allows the reidentification of redacted Personal Information (such as a Merchant's Social Security Number or other equivalent government registration identifiers appropriate to the Merchant's country of operation and driver's license information) in the MATCH Pro system. With respect to Corporation's Processing of California consumer Personal Information for the MATCH Pro system on behalf of an Acquirer where the Acquirer is a "Business" under CCPA, the Corporation as a Service Provider must:

1. Use, retain, disclose, or otherwise Process Personal Information only on behalf of Acquirers and for the specific business purpose of providing and operating the MATCH Pro system and in accordance with Customer's instructions, including as described in the Agreement. The Corporation will not "sell" or "share" (as each is defined under CCPA) Personal Information and will not use, retain, disclose, or otherwise Process Personal Information outside of its direct business relationship with Acquirers or for any other business or commercial purpose except as permitted or required by the Mastercard Rules, any Standards or by applicable law. The Corporation will inform Acquirers if the Corporation determines that it is no longer able to meet its obligations under CCPA. Acquirers reserve the right to take reasonable and appropriate steps to (a) help ensure that the Corporation uses California consumer Personal Information in a manner consistent with the Acquirers' obligations under CCPA and (b) discontinue and remediate unauthorized use of Personal Information.
2. Not combine Personal Information which it Processes on Acquirers' behalf, with Personal Information which it receives from or on behalf of another person or persons, or collects from its own interaction with individuals, provided that Corporation may combine Personal Information to perform any business purpose permitted or required under the MATCH Pro terms to perform and operate the MATCH Pro system services.
3. Comply with all applicable sections of CCPA, including with respect to the Personal Information that it collects pursuant to the terms, providing the same level of privacy protections as required of Acquirers by the CCPA (including the applicable regulations).
4. Provide Acquirers with reasonable assistance to enable Acquirer to comply with California consumer requests made pursuant to CCPA. Privacy and Data Protection Standards for MATCH Pro F.5 The Corporation and Customer Obligations Security Rules and Procedures—Merchant Edition • 11 February 2025
5. Process Personal Information for the following CCPA business purposes:
   1. Helping to ensure security and integrity to the extent the use of the California consumer's Personal Information is reasonably necessary and proportionate for these purposes;
   2. Debugging to identify and repair errors that impair existing intended functionality;
   3. Performing services on behalf of the Acquirers;
   4. Undertaking internal research for technological development and demonstration;
   5. Undertaking activities to verify or maintain the quality or safety of the MATCH Pro service and to improve, upgrade, or enhance the MATCH Pro service;
   6. To retain and employ another service provider or contractor as a subcontractor where the subcontractor meets the requirements for a service provider or contractor under CCPA;
   7. To build or improve the quality of the MATCH Pro services provided that the Corporation does not use the Personal Information to perform services on behalf of another person; or
   8. To prevent, detect, or investigate data security incidents or protect against malicious, deceptive, fraudulent, or illegal activity. F.6 Data Transfers With respect to Personal Information governed by EU Data Protection Law, a Customer may transfer such Personal Information Processed in connection with MATCH Pro outside of the EEA, the UK, and Switzerland in accordance with EU Data Protection Law, including based on the EEA SCCs or the UK Addendum as appropriate. The Corporation may transfer such Personal Information Processed in connection with MATCH Pro outside of the EEA, the UK, and Switzerland in accordance with the Mastercard BCRs or with any other lawful data transfer mechanism that provides an adequate level of protection under EU Data Protection Law. The Corporation will abide by the Mastercard BCRs when Processing Personal Information in the context of MATCH Pro. A Customer must ensure that any transfers (including any cross-border transfers) of Personal Information Processed in connection with the MATCH Pro (i) comply with Applicable Data Protection Law; (ii) be in accordance with any lawful data transfer mechanism; and (iii) ensure that the Personal Information will be protected with the same level of protection as provided in context of MATCH Pro. F.7 Data Disclosures The Corporation and its Customers must ensure that they will only disclose Personal Information Processed in the context of MATCH Pro in accordance with Applicable Data Protection Law, and in particular that they will require the data recipients to protect the data with at least the same level of protection as described in this appendix. Privacy and Data Protection Standards for MATCH Pro F.6 Data Transfers Security Rules and Procedures—Merchant Edition • 11 February 2025 The Corporation represents and warrants that it will only disclose Personal Information