GROUP CONTRACT AMENDMENT

Exhibit 10.2

CERTAIN PORTIONS OF THESE MATERIALS HAVE BEEN OMITTED BASED ON A REQUEST FOR CONFIDENTIAL TREATMENT SUBMITTED TO THE U.S. SECURITIES AND EXCHANGE COMMISSION (THE “SEC”). THE NON-PUBLIC INFORMATION HAS BEEN OMITTED AND HAS BEEN SEPARATELY FILED WITH THE SEC. EACH REDACTED PORTION OF THE AGREEMENT IS INDICATED BY A “[XXXX]” AND IS SUBJECT TO THE REQUEST FOR CONFIDENTIAL TREATMENT SUBMITTED TO THE SEC. THE REDACTED INFORMATION IS CONFIDENTIAL INFORMATION OF GLOBAL AXCESS CORP.

GROUP CONTRACT
AMENDMENT

THIS GROUP CONTRACT AMENDMENT (this “Amendment”) is made as of the 20^th day of December, 2011, by and among Nationwide Money Services, Inc., a Nevada corporation (“Nationwide”), Food Lion, LLC, a North Carolina limited liability company (“Food Lion”), X.X. Xxxxxx Co., LLC, a Georgia limited liability company (“Xxxxxx”) and Kash N’ Carry Food Stores, Inc., a Delaware corporation (“K&K,” and together with Food Lion and Xxxxxx, each a “Merchant” and together, the “Merchants”). Nationwide, Food Lion, Xxxxxx and K&K are sometimes referred to in this Amendment collectively as, the “Parties,” and individually as, a “Party”).

W I T N E S S E T H:

WHEREAS, Food Lion, LLC and Nationwide are parties to that certain Agreement dated as of October 5, 2001 (as amended by Amendment No. 1 to the Agreement by and between Food Lion and Nationwide, dated as of August 28, 2003, and as it may be further amended, modified or restated, the “Food Lion Agreement”); and

WHEREAS, Xxxxxx and Nationwide are parties to that certain Automated Teller Machine License/Use Agreement dated as of January 20, 2010 (as amended, modified or restated, the “Xxxxxx Agreement”); and

WHEREAS, Nationwide and K&K are parties to that certain Agreement dated October 10, 2001 (as amended by Amendment No. 1 to the Agreement by and between K&K and Nationwide dated August 28, 2003, and as it may be further amended, modified or restated, the “K&K Agreement”); and

WHEREAS, the Parties desire to modify certain provisions of the Food Lion Agreement, the Xxxxxx Agreement and the K&K Agreement (collectively, the “Agreements”), so that such provisions are uniform among the three Agreements;

NOW THEREFORE, in consideration of the mutual covenants and promises contained herein and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

1. Extension. The Parties agree and acknowledge that each of the Agreements shall remain (and have remained) in full force and effect in accordance with their current terms and provisions until December 31, 2011, and as amended, shall continue in force until December 31, 2014, as set forth in Section 2(A) below.

2. Amendment. The Parties agree that, effective as of January 1, 2012, each of the Agreements shall be amended as follows:

Notwithstanding any provision of any of the Agreements to the contrary, each of the Agreements shall, effective as of January 1, 2012 be amended to include the following provisions and to delete any provision of the Agreements that is in conflict therewith. For the avoidance of doubt, the following amendments are, among other things, intended to replace, in their entirety, any provisions requiring Nationwide to make any payments or revenue share with respect to any automated teller machines (“ATM’s”) placed pursuant to the Agreements (including, without limitation, any portion of screen advertising or coupon revenues), payments required to be made to Nationwide in connection with any ATM that is moved at the request of Merchant, the fee paid by Food Lion, Xxxxxx or K&K for a permanent removal of an ATM at such Party’s request and Nationwide’s rights to remove ATM’s due to performance issues.

A. Term. Each Agreement shall continue in full force and effect, unless earlier terminated as permitted in such Agreement, until December 31, 2014.

