Exhibit 10.2

 

CERTAIN PORTIONS OF THESE MATERIALS HAVE BEEN OMITTED BASED ON A REQUEST FOR
CONFIDENTIAL TREATMENT SUBMITTED TO THE U.S. SECURITIES AND EXCHANGE COMMISSION
(THE “SEC”). THE NON-PUBLIC INFORMATION HAS BEEN OMITTED AND HAS BEEN SEPARATELY
FILED WITH THE SEC. EACH REDACTED PORTION OF THE AGREEMENT IS INDICATED BY A
“[XXXX]” AND IS SUBJECT TO THE REQUEST FOR CONFIDENTIAL TREATMENT SUBMITTED TO
THE SEC. THE REDACTED INFORMATION IS CONFIDENTIAL INFORMATION OF GLOBAL AXCESS
CORP.

 

GROUP CONTRACT
AMENDMENT

 

THIS GROUP CONTRACT AMENDMENT (this “Amendment”) is made as of the 20th day of
December, 2011, by and among Nationwide Money Services, Inc., a Nevada
corporation (“Nationwide”), Food Lion, LLC, a North Carolina limited liability
company (“Food Lion”), J.H. Harvey Co., LLC, a Georgia limited liability company
(“Harvey”) and Kash N’ Carry Food Stores, Inc., a Delaware corporation (“K&K,”
and together with Food Lion and Harvey, each a “Merchant” and together, the
“Merchants”). Nationwide, Food Lion, Harvey and K&K are sometimes referred to in
this Amendment collectively as, the “Parties,” and individually as, a “Party”).

 

W I T N E S S E T H:

 

WHEREAS, Food Lion, LLC and Nationwide are parties to that certain Agreement
dated as of October 5, 2001 (as amended by Amendment No. 1 to the Agreement by
and between Food Lion and Nationwide, dated as of August 28, 2003, and as it may
be further amended, modified or restated, the “Food Lion Agreement”); and

 

WHEREAS, Harvey and Nationwide are parties to that certain Automated Teller
Machine License/Use Agreement dated as of January 20, 2010 (as amended, modified
or restated, the “Harvey Agreement”); and

 

WHEREAS, Nationwide and K&K are parties to that certain Agreement dated October
10, 2001 (as amended by Amendment No. 1 to the Agreement by and between K&K and
Nationwide dated August 28, 2003, and as it may be further amended, modified or
restated, the “K&K Agreement”); and

 

WHEREAS, the Parties desire to modify certain provisions of the Food Lion
Agreement, the Harvey Agreement and the K&K Agreement (collectively, the
“Agreements”), so that such provisions are uniform among the three Agreements;

 

 

CERTAIN PORTIONS OF THESE MATERIALS HAVE BEEN OMITTED BASED ON A REQUEST FOR
CONFIDENTIAL TREATMENT SUBMITTED TO THE U.S. SECURITIES AND EXCHANGE COMMISSION
(THE “SEC”). THE NON-PUBLIC INFORMATION HAS BEEN OMITTED AND HAS BEEN SEPARATELY
FILED WITH THE SEC. EACH REDACTED PORTION OF THE AGREEMENT IS INDICATED BY A
“[XXXX]” AND IS SUBJECT TO THE REQUEST FOR CONFIDENTIAL TREATMENT SUBMITTED TO
THE SEC. THE REDACTED INFORMATION IS CONFIDENTIAL INFORMATION OF GLOBAL AXCESS
CORP.

 

NOW THEREFORE, in consideration of the mutual covenants and promises contained
herein and for other good and valuable consideration, the receipt and
sufficiency of which are hereby acknowledged, the Parties agree as follows:

 

1.                  Extension. The Parties agree and acknowledge that each of
the Agreements shall remain (and have remained) in full force and effect in
accordance with their current terms and provisions until December 31, 2011, and
as amended, shall continue in force until December 31, 2014, as set forth in
Section 2(A) below.

