confirms that it enters into the Agreement in its capacity as a business (Sw. näringsidkare) and not as a consumer. In accordance with Chapter 4, Section 20 of the Swedish Payment Services Act (Sw. lag (2010:751) om betaltjänster), the Parties agree that the provisions of Chapters 4 and 5 of the Payment Services Act shall not apply to the Agreement, to the extent such derogation is permitted in relation to payment service users that are not consumers. The Merchant may furthermore not invoke against Paytrim any provision of the Payment Services Act from which deviation by agreement is permitted; in case of conflict, the Agreement shall prevail.

2 ADDITIONAL DEFINITIONS

In addition to the definitions set out in the General Terms, the following definitions shall apply to these E-commerce Terms.

“3-D Secure (3DS)” means the authentication protocols approved by the Card Schemes for authentication of Cardholders in E-commerce Transactions (e.g., Visa Secure and Mastercard Identity Check), in the version required by the Card Schemes from time to time.

“Approved E-commerce Solution” means a hosted payment page, redirect solution or other technical solution for the initiation and processing of E-commerce Transactions which has been approved in writing by Paytrim, and which is provided by Paytrim or by a PCI DSS-certified PSP approved by Paytrim.

“Credential-on-File Transaction” means a Transaction based on Card Information that has, with the Cardholder’s consent, been stored by Paytrim or an approved PSP for future Transactions.

“Hosted Payment Page” means a payment page hosted and controlled by Paytrim or an approved PCI DSS-certified PSP, on which the Cardholder enters Card Information, and to which the Cardholder is redirected from the Merchant’s Website.

“Recurring Transaction” means a Transaction within a series of Transactions which the Cardholder has agreed shall be charged to the Card at predetermined intervals (e.g., subscriptions).

“SAQ” means a PCI DSS Self-Assessment Questionnaire in the form prescribed by the PCI Security Standards Council (e.g., SAQ A), and “AOC” means the related Attestation of Compliance.

“SCA” means strong customer authentication within the meaning of Directive (EU) 2015/2366 (PSD2), the Swedish Payment Services Act and Commission Delegated Regulation (EU) 2018/389.

“Website” means the website(s), app(s) and other digital sales channels of the Merchant, registered with and approved by Paytrim in the Order Form, from which E-commerce Transactions are initiated.

3 APPROVED E-COMMERCE SOLUTION

3.1

The Merchant may only initiate and submit E-commerce Transactions through an Approved E-commerce Solution. Card Information may only be entered by the Cardholder on a Hosted Payment Page or in another payment interface controlled by Paytrim or an approved PSP. The Merchant’s own systems, including the Website, may not collect, transmit, process or store Card Information in any form.

3.2

The Merchant may not modify, reconfigure, integrate or otherwise alter the Approved E-commerce Solution, the checkout flow or any scripts or content affecting the payment flow, without Paytrim’s prior written approval. The Merchant shall notify Paytrim in writing in advance of any planned change to its technical solution, PSP, platform provider or business model that may affect the payment flow.

3.3

Paytrim may withdraw its approval of an Approved E-commerce Solution if the solution no longer meets the PCI Standards, the CSR or Paytrim’s internal requirements. In such case, the Parties shall cooperate to migrate the Merchant to a compliant solution; pending such migration, Paytrim may suspend the acquiring of E-commerce Transactions.

4 PCI STANDARDS AND VALIDATION FOR E-COMMERCE

4.1

Section 6 of the General Terms applies to E-commerce Transactions. In addition, the provisions of this Section 4 apply. The Merchant shall never request, retain or store sensitive authentication data, including card verification codes (e.g., CVV2/CVC2), in any form.

4.2

Where the Merchant uses an Approved E-commerce Solution based on a Hosted Payment Page or redirect, the Merchant’s PCI DSS validation may, subject to the criteria of the PCI Security Standards Council, be performed by way of SAQ A. The Merchant shall in such case confirm that the Website used in connection with the payment solution is not susceptible to script-based attacks that could affect the payment flow, in accordance with the PCI SSC eligibility criteria for SAQ A.