B. Surcharge. Nationwide shall not charge a surcharge in excess of $[XXX] without the prior written consent of the applicable Merchant. In addition, Nationwide shall not charge any surcharge for transactions which relate to any of the credit unions set forth in Exhibit A attached hereto, or any other credit union with which Delhaize Group (the parent of each of the Merchants) has a contractual relationship of which Nationwide is informed in writing, in each case, so long as such credit union continues to contract with Delhaize (collectively, a “Delhaize Associated Credit Union”).

C. Revenue Share. Nationwide shall pay each Merchant an amount equal to (i) [XXXXX percent (XX%)] of the surcharge revenue received by Nationwide, plus [XXX] ($[XXX]) per Free Transaction (as defined below), in each case, with respect transactions undertaken at ATM’s placed at such Merchant’s location pursuant to an Agreement. For purposes of calculation of the above revenue share, “Free Transaction” shall mean any cash withdrawal from a checking or savings account or any credit card or debit card cash advance, for which Nationwide does not receive any surcharge, other than transactions relating to Delhaize Associated Credit Unions (as defined in Section B above) and electronic benefit transfers (EBTs) for which no surcharge is permitted to be charged by law.

D. New Site Setup Expenses. Merchant will pre-wire electrical and telephone lines, for purposes of placing an ATM in a newly constructed location. Such costs shall be borne by Merchant. Merchant shall provide power and floor space, and prepare the same to enable installation of an ATM, at no cost to Nationwide. Nationwide shall not charge Merchant for any installation of an ATM and shall be responsible for all other costs related to the installation of ATM’s pursuant to the Agreements. Nothing herein is intended to change Merchant’s obligations with respect to the purchase or maintenance of bumpers as set forth in the Agreements.

E. Branding/Advertising. Nationwide shall receive the approval of Merchant before any advertising is placed on, or displayed through, an ATM placed under an Agreement.

F. Telecommunications. Nationwide shall be responsible for providing telecommunication services for ATM’s placed under the Agreement. In cases where it is necessary for Merchant to provide phone service, Nationwide will pay Merchant a one-time fee of $[XXX], due upon the initiation of such phone service, and a $[XXX] fee per month thereafter, payable monthly in arrears payment of the revenue share.

G. ATM Moving Fees. In the event that Merchant requests Nationwide to change the location of an ATM within a store, Merchant shall pay Nationwide the following fees:

(i) $[XXX], if Merchant provides Nationwide at least 21 days’ notice;

(ii) $[XXX], if Merchant provides Nationwide with less than 21 days’ notice;

(iii) $[XXX], if Merchant requests that Nationwide remove an ATM and re-install such ATM at a later date (which date must be within at least ninety days of the date of such removal of the ATM, or Merchant shall be subject to the fees set forth in Section H below).

Any relocation of an ATM requested by Nationwide or to comply with the Americans with Disabilities Act, shall be at Nationwide’s expense.

H. Removal of ATM for In-Store Bank. Merchant shall have the right to request Nationwide to remove an ATM in the event that Merchant is installing a bank branch ATM at such location. In such event, Nationwide will coordinate with Merchant for the removal of such ATM within thirty (30) days of such request. Upon removal of an ATM pursuant to this Section H, Merchant shall pay Nationwide a permanent removal fee equal to $[XXX], plus $[XXX] times the number of months remaining in the Term (as set forth in Section A of this Amendment).

I. ATM Uptime Commitment. Nationwide shall maintain the ATM’s so that they are functional greater than [XXX]% of the time, as calculated for each calendar month.

J. ADA Compliance. All ATM’s placed pursuant to the Agreements shall be compliant with the Americans with Disabilities Act prior to March 15, 2012, or such later date as may be provided for such compliance by law.

K. Security. Nationwide shall maintain compliance with the PCI security standards and all other applicable security rules and regulations imposed by law. Nationwide agrees to promptly notify Merchant of any breach in such security requirements.

L. Removal of ATM’s by Nationwide. If, in any calendar month the average number of transactions per ATM for the ATM’s placed at a Merchant is less than the threshold set forth below, Nationwide may, but shall not be obligated to, remove ATM’s placed at such Merchant’s locations, so that the calculation for such month with respect to the remaining ATM’s would exceed the threshold. For purposes of the foregoing, the threshold shall be an average of [XXX] transactions per ATM per month for Food Lion and K&K, and shall be [XXX] transactions per ATM per month for Xxxxxx.