 

2.                  Amendment. The Parties agree that, effective as of January
1, 2012, each of the Agreements shall be amended as follows:

 

Notwithstanding any provision of any of the Agreements to the contrary, each of
the Agreements shall, effective as of January 1, 2012 be amended to include the
following provisions and to delete any provision of the Agreements that is in
conflict therewith. For the avoidance of doubt, the following amendments are,
among other things, intended to replace, in their entirety, any provisions
requiring Nationwide to make any payments or revenue share with respect to any
automated teller machines (“ATM’s”) placed pursuant to the Agreements
(including, without limitation, any portion of screen advertising or coupon
revenues), payments required to be made to Nationwide in connection with any ATM
that is moved at the request of Merchant, the fee paid by Food Lion, Harvey or
K&K for a permanent removal of an ATM at such Party’s request and Nationwide’s
rights to remove ATM’s due to performance issues.

 

A.                Term. Each Agreement shall continue in full force and effect,
unless earlier terminated as permitted in such Agreement, until December 31,
2014.

 

B.                 Surcharge. Nationwide shall not charge a surcharge in excess
of $[XXX] without the prior written consent of the applicable Merchant. In
addition, Nationwide shall not charge any surcharge for transactions which
relate to any of the credit unions set forth in Exhibit A attached hereto, or
any other credit union with which Delhaize Group (the parent of each of the
Merchants) has a contractual relationship of which Nationwide is informed in
writing, in each case, so long as such credit union continues to contract with
Delhaize (collectively, a “Delhaize Associated Credit Union”).

 

C.                 Revenue Share. Nationwide shall pay each Merchant an amount
equal to (i) [XXXXX percent (XX%)] of the surcharge revenue received by
Nationwide, plus [XXX] ($[XXX]) per Free Transaction (as defined below), in each
case, with respect transactions undertaken at ATM’s placed at such Merchant’s
location pursuant to an Agreement. For purposes of calculation of the above
revenue share, “Free Transaction” shall mean any cash withdrawal from a checking
or savings account or any credit card or debit card cash advance, for which
Nationwide does not receive any surcharge, other than transactions relating to
Delhaize Associated Credit Unions (as defined in Section B above) and electronic
benefit transfers (EBTs) for which no surcharge is permitted to be charged by
law.

 

2

 

CERTAIN PORTIONS OF THESE MATERIALS HAVE BEEN OMITTED BASED ON A REQUEST FOR
CONFIDENTIAL TREATMENT SUBMITTED TO THE U.S. SECURITIES AND EXCHANGE COMMISSION
(THE “SEC”). THE NON-PUBLIC INFORMATION HAS BEEN OMITTED AND HAS BEEN SEPARATELY
FILED WITH THE SEC. EACH REDACTED PORTION OF THE AGREEMENT IS INDICATED BY A
“[XXXX]” AND IS SUBJECT TO THE REQUEST FOR CONFIDENTIAL TREATMENT SUBMITTED TO
THE SEC. THE REDACTED INFORMATION IS CONFIDENTIAL INFORMATION OF GLOBAL AXCESS
CORP.

 

 

D.                New Site Setup Expenses. Merchant will pre-wire electrical and
telephone lines, for purposes of placing an ATM in a newly constructed location.
Such costs shall be borne by Merchant. Merchant shall provide power and floor
space, and prepare the same to enable installation of an ATM, at no cost to
Nationwide. Nationwide shall not charge Merchant for any installation of an ATM
and shall be responsible for all other costs related to the installation of
ATM’s pursuant to the Agreements. Nothing herein is intended to change
Merchant’s obligations with respect to the purchase or maintenance of bumpers as
set forth in the Agreements.

 

E.                 Branding/Advertising. Nationwide shall receive the approval
of Merchant before any advertising is placed on, or displayed through, an ATM
placed under an Agreement.

 

F.                  Telecommunications. Nationwide shall be responsible for
providing telecommunication services for ATM’s placed under the Agreement. In
cases where it is necessary for Merchant to provide phone service, Nationwide
will pay Merchant a one-time fee of $[XXX], due upon the initiation of such
phone service, and a $[XXX] fee per month thereafter, payable monthly in arrears
payment of the revenue share.