4.3

Unless Section 4.4 applies, the Merchant shall annually provide Paytrim with a completed and signed SAQ of the type designated by Paytrim, together with the related AOC, and any other validation documentation required by the Card Schemes (including, where applicable, a Report on Compliance (ROC) performed by a Qualified Security Assessor).

4.4

Simplified PCI validation for standard solutions. For Merchants classified as PCI Level 4 using a Paytrim-approved standard solution (e.g., a Hosted Payment Page), the Merchant warrants that such solution is used in accordance with Paytrim’s Instructions and has not been altered or integrated with other systems in a way that captures or stores Card Information. By entering into the Agreement, and continuously by using the services, the Merchant confirms that the requirements of the applicable SAQ (e.g., SAQ A) are met. This confirmation shall serve as the Merchant’s annual validation of compliance, unless the Merchant notifies Paytrim otherwise or Paytrim notifies the Merchant that separate validation is required.

4.5

Paytrim classifies each Merchant’s PCI level and applicable validation form in accordance with the rules of the Card Schemes and Paytrim’s internal Merchant PCI DSS programme, based on, inter alia, transaction volumes per Card Scheme and payment channel. Paytrim may at any time reclassify the Merchant and apply stricter validation requirements where the Card Schemes’ rules or the risk profile so require. The Merchant shall provide the information and cooperation reasonably required for such classification and follow-up.

4.6

The Merchant shall immediately notify Paytrim of any suspected or confirmed security incident that may affect Card Information or the payment flow, and shall cooperate with Paytrim, the Card Schemes and any appointed forensic investigator in the investigation and remediation of such incident. If an incident affecting Card Information or the payment flow is attributable to the Merchant’s Website or other systems under the Merchant’s control, or to the Merchant’s breach of Section 3, the Merchant shall reimburse Paytrim for any fines, fees and assessments imposed on Paytrim by the Card Schemes as a result of the incident, and for reasonable costs of investigation and remediation (including any forensic investigation required by the Card Schemes).

5 STRONG CUSTOMER AUTHENTICATION (3-D SECURE)

5.1

The Merchant shall ensure that all E-commerce Transactions support SCA through 3DS in the version required by the Card Schemes from time to time, and shall not take any measure that circumvents or disables SCA.

5.2

Exemptions from SCA may only be applied where permitted under applicable law and the CSR and as approved or applied by Paytrim or the approved PSP. The Merchant acknowledges that Transactions completed without successful 3DS authentication may carry increased Chargeback liability for the Merchant in accordance with the CSR.

6 WEBSITE REQUIREMENTS

6.1

The Merchant shall ensure that the Website at all times clearly displays at least the following information, in accordance with the CSR and applicable law:

(a) the Merchant’s legal name, corporate registration number and contact details (including customer service contact and the country of the Merchant’s domicile);

(b) a complete and accurate description of the goods and/or services offered;

(c) the price, the transaction currency and all taxes, fees and delivery costs;

(d) delivery methods and delivery times;

(e) the Merchant’s policy for returns, cancellations and refunds;

(f) the Merchant’s privacy policy and information about the processing of personal data and use of cookies;

(g) a description of the security measures applied to the payment process; and

(h) the marks of the accepted Card Schemes, in accordance with the CSR.

6.2

The Merchant is responsible for ensuring that its e-commerce activities comply with all applicable laws and regulations, including (where applicable) the Swedish E-commerce Act (Sw. lag (2002:562) om elektronisk handel), the Swedish Distance and Off-Premises Contracts Act (Sw. lag (2005:59) om distansavtal och avtal utanför affärslokaler) in relation to consumers, marketing legislation and Data Protection Legislation.