3. Survival of License Agreement. Except as expressly amended hereby, all terms, conditions and obligations contained in the Agreements shall remain in full force and effect.

4. Counterparts. This Agreement may be executed in two or more counterparts, each of which will be deemed an original, but all of which together will constitute one and the same instrument. Signatures delivered as facsimiles shall be binding to the same extent as original signatures.

IN WITNESS WHEREOF, the Parties have executed this Amendment as of the date first set forth above.

	NATIONWIDE MONEY SERVICES, INC.

	By:	/s/ Lock Ireland
		Lock Ireland Title: CEO

	FOOD LION, LLC

	By:	/s/ Xxxxx Xxxxxxxx
		Name: Xxxxx Xxxxxxxx Title: Assistant Treasurer

	X.X. XXXXXX CO., LLC.

	By:	/s/ [Insert Name]
		Name: Xxxxx Xxxxxxxx Title: Assistant Treasurer

	KASH N’ CARRY FOOD STORES, INC.

	By:	/s/ Xxxxx Xxxxxxxx
		Name: Xxxxx Xxxxxxxx Title: Assistant Treasurer

Exhibit A

Food Lion Credit Association

Exhibit A

To Group Contract Amendment

Service Provider Privacy, Confidentiality and Information Security Addendum

This Service Provider Privacy, Confidentiality and Information Security Addendum (this “Addendum”) sets forth the terms and conditions relating to the privacy, confidentiality and security of Personal Information (as defined below) associated with services rendered pursuant to the Agreements.

1. DEFINITIONS

All capitalized terms used in this Addendum but not defined herein shall have the same meaning ascribed to such terms in the Agreement as supplemented by this Addendum.

1.1. “Access” means access to: (i) Personal Information and/or (ii) Customer information technology (“IT”) resources or systems which use, process or store Personal Information and/or (iii) Customer facilities where Personal Information is used or stored, including, but not limited to, corporate offices, distribution centers, or retail stores.

1.2. “PCI Standard” means the Payment Card Industry Data Security Standard of the PCI Security Standards Council, as may be amended from time to time, which can be found at xxxxx://xxx.xxxxxxxxxxxxxxxxxxxx.xxx/.

1.3. “Personal Information” means any information relating to an identified or identifiable individual, including, but not limited to, name, postal or email address, Social Security number, driver’s license number, date of birth, demographic information, health or medical information, checking and credit card account data, personal identification number, next of kin contact information, in whatever format, including that contained in communications, documents, databases, records, or materials of any kind whether in individual or aggregate form, and regardless of the media in which it is contained, that may be (i) disclosed at any time to Service Provider or Service Provider Personnel by Customer or Customer Personnel in anticipation of, in connection with or incidental to the performance of services of or on behalf of Customer; (ii) Processed (as defined below) at any time by Service Provider or Service Provider Personnel in connection with or incidental to the performance of this Addendum or the Agreement; or (iii) derived by Service Provider or Service Provider Personnel from the information described in (i) or (ii) above. Personal Information includes cardholder data from Customer’s customers, including but not limited to, transaction authorization information, credit card numbers, service codes and expiration dates, and Track 1 and Track 2 data contained on the magnetic stripe of standard credit and debit cards and other information within the scope of the PCI Standard (collectively, “Cardholder Data”).

1.4. “Process”, “Processed” or “Processing” means any operation or set of operations performed upon Personal Information, whether or not by automatic means, such as creating, collecting, procuring, obtaining, accessing, recording, organizing, storing, adapting, altering, retrieving, consulting, using, disclosing, transmitting or destroying the data.