 

G.                ATM Moving Fees. In the event that Merchant requests
Nationwide to change the location of an ATM within a store, Merchant shall pay
Nationwide the following fees:

 

(i)                $[XXX], if Merchant provides Nationwide at least 21 days’
notice;

 

(ii)               $[XXX], if Merchant provides Nationwide with less than 21
days’ notice;

 

(iii)             $[XXX], if Merchant requests that Nationwide remove an ATM and
re-install such ATM at a later date (which date must be within at least ninety
days of the date of such removal of the ATM, or Merchant shall be subject to the
fees set forth in Section H below).

 

Any relocation of an ATM requested by Nationwide or to comply with the Americans
with Disabilities Act, shall be at Nationwide’s expense.

 

H.                Removal of ATM for In-Store Bank. Merchant shall have the
right to request Nationwide to remove an ATM in the event that Merchant is
installing a bank branch ATM at such location. In such event, Nationwide will
coordinate with Merchant for the removal of such ATM within thirty (30) days of
such request. Upon removal of an ATM pursuant to this Section H, Merchant shall
pay Nationwide a permanent removal fee equal to $[XXX], plus $[XXX] times the
number of months remaining in the Term (as set forth in Section A of this
Amendment).

 

I.                   ATM Uptime Commitment. Nationwide shall maintain the ATM’s
so that they are functional greater than [XXX]% of the time, as calculated for
each calendar month.

 

J.                   ADA Compliance. All ATM’s placed pursuant to the Agreements
shall be compliant with the Americans with Disabilities Act prior to March 15,
2012, or such later date as may be provided for such compliance by law.

3

 

CERTAIN PORTIONS OF THESE MATERIALS HAVE BEEN OMITTED BASED ON A REQUEST FOR
CONFIDENTIAL TREATMENT SUBMITTED TO THE U.S. SECURITIES AND EXCHANGE COMMISSION
(THE “SEC”). THE NON-PUBLIC INFORMATION HAS BEEN OMITTED AND HAS BEEN SEPARATELY
FILED WITH THE SEC. EACH REDACTED PORTION OF THE AGREEMENT IS INDICATED BY A
“[XXXX]” AND IS SUBJECT TO THE REQUEST FOR CONFIDENTIAL TREATMENT SUBMITTED TO
THE SEC. THE REDACTED INFORMATION IS CONFIDENTIAL INFORMATION OF GLOBAL AXCESS
CORP.

 

 

K.                Security. Nationwide shall maintain compliance with the PCI
security standards and all other applicable security rules and regulations
imposed by law. Nationwide agrees to promptly notify Merchant of any breach in
such security requirements.

 

L.                 Removal of ATM’s by Nationwide. If, in any calendar month the
average number of transactions per ATM for the ATM’s placed at a Merchant is
less than the threshold set forth below, Nationwide may, but shall not be
obligated to, remove ATM’s placed at such Merchant’s locations, so that the
calculation for such month with respect to the remaining ATM’s would exceed the
threshold. For purposes of the foregoing, the threshold shall be an average of
[XXX] transactions per ATM per month for Food Lion and K&K, and shall be [XXX]
transactions per ATM per month for Harvey.

 

3.                  Survival of License Agreement. Except as expressly amended
hereby, all terms, conditions and obligations contained in the Agreements shall
remain in full force and effect.

 

4.                  Counterparts. This Agreement may be executed in two or more
counterparts, each of which will be deemed an original, but all of which
together will constitute one and the same instrument. Signatures delivered as
facsimiles shall be binding to the same extent as original signatures.

 

IN WITNESS WHEREOF, the Parties have executed this Amendment as of the date
first set forth above.

