Document:

exv10w02

Exhibit 10.02

Pursuant to 17 C.F.R §240.24b-2, confidential information (indicated as [*]) has been omitted and
filed separately with the SEC pursuant to an application for confidential treatment.

Amendment 3 to

INTUIT MASTER SERVICES AGREEMENT

This Amendment 3 (“Amendment 3”), dated as of April 1, 2008 (“Amendment Effective Date”), to the
INTUIT MASTER SERVICES AGREEMENT dated May 28, 2003 (the “Agreement”), is by and between Intuit
Inc., 2535 Garcia Avenue, Mountain View, CA 94043 (“Intuit”) and Arvato Digital Services LLC,
successor in interest to Arvato Services, Inc. (“Arvato”, “ADS” or “Contractor”).

RECITALS

     WHEREAS, Intuit and Contractor entered into the Agreement;

     WHEREAS, Intuit and Contractor each desires to amend the terms of the Agreement as described
in this Amendment;

     NOW, THEREFORE, in consideration of the mutual covenants, promises and agreements herein
contained, the Parties hereto agree as follows:

TERMS

Unless defined herein, words used in this Amendment 3 as defined terms shall have the same meanings
herein as in the Agreement.

The parties agree that the Agreement is modified and amended as follows:

1. Change of Entity.

All references in the Agreement to “Arvato Services, Inc.” are hereby amended to refer to Arvato
Digital Services LLC (“Arvato”, “ADS” or “Contractor”).

2. Section 2(f) Services is deleted and replaced in its entirety with the following:

During the term of any Statement of Work, if any change in the scope of the Services being
performed under such Statement of Work occurs, either party may propose a change or additions to
the work. Such changes may affect the scope or duration of the Services relating to any such
Statement of Work, including changes in the specifications and changes in any deliverables to be
delivered. The following procedures shall apply to any proposed change. Contractor promptly shall
assign a member of its team to define and describe the change (an “Assessment”), and to notify
Intuit of the cost and/or the impact on the schedule set forth in the applicable Statement of Work
if Contractor believes that an adjustment in the fees to be paid to

 

Contractor with respect to the applicable Statement of Work, or an adjustment to the applicable
performance or delivery schedule, is required. If such change is initiated or caused by Intuit,
Contractor shall invoice Intuit for the work described in the immediately preceding sentence at the
rate of the applicable team member and pre-approved in writing by Intuit, all as set forth in such
Statement of Work. In the event Contractor initiates or causes such a change, Contractor shall not
charge Intuit for such Assessment. Intuit also may request a change in the schedule without
changing the scope of the Services relating to the applicable Statement of Work. In either case,
the parties shall follow the above procedures and negotiate in good faith a reasonable and
equitable adjustment in the applicable fees, schedule and specifications. Once the scope of the
change has been determined, the parties shall determine jointly whether the change should be
implemented, deferred until a later phase or project, or abandoned. In the event the parties
tentatively agree upon a present or future implementation of a change, such agreement shall take
effect only as set forth in a written amendment to the applicable Statement of Work executed by
both parties. Contractor shall continue work pursuant to the existing Statement of Work, and shall
not be bound by any change requested by Intuit, until such change has been agreed upon in writing
by the parties as specified herein. From time to time, an email communication from Intuit to
Contractor requesting a change and an email from Contractor acknowledging and agreeing to such will
suffice as written agreement for purposes of this Section. To the extent that the agreed upon
change would result in a material adjustment of Contractor’s processes or to other long-term
aspects of the Services that may impact Contractor’s costs, the parties shall, notwithstanding such
prior email communications or subsequent actions pursuant thereto, initiate the formal change
request process described above.

3. The following is hereby made a part of the Agreement as Section 2(h) Services:

Intuit may deem it necessary that a third party auditing company perform an audit of Contractor’s
processes. Upon Intuit’s written request, which may be made once per year, Contractor agrees to,
within a commercially reasonable period of time thereafter, at Intuit’s expense, engage a reputable
outside auditing firm reasonably acceptable to Intuit and Contractor, to perform such audit.
Intuit and Contractor shall select such auditor within fifteen (15) days following Intuit’s
request. Contractor shall share the auditor’s report generated in connection with such audit with
Intuit, which report shall be in accordance with AICPA Statement of Auditing Standards No. 70,
“Service Organizations,” (SAS 70), and shall be in the form of a SAS 70 type 2 report as defined in
such standards. In the event such audit detects a material weakness in Contractor’s processes that
has been demonstrated to have resulted in adverse business impact actually suffered by Intuit,
Contractor agrees to correct such weakness(es) within a commercially reasonable period of time and
to provide Intuit with written notice that such weakness has been corrected and the measures taken
to perform such correction. To the extent that such material weakness has been demonstrated to
have adversely impacted Intuit’s business, Contractor shall [*].

4. Section 3 Testing and Acceptance shall be deleted and replaced in its entirety with the
following:

To the extent a particular Statement of Work specifically identifies Services or deliverables for
which Intuit’s acceptance is required, Intuit may, in accordance with any additional terms set
forth in an applicable Statement of Work, conduct acceptance tests to verify whether the Services
and/or the deliverables substantially conform to the applicable specifications set forth in the
applicable Statement of Work or any written documentation provided by Contractor for the Services
and/or deliverables.

 

Intuit shall have fifteen (15) days after completion of the applicable Services, or such other
period as may be mutually agreed upon as set forth in the applicable Statement of Work (the
“Acceptance Period”), to perform such tests. If Intuit notifies Contractor of any material
non-conformities with such specifications in any of the Services and/or the deliverables (each, a
“Nonconformity” and collectively, the “Non-conformities”) in writing within the applicable
Acceptance Period, Contractor promptly shall either demonstrate to Intuit that no such
Non-Conformities exist or use commercially reasonable efforts to correct such Non-conformities at
its own expense and notify Intuit in writing when such corrections are complete. Intuit then shall
have the right to test the corrected Services and/or deliverables, as upon the initial completion
of the applicable Services as set forth above. If Intuit accepts the Services and/or deliverables,
as determined by Intuit as set forth above, Intuit shall notify Contractor in writing of such
acceptance. If Intuit does not notify Contractor of any material Non-conformities within the
applicable Acceptance Period, Intuit shall be deemed to have accepted the Services and/or the
deliverables. Should Contractor fail to correct a Nonconformity within ten (10) calendar days
after receiving written notice thereof from Intuit, or such time period as may be mutually agreed
upon in writing by the parties, which period must be of reasonably sufficient duration to correct
such Nonconformity, Intuit may terminate the applicable Statement of Work, without prejudice to its
rights and remedies hereunder and without any further obligation to Contractor other than the
payment to Contractor of any and all fees incurred by Contractor through the effective date of such
termination pursuant to the applicable Statement of Work.

In the event that Intuit is [*], Intuit reserves the right to [*] acceptable to Arvato to [*]. If
the [*], ADS shall [*].

5. Section 4(b) Compensation and Payment is deleted and replaced in its entirety with the
following:

Contractor will submit to Intuit monthly reports as reasonably requested by Intuit and (i) daily
invoices for cost of goods sold (materials and labor), as shipment occurs, and (ii) monthly
invoices for all other items, including management fees, fulfillment fees, additional packaging
materials, freight, and other expenses, accompanied by reasonably detailed descriptions of the
Services performed during the relevant preceding period, the fees related thereto, prior approved
disbursements and out-of-pocket expenses then due.

If permitted in a Statement of Work, Contractor shall invoice Intuit for travel expenses in
accordance with Intuit’s then-current reimbursable expenses guidelines. Unless reimbursement for
travel expenses is expressly stated in a Statement of Work, however, Contractor shall bear all
travel expenses of its employees and/or agents. The current version of such expense guidelines is
attached hereto as Exhibit G. Intuit will provide reasonable advance written notice to Contractor
of any material amendment to Exhibit G. Contractor will mail invoices to Intuit Inc., Attn:
Accounts Payable, 7535 Torrey Santa Fe Rd, San Diego, California 92129 or such other address as
Intuit shall designate in writing from time to time. Invoices must reference the number and date of
the relevant Statement of Work and must be received by Intuit within six (6) months after the
completion of any Statement of Work. Unless otherwise set forth in a Statement of Work or
otherwise agreed by the parties, any invoices not received within such six (6) month time period
shall be deemed forgiven by Contractor.