subject to EU Data Protection Law in accordance with the Mastercard BCRs, EEA SCCs or UK Addendum, as applicable. Where the Corporation transfers Personal Information subject to the GDPR or the Swiss Data Protection Act to a Customer in a country that is not part of the EEA or subject to a European Commission adequacy decision, the Parties agree that the transfer are governed by the EEA SCCs, which are hereby incorporated into this appendix by reference. The EEA SCCs are completed as follows: the Parties conclude Module One (controller-to-controller) of the EEA SCCs. The "data exporter" is Corporation; the "data importer" is Customer; the optional docking clause in Clause 7 is implemented; the optional paragraph in Clause 11(a) is struck; the competent supervisory authority in Clause 13(a) is the supervisory authority of Belgium; the governing law in Clause 17 is the law of the Belgium and the courts in Clause 18(b) are the courts of the Belgium; Annex 1 and 2 to the EEA SCCs are Annex 1 and 2 to this appendix. The Parties conclude the UK Addendum for transfers of Personal Information subject to the UK Data Protection Act from Corporation to Customer in a country that is not subject to a UK adequacy decision. The UK Addendum is hereby incorporated into this appendix by reference. Part 1 of the UK Addendum is completed as follows: (i) in Table 1, the "Exporter" is Corporation and the "Importer" is Customer (as set out in the paragraph above), their details are set forth in the Acquirer license agreement and their signatures are included in the signature page of the Acquirer license agreement; (ii) in Table 2, the first option is selected and the "Approved EU SCCs" are those incorporated into this appendix as per the paragraph above; (iii) in Table 3, Annexes 1 and 2 to the Approved EU SCCs are Annexes 1 and 2 to this appendix respectively; and (iv) in Table 4, both the "Importer" and the "Exporter" can terminate the UK Addendum. If either Party's compliance with EU Data Protection Law applicable to transfers of Personal Information is affected by circumstances outside of either Party's control, including if a legal instrument for transfers is invalidated, amended, or replaced, then the Parties will work together in good faith to reasonably resolve such noncompliance. F.8 Security Measures The Corporation and its Customers must implement and maintain a comprehensive written information security program with appropriate technical and organizational measures to ensure a level of security appropriate to the risk, which includes, at a minimum, as appropriate: (1) the pseudonymization and encryption of Personal Information; (2) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services; (3) the ability to restore the availability and access to Personal Information in a timely manner in the event of a physical or technical incident; and (4) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing. In assessing the appropriate level of security, the Corporation and its Customers must take into account the state of the art; the costs of implementation; and the nature, scope, context, and purposes of Processing of Personal Information; as well as the risk of varying likelihood and Privacy and Data Protection Standards for MATCH Pro F.8 Security Measures Security Rules and Procedures—Merchant Edition • 11 February 2025 severity for the rights and freedoms of Individuals and the risks that are presented by the Processing of Personal Information, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Information transmitted, stored, or otherwise Processed. F.9 Confidentiality of Personal Information The Corporation and its Customers must take steps to ensure that any person acting under their authority who has access to Personal Information is subject to a duly enforceable contractual or statutory confidentiality obligation, and if applicable, Process Personal Information in accordance with the disclosing party's instructions. F.10 Personal Information Breach Notification Requirements The Parties will assist each other in complying with their Personal Information Breach notification obligations. Where required under Applicable Data Protection Law, the Party which became aware of a Personal Information Breach will notify, without undue delay and, where feasible, not later than 72 hours after having become aware of it, the competent supervisory authority. When the Personal Information Breach is likely to result in a high risk to the rights and freedoms of Individuals or upon the competent supervisory authority’s request to do so, or where such notification is required by Applicable Data Protection Law, such Party must communicate the Personal Information Breach to the Individual without undue delay. F.11 Personal Information Breach Cooperation and Documentation Requirements Each Party must notify the other Party of a Personal Information Breach that relates to Personal Information Processed in the context of MATCH Pro and for which the other Party is a Controller, Business, or Service Provider, without undue delay, and not later than forty-eight (48) hours after having become aware of a Personal Information Breach. Each Party must document all Personal Information Breaches, including the facts relating to the Personal Information Breach, its effects, and the remedial action taken. F.12 Data Protection and Security Audit The Corporation and each Customer