 

 

  NATIONWIDE MONEY SERVICES, INC.       By:  /s/ Lock Ireland    

Lock Ireland

Title: CEO

 

 

  FOOD LION, LLC       By:  /s/ Patti Fletcher    

Name: Patti Fletcher

Title: Assistant Treasurer

 

 

  J.H. HARVEY CO., LLC.       By:  /s/ [Insert Name]    

Name: Patti Fletcher

Title: Assistant Treasurer

 

 

  KASH N’ CARRY FOOD STORES, INC.       By:  /s/ Patti Fletcher    

Name: Patti Fletcher

Title: Assistant Treasurer

 

4

 

 

 

 Exhibit A

 

Food Lion Credit Association

 

 

5

 

 

Exhibit A

To Group Contract Amendment

 

Service Provider Privacy, Confidentiality and Information Security Addendum

 

This Service Provider Privacy, Confidentiality and Information Security Addendum
(this “Addendum”) sets forth the terms and conditions relating to the privacy,
confidentiality and security of Personal Information (as defined below)
associated with services rendered pursuant to the Agreements.

 

1.             DEFINITIONS

 

All capitalized terms used in this Addendum but not defined herein shall have
the same meaning ascribed to such terms in the Agreement as supplemented by this
Addendum.

 

1.1.         “Access” means access to: (i) Personal Information and/or (ii)
Customer information technology (“IT”) resources or systems which use, process
or store Personal Information and/or (iii) Customer facilities where Personal
Information is used or stored, including, but not limited to, corporate offices,
distribution centers, or retail stores.

 

1.2.         “PCI Standard” means the Payment Card Industry Data Security
Standard of the PCI Security Standards Council, as may be amended from time to
time, which can be found at https://www.pcisecuritystandards.orp/.

 

1.3.         “Personal Information” means any information relating to an
identified or identifiable individual, including, but not limited to, name,
postal or email address, Social Security number, driver’s license number, date
of birth, demographic information, health or medical information, checking and
credit card account data, personal identification number, next of kin contact
information, in whatever format, including that contained in communications,
documents, databases, records, or materials of any kind whether in individual or
aggregate form, and regardless of the media in which it is contained, that may
be (i) disclosed at any time to Service Provider or Service Provider Personnel
by Customer or Customer Personnel in anticipation of, in connection with or
incidental to the performance of services of or on behalf of Customer; (ii)
Processed (as defined below) at any time by Service Provider or Service Provider
Personnel in connection with or incidental to the performance of this Addendum
or the Agreement; or (iii) derived by Service Provider or Service Provider
Personnel from the information described in (i) or (ii) above. Personal
Information includes cardholder data from Customer’s customers, including but
not limited to, transaction authorization information, credit card numbers,
service codes and expiration dates, and Track 1 and Track 2 data contained on
the magnetic stripe of standard credit and debit cards and other information
within the scope of the PCI Standard (collectively, “Cardholder Data”).

 

1.4.         “Process”, “Processed” or “Processing” means any operation or set
of operations performed upon Personal Information, whether or not by automatic
means, such as creating, collecting, procuring, obtaining, accessing, recording,
organizing, storing, adapting, altering, retrieving, consulting, using,
disclosing, transmitting or destroying the data.

 

2.             PROTECTION OF PERSONAL INFORMATION

 

2.1.         OBLIGATION TO PROTECT.

 

2.1.1.         Service Provider’s obligations regarding Personal Information
shall extend to employees, officers, directors, agents, advisors, contractors,
any subcontractors or other party or person acting on behalf of or at the
direction of Service Provider (collectively, “Service Provider Personnel”) with
Access pursuant to the Agreement or the performance of Services thereunder.
Service Provider shall limit Access to Service Provider Personnel who have a
need to know the Personal Information as a condition to Service Provider’s
performance of Services for or on behalf of Customer and who have agreed in
writing to comply with legally-enforceable privacy, confidentiality and security
obligations that are substantially similar to those required by this Addendum
(including in the case of contractors and subcontractors, an acknowledgement of
their responsibility for the security of any Cardholder Data where such
contractors or subcontractors Process Cardholder Data or manage any systems (or
components of such systems) that store, process or transmit Cardholder Data).
Service Provider shall ensure that all Service Provider Personnel comply with
the provisions of this Addendum regarding the handling and treatment of Personal
Information.