2. PROTECTION OF PERSONAL INFORMATION

2.1. OBLIGATION TO PROTECT.

2.1.1. Service Provider’s obligations regarding Personal Information shall extend to employees, officers, directors, agents, advisors, contractors, any subcontractors or other party or person acting on behalf of or at the direction of Service Provider (collectively, “Service Provider Personnel”) with Access pursuant to the Agreement or the performance of Services thereunder. Service Provider shall limit Access to Service Provider Personnel who have a need to know the Personal Information as a condition to Service Provider’s performance of Services for or on behalf of Customer and who have agreed in writing to comply with legally-enforceable privacy, confidentiality and security obligations that are substantially similar to those required by this Addendum (including in the case of contractors and subcontractors, an acknowledgement of their responsibility for the security of any Cardholder Data where such contractors or subcontractors Process Cardholder Data or manage any systems (or components of such systems) that store, process or transmit Cardholder Data). Service Provider shall ensure that all Service Provider Personnel comply with the provisions of this Addendum regarding the handling and treatment of Personal Information.

2.1.2. Service Provider shall not contract any of its rights or obligations concerning Personal Information without the prior written consent of Customer. Where Service Provider, with the consent of Customer, contracts such rights or obligations, Service Provider shall enter into a written agreement with each contractor that imposes obligations on the contractor that are substantially similar to those imposed on Service Provider under this Addendum. Service Provider shall only retain contractors that Service Provider reasonably can expect to be suitable and capable of performing the delegated obligations in accordance with this Addendum, the Agreement and Customer’s instructions.

2.1.3. Service Provider agrees to hold, maintain, and manage (i) the existence and terms of this Addendum, and any related agreement, and (ii) any and all Personal Information in strictest confidence and use due care to prevent any unauthorized or inappropriate disclosure. Service Provider will not, and will not allow any third party under its control (including Service Provider Personnel) to transmit or disclose any of the Personal Information to any third party, except as required in the provision of the Services, required by law or governmental order, or otherwise with Customer’s express written consent.

2.1.4. Service Provider shall notify Customer promptly in writing of any subpoena or other judicial or administrative order by a government authority or proceeding seeking access to or disclosure of Personal Information. Customer shall have the right to defend such action in lieu of and on behalf of Service Provider. Customer may, if it so chooses, seek a protective order. Service Provider shall reasonably cooperate with Customer in such efforts.

2.1.5. Service Provider covenants and agrees to adhere to all applicable requirements to be considered compliant with the PCI Standard and shall perform the necessary steps to validate its compliance with the PCI Standard. Service Provider shall provide to Customer a copy of its most recent validation of PCI Standard compliance and all supporting documentation (including any exceptions noted therein) promptly following the Amendment Effective Date, and on an annual basis thereafter (or at such other time to coincide with Customer’s own PCI Standard certification). Service Provider will promptly notify Customer if it learns that it is no longer compliant with the PCI Standard, or reasonably anticipates that it is or will be non-compliant, and will promptly inform Customer of the steps being taken to remediate such non-compliance. Service Provider acknowledges that it is responsible for the security of any Cardholder Data in its possession.

2.2. SERVICE PROVIDER WRITTEN SECURITY POLICY.

2.2.1. Service Provider hereby warrants, represents and covenants that, as of the Amendment Effective Date, it has and will at all times during the term of the Agreement, maintain a comprehensive written information security program that complies with applicable Privacy Laws (as defined below). Service Provider’s information security program shall include appropriate administrative, technical, physical, organizational and operational safeguards and other security measures designed to (a) establish minimum standards to be met in connection with the safeguarding of Personal Information contained in both paper and electronic records; (b) protect the security and confidentiality of Personal Information in a manner consistent with applicable industry standards; (c) protect against anticipated threats or hazards to the security or integrity of Personal Information; and (d) protect against any actual or suspected unauthorized Processing, loss, use, disclosure or acquisition of or Access to any Personal Information (hereinafter “Information Security Incident”).

2.2.2. Service Provider shall immediately inform Customer in writing of any Information Security Incident of which Service Provider becomes aware. Such notice shall summarize in reasonable detail the effect on Customer, if known, of the Information Security Incident and the corrective action taken or to be taken by Service Provider. Service Provider shall promptly take all necessary and advisable corrective actions, and shall cooperate fully with Customer in all reasonable and lawful efforts to prevent, mitigate or rectify such Information Security Incident. The content of any filings, communications, notices, press releases or reports related to any Information Security Incident must be approved by Customer prior to any publication or communication thereof.