6. Section 4(c) Compensation and Payment is deleted and replaced in its entirety with the
following:

 

All undisputed payments will be made by Intuit within twenty (20) days after the receipt by Intuit
of any invoice, and mailed to Contractor at its address specified in the invoice. If Intuit pays
any invoice within ten (10) days of receipt by Intuit of such invoice, such invoice shall be
discounted by Contractor by one percent (1%) of the total amount of the invoice. This discount will
apply to all services except for Retail Freight. Any applicable discounts shall be calculated from
the later of the receipt of the invoice by Intuit or the date any deliverable is received by Intuit
at the designated Intuit location with respect to any Statement of Work executed under this
Agreement. In the event that Intuit in good faith disputes any invoice rendered or amount paid,
Intuit will notify Contractor in writing and the parties shall work together to resolve such
dispute expeditiously, all in accordance with Section 14(c) of this Agreement and the time for
payment of the disputed invoice shall be extended until resolution of the dispute.

7. Section 4(d) Compensation and Payment is deleted and replaced in its entirety with the
following:

Contractor shall detail in each invoice provided under this Agreement applicable taxes for goods
and services, and shall separately state the different types of taxes by the type of tax Intuit
shall pay on products and services, if any, sold or provided by Contractor to Intuit (sales, use,
etc.). Intuit shall bear all applicable taxes, duties, levies, and other similar charges (and any
related interest and penalties), however designated, imposed as a result of the existence or
operation of this Agreement, including but not limited to any tax which Intuit is required to
withhold or deduct from payments to Contractor unless Intuit provides a valid resale/exemption
certificate that will relieve the Contractor from all sales/use tax liabilities. Intuit will
reimburse and indemnify Contractor for any such taxes and contributions and interest and penalties
that Contractor may be compelled to pay on account of Intuit’s non-payment.

8. Section 6 (a) Term/Termination is deleted and replaced in its entirety with the following:

Unless otherwise terminated in accordance with this Agreement, the term of this Agreement shall
begin on the Effective Date and will continue until 9/15/11 and shall be automatically extended to
the expiration or termination date of any SOWs then outstanding. Upon mutual written agreement of
the parties, this Agreement will be renewed for additional agreed upon periods of time.

9. The following is added to the Agreement as Section 6(g) Term/Termination:

Prior to the effective date of the termination or expiration of this Agreement, Intuit and
Contractor shall develop a mutually acceptable plan designed to permit Intuit to transition the
Services in a seamless manner to a succeeding service provider. Contractor agrees to cooperate with
the transition to another service provider and to provide reasonable assistance to Intuit [*] . The
parties agree that the costs and other terms for the above services will be mutually negotiated by
the parties in good faith at the time Intuit notifies Contractor of Intuit’s desire to transition
to a succeeding service provider. Contractor agrees that in no event [*] Intuit for [*] Contractor
[*]. In no event, however, will Contractor be required to disclose its Confidential Information to
such succeeding service provider in connection with the foregoing.

10. Section 12 Insurance is deleted and replaced in its entirety with the following:

 

Contractor will, at Contractor’s expense, maintain insurance policies that cover Contractor’s
activities under this Agreement and the activities of Contractor’s employees, agents and
representatives, including, but not limited to, workers compensation insurance and comprehensive
general liability with minimum limits of insurance of $[*]. In addition, Contractor will carry
commercial crime insurance (with coverage for employee dishonesty, theft / disappearance or
destruction, deposit forgery or computer fraud) with coverage of not less than $[*]. All of
Contractor’s policies will be underwritten by reputable insurers who are licensed to do business in
the State of California. Contractor will name Intuit as an additional insured on each such policy.
Upon the request of Intuit, Contractor shall provide Intuit with a certificate of insurance
evidencing such coverage. In addition, Contractor will provide Intuit ten (10) days advance
written notice of any cancellation or reduction in coverage or limits.

11. Section 13 Limitation of Liability is deleted and replaced in its entirety with the following:

EXCEPT FOR A BREACH OF CONFIDENTIALITY OR IN CONNECTION WITH A PARTY’S INDEMNIFICATION OBLIGATIONS
UNDER SECTION 11, ABOVE, IN NO EVENT WILL (i) EITHER PARTY BE LIABLE TO THE OTHER FOR ANY SPECIAL,
INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES, WHETHER BASED ON BREACH OF CONTRACT, TORT
(INCLUDING NEGLIGENCE) OR OTHERWISE, WHETHER OR NOT THAT PARTY HAS BEEN ADVISED OF THE POSSIBILITY
OF SUCH DAMAGE, OR (ii) THE LIABILITY OF EITHER PARTY TO THE OTHER PARTY FOR DAMAGES OR ALLEGED
DAMAGES HEREUNDER, WHETHER IN CONTRACT, TORT OR ANY OTHER LEGAL THEORY, EXCEED THE GREATER OF (i)
[*] DOLLARS ($[*]) OR (ii) THE AMOUNTS PAID (OR IN THE CASE OF INTUIT, PAID AND DUE AND PAYABLE) BY
INTUIT TO CONTRACTOR HEREUNDER DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE CLAIM.

12. Section 14(e) Notice is deleted and replaced in its entirety with the following:

Unless otherwise stated, all notices required under this Agreement shall be in writing and shall be
considered given (i) when delivered personally; (ii) five (5) days after mailing, when sent
certified mail, return receipt requested and postage prepaid; (iii) one (1) business day after
dispatch, when sent via a commercial overnight carrier, fees prepaid; or (iv) upon delivery when
sent by facsimile transmission confirmed by telephone and followed by notice sent in accordance
with clause (i), (ii) or (iii) above. All communications will be addressed as follows (unless
changed by notice):

	 	 	 
	To Contractor:	 	with a copy to:
	 
	 	 
	Attn: Chief Financial Officer
	 	Attn:  Vice President, Legal Affairs
	Address:
	 	Address:
	Arvato Digital Services LLC

29011 Commerce Center Drive

Valencia, California 91355
	 	Bertelsmann, Inc.

1745 Broadway,
7th Floor

	

	 	New York, New York 10019
	Phone: (661) 702-7623
	 	Phone:           (212) 782-1142
	Fax:     (661) 257-1986
	 	Fax:     (212) 782-1042

	 	 	 
	To Intuit:	 	with a copy to:
	Attn: Luke Tapsall,
	 	Intuit Inc.

 

	 	 	 
	To Intuit:	 	with a copy to:
	Vendor Mgr for ADS Direct Services
	 	 
	Address: Intuit Inc.
	 	2700 Coast Avenue
	2632 Marine Way, M/S MPK 01-03
	 	Mountain View, California 94043
	Mountain View, CA 94043
	 	Attn:   General Counsel, Legal Dept.
	Phone: 650-944-2082
	 	Phone: (650) 944-6000
	Fax:     650-944-3033
	 	Fax:     (650) 944-6622
	 
	 	 
	Attn: Steve Scheid
	 	 
	Vendor Mgr for ADS Retail Services
	 	 
	Address: Intuit Inc.
	 	 
	2632 Marine Way, M/S MPK 01-03
	 	 
	Phone: 269-983-8773
	 	 
	Fax:     650-944-3033
	 	 

13. The following shall be added to the Agreement as Section 14(m) Business Continuity:

(i) Contractor shall: (1) be responsible for business continuity of operations as to the products
and services to be provided under the Supply Agreement; (2) within sixty (60) days after the
Effective Date, submit to Intuit for approval Contractor’s business continuity plan (“Business
Continuity Plan”) that mitigates and minimizes Intuit service interruptions; and (3) update the
Business Continuity Plan to reflect changes in technology and industry standards no less than once
a year.

(ii) Contractor shall provide Intuit reasonable assistance in Intuit’s assessment of Intuit’s
business continuity requirements and provide, for Intuit’s approval at Intuit’s expense, a set of
alternatives for the development of a viable Intuit business continuity program, and the estimated
fees associated with each alternative.

(iii) Contractor shall immediately provide Intuit with written notice of any service failure under
this Agreement due to any of the events specified in Section 14(f) of this Agreement and shall use
commercially reasonable efforts to immediately implement the Business Continuity Plan with regard
to such failure.