 

6

 

 

2.1.2.         Service Provider shall not contract any of its rights or
obligations concerning Personal Information without the prior written consent of
Customer. Where Service Provider, with the consent of Customer, contracts such
rights or obligations, Service Provider shall enter into a written agreement
with each contractor that imposes obligations on the contractor that are
substantially similar to those imposed on Service Provider under this Addendum.
Service Provider shall only retain contractors that Service Provider reasonably
can expect to be suitable and capable of performing the delegated obligations in
accordance with this Addendum, the Agreement and Customer’s instructions.

 

2.1.3.         Service Provider agrees to hold, maintain, and manage (i) the
existence and terms of this Addendum, and any related agreement, and (ii) any
and all Personal Information in strictest confidence and use due care to prevent
any unauthorized or inappropriate disclosure. Service Provider will not, and
will not allow any third party under its control (including Service Provider
Personnel) to transmit or disclose any of the Personal Information to any third
party, except as required in the provision of the Services, required by law or
governmental order, or otherwise with Customer’s express written consent.

 

2.1.4.         Service Provider shall notify Customer promptly in writing of any
subpoena or other judicial or administrative order by a government authority or
proceeding seeking access to or disclosure of Personal Information. Customer
shall have the right to defend such action in lieu of and on behalf of Service
Provider. Customer may, if it so chooses, seek a protective order. Service
Provider shall reasonably cooperate with Customer in such efforts.

 

2.1.5.         Service Provider covenants and agrees to adhere to all applicable
requirements to be considered compliant with the PCI Standard and shall perform
the necessary steps to validate its compliance with the PCI Standard. Service
Provider shall provide to Customer a copy of its most recent validation of PCI
Standard compliance and all supporting documentation (including any exceptions
noted therein) promptly following the Amendment Effective Date, and on an annual
basis thereafter (or at such other time to coincide with Customer’s own PCI
Standard certification). Service Provider will promptly notify Customer if it
learns that it is no longer compliant with the PCI Standard, or reasonably
anticipates that it is or will be non-compliant, and will promptly inform
Customer of the steps being taken to remediate such non-compliance. Service
Provider acknowledges that it is responsible for the security of any Cardholder
Data in its possession.

 

2.2.         SERVICE PROVIDER WRITTEN SECURITY POLICY.

 

2.2.1.         Service Provider hereby warrants, represents and covenants that,
as of the Amendment Effective Date, it has and will at all times during the term
of the Agreement, maintain a comprehensive written information security program
that complies with applicable Privacy Laws (as defined below). Service
Provider’s information security program shall include appropriate
administrative, technical, physical, organizational and operational safeguards
and other security measures designed to (a) establish minimum standards to be
met in connection with the safeguarding of Personal Information contained in
both paper and electronic records; (b) protect the security and confidentiality
of Personal Information in a manner consistent with applicable industry
standards; (c) protect against anticipated threats or hazards to the security or
integrity of Personal Information; and (d) protect against any actual or
suspected unauthorized Processing, loss, use, disclosure or acquisition of or
Access to any Personal Information (hereinafter “Information Security
Incident”).

 

7

 

 

2.2.2.         Service Provider shall immediately inform Customer in writing of
any Information Security Incident of which Service Provider becomes aware. Such
notice shall summarize in reasonable detail the effect on Customer, if known, of
the Information Security Incident and the corrective action taken or to be taken
by Service Provider. Service Provider shall promptly take all necessary and
advisable corrective actions, and shall cooperate fully with Customer in all
reasonable and lawful efforts to prevent, mitigate or rectify such Information
Security Incident. The content of any filings, communications, notices, press
releases or reports related to any Information Security Incident must be
approved by Customer prior to any publication or communication thereof.

 

2.2.3.         Service Provider shall provide appropriate training to and
exercise the necessary and appropriate supervision over its relevant Service
Provider Personnel to maintain appropriate privacy, confidentiality and security
of Personal Information.

 

2.3.         RETURN OR SECURE DESTRUCTION OF PERSONAL INFORMATION. Promptly upon
the expiration or termination of the Agreement or as otherwise requested by
Customer, Service Provider shall, at Customer’s written request, either (i)
destroy or render unreadable or undecipherable, or (ii) return to Customer, each
and every original and copy in every media of all Personal Information in
Service Provider’s possession, custody or control by secure means.