must conduct audits on a regular basis to control compliance with Applicable Data Protection Law, including the security measures provided in Section F.8, and the Corporation must comply with the Mastercard BCRs. Privacy and Data Protection Standards for MATCH Pro F.9 Confidentiality of Personal Information Security Rules and Procedures—Merchant Edition • 11 February 2025 Upon prior written request, the Corporation and each Customer agrees to cooperate and, within reasonable time, provide the requesting Party with: (1) a summary of the audit reports demonstrating its compliance with Applicable Data Protection Law obligations and the Standards in this appendix, and as applicable Mastercard BCRs, after redacting any confidential and commercially sensitive information; and (2) confirmation that the audit has not revealed any material vulnerability, or to the extent that any vulnerability was detected, that such vulnerability has been fully remedied. F.13 Liability Subject to the liability clauses in the Standards, the Corporation and each Customer agrees that it will be liable towards Individuals for the entire damage resulting from a violation of Applicable Data Protection Law with regard to Processing of Personal Information for which it is a Controller. Where the Parties are involved in the same Processing and where they are responsible for any damage caused by the Processing of Personal Information, both the Corporation and each responsible Customer may be held liable for the entire damage in order to ensure effective compensation of the Individual. If the Corporation paid full compensation for the damage suffered, the Corporation is entitled to claim back from the Customer(s) that part of the compensation corresponding to each Customer's part of responsibility for the damage. F.14 Termination of MATCH Pro The Corporation and its Customers agree that, apart from the data retention obligation in Section F.5, Paragraph 9, the Standards in this appendix are no longer applicable to a Customer upon the termination of such Customer's use of MATCH Pro. F.15 Invalidity and Severability If any Standard in this appendix is found by any court or administrative body of competent jurisdiction to be invalid or unenforceable, the invalidity or unenforceability of such Standard does not affect any other Standard in this appendix, and all Standards not affected by such invalidity or unenforceability will remain in full force and effect. Privacy and Data Protection Standards for MATCH Pro F.13 Liability Security Rules and Procedures—Merchant Edition • 11 February 2025 Annex 1 to Appendix F: Processing of Personal Data A. List of Parties
6. Data exporter: The Corporation – Name and address of the Corporation as well as the name, position, and contact details for the Corporation's contact person: as stipulated in the Acquirer License agreement. – Activities relevant to the data transferred: Providing MATCH Pro – Signature and date: as stipulated in the Acquirer License agreement – Role: controller for the purposes listed in Section F.4 of Appendix F
7. Data importer: The Customer – Name and address of the Customer as well as the name, position, and contact details for Customer's contact person: as stipulated in the Acquirer License agreement – Activities relevant to the data transferred: participating in, or benefiting from MATCH Pro – Signature and date: as stipulated in the Acquirer License agreement – Role: controller for the purposes listed in Section F.4 of Appendix F B. Description of the Transfer Data Subjects Data Subjects as defined in Appendix E. Categories of data Personal Data relating to a Merchant's principal owners or sole proprietors. Frequency of the transfer Upon Customer's requests, such as on a per query basis or via batch file transfer. Nature of the Processing Collection, storage, analysis, disclosure by transfer or otherwise making available. Purposes of the transfer(s) The transfer is made for the purposes set forth in Section F.4 of Appendix F. Period for which the Personal Data will be retained Personal Data will be retained only for as long as necessary to achieve the relevant purposes of MATCH Pro. C. Competent Supervisory Authority The competent supervisory authority in accordance with Clause 13 of the EEA SCCs is the Belgian Data Protection Authority. Privacy and Data Protection Standards for MATCH Pro Annex 1 to Appendix F: Processing of Personal Data Security Rules and Procedures—Merchant Edition • 11 February 2025 Annex 2 to Appendix F: Technical and Organizational Measures Ensure the Security of the Data The Parties will, as a minimum, implement the following types of security measures:
8. Physical access control Technical and organizational measures to prevent unauthorized persons from gaining access to the data processing systems available in premises and facilities (including databases, application servers and related hardware), where Personal Data are processed, include: – Establishing security areas, restriction of access paths; – Establishing access authorizations for employees and third parties; – Access control system (ID reader, magnetic card, chip card); – Key management, card-keys procedures; – Door locking (electric door openers, etc.); – Security staff, janitors; – Surveillance facilities, video/CCTV monitor, alarm system; and – Securing decentralized data processing equipment and personal computers.