(iv) In the event of a Force Majeure, Contractor shall not charge Intuit any fees in excess of the
fees set forth in the applicable Statement of Work.

(iv) Whenever a Force Majeure requires that Contractor allocate limited resources between or among
its customers, Intuit shall receive no less priority in respect to such allocation than any of
Contractor’s other customers.

(v) Upon request by Intuit, Contractor shall provide a copy of its Business Continuity Plan,
Disaster Recovery Plan, and a copy of its annual Business Continuity and Disaster Recovery
exercises.

14. Exhibit E — Intuit Service Provider Privacy Exhibit is deleted and replaced in its entirety
with Exhibit E attached hereto.

15. Exhibit F — Intuit Security Requirements is deleted and replaced in its entirety with Exhibit F
attached hereto.

16. Counterparts and Facsimile Delivery.

This Amendment 3 may be executed in two or more identical counterparts, each of which shall be
deemed to be an original and all of which taken together shall be deemed to constitute Amendment 3
when a duly authorized representative of each party has signed and delivered to the other party a
counterpart.

 

17. Effectiveness of Agreement.

Except as expressly provided herein, nothing in this Amendment 3 shall be deemed to waive or modify
any of the provisions of the Agreement, which otherwise remains in full force and effect. In the
event of any conflict between the Agreement and this Amendment 3, this Amendment 3 shall prevail
with respect to the subject matter hereof.

IN WITNESS WHEREOF, the undersigned have executed this Amendment 3 as of the Amendment Effective
Date.

	 	 	 	 	 	 	 	 	 
	INTUIT INC.
	 	ARVATO DIGITAL SERVICES LLC	 	 
	 	 	 
	By:

	 	/s/ SCOTT BETH
	 	By:
	 	/s/ Jan Icking	 	 
	 

	 	Name: Scott Beth
	 	 	 	Name: Jan Icking	 	 
	 

	 	Title:   VP, Procurement
	 	 	 	Title:   CFO	 	 
	 

	 	Date:   April 4, 2008
	 	 
	 	Date:   April 7, 2008	 	 

 

Exhibit E

Intuit 3rd Party Privacy Exhibit

	1.	 	INTRODUCTION

	 	1.1.	 	This Intuit Privacy Exhibit governs the manner in which specified customer-related
information may be handled or processed by the 3rd Party. Intuit may impose
different or additional restrictions as identified according to country of origin,
transmission, or processing; type of data; or type of processing.

	2.	 	DEFINITIONS

	 	2.1.	 	“Affiliate Companies” shall mean any companies controlling, being controlled by, or
under common control with another company.
	 
	 	2.2.	 	“Individual” shall mean, unless otherwise indicated, any natural person.
	 
	 	2.3.	 	“Intuit” shall mean Intuit Inc. and its Affiliate Companies.
	 
	 	2.4.	 	“Opt-out” shall mean the opportunity afforded to individuals to decline to have their
Personal Information used for purposes other than as necessary to provide the product or
service for which the Personal Information is collected.
	 
	 	2.5.	 	“Opt-in” shall mean the active, affirmative permission granted by individuals to have
their Personal Information used for specified purposes.
	 
	 	2.6.	 	“3rd Party” shall mean the party entering into an agreement with Intuit, into which
this Exhibit has been incorporated by reference, as well as all Affiliate Companies of
said 3rd Party.
	 
	 	2.7.	 	“Personal Information” (“PI”) shall mean any factual or subjective information the,
by itself or in combination, (i) identifies or can be used to identify, contact, or locate
an individual, (ii) pertains to an individual, or (iii) is defined as personal
information under applicable personal data protection laws . PI includes, but is not
limited to: name, address, phone number, fax number, email address, financial profile,
medical information or profile, social security number, credit card information, personal
profile, age, income, credit information, unique identifier, biometric information, and IP
address associated with PI, an individual. PI. For the purposes of this Exhibit,
information about an individual in the business context is considered Personal
Information. For example, business contact information is considered Personal Information.
	 
	 	2.8.	 	“Sensitive Personal Information” shall mean any information that identifies or
suggests an individual’s health, trade union membership, religion or philosophy, race,
ethnicity, politics, or sex life; or that could be misused in such a way as to jeopardize
the financial or legal position of its owner or cause personal embarrassment. Examples of
sensitive personal information include but are not limited to: social security or services
number, national ID number, credit card information, bank account information, physical or
mental health status, genetic information.

	3.	 	3RD PARTY RESPONSIBILITIES — GENERAL

 

	 	3.1.	 	Intuit maintains a compilation of internal privacy policies that govern how Intuit
and its 3rd Parties handle Intuit Personal Information. These policies follow
Safe Harbor principles. The 3rd Party shall apply each of these Safe Harbor
principles as applicable when handling Intuit Personal Information:

	 	3.1.1.	 	Notice — Offer clear, conspicuous notice before collection of Personal
Information from any individual.
	 
	 	3.1.2.	 	Choice — Provide individuals choice regarding secondary uses of personal
information, including but not limited to marketing-related uses; and before
sharing Personal Information with other 3rd Parties not acting as
agent.
	 
	 	3.1.3.	 	Security — Provide adequate protections against unauthorized access and
exposure of Personal Information, commensurate with the sensitivity of the
Personal Information.
	 
	 	3.1.4.	 	Data Integrity — Take reasonable steps to ensure that Personal Information
is relevant, reliable for its intended use, accurate, complete, and current.
	 
	 	3.1.5.	 	Access — Take reasonable measures to provide individuals the ability to
view, and in some cases, amend or correct, Personal Information.
	 
	 	3.1.6.	 	Enforcement — Provide specific mechanisms for ensuring compliance with
principles, recourse, and consequences for non-compliance.

	 	3.2.	 	Each party shall comply with this Exhibit and all applicable laws, rules and
regulations relating to the collection or use of Intuit Personal Information. The
3rd Party agrees to [*] of this Exhibit [*] with access to Intuit Personal
Information.
	 
	 	3.3.	 	The 3rd party shall document in writing Personal Information handling
procedures designed to implement technical and organization measures to protect Intuit
Personal Information as required by applicable laws and this Exhibit. The 3rd
Party will train employees/contractors/vendors on and implement said procedures in a way
that produces the same degree of care, but never less than a reasonable degree of care, to
prevent the unauthorized collection, use, sharing, retention/destruction, and other
inappropriate or prohibited Personal Information handling practices. These written and
actual Personal Information handling procedures are subject to approval by Intuit. Any
substantive deviation from said procedures must by approved by Intuit in writing.
	 
	 	3.4.	 	The 3rd Party shall provide access to Intuit Personal Information to only those
employees, contractors, vendors or authorized agents who (i) have a need to view them in
order to performance of authorized work, (ii) are trained in the proper handling of Intuit
Personal Information, and (iii) are subject to an obligation to handle Intuit Personal
Information in ways at least as restrictive as those practices outlined in this Exhibit.
The 3rd Party and its authorized agents and vendors shall never sell, rent, or
lease Intuit Personal Information to any individual or organization.
	 
	 	3.5.	 	The 3rd Party shall under no circumstances collect, access, use, store, destroy,
reproduce, disclose, or otherwise handle or process Intuit Personal Information other than
as specifically authorized by this or the agreement into which this Exhibit is
incorporated. Should the 3rd Party become legally obligated to handle Intuit Personal
Information other than as permitted by this Exhibit or the associated agreement, it shall,
unless legally prohibited from doing so, first provide notice to Intuit.

 

	 	3.6.	 	The 3rd Party shall maintain such records as are applicable to demonstrate its
compliance with this Exhibit and shall permit Intuit, or a third party chosen by Intuit
and reasonably acceptable to the 3rd Party, to audit 3rd Party’s records and practices
relating to its obligations under this Exhibit upon reasonable notice and during regular
business hours, and at Intuit’s expense, at the locations where such records and data are
maintained, for purposes of verifying the 3rd Party’s compliance. Intuit shall be
provided with a description of all data flows, practices and uses, and names of
individuals with access to the Intuit Personal Information. All such data flows,
practices, uses of Personal Information, and categories of individuals with access to that
Personal Information are subject to approval by Intuit.
	 