2.2.3. Service Provider shall provide appropriate training to and exercise the necessary and appropriate supervision over its relevant Service Provider Personnel to maintain appropriate privacy, confidentiality and security of Personal Information.

2.3. RETURN OR SECURE DESTRUCTION OF PERSONAL INFORMATION. Promptly upon the expiration or termination of the Agreement or as otherwise requested by Customer, Service Provider shall, at Customer’s written request, either (i) destroy or render unreadable or undecipherable, or (ii) return to Customer, each and every original and copy in every media of all Personal Information in Service Provider’s possession, custody or control by secure means.

2.4. COMPLIANCE.

2.4.1. Service Provider agrees to comply with: (i) all applicable federal, state, and local laws, rules, regulations and governmental requirements, as the same may be amended or supplemented from time to time, pertaining in any way to the privacy, confidentiality, security, management, disclosure, reporting, and any other obligations attaching or arising from the possession or use of Personal Information, including without limitation, the Xxxxx-Xxxxx-Xxxxxx Act (“GLBA”), 15 U.S.C. § § 6801-6827, and all regulations implementing GLBA; the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681 et seq., as amended by the Fair and Accurate Credit Transactions Act (“FACTA”), and all regulations implementing the FCRA and FACTA; the Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM); security breach notification laws; laws imposing minimum security requirements (such as 201 Mass. Code Reg. 17.00); laws requiring the secure disposal of records containing certain Personal Information (such as N.Y. Gen. Bus. Law § 399-H)] (collectively, the “Privacy Laws”); (ii) all applicable industry standards concerning privacy, data protection, confidentiality or information security, including, without limitation, the PCI Standard; and (iii) all applicable provisions of Customer written policies currently in effect and as they become effective relating in any way to the privacy, confidentiality and security of Personal Information or applicable privacy policies, statements or notices that are provided to Service Provider in writing.

2.4.2. Service Provider warrants that no applicable law, or legal requirement, or privacy or information security enforcement action, investigation, litigation or claim prohibits Service Provider from fulfilling its obligations under this Addendum. In the event a law, or legal requirement, or privacy or information security enforcement action, investigation, litigation or claim, or any other circumstance, is reasonably likely to adversely affect Service Provider’s ability to fulfill its obligations under this Addendum, Service Provider shall promptly notify Customer in writing and Customer may, in its sole discretion and without penalty of any kind to Customer, suspend the transfer or disclosure of Personal Information to Service Provider or access to Personal Information by Service Provider, terminate any further Processing of Personal Information by Service Provider, and terminate the Agreement, if doing so is necessary to comply with applicable Privacy Laws.

2.4.3. Service Provider shall enter into any further privacy or information security agreement reasonably requested by Customer for the purpose of compliance with applicable Privacy Laws. In case of any conflict between this Addendum and any such further data privacy or information security agreement, such further agreement shall prevail with regard to the Processing of Personal Information covered by it.

2.5. INJUNCTIVE RELIEF. Service Provider agrees that any Processing of Personal Information in violation of Section 2 of this Addendum, Customer’s instructions or any applicable Privacy Law, or any Information Security Incident, may cause immediate and irreparable harm to Customer for which money damages may not constitute an adequate remedy. Therefore, Service Provider agrees that Customer may seek to obtain specific performance and injunctive or other equitable relief for any such violation or incident, in addition to its remedies at law, without proof of actual damages. Service Provider agrees to waive any requirement for the securing or posting of any bond in connection with such remedy.