6.3

Presentation of payment methods. Where the Merchant offers consumers more than one payment method online, the Merchant shall present the available payment methods in accordance with Chapter 7 a, Section 1 of the Swedish Payment Services Act (Sw. lag (2010:751) om betaltjänster). This means that, if a payment method that does not entail the granting of credit is available, such payment method shall be displayed first in the checkout, and a payment method that entails the granting of credit may not be pre-selected where other payment methods are available. The Merchant is solely responsible for such compliance and shall indemnify Paytrim for any costs, fees or sanctions imposed on Paytrim as a result of the Merchant’s non-compliance with this Section 6.3.

7 RESTRICTED ACTIVITIES

7.1

In accordance with Section 3.4 of the General Terms, the Merchant may only accept payment for activities, products and services that have been registered with and approved by Paytrim. In addition, the following activities, products and services may only be sold through E-commerce Transactions with Paytrim’s prior written approval:

(a) travel, accommodation, event tickets and other goods or services that are delivered or performed significantly later than the time of payment;

(b) memberships, subscriptions and other goods or services of a continuous or future-delivery nature;

(c) prepaid gift cards, vouchers and other stored-value products;

(d) gambling, betting, lotteries and similar activities;

(e) alcoholic beverages, tobacco, nicotine products and e-cigarettes;

(f) pharmaceuticals and other medicinal products;

(g) financial services, currency exchange, crypto-assets, electronic money, e-wallet top-ups, money transfer services and payment of debts;

(h) adult entertainment, dating and chat services; and

(i) any other activity designated by Paytrim in the Instructions as requiring prior approval, including activities classified as high-risk by the Card Schemes.

7.2

The Merchant may not use the services to accept payment for goods or services sold or provided by any party other than the Merchant, or to forward, aggregate or otherwise transfer settlement funds to a third party (so-called transaction laundering or aggregation), unless expressly agreed in writing with Paytrim.

7.3

Approval under Section 7.1 may be made subject to conditions, including security arrangements pursuant to Sections 8.2 and 12. Paytrim may withdraw an approval upon written notice if the risk profile of the activity changes, if required by the Card Schemes or applicable law, or if the conditions for the approval are no longer met.

8 DELIVERY AND ADVANCED PAYMENTS

8.1

The Merchant shall deliver the goods and/or services in accordance with the terms communicated to the Cardholder, and may only submit a Purchase Transaction for settlement in accordance with the CSR and the Instructions.

8.2

Where payment is collected in advance of delivery (e.g., pre-orders, bookings, vouchers or subscriptions), the Merchant acknowledges that this entails an increased Chargeback exposure for Paytrim. In addition to its rights under Section 10 of the General Terms, Paytrim may, based on a risk assessment, apply a rolling reserve, delayed settlement or other security arrangements in respect of such Transactions. Paytrim shall inform the Merchant of any such arrangement applied.

9 RECURRING AND CREDENTIAL-ON-FILE TRANSACTIONS

9.1

The Merchant may only carry out Recurring Transactions and Credential-on-File Transactions where this has been approved by Paytrim and in accordance with the CSR. The Merchant shall obtain and retain evidence of the Cardholder’s consent, clearly disclose the terms of the recurring charge (amount, frequency and duration) prior to the first Transaction, and provide the Cardholder with a simple mechanism to cancel future charges.

9.2

Storage of Card Information for future Transactions may only take place with Paytrim or an approved PSP (e.g., through tokenisation). The Merchant may not itself store Card Information.

10 REFUNDS AND CHARGEBACK

10.1

Refund Transactions shall be made to the same Card that was used for the corresponding Purchase Transaction, in accordance with Section 5.2 of the General Terms. Refunds in cash or via other payment methods are not permitted for purchases paid by Card.

10.2

The Merchant is liable for Chargebacks in accordance with Section 8 of the General Terms, including Chargebacks relating to fraudulent E-commerce Transactions to the extent liability is not shifted to the issuer under the CSR (e.g., following successful 3DS authentication).