	 	3.7.	 	The 3rd Party shall immediately report to Intuit any failure to treat or protect —
including specifically any actual or suspected accidental exposure or unauthorized use or
disclosure of — Intuit Personal Information as set forth in this Exhibitor the agreement
into which it is incorporated, including any related complaints about 3rd Party’s
information and collection practices, and to consult with Intuit as to correction thereof.
The 3rd Party agrees that Intuit shall have the right to participate in the breach
investigation, and control and direct any response and/or correction of any such breach.
	 
	 	3.8.	 	The 3rd Party designates the following person as its Privacy Exhibit Coordinator.
This Privacy Exhibit Coordinator will (i) maintain responsibility for applying adequate
protections to Intuit Personal Information, (ii) oversee application of 3rd
Party compliance with Exhibit requirements, and (iii) serve as a single point of contact
for internal communications and communications with Intuit pertaining to this Exhibit and
compliance with or any breaches thereof.

	 	 	 	COMPANY: Arvato Digital Services LLC
	 
	 	 	 	Designated Privacy Exhibit Coordinator:
	 
	 	 	 	Title:
	 
	 	 	 	Phone:
	 
	 	 	 	Email:
	 
	 	 	 	Mailing Address:

	 	3.9	 	Intuit may propose Amendments of this Exhibit from time to time, with reasonable
notice, as may be required by law or updated Intuit policies, and as promptly as
practicable, Intuit will provide notice to the 3rd Party of any such
requirements of which Intuit becomes aware. 3rd Parties not willing or able to
change practices that are required by law in accordance with such Amendments may be given
sixty (60) days written notice prior to the date of effectiveness of the lawful
requirements of termination of the Agreement. 3rd Parties not willing or able
to change practices that are required by Intuit policies in accordance with such
Amendments may be given reasonable advance written notice by Intuit to comply or terminate
the Agreement. Any Amendments shall be signed by both Intuit and the 3rd Party
and may entail reasonable and commensurate additional costs, if applicable, for upholding
the increased Privacy requirements, as required by law or by Intuit.

 

	4.	 	3RD PARTY RESPONSIBILITIES — SPECIFIC.

	 	 	The following provisions shall not be applicable except to the extent that Intuit and the
3rd Party execute a Statement of Work requiring that the 3rd Party
handles Personal Information of residents of the relevant jurisdiction listed below. The
parties shall jointly determine the precise requirements applicable to Intuit and the
3rd Party as to such jurisdiction based on the Reference Laws and Requirements
referred to below:

	 	a.	 	Italy

	 	i.	 	The 3rd Party recognizes that some Intuit personal data may
pertain to residents of the Italian Republic, and may be governed by Italian privacy
and data protection laws. The 3rd Party agrees to review and apply, with
Intuit supervision and approval, all such pertinent data protection requirements.
	 
	 	ii.	 	Reference Laws and Requirements: The Italian legal framework provides for
some protections additional to those outlined previously in this document. These
differences include but are not limited to:

Constitutional requirements (Italian Constitution, Articles 14, 15)
pertaining to:

Limits on inspection and search of personal domicile.
Guarantees of liberty and secrecy of correspondence of every form of
communication.

Italian Data Protection Code, enforced by the Garante
Defines “personal data” as “any information relating to natural or
legal persons, bodies, or associations that are or can be
identified, even indirectly, by reference to any other information
including a personal identification number.
Unless noted, follows the European Union Data Protection Directive
(95/46/EC) and European Union Directive on Privacy and Electronic
Communication (2002/58/EC) guidelines.

Provides special protections for health information.

Considers unsolicited commercial email to be an act of “theft” and
prohibits the sending of unsolicited email.

Provides for especially harsh criminal and civil penalties for
non-compliance.

	 	b.	 	One or more Member States of the European Union

	 	i.	 	The 3rd Party recognizes that some Intuit personal data may
pertain to residents of one or more European Union Member States, and may be
governed by European Union privacy and data protection laws. The 3rd
Party recognizes that Intuit privacy policies are based around the Safe Harbor
framework, a set of principles that form the basis of an “adequacy” determination
that predicates legal transmission from any European Union Member State to a
non-European Union country. The 3rd Party agrees to apply these Safe
Harbor principles in a way that at least meets and can exceed Safe Harbor
requirements.
	 
	 	ii.	 	Reference Laws and Requirements: The European Union legal framework
provides for some protections additional to those outlined previously in this
document. These differences include but are not limited to:

Safe Harbor, as established by the US Department of Commerce and overseen by
the US Federal Trade Commission and Department of Transportation.

European Union Data Protection Directive (95/46/EC)

European Union Directive on Privacy and Electronic Communication (2002/58/EC)

 

	 	c.	 	Australia

	 	i.	 	The 3rd Party recognizes that some Intuit personal data may
pertain to residents of Australia and may be governed by Australian privacy and data
protection laws. The 3rd Party agrees to review and apply, with Intuit
supervision and approval, all such pertinent data protection requirements.
	 
	 	ii.	 	Reference Laws and Requirements: The Australian legal framework provides
for some protections additional to those outlined previously in this document. These
differences include but are not limited to:

Privacy Act of 1988

Applies the National Privacy Principles.

Imposes special considerations for credit reporting.

Imposes special considerations for tax information.

Spam Act of 2003: Prohibits unsolicited electronic messages, including
email, SMS, IM, and MMS; requires opt-out, and requires accurate sender
address

State Laws — some Australian states have also enacted privacy laws,
including but not limited to the Privacy and Personal Information
Protection Act (1998) of New South Wales.

	 	d.	 	Canada

	 	i.	 	The 3rd Party recognizes that some Intuit personal data may
pertain to residents of Canada and may be governed by Canadian privacy and data
protection laws. The 3rd Party agrees to review and apply, with Intuit
supervision and approval, all such pertinent data protection requirements and abide
by the Canadian Model Code for the Protection of Personal Information:
accountability, purpose specification, use limitation, data quality, security
safeguards, openness, and individual participation.
	 
	 	ii.	 	Reference Laws and Requirements: The Canadian legal framework provides for some
protections additional to those outlined previously in this document. These differences
include but are not limited to:

PIPEDA, PIPA, and the Act Respecting the Protection of Personal Information
in the Private Sector.

Applies the Model Code for the Protection of Personal Information
(CAN/CSA-Q830-96).
Limits Personal Information collection, use, or disclosure only for
purposes that a reasonable person would consider are appropriate to the
circumstances.
Requires notice and opt-out before collecting, using, or disclosing
personal information.

Requires consent for communication or use of personal information for
specific purposes and for a defined period of time.

	 	e.	 	United Kingdom

	 	i.	 	The 3rd Party recognizes that some Intuit personal data may pertain
to residents of the United Kingdom and may be governed by United Kingdom privacy and
data protection laws. The 3rd Party agrees to review and apply, with Intuit
supervision and approval, all such pertinent data protection requirements and the
associated eight data protection principles.
	 
	 	ii.	 	Reference Laws and Requirements: The United Kingdom legal framework provides
for some protections additional to those outlined previously in this document. These
differences include but are not limited to:

Data Protection Act of 1998 and the Employment
Practices Data Protection Code of 2004.

 

Unless noted, follows the European Union Data Protection Directive
(95/46/EC) and European Union Directive on Privacy and Electronic
Communication (2002/58/EC) guidelines.

Applies the eight data protection principles: Personal Information
should be:

	1.	 	Fairly and lawfully processed
	 
	2.	 	Processed for limited purposes
	 
	3.	 	Adequate, relevant and not excessive
	 
	4.	 	Accurate and up to date
	 
	5.	 	Not kept for longer than is necessary
	 
	6.	 	Processed in line with individuals’ rights
	 
	7.	 	Secure
	 
	8.	 	Not transferred to other countries without adequate protection

Provides for rights of individuals to access information about their
Personal Information, and the right to change inaccurate Personal
Information.

	 	•	 	Note that the Scottish Parliament has approved a stronger Freedom of
Information Act, and that territories (Isle of Man, Bailiwick of
Guernsey, and Jersey) have also approved additional data protection
acts.

 

EXHIBIT F

Intuit Comprehensive Security Requirements

Definitions

     For the purposes of this Exhibit, the following definitions shall apply.