 

2.4.         COMPLIANCE.

 

2.4.1.         Service Provider agrees to comply with: (i) all applicable
federal, state, and local laws, rules, regulations and governmental
requirements, as the same may be amended or supplemented from time to time,
pertaining in any way to the privacy, confidentiality, security, management,
disclosure, reporting, and any other obligations attaching or arising from the
possession or use of Personal Information, including without limitation, the
Gramm-Leach-Bliley Act (“GLBA”), 15 U.S.C. § § 6801-6827, and all regulations
implementing GLBA; the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681 et
seq., as amended by the Fair and Accurate Credit Transactions Act (“FACTA”), and
all regulations implementing the FCRA and FACTA; the Controlling the Assault of
Non-Solicited Pornography and Marketing Act (CAN-SPAM); security breach
notification laws; laws imposing minimum security requirements (such as 201
Mass. Code Reg. 17.00); laws requiring the secure disposal of records containing
certain Personal Information (such as N.Y. Gen. Bus. Law § 399-H)]
(collectively, the “Privacy Laws”); (ii) all applicable industry standards
concerning privacy, data protection, confidentiality or information security,
including, without limitation, the PCI Standard; and (iii) all applicable
provisions of Customer written policies currently in effect and as they become
effective relating in any way to the privacy, confidentiality and security of
Personal Information or applicable privacy policies, statements or notices that
are provided to Service Provider in writing.

 

2.4.2.         Service Provider warrants that no applicable law, or legal
requirement, or privacy or information security enforcement action,
investigation, litigation or claim prohibits Service Provider from fulfilling
its obligations under this Addendum. In the event a law, or legal requirement,
or privacy or information security enforcement action, investigation, litigation
or claim, or any other circumstance, is reasonably likely to adversely affect
Service Provider’s ability to fulfill its obligations under this Addendum,
Service Provider shall promptly notify Customer in writing and Customer may, in
its sole discretion and without penalty of any kind to Customer, suspend the
transfer or disclosure of Personal Information to Service Provider or access to
Personal Information by Service Provider, terminate any further Processing of
Personal Information by Service Provider, and terminate the Agreement, if doing
so is necessary to comply with applicable Privacy Laws.

 

8

 

 

2.4.3.         Service Provider shall enter into any further privacy or
information security agreement reasonably requested by Customer for the purpose
of compliance with applicable Privacy Laws. In case of any conflict between this
Addendum and any such further data privacy or information security agreement,
such further agreement shall prevail with regard to the Processing of Personal
Information covered by it.

 

2.5.         INJUNCTIVE RELIEF. Service Provider agrees that any Processing of
Personal Information in violation of Section 2 of this Addendum, Customer’s
instructions or any applicable Privacy Law, or any Information Security
Incident, may cause immediate and irreparable harm to Customer for which money
damages may not constitute an adequate remedy. Therefore, Service Provider
agrees that Customer may seek to obtain specific performance and injunctive or
other equitable relief for any such violation or incident, in addition to its
remedies at law, without proof of actual damages. Service Provider agrees to
waive any requirement for the securing or posting of any bond in connection with
such remedy.

 

3.             WARRANTY AND INDEMNIFICATION

 

Service Provider warrants and represents that it is capable of maintaining
safeguards for Personal Information as otherwise provided in this Addendum.
Notwithstanding anything to the contrary in the Agreement, Service Provider
shall indemnify, defend and hold harmless Customer, their officers, directors,
shareholders, and employees from any and all third-party claims, losses,
demands, liabilities, suits, enforcement actions, damages, penalties, fines,
expenses and costs (including attorneys’ fees, consultants’ fees and court
costs) arising from or related to (i) the failure of Service Provider to comply
with Privacy Laws; (ii) any violation of Section 2 of this Addendum; (iii) the
loss, misappropriation or other unauthorized disclosure of Personal Information
by Service Provider or Service Provider Personnel; (iv) the negligence, gross
negligence, bad faith, or intentional or willful misconduct of Service Provider
or Service Provider Personnel in connection with obligations set forth in this
Addendum; (v) Service Provider’s use of any contractor providing services in
connection with or relating to Service Provider’s performance under this
Addendum; and (vi) any Information Security Incident involving Personal
Information in Service Provider’s possession, custody or control, or for which
Service Provider is otherwise responsible.