3. WARRANTY AND INDEMNIFICATION

Service Provider warrants and represents that it is capable of maintaining safeguards for Personal Information as otherwise provided in this Addendum. Notwithstanding anything to the contrary in the Agreement, Service Provider shall indemnify, defend and hold harmless Customer, their officers, directors, shareholders, and employees from any and all third-party claims, losses, demands, liabilities, suits, enforcement actions, damages, penalties, fines, expenses and costs (including attorneys’ fees, consultants’ fees and court costs) arising from or related to (i) the failure of Service Provider to comply with Privacy Laws; (ii) any violation of Section 2 of this Addendum; (iii) the loss, misappropriation or other unauthorized disclosure of Personal Information by Service Provider or Service Provider Personnel; (iv) the negligence, gross negligence, bad faith, or intentional or willful misconduct of Service Provider or Service Provider Personnel in connection with obligations set forth in this Addendum; (v) Service Provider’s use of any contractor providing services in connection with or relating to Service Provider’s performance under this Addendum; and (vi) any Information Security Incident involving Personal Information in Service Provider’s possession, custody or control, or for which Service Provider is otherwise responsible.

4. ACCESS TO CUSTOMER IT RESOURCES OR SYSTEMS

4.1. RESTRICTIONS. Except as specifically contemplated in provision of the Services, Service Provider agrees that it will not and will not allow any Service Provider Personnel or other third party acting at its direction to (i) transfer or use Personal Information (or access Personal Information from) outside of the United States; (ii) attempt unauthorized access to such Personal Information; (iii) input, delete or otherwise modify any Personal Information or make any changes to the Customer’s IT resources or systems; or (iv) access, or attempt to access, any third-party networks or systems from the Customer’s IT resources or systems except as necessary for performance of the Services.

4.2. UNAUTHORIZED STORAGE. Unless expressly authorized in writing by Customer, Service Provider shall not allow any Personal Information to be stored on or Accessed by laptops, USB drives, blackberry devices, or any other portable storage media belonging to Service Provider or Service Provider’s Personnel, except as required for the performance of the Services and only for such duration of time necessary to complete the performance of the applicable Services.

4.3. CREDENTIALS. If Service Provider or Service Provider’s Personnel is provided (i) a login ID, password or other authentication credential such as a digital certificate, token, smartcard, or biometrics device; or (ii) Customer facility identification cards or other physical security access permission (collectively, “Credentials”), Service Provider shall treat Credentials with the utmost care and confidentiality to prevent unauthorized disclosure or misuse. Service Provider acknowledges that any Credentials issued to it are Customer’s Confidential Information subject to the protections provided in the Agreement, and Service Provider and Service Provider Personnel will not share, disclose or use the Credentials in any unauthorized manner. Service Provider agrees that it is responsible for the actions of any individuals using the Credentials issued to it. Upon the termination of the Services or the underlying Agreement, Service Provider will promptly return any Credentials to Customer upon request or when network or physical access is no longer required. Service Provider shall promptly notify Customer if any Service Provider Personnel is terminated or reassigned from Customer’s account, or is otherwise no longer performing Services under the Agreement, so that Customer may deactivate such Service Provider Personnel’s Credentials.

4.4. SECURITY DESIGN INFORMATION. For the avoidance of doubt, any information related to the design or security topology of Customer’s IT resources and systems acquired by Service Provider or that may be gained by virtue of Service Provider’s Access shall constitute Confidential Information of Customer, and Service Provider shall not share, disclose or use such design or security information in any unauthorized manner.

4.5. REMOTE ACCESS. If the Services involve remote Access to a Customer IT resource or system, the parties shall agree upon an encryption mechanism for use in exchanging any Personal Information and any other information in accordance with this Addendum. Upon being provided the same, Service Provider shall use the approved encryption mechanism for all such communications. In addition, Service Provider shall take all reasonable precautions to prevent transmission of a computer virus, malware, or other malicious code to a Customer IT resource or system or any Customer customer or employee where the Services contemplate its access to a Service Provider IT resource or system. Service Provider shall maintain current industry standard anti-virus and anti-malware tools on its IT resources and systems that will interface with a Customer IT resource or system and shall ensure that all its IT resources and systems are maintained with up-to-date security patches, hotfixes, and other similar software or firmware changes. Prior to transmission of information to Customer, Service Provider will use anti-virus software to check for and eradicate viruses. Furthermore, Service Provider shall prohibit Service Provider Personnel from using their personal IT assets or resources to gain access to any Customer IT resource or system except as otherwise provided in the Agreement. If any Services performed by Service Provider Personnel are performed using non-Customer-owned and controlled IT assets and resources, such assets and resources shall comply with this Addendum. Service Provider will notify Customer promptly if a virus, malware, or other malicious code is detected in a file sent to or received from Customer.