Confidential Information: Information which (i) is proprietary to, about, or created by a specific
person or company; (ii) gives the specified person or company some competitive business advantage
or the opportunity of obtaining such advantage, or the disclosure of which could be detrimental to
the interests of the specified person or company; (iii) is designated as Confidential Information
by the specified person or company, or from all the relevant circumstances should reasonably be
assumed by the receiving party to be confidential and proprietary to the specified person or
company.

The following subcategories of Confidential Information are also defined:

	 	•	 	Secret Information: Information that is used to protect other Confidential Information.
Generally, Secret Information is not disclosed to outside parties under any circumstances.
	 
	 	•	 	Sensitive Information: Any information that could be misused in such a way as to
jeopardize the financial or legal position of its owner, or of the person or company
described by the information.
	 
	 	•	 	Restricted Information: Information that is not secret or Sensitive, but whose
permissible use has been restricted by its owner.

Confidential Information includes, but is not limited to, the following types of information and
other information of a similar nature (whether or not reduced to writing or designated as
Confidential):

	 	a	 	Personally-Identifiable Information. Information that identifies or can be used to
identify, contact, or locate the person to whom such information pertains. It includes,
without limitation, the following information:

	 	•	 	Secret Information: Customer passwords, private encryption keys, and private
signature keys.
	 
	 	•	 	Sensitive Information: Customer account numbers, Social Security numbers, taxpayer
identification numbers, account balances, account activity, financial information,
medical records, legal records, and records of customer services and other data
relating to the products and services offered, received, or purchased by customers of
Intuit or the Company.
	 
	 	•	 	Restricted Information: Customer names, customer street or e-mail addresses,
customer telephone numbers.

	 	b	 	Confidential Corporate Information, consisting of any of the following:

	 	•	 	Secret Information: Computer account IDs, passwords for computer or database
systems, private encryption keys, SSL keys, computer source code relating to
encryption / decryption, special access privileges, known security vulnerabilities,
the results of security audits and reviews, and any information explicitly designated
Secret by Intuit or by Company.
	 
	 	•	 	Sensitive Information: Any of the following:

	 	(i)	 	Work Products: Work product resulting from or related to work or
projects performed or to be performed for Intuit or the Company, or for customers
of Intuit or the Company (including all media on which such information is
contained);
	 
	 	(ii)	 	Business Operations: Internal Intuit or Company personnel and
financial information, names and other information about Service Providers
(including without limitation Service Provider characteristics, services and
agreements), purchasing and internal cost information, internal services and
operational manuals, and the manner and methods of conducting Intuit’s or the
Company’s business;

 

	 	(iii)	 	Marketing and Development Operations: Marketing and development
information regarding Intuit’s or the Company’s operations (including without
limitation marketing and development plans, price and cost data, price and fee
amounts, pricing and billing policies, quoting procedures, marketing techniques
and methods of obtaining business, forecasts and forecast assumptions and
volumes, and future plans and potential strategies of Intuit or the Company which
have been or are being discussed);
	 
	 	(iv)	 	Other Proprietary Data: Information relating to Intuit’s or the
Company’s proprietary business information (including without limitation
information pertaining to business transactions and financial performance) or
proprietary rights prior to any public disclosure thereof, and information
regarding acquiring, protecting, enforcing and licensing proprietary rights
(including without limitation patents, copyrights and trade secrets).
	 
	 	(v)	 	Designated Information: Notwithstanding the above, any information
explicitly designated as Sensitive by Intuit or by Company.

	 	•	 	Restricted Information: Aggregated or anonymous customer information (any customer
information other than Personally Identifiable Customer Information), contractual
information or obligations not designated as Sensitive, and any information
explicitly designated as Restricted by Intuit or by Company

A.  Controlling Access to Confidential Information

	1.	 	Access to Confidential Information stored on Company’s systems must not be granted to
members of Company’s staff, Sub Suppliers, or other agents, unless the following
conditions are met:

	 	a)	 	The staff member, Sub Supplier, or other agent requesting the access can be
uniquely identified (e.g., by a unique User ID), with the exception of “root”
password access provided by the Company to its core system administration team;
	 
	 	b)	 	The staff member, Sub Supplier, or other agent requesting the access has
entered a correct password or other authorizing token to indicate that he / she is
the authorized user of this account. If passwords are the only method used for
authentication, they must satisfy certain minimal standards mutually agreeable to
Intuit and Company (i.e., 8 characters minimum length, required use of special- and /
or mixed-case characters, no words that could be found in a dictionary, and required
to be changed every 90 days) that make them sufficiently robust to effectively resist
both educated guessing and brute-force attacks.
	 
	 	c)	 	In all cases, access permissions must be established in a manner that
allows only for the minimum access level(s) required for each staff member, Sub
Supplier, or other agent to perform his or her job function. The ability to read,
write, modify or delete Confidential Information must be limited to those individuals
who are specifically authorized to perform those data maintenance functions.
	 
	 	d)	 	The date, time, requestor, and nature of the access (i.e., read-only or
modify) has been recorded in a log file.

	2.	 	Confidential Information stored on Company’s systems must be stored behind firewalls
with access to such data limited as described in the preceding requirement.
	 
	3.	 	Secret Information must never be stored in clear text on Company’s systems. At a
minimum, financial services industry-standard encryption techniques must be employed to
safeguard Secret Information in Company’s systems from retrieval by unauthorized persons.
Company should strive to adopt best industry practices where appropriate. Whenever
possible, message digest algorithms such as SHA-1 or MD5 should be used to hash and verify
the user’s

 

	 	 	password, and “salt” should be added to the input string prior to encoding to ensure that
the same password text chosen by different users will yield different encodings.
	 
	4.	 	Passwords used to control Company’s staff, Sub Suppliers, or other agents’ access to
Confidential Information must at a minimum conform to the password policies described in
paragraph A.1.b above. Passwords used by Company’s Customers are not required to conform
to these policies; however, Company must ensure that Customers do not have access to
Confidential Information other than that which pertains to them.
	 
	5.	 	Procedures must be in place to modify or revoke access permissions to Confidential
Information when staff members leave the Company or when their job responsibilities
change.
	 
	6.	 	Printed material that contains Confidential Information must be stored in secured
areas to which access is limited to those staff members who have a business need to access
it. It must also be disposed of in a secure manner. At a minimum, financial services
industry-standard protections must be employed to ensure the secure storage and
destruction of Secret and Sensitive Information. Whenever possible, secure disposal
alternatives such as on-site shredding prior to recycling or placement in
publicly-accessible trash bins with subsequent off-site shredding by a licensed Sub
Supplier should be implemented.

B. Transmitting Confidential Information

	1.	 	Unless restricted by law, Company must not electronically transmit Secret or
Sensitive Information over publicly accessible networks without using 128-bit SSL or
another mechanism that affords similar or greater security and confidentiality. If legal
restrictions limit the use of 128-bit SSL encryption technology, Company must use the
strongest encryption technology permitted.
	 
	2.	 	Confidential Information must never be passed in a URL (e.g., using a Get method) in
a manner that potentially exposes the information to third parties and causes such
information to appear in log files.

C. Maintaining a Secure Environment

	1.	 	To protect the accuracy and integrity of Confidential Information, all such data must
be backed up regularly (no less often than weekly), and the backups stored in secure,
environmentally-controlled, limited-access facilities.
	 
	2.	 	Company must run internal and external network vulnerability scans at least monthly
and after any change in the network configuration (e.g., new system component
installations, changes in network topology, firewall rule modifications, or product
upgrades).
	 
	3.	 	Company must promptly install any security-related fixes identified by its hardware
or software Suppliers, if the security threat being addressed by the fix is one that
threatens the privacy or integrity of any Confidential Information covered by this
Agreement. Such upgrades must be made as soon as they can safely be installed and
integrated into Company’s existing architecture and systems.
	 
	4.	 	Intuit may, from time to time, advise Company of recent security threats that have
come to its attention, and require Company to implement specific modifications to its
software, policies, or procedures that may be necessary to counter these threats. Company
must implement these modifications within a mutually-agreeable time, or must obtain
written permission from Intuit to take some other course of action to ensure that the
privacy and integrity of any Confidential Information is preserved.
	 