10.3

If the Merchant’s fraud or Chargeback ratios exceed the thresholds applied by the Card Schemes (e.g., under the Visa and Mastercard fraud and dispute monitoring programmes), the Merchant shall reimburse Paytrim for any fines, fees and costs imposed on Paytrim as a result thereof, and shall implement the remedial measures reasonably required by Paytrim. Paytrim may suspend or terminate the acquiring of E-commerce Transactions in accordance with the Agreement if such ratios are not restored within a reasonable time.

11 FRAUD PREVENTION

11.1

The Merchant shall apply the fraud prevention measures set out in the Instructions or otherwise reasonably required by Paytrim, including screening of orders and verification of delivery details where appropriate.

11.2

Paytrim may suspend the processing or settlement of E-commerce Transactions where Paytrim reasonably suspects fraud, money laundering or other illegal activity, pending investigation.

12 RISK ASSESSMENT AND SECURITY

12.1

Paytrim may at any time during the term of the Agreement carry out a risk assessment of the Merchant. For this purpose, Paytrim may obtain credit information regarding the Merchant and request from the Merchant financial statements, information on expected transaction volumes (including the share of advance payments pursuant to Section 8.2), and other information reasonably required to assess the Merchant’s creditworthiness and risk profile. The Merchant shall provide such information without undue delay.

12.2

Where motivated by the outcome of a risk assessment, a deterioration of the Merchant’s financial position, or a material change in the Merchant’s business model, product range or Chargeback exposure, Paytrim may, upon written notice to the Merchant:

(a) require that the Merchant provides a bank guarantee, cash deposit or other security acceptable to Paytrim for the Secured Amounts;

(b) apply a rolling reserve or an extended settlement period for all or part of the Merchant’s transaction volume;

(c) apply a risk-based fee in accordance with the Price List; and/or

(d) change the Merchant’s settlement form in accordance with Section 9.4 of the General Terms.

12.3

Measures under Section 12.2 shall be proportionate to the identified risk, shall be reviewed by Paytrim at regular intervals and shall be removed or adjusted when no longer motivated by the risk assessment. Paytrim shall state the principal reasons for a measure, unless prevented by applicable law or the CSR.

12.4

The Merchant may not pledge, assign or otherwise use its claims for settlement under the Agreement, or any funds withheld or reserved by Paytrim, as security towards any third party without Paytrim’s prior written consent.

13 CHANGES TP THE E-COMMERCE TERMS

13.1

Paytrim may, at any time and at its sole discretion, amend, supplement or otherwise change these E-commerce Terms without the Merchant’s prior approval and without prior notice to the Merchant. Amended E-commerce Terms become effective when published on Paytrim’s website (www.paytrim.io). The Merchant is responsible for keeping itself informed of the version of the E-commerce Terms in force from time to time. By continuing to submit E-commerce Transactions after publication of amended E-commerce Terms, the Merchant shall be deemed to have accepted the amendments.

13.2

Section 18 of the General Terms shall not apply to changes to these E-commerce Terms. If the Merchant does not accept amended E-commerce Terms, the Merchant’s sole remedy is to terminate the Agreement in accordance with Section 11.1 of the General Terms.

14 SUSPENSION AND TERMINATION

14.1

In addition to Paytrim’s rights under Section 11 of the General Terms, Paytrim may suspend the acquiring of E-commerce Transactions or terminate the Agreement with immediate effect if (i) the Merchant breaches Sections 3, 4, 5, 7, 9 or 12.4 of these E-commerce Terms, (ii) the Merchant’s PCI DSS validation is missing, invalid or has been revoked, (iii) the Merchant fails to provide security required under Section 12.2 within the time reasonably set by Paytrim, or (iv) the Merchant’s e-commerce activities expose Paytrim to fines, sanctions or material reputational risk under the CSR or applicable law.

15 MISCELLANEOUS

15.1

In all other respects, the provisions of the General Terms apply to E-commerce Transactions, including Sections 13 (Force Majeure), 14 (Personal Data), 15 (Confidentiality), 16 (Assignment), 17 (Severability), 19 (Miscellaneous) and 20 (Governing Law and Disputes).

INLÖSENAVTAL / ACQUIRING AGREEMENT