 

4.             ACCESS TO CUSTOMER IT RESOURCES OR SYSTEMS

 

4.1.         RESTRICTIONS. Except as specifically contemplated in provision of
the Services, Service Provider agrees that it will not and will not allow any
Service Provider Personnel or other third party acting at its direction to (i)
transfer or use Personal Information (or access Personal Information from)
outside of the United States; (ii) attempt unauthorized access to such Personal
Information; (iii) input, delete or otherwise modify any Personal Information or
make any changes to the Customer’s IT resources or systems; or (iv) access, or
attempt to access, any third-party networks or systems from the Customer’s IT
resources or systems except as necessary for performance of the Services.

 

4.2.         UNAUTHORIZED STORAGE. Unless expressly authorized in writing by
Customer, Service Provider shall not allow any Personal Information to be stored
on or Accessed by laptops, USB drives, blackberry devices, or any other portable
storage media belonging to Service Provider or Service Provider’s Personnel,
except as required for the performance of the Services and only for such
duration of time necessary to complete the performance of the applicable
Services.

 

4.3.         CREDENTIALS. If Service Provider or Service Provider’s Personnel is
provided (i) a login ID, password or other authentication credential such as a
digital certificate, token, smartcard, or biometrics device; or (ii) Customer
facility identification cards or other physical security access permission
(collectively, “Credentials”), Service Provider shall treat Credentials with the
utmost care and confidentiality to prevent unauthorized disclosure or misuse.
Service Provider acknowledges that any Credentials issued to it are Customer’s
Confidential Information subject to the protections provided in the Agreement,
and Service Provider and Service Provider Personnel will not share, disclose or
use the Credentials in any unauthorized manner. Service Provider agrees that it
is responsible for the actions of any individuals using the Credentials issued
to it. Upon the termination of the Services or the underlying Agreement, Service
Provider will promptly return any Credentials to Customer upon request or when
network or physical access is no longer required. Service Provider shall
promptly notify Customer if any Service Provider Personnel is terminated or
reassigned from Customer’s account, or is otherwise no longer performing
Services under the Agreement, so that Customer may deactivate such Service
Provider Personnel’s Credentials.

9

 

 

4.4.         SECURITY DESIGN INFORMATION. For the avoidance of doubt, any
information related to the design or security topology of Customer’s IT
resources and systems acquired by Service Provider or that may be gained by
virtue of Service Provider’s Access shall constitute Confidential Information of
Customer, and Service Provider shall not share, disclose or use such design or
security information in any unauthorized manner.

 

4.5.         REMOTE ACCESS. If the Services involve remote Access to a Customer
IT resource or system, the parties shall agree upon an encryption mechanism for
use in exchanging any Personal Information and any other information in
accordance with this Addendum. Upon being provided the same, Service Provider
shall use the approved encryption mechanism for all such communications. In
addition, Service Provider shall take all reasonable precautions to prevent
transmission of a computer virus, malware, or other malicious code to a Customer
IT resource or system or any Customer customer or employee where the Services
contemplate its access to a Service Provider IT resource or system. Service
Provider shall maintain current industry standard anti-virus and anti-malware
tools on its IT resources and systems that will interface with a Customer IT
resource or system and shall ensure that all its IT resources and systems are
maintained with up-to-date security patches, hotfixes, and other similar
software or firmware changes. Prior to transmission of information to Customer,
Service Provider will use anti-virus software to check for and eradicate
viruses. Furthermore, Service Provider shall prohibit Service Provider Personnel
from using their personal IT assets or resources to gain access to any Customer
IT resource or system except as otherwise provided in the Agreement. If any
Services performed by Service Provider Personnel are performed using
non-Customer-owned and controlled IT assets and resources, such assets and
resources shall comply with this Addendum. Service Provider will notify Customer
promptly if a virus, malware, or other malicious code is detected in a file sent
to or received from Customer.