	5.	 	Company must immediately notify Intuit if it knows or suspects that Confidential
Information has been compromised or disclosed to unauthorized persons, or if there has
been any meaningful or substantial deviation from the

 

	 	 	requirements contained in the Agreement or this Exhibit. See Section F for contact
information. Company agrees that Intuit shall have the right to control and direct any
response and / or correction of any such compromise or disclosure.

	6.	 	Notwithstanding the minimum standards set forth in this Exhibit, Company should
monitor and periodically incorporate reasonable industry-standard security safeguards.

D. Electronic Mail

	1.	 	Company shall not send any Secret or Sensitive Information in an e-mail message over
publicly-accessible networks unless the e-mail is encrypted using a previously-approved
encryption mechanism or is otherwise made secure with an approach that has been mutually
agreed upon in advance by Intuit and Company.
	 
	2.	 	Company and its Sub Suppliers and agents must not reveal the Personally-Identifiable
Information of one customer to any other customer or other third party, in any e-mail or
other communication, except as permitted in writing by the affected person, as deemed
appropriate in light of the interests of the affected person, or as otherwise required by
law.

E. Reviews, Audits, and Remedies

	1.	 	Company agrees that Intuit shall have a right to verify Company’s compliance with
this Exhibit. Upon no less than 14 days’ prior written notice to Company, Intuit (or its
agent) may enter Company’s premises and inspect such of Company’s books, records,
facilities and computer systems as Intuit and Company shall mutually agree is necessary to
ensure that Company complies with the terms, covenants and conditions of this Exhibit.
Intuit or its agent shall comply with Company’s standard policies and procedures that
apply to third party companies that have access to Company’s premises, and Intuit or its
agent shall access Company’s premises during normal business hours (Monday through Friday,
8:00 AM to 5:00 PM), subject to Company’s standard security and confidentiality procedures
and without disruption to Company’s business. Notwithstanding the foregoing, if Intuit in
good faith believes that a threat to security exists that could affect Confidential
Information, Company must provide Intuit or its agent access to its premises immediately
upon request by Intuit.
	 
	2.	 	Intuit may inspect or employ third parties to conduct studies of Company’s
operational processes, systems, vulnerability scan results and computer network security
to determine Company’s compliance with this Exhibit. Intuit agrees to coordinate the
scheduling of any such study with Company to minimize disruption to Company’s business.
Company agrees to cooperate with Intuit to commence such a study within thirty (30) days
from Company’s receipt of written notice of Intuit’s intent to conduct, or to employ a
third party reasonably acceptable to Company to conduct, such a study. At Company’s
request, Intuit will require any such third party it employs to conduct such a study to
sign a nondisclosure agreement pursuant to which it agrees not to disclose any
Confidential Information. Intuit will make the results of any such study available to
Company and, depending on the seriousness of any problems found, may require Company to
remedy any and all such deficiencies in a timely fashion. Costs of such audits shall be
[*], and Company shall only be responsible for [*].
	 
	3.	 	Notwithstanding any time-to-cure provision in this Agreement to the contrary, it
shall be completely within Intuit’s discretion to require correction of any demonstrated
security-related problem within a shorter period of time, subject to the procedures set
forth in this Section E.3. Intuit shall provide written notice of the problem to Company,
and Company must immediately take appropriate steps to correct the problem. If Company
fails to correct any

 

demonstrated security problem within a commercially reasonable time, factoring in the work
that must be completed to address the problem, and resulting in the material disclosure or
threatened disclosure of Intuit’s Confidential Information, Intuit may instruct Company to
take such interim measures as are necessary to protect Intuit’s Confidential Information.
If Company fails or refuses to take those interim and / or permanent measures which are
necessary to prevent the material disclosure of Intuit’s Confidential Information within a
commercially-reasonable time, Intuit may terminate any and all affected agreements between
Intuit and Company for cause.

F. Compliance with U.S. Laws and Regulations

Each of Intuit and Company shall comply with federal, state, and local laws and regulations as the
same are applicable to the Services.

G. Changes to Requirements

Intuit may, in its sole discretion, amend these requirements from time to time, as required by law.
Any amendments to these requirements not expressly required by law shall be subject to written
amendment signed by both Intuit and Company and may entail additional costs.

H. Contact Information

The primary business contact person for each party under this Agreement shall designate a primary
and an alternate single point of contact for security issues for such party (a “Security SPOC”) and
provide mail, email, telephone, home telephone, and pager or portable telephone contact information
for such persons. Both parties agree that either the primary or alternate Security SPOC will be
available at all times (“24/7/365”). Such designation and information must be given in writing to
the other party within ten (10) business days after the effective date of the Agreement. Any
updates to the same shall be given promptly in writing to the other party.exv4w4

Exhibit 4.4

SUBSCRIPTION AGENT AGREEMENT

     This Subscription Agent Agreement (the “Agreement”) is made as of May 19, 2008, between
Guaranty Financial Group Inc., a Delaware corporation (the “Company”), and Computershare Inc., a
Delaware corporation and its wholly-owned subsidiary Computershare Trust Company, N.A., a national
banking association (collectively, the “Agent” or individually “Computershare” and the “Trust
Company,” respectively). All terms not defined herein shall have the meaning abscribed to such
terms in the prospectus (the “Prospectus”) included in the Registration Statement on Form S-1 (File
No. 333-150558) filed by the Company with the Securities and Exchange Commission (the “SEC”) on May
1, 2008, as amended by any amendment filed with respect thereto (the “Registration Statement”).

     WHEREAS, the Company proposes to distribute non-transferable rights to subscribe for shares of
its common stock, par value $1.00 per share (the “Common Stock”), to the stockholders
(“Stockholders”) of record as of 5:00 p.m., New York City
time, on June 2, 2008, or such later date
as the registration statement regarding the rights offering is declared effective by the SEC (the
“Record Date”) by issuing rights certificates or other evidences of the subscription rights, in the
form designated by the Company (the “Rights Certificates”), pursuant to which each Stockholder will
have the subscription rights (the “Subscription Rights”) to subscribe for shares of Common Stock as
described in and on such terms as are set forth in the Prospectus, a final copy of which has been
or, upon availability, will promptly be delivered to the Agent; and

     WHEREAS, the Company wishes the Agent to perform certain acts on behalf of the Company, and
the Agent is willing to so act, in connection with the distribution of the Rights Certificates and
the issuance and exercise of the Subscription Rights to subscribe therein set forth, all upon the
terms and conditions set forth herein.

     NOW, THEREFORE, in consideration of the foregoing and of the mutual agreements set forth
herein, the parties agree as follows:

1. Appointment. The Company hereby appoints the Agent to act as subscription agent in
connection with the distribution of the Rights Certificates and the issuance and exercise of the
Subscription Rights in accordance with the terms set forth in this Agreement and the Agent hereby
accepts such appointment.

2. Form and Execution of Rights Certificates. Each Rights Certificate shall be irrevocable
and non-transferable. The Agent shall, in its capacity as transfer agent of the Company, maintain
a register of Rights Certificates and the holders of record thereof (each of whom shall be deemed a
“Stockholder” hereunder for purposes of determining the rights of holders of Rights Certificates).
Each Rights Certificate shall, subject to the provisions thereof, entitle the Stockholder in whose
name it is recorded to the following:

     A. With respect to Stockholders as of 5:00 p.m., New York City time, on the Record Date only
(“Record Date Stockholders”), the right to acquire during the Subscription Period (as defined in
the Prospectus), at the Subscription Price (as defined in the Prospectus), the number of

 

 

shares of Common Stock defined in the Prospectus for every one
Right (the “Basic Subscription Right”); and

     B. With respect to Record Date Stockholders only, the right to subscribe for additional shares
of Common Stock, subject to the limitations contained in the Prospectus and to the allotment of
such shares as may be available among Record Date Stockholders who exercise Over-Subscription
Priveleges on the basis specified in the Prospectus; provided, however, that such Record Date
Stockholder has exercised their Basic Subscription Rights in full (the “Over-Subscription
Privilege”).

3. Subscription Rights and Issuance of Rights Certificates.

     A. Each Rights Certificate shall evidence the Subscription Rights of the Stockholder therein
named to purchase Common Stock upon the terms and conditions therein and herein set forth.