9. Virtual access control Technical and organizational measures to prevent data processing systems from being used by unauthorized persons include: – User identification and authentication procedures; – ID/password security procedures (special characters, minimum length, change of password); – Automatic blocking (e.g., password or timeout); – Monitoring of break-in-attempts and automatic turn-off of the user ID upon several erroneous passwords attempts; and – Creation of one master record per user, user master data procedures, per data processing environment.
10. Data access control Technical and organizational measures to ensure that persons entitled to use a data processing system gain access only to such Personal Data in accordance with their access rights, and that Personal Data cannot be read, copied, modified or deleted without authorization, include: – Internal policies and procedures; – Control authorization schemes; – Differentiated access rights (profiles, roles, transactions and objects); – Monitoring and logging of accesses; – Disciplinary action against employees who access Personal Data without authorization; – Reports of access; – Access procedure; Privacy and Data Protection Standards for MATCH Pro Annex 2 to Appendix F: Technical and Organizational Measures Ensure the Security of the Data Security Rules and Procedures—Merchant Edition • 11 February 2025 – Change procedure; and – Deletion procedure.
11. Disclosure control Technical and organizational measures to ensure that Personal Data cannot be read, copied, modified or deleted without authorization during electronic transmission, transport or storage on storage media (manual or electronic), and that it can be verified to which companies or other legal entities Personal Data are disclosed, include: – Tunneling; – Logging; and – Transport security.
12. Entry control Technical and organizational measures to monitor whether data have been entered, changed or removed (deleted), and by whom, from data processing systems, include: – Logging and reporting systems; and – Audit trails and documentation.
13. Control of instructions Technical and organizational measures to ensure that Personal Data are processed solely in accordance with the Instructions of the Controller include: – Unambiguous wording of the contract; – Formal commissioning (request form); and – Criteria for selecting the Processor.
14. Availability control Technical and organizational measures to ensure that Personal Data are protected against accidental destruction or loss (physical/logical) include: – Backup procedures; – Mirroring of hard disks (e.g., RAID technology); – Uninterruptible power supply (UPS); – Remote storage; – Anti-virus/firewall systems; and – Disaster recovery plan.
15. Separation control Technical and organizational measures to ensure that Personal Data collected for different purposes can be processed separately include: – Separation of databases; – "Internal client" concept/limitation of use; – Segregation of functions (production/testing); and – Procedures for storage, amendment, deletion, transmission of data for different purposes. Privacy and Data Protection Standards for MATCH Pro Annex 2 to Appendix F: Technical and Organizational Measures Ensure the Security of the Data Security Rules and Procedures—Merchant Edition • 11 February 2025 Notices Following are policies pertaining to proprietary rights, trademarks, translations, and details about the availability of additional information online. Proprietary Rights The information contained in this document is proprietary and confidential to Mastercard International Incorporated, one or more of its affiliated entities (collectively “Mastercard”), or both. This material may not be duplicated, published, or disclosed, in whole or in part, without the prior written permission of Mastercard. Trademarks Trademark notices and symbols used in this document reflect the registration status of Mastercard trademarks in the United States. Consult with the Global Customer Service team or the Mastercard Law Department for the registration status of particular product, program, or service names outside the United States. All third-party product and service names are trademarks or registered trademarks of their respective owners. EMV® is a registered trademark of EMVCo LLC in the United States and other countries. For more information, see http://www.emvco.com. Disclaimer Mastercard makes no representations or warranties of any kind, express or implied, with respect to the contents of this document. Without limitation, Mastercard specifically disclaims all representations and warranties with respect to this document and any intellectual property rights subsisting therein or any part thereof, including but not limited to any and all implied warranties of title, non-infringement, or suitability for any purpose (whether or not Mastercard has been advised, has reason to know, or is otherwise in fact aware of any information) or achievement of any particular result. Translation A translation of any Mastercard manual, bulletin, release, or other Mastercard document into a language other than English is intended solely as a convenience to Mastercard customers. Mastercard provides any translated document to its customers “AS IS” and makes no representations or warranties of any kind with respect to the translated document, including, but not limited to, its accuracy or reliability. In no event shall Mastercard be liable for any damages resulting from reliance on any translated document. The English version of any Mastercard document will take precedence over any translated version in any legal proceeding. Notices Security Rules and Procedures—Merchant Edition • 11 February 2025 Information Available Online Mastercard provides details about the standards used for this document, including times expressed, language use, and contact information, on the Technical Resource Center (TRC). Go to the Rules collection of the References section for centralized information. Notices Security Rules and Procedures—Merchant Edition • 11 February 2025