 

4.6.         BACKGROUND INVESTIGATIONS. Service Provider acknowledges and agrees
that it is responsible for the conduct of reference checks, criminal background
checks and such other screening measures as a reasonably prudent employer would
deem appropriate, of Service Provider Personnel prior to such individual’s
performance of any Services which involve Access. Vendor shall not assign any
Vendor Personnel to Customer’s account or otherwise allow any Vendor Personnel
to have Access if such Personnel have been found to have engaged in criminal
acts that involve fraud, dishonesty, or breach of trust, or that constitute a
felony under applicable law. Vendor has the ongoing duty to inform Customer
promptly upon learning that any Vendor Personnel have been convicted of a
felony, and to remove any such individual promptly from Customer’s account.
Notwithstanding the foregoing, Customer, in its sole discretion, has the option
of barring any person from any Customer facilities.

 

5.             AUDIT AND MONITORING RIGHTS

 

5.1.         CUSTOMER SYSTEMS. Service Provider’s Personnel, while using the IT
resources or systems of Customer, may be subject to monitoring and their
activity recorded. Service Provider, for itself and Service Provider Personnel,
expressly consents to such monitoring and recording. No advanced notice or
warning shall be required to monitor Service Provider Personnel’s use of a
Customer IT resource or system.

10

 

 

5.2.         AUDIT RIGHTS. In addition to any other audit rights provided in the
Agreement, upon reasonable advance notice, Customer shall have the right to
audit Service Provider’s information to the extent required to assess compliance
with the terms of this Addendum. During normal business hours, with reasonable
notice, Customer or its authorized representatives may reasonably inspect
Service Provider’s facilities and equipment, and any information or materials in
Service Provider’s possession, custody or control, relating to Service
Provider’s obligations under Section 2 of this Addendum. Such audit may be
conducted by reputable third party auditors hired on behalf of Customer and
reasonably acceptable to Service Provider, and shall be conducted so as to
minimize any disruption to the Service Provider’s operations. Service Provider
shall provide reasonable cooperation with such auditors and will provide
reasonable access to facilities necessary to audit and test compliance. Service
Provider shall deal promptly and appropriately with any inquiries from Customer
relating to the Processing of Personal Information subject to this Addendum.

 

5.3.         REPORTS. At Customer’s reasonable request (depending upon the type
of Access pursuant to the Agreement or the performance of Services thereunder),
Service Provider will provide, or cause to be prepared and provided, (i) a
description prepared by management of Service Provider of Service Provider’s
systems relating to the Services, including the control objectives and related
controls applicable to such systems, and/or (ii) an executed copy of one or more
opinions or attestations (as applicable) from independent auditors of national
reputation engaged and compensated by Service Provider, of Type II examinations
in accordance with SAS No. 70 (or a comparable or successor standard, such as
Statement on Standards for Attestation Engagements (SSAE) No. 16 or
International Standard on Assurance Engagements (ISAE) No. 3402), containing no
material exceptions and identifying no material weakness or significant
deficiency (each, a “Report”). Any such Reports shall be provided at no expense
to Customer and completed as of a date to which the parties agree.

 

6.             OWNERSHIP

 

As between the parties, the Personal Information and Credentials, together with
any intellectual property rights therein, including, but not limited to,
copyrights, shall be the sole property of Customer, and Service Provider shall
not have or obtain any rights therein.

 

7.             CONFLICT

 

In the event of a conflict between the terms of this Addendum and the terms of
the Agreement, the terms of this Addendum shall govern and control such
conflict.

 

8.             NOTICE

 

With respect to notice pursuant to paragraph 2.2.2. hereof, notice shall be made
telephonically to Customer’s Chief Information Security Officer at (704)
633-8250 and to Customer’s IT Support at (800) 559-6161, followed promptly by
written notice in the form and manner set forth in the Agreement.

 

 

 

11