     B. Upon the written advice of the Company, signed by any of its duly authorized officers, as
to the Record Date, the Agent shall, from a list of the Stockholders as of the Record Date to be
prepared by the Agent in its capacity as transfer agent of the Company, prepare and record Rights
Certificates in the names of the Stockholders, setting forth the number of Suscription Rights to
subscribe for the Company’s Common Stock calculated on the basis of one Right for each whole share
of Common Stock recorded on the books in the name of each such Stockholder as of the Record Date.
The number of Subscription Rights that are issued to Record Date Stockholders will be rounded down,
by the Agent, to the nearest number of full shares of Common Stock held by each Record Date
Stockholder. Fractional Subscription Rights will not be issued. Each Rights Certificate shall be
dated as of the Record Date and may be executed manually or by facsimile signature of a duly
authorized officer of the Agent. Upon the written advice, signed as aforesaid, as to the effective
date of the Registration Statement, the Agent shall deliver the Rights Certificates, together with
a copy of the Prospectus, instruction letter and any other document as the Company deems necessary
or appropriate, to all Record Date Stockholders with record addresses in the United States
(including its territories and possessions and the District of Columbia) by first class mail.

4. Exercise. 

     A. Record Date Stockholders may acquire shares of Common Stock on the exercise of the Basic
Subscription Rights and, if the Basic Subscription Rights are exercised in full, pursuant to the
Over-Subscription Privilege by delivery to the Agent as specified in the Prospectus of (i) the
Rights Certificate with respect thereto, duly executed by such Stockholder in accordance with and
as provided by the terms and conditions of the Rights Certificate, together with (ii) the estimated
purchase price, as disclosed in the Prospectus, for each share of Common Stock subscribed for by
exercise of such Subscription Rights, in U.S. dollars by money order or check drawn on a bank in
the United States, postal or express money order, in each case payable to the order of
Computershare, or wire transfer of immediately available funds to an account of
Computershare specified in the Rights Certificate or instructions as to use of the Rights
Certificates.

2

 

     B. Subscription Rights may be exercised at any time after the date of issuance of the Rights
Certificates with respect thereto but no later than 5:00 p.m., New York City time, on such date as
the Company shall designate to the Agent in writing (the “Expiration Date”). For the purpose of
determining the time of the exercise of any Subscription Rights, delivery of any material to the
Agent shall be deemed to occur when such materials are received by the Agent specified in the
Prospectus.

     C. Notwithstanding the provisions of Section 4(A) and 4(B) regarding delivery of an executed
Rights Certificate to the Agent prior to 5:00 p.m., New York City time, on the Expiration Date, if
prior to such time the Agent receives a Notice of Guaranteed Delivery by facsimile (telecopy) or
otherwise from a bank, a trust company or a New York Stock Exchange member guaranteeing delivery
and payment of the full Subscription Price (as defined in the Prospectus) for the shares of Common
Stock subscribed pursuant to the Stockholder’s Basic Subscription Rights and any additional shares
of Common Stock subscribed for pursuant to the Over-Subscription Privilege, then such exercise of
Basic Subscription Rights and Over-Subscription Privilege shall be regarded as timely, subject,
however, to receipt of the duly executed Rights Certificate within three Business Days (as defined
below) after the Expiration Date (the “Protect Period”). For the purposes of the Prospectus and
this Agreement, “Business Day” shall mean any day on which trading is conducted on the New York
Stock Exchange.

     D. As soon as practicable after the Expiration Date, Computershare shall send to each
exercising Stockholder (or, if shares of Common Stock on the Record Date are held by broker,
custodian bank, or other nominee, to such broker, custodian bank, or other nominee) a confirmation
showing the number of shares of Common Stock acquired pursuant to the Basic Subscription Rights,
and, if applicable, the Over-Subscription Privilege, the per share and total purchase price for
such shares, and any excess to be refunded by the Company to such Stockholder in the form of a
check and stub, along with a letter explaining the allocation of shares of Common Stock pursuant to
the Over-Subscription Privilege.

     E. If a Stockholder does not make timely payment of any additional amounts due in accordance
with Section 4(C), Computershare will consult with the Company in accordance with Section 5 as to
the appropriate action to be taken. Computershare will not issue or deliver certificates or
Statements of Holding for shares subscribed for until payment in full therefore has been received,
including collection of checks and payment pursuant to notices of guaranteed delivery.

     5. Validity of Subscriptions. Irregular subscriptions not otherwise covered by specific
instructions herein shall be submitted to an appropriate officer of the Company and handled in
accordance with his or her instructions. Such instructions will be documented by the Agent
indicating the instructing officer and the date thereof.

     6. Over-Subscription. If, after allocation of shares of Common Stock to Record Date
Stockholders, there remain unexercised Subscription Rights, then the Agent shall allot the shares
issuable upon exercise of such unexercised Rights (the “Remaining Shares”) to Stockholders who have
exercised their Basic Subscription Rights in full and who elected to exercise their
Over-Subscription Privilege. Shares subscribed for pursuant to the Over-Subscription Privilege
will be allocated according to the formula and subject to the limitations set forth in the

3

 

Prospectus. If the number of shares for which the Over-Subscription Privilege has been exercised
is greater than the Remaining Shares, the Agent shall allocate the Remaining Shares to Record Date
Stockholders exercising Over-Subscription Privileges as described in the Prospectus. The
percentage of Remaining Shares each over-subscribing Record Date Stockholder acquires will be
rounded down to result in delivery of whole shares of Common Stock. The Agent shall advise the
Company immediately upon the completion of the allocation set forth above as to the total number of
shares subscribed and distributable. Any Remaining Shares offered but not subscribed for by the
Record Date Stockholders pursuant to the exercise of either Basic Subscription Rights and
Over-Subscription Privileges and any shares of Common Stock issued pursuant to the minimum
guarantee amount in the standby purchase agreements shall be allocated to the standby purchasers on
the terms and conditions set forth in the Prospectus and the standby purchase agreements.

     7. Delivery of Shares. The Agent will deliver certificates or Statement of Holding
reflecting new shares of Common Stock in the Direct Registration System, representing those shares
of Common Stock purchased pursuant to exercise of Basic Subscription Rights and, as applicable,
Over-Subscription Privileges as soon as practicable after the Expiration Date.

     8. Holding Proceeds of Rights Offering.

     A. All proceeds received by Computershare from Stockholders in respect of the exercise of
Subscription Rights shall be held by Computershare, on behalf of the Company, in a segregated
account (the “Account”). No interest shall accrue to the Company or Stockholders on funds held in
the Account pending disbursement in the manner described in Section 4 above.

     B. Computershare shall deliver all proceeds received in respect of the exercise of
Subscription Rights to the Company as promptly as practicable, but in
no event later than two
business days after the Expiration Date of the Rights Offering.

     C. The Company acknowledges that the bank accounts maintained by Computershare in connection
with the services provided under this Agreement will be in its name and that Computershare may
receive investment earnings in connection with the investment at Computershare’s risk and for its
benefit of funds held in those accounts from time to time.

     9. Reports. Daily, during the period commencing on the date hereof, until termination of
the Subscription Period, the Agent will report by telephone or telecopier, confirmed by letter, to
an officer of the Company, data regarding Subscription Rights
exercised, the total number of shares of Common Stock subscribed for, and payments received
therefor, bringing forward the figures from the previous day’s report in each case so as to show
the cumulative totals and any such other information as may be mutually determined by the Company
and the Agent.

     10. Loss or Mutilation. If any Rights Certificate is lost, stolen, mutilated or destroyed,
the Agent may, on such terms which will indemnify and protect the Company and the Agent, issue a
new Rights Certificate of like denomination in substitution for the Rights Certificate so lost,
stolen, mutilated or destroyed.

4

 

     11. Compensation for Services. The Company agrees to pay to the Agent, as compensation for
Agent’s services hereunder, in accordance with the Fee Schedule attached hereto as Exhibit
A. The Company further agrees that it will reimburse the Agent for its reasonable
out-of-pocket expenses incurred in the performance of its duties as such.