4.6. BACKGROUND INVESTIGATIONS. Service Provider acknowledges and agrees that it is responsible for the conduct of reference checks, criminal background checks and such other screening measures as a reasonably prudent employer would deem appropriate, of Service Provider Personnel prior to such individual’s performance of any Services which involve Access. Vendor shall not assign any Vendor Personnel to Customer’s account or otherwise allow any Vendor Personnel to have Access if such Personnel have been found to have engaged in criminal acts that involve fraud, dishonesty, or breach of trust, or that constitute a felony under applicable law. Vendor has the ongoing duty to inform Customer promptly upon learning that any Vendor Personnel have been convicted of a felony, and to remove any such individual promptly from Customer’s account. Notwithstanding the foregoing, Customer, in its sole discretion, has the option of barring any person from any Customer facilities.

5. AUDIT AND MONITORING RIGHTS

5.1. CUSTOMER SYSTEMS. Service Provider’s Personnel, while using the IT resources or systems of Customer, may be subject to monitoring and their activity recorded. Service Provider, for itself and Service Provider Personnel, expressly consents to such monitoring and recording. No advanced notice or warning shall be required to monitor Service Provider Personnel’s use of a Customer IT resource or system.

5.2. AUDIT RIGHTS. In addition to any other audit rights provided in the Agreement, upon reasonable advance notice, Customer shall have the right to audit Service Provider’s information to the extent required to assess compliance with the terms of this Addendum. During normal business hours, with reasonable notice, Customer or its authorized representatives may reasonably inspect Service Provider’s facilities and equipment, and any information or materials in Service Provider’s possession, custody or control, relating to Service Provider’s obligations under Section 2 of this Addendum. Such audit may be conducted by reputable third party auditors hired on behalf of Customer and reasonably acceptable to Service Provider, and shall be conducted so as to minimize any disruption to the Service Provider’s operations. Service Provider shall provide reasonable cooperation with such auditors and will provide reasonable access to facilities necessary to audit and test compliance. Service Provider shall deal promptly and appropriately with any inquiries from Customer relating to the Processing of Personal Information subject to this Addendum.

5.3. REPORTS. At Customer’s reasonable request (depending upon the type of Access pursuant to the Agreement or the performance of Services thereunder), Service Provider will provide, or cause to be prepared and provided, (i) a description prepared by management of Service Provider of Service Provider’s systems relating to the Services, including the control objectives and related controls applicable to such systems, and/or (ii) an executed copy of one or more opinions or attestations (as applicable) from independent auditors of national reputation engaged and compensated by Service Provider, of Type II examinations in accordance with SAS No. 70 (or a comparable or successor standard, such as Statement on Standards for Attestation Engagements (SSAE) No. 16 or International Standard on Assurance Engagements (ISAE) No. 3402), containing no material exceptions and identifying no material weakness or significant deficiency (each, a “Report”). Any such Reports shall be provided at no expense to Customer and completed as of a date to which the parties agree.

6. OWNERSHIP

As between the parties, the Personal Information and Credentials, together with any intellectual property rights therein, including, but not limited to, copyrights, shall be the sole property of Customer, and Service Provider shall not have or obtain any rights therein.

7. CONFLICT

In the event of a conflict between the terms of this Addendum and the terms of the Agreement, the terms of this Addendum shall govern and control such conflict.

8. NOTICE

With respect to notice pursuant to paragraph 2.2.2. hereof, notice shall be made telephonically to Customer’s Chief Information Security Officer at (000) 000-0000 and to Customer’s IT Support at (000) 000-0000, followed promptly by written notice in the form and manner set forth in the Agreement.

Document Metadata

Table of Contents

GROUP CONTRACT AMENDMENT

Document Metadata