     12. Instructions, Indemnification and Limitation of Liability. The Agent undertakes the
duties and obligations imposed by this Agreement upon the following terms and conditions:

     A. The Agent shall be entitled to rely upon any instructions or directions furnished to it by
an appropriate officer of the Company, whether in conformity with the provisions of this Agreement
or constituting a modification hereof or a supplement hereto. Without limiting the generality of
the foregoing or any other provision of this Agreement, the Agent, in connection with its duties
hereunder, shall not be under any duty or obligation to inquire into the validity or invalidity or
authority or lack thereof of any instruction or direction from an officer of the Company which
conforms to the applicable requirements of this Agreement and which the Agent reasonably believes
to be genuine and shall not be liable for any delays, errors or loss of data occurring by reason of
circumstances beyond the Agent’s control.

     B. The Company will indemnify the Agent and its nominees against, and hold it harmless from,
all liability and expense which may arise out of or in connection with the services described in
this Agreement or the instructions or directions furnished to the Agent relating to this Agreement
by an appropriate officer of the Company, except for any liability or expense which shall arise out
of the gross negligence, bad faith or willful misconduct of the Agent or such nominees.

     C. Promptly after the receipt by the Agent of notice of any demand or claim or the
commencement of any action, suit, proceeding or investigation, the Agent shall, if a claim in
respect thereof is to be made against the Company, notify the Company thereof in writing. The
Company shall be entitled to participate as its own expense in the defense of any such claim or
proceeding, and, if it so elects at any time after receipt of such notice, it may assume the
defense of any suit brought to enforce any such claim or of any other legal action or proceeding.
For the purposes of this Section 12, the term “expense or loss” means any amount paid or payable to
satisfy any claim, demand, action, suit or proceeding settled with the express written consent of
the Agent, and all reasonable costs and expenses, including, but not limited to, reasonable counsel fees and
disbursements, paid or incurred in investigating or defending against any such claim, demand,
action, suit, proceeding or investigation.

     D. The Agent shall be responsible for and shall indemnify and hold the Company harmless from and
against any and all losses, damages, costs, charges, counsel fees, payments, expenses and liability
arising out of or attributable to Agent’s refusal or failure to comply with the terms of this
Agreement, or which arise out of Agent’s negligence or willful misconduct or which arise out of the
breach of any representation or warranty of Agent hereunder, for which Agent is not entitled to
indemnification under this Agreement; provided, however, that Agent’s aggregate liability during
any term of this Agreement with respect to, arising from, or arising in connection with this
Agreement, or from all services provided or omitted to be provided under this Agreement, whether in
contract, or in tort, or otherwise, is limited to, and shall not exceed, the amounts paid hereunder
by the Company to Agent as fees and charges, but not including

5

 

reimbursable expenses, during the twelve (12) calendar months immediately preceding the event
for which recovery from the Agent is being sought.

13. Changes in Rights Certificate. The Agent may, without the consent or concurrence of
the Stockholders in whose names Rights Certificates are registered, by supplemental agreement or
otherwise, concur with the Company in making any changes or corrections in a Rights Certificate
that it shall have been advised by counsel (who may be counsel for the Company) is appropriate to
cure any ambiguity or to correct any defective or inconsistent provision or clerical omission or
mistake or manifest error therein or herein contained, and which shall not be inconsistent with the
provision of the Rights Certificate except insofar as any such change may confer additional rights
upon the Stockholders.

14. Assignment/Delegation.

     A. Except as provided in Section 14(B) below, neither this Agreement nor any rights or
obligations hereunder may be assigned or delegated by either party without the written consent of
the other party.

     B. The Agent may, without further consent on the part of the Company, subcontract with other
subcontractors for systems, processing, telephone and mailing services, and post-exchange
activities, as may be required from time to time; provided, however, that the Agent shall be as
fully responsible to the Company for the acts and omissions of any subcontractor as it is for its
own acts and omissions.

     C. Except as explicitly stated elsewhere in this Agreement, nothing under this Agreement shall
be construed to give any rights or benefits in this Agreement to anyone other than the Agent and
the Company and the duties and responsibilities undertaken pursuant to this Agreement shall be for
the sole and exclusive benefit of the Agent and the Company.

15. Governing Law. The validity, interpretation and performance of this Agreement shall be
governed by the law of the Commonwealth of Massachusetts and shall inure to the benefit of and the
obligations created hereby shall be binding upon the successors and permitted assigns of the
parties hereto.

16. Third Party Beneficiaries. This Agreement does not constitute an agreement for a
partnership or joint venture between the Agent and the Company. Neither party shall make any
commitments with third parties that are binding on the other party without the other party’s prior
written consent.

17. Force Majeure. In the event either party is unable to perform its obligations under
the terms of this Agreement because of acts of God, strikes, terrorist acts, equipment or
transmission failure or damage reasonably beyond its control, or other cause reasonably beyond its
control, such party shall not be liabile for damages to the other for any damages resulting from
such failure to perform or otherwise from such causes. Performance under this Agreement shall
resume when the affected party or parties are able to perform substantially that party’s duties.

18. Consequential Damages. Neither party to this Agreement shall be liable to the other
party for any consequential, indirect, special or incidental damages under any provisions of this

6

 

Agreement or for any consequential, indirect, penal, special or incidential damages arising out of
any act or failure to act hereunder even if that party has been advised of or has foreseen the
possibility of such damages.

19. Severability. If any provision of this Agreement shall be held invalid, unlawful, or
unenforceable, the valididty, legality, and enforceability of the remaining provisions shall not in
any way be affected or impaired.

20. Counterparts. This Agreement may be executed in one or more counterparts, each of which
shall be deemed an original and all of which together shall be considered one and the same
agreement.

21. Captions. The captions and descriptive headings herein are for the convenience of the
parties only. They do not in any way modify, amplify, alter or give full notice of the provisions
hereof.

22. Confidentiality. The Agent and the Company agree that all books, records, information
and data pertaining to the business of the other party which are exchanged or received pursuant to
the negotiation or the carrying out of this Agreement including the fees for services set forth in
the attached schedule shall remain confidential, and shall not be voluntarily disclosed to any
other person, except as may be required by law.

23. Term and Termination. This Agreement shall remain in effect until the earlier of (a)
60 days after the Expiration Date; (b) it is terminated by either party upon a material breach of
this Agreement which remains uncured for 30 days after written notice of such breach has been
provided; or (c) 30 days’ written notice has been provided by either party to the other. Upon
termination of the Agreement, the Agent shall retain all canceled Rights Certificates and related
documentation as required by applicable law.

24. Notices. Until further notice in writing by either party hereto to the other party, all
written reports, notices and other communications between the Agent and the Company required or
permitted hereunder shall be delivered or mailed by first class mail, postage prepaid, telecopier
or overnight courier guaranteeing next day delivery, addressed as follows:

     If to the Company, to:

Guaranty Financial Group Inc.

1300 MoPac Expressway South

Austin, Texas 78746

Attention: Ron Murff, Chief Financial Officer

     If to the Agent, to:

Computershare Trust Company, N.A.

c/o Comutershare Stockholder Services, Inc.

250 Royall Street

Canton, MA 02021

7

 

Attention: Reorganization Department

25. Survival. The provisions of Paragraphs 12, 15, 17-19, 22, and 24-26 shall survive any
termination, for any reason, of this Agreement.

26. Entire Agreement. This Agreement constitutes the entire agreement between the parties
hereto and supercedes any prior agreement with respect to the subject matter hereof whether oral or
written.

[Remainder of this page intentionally left blank; Signature page follows]

8

 

     IN WITNESS WHEREOF, the parties hereto have caused this Agreement to be executed by their
respective officers, hereunto duly authorized, as of the day and year first above written.

COMPUTERSHARE TRUST COMPANY, NA.

By:     /s/              
                    
                   
         

Date:  5/28/08                
                             
         

Title:  Director,
Corporate Actions             
      

COMPUTERSHARE INC.

By:     /s/            
                               
                    

Date:  5/28/08        
                           
                    

Title:  Director,
Corporate Actions                
    

GUARANTY FINANCIAL GROUP INC.

By:     /s/
Ronald A. Murff                      
            

Date:            
                    
                 
                   

Title:  Senior
Executive Vice President & Chief Financial Officer

9

Source: [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00143-of-00352.parquet"}, [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00143-of-00352.parquet"}]]