MASTER AGREEMENT
Exhibit 10.25
*** Certain confidential portions (indicated by brackets and asterisks) have been omitted from this exhibit because such information is both (i) non-material and (ii) the type the Registrant treats as private or confidential.
This Master Agreement (together with all exhibits and attachments hereto, the “Agreement”) is made and entered into as of the 18th day of April , 2019 (the “Effective Date”) by and between IDM Global, Inc., a Delaware corporation (“IDM”), and 55 Global, Inc., a Delaware corporation (“Client”). Each of IDM and Client is sometimes referred to herein as a “Party”, and collectively, as “Parties”. The Parties, intending to be legally bound, agree as follows:
1. SERVICE AND SUPPORT
1.1 IDM Solution. IDM provides certain services as described in this Section 1.1 (“IDM Services”) and services through various third parties (“Additional Services”). Collectively, IDM Services and Additional Services shall be referred to as “Services”. Client shall select those elements of the Services that Client desires to utilize through IDM’s Platform User Interface (“IPUI”).
A. Antifraud Reputation Service. IDM’s real time fraud screening service assists Client in employing transaction security with respect to internet commerce transactions (“Transaction”) from Client’s customers (“Customers”) who are utilizing any of ACH, credit, charge and debit cards (“Cards”), together with Bitcoin, Ethereum and other cryptocurrencies, PayPal, Google Checkout and other commercially available offerings, as methods of payment (collectively, “Payment Methods”) by matching the Payment Method along with the current transaction information such as full name, address, phone number, email address, ID information, transaction amount and Bitcoin address (“Transaction Data”) with previous Customer patterns for the purpose of evaluating the likelihood of a Customer being authorized to use the Payment Method (“Antifraud Reputation Service”). The Antifraud Reputation Service includes the following features:
| ● | Real time comparison and analysis of aspects of the attempted Transaction, prior or post Client sending the Transaction to Client’s payment gateway, with IDM’s extensive secure database containing Transaction Data and the provision by IDM to Client of an electronic report relating to the attempted transaction of “Accept”, “Reject” or “Manual Review” (“Response”). |
| ● | Customization of rules and algorithms for fraud evaluation based on the Client’s unique business profile. |
| ● | Client access to fraud evaluation tools and reports for systematic evaluation of transactions related to potential fraud. |
| ● | Customized reports on fraud analysis data. |
IDM reserves the right to make changes in the Antifraud Reputation Service from time to time provided, however, no changes will reduce the features or functionality in any material respects. In addition, IDM will provide no less than fifteen (15) days prior written notice for changes that could impact negatively Client’s operation, except for urgent maintenance and support changes that are critical patches or required to improve the availability or robustness of the Services.
B. Consumer Account Origination Service (Know Your Customer). This real time service evaluates various elements of Customer’s “Transaction Data” provided as part of a Transaction for the purpose of answering three fundamental questions:
| ● | Is the information presented likely to represent a true person (e.g. matching data to a public database)? |
| ● | How likely is it that the information presented is owned by the person that is providing it (e.g. verifying documents, or out of band authentication)? |
| ● | Is the information associated with individuals that may need special treatment based on their public affiliations (e.g. sanction screening) (“Consumer Account Origination Service”)? |
The Customer Account Origination Service includes the following features:
- Sanction screening. This compares the information presented in the context of KYC, payments, merchant risk, and anti-money laundering, to establish whether that Customer should be subject to further scrutiny. The lists to compare can come from governmental institutions (e.g. Office of Foreign Asset Control -- OFAC), international bodies (e.g. United Nations), or by the potential risk associated with a person given their political status and visibility (e.g. Politically Exposed Persons -- PEP)
- Out of Band Verification. This service aims to establish communication with the Customer outside the flow of the main activity for the purposes of further validating the identity of the Customer. For example, SMS 2 factor authentication: if the Customer is in a payment flow, the Customer may receive a text message on his/her phone with an additional code to be input as part of the payment process.
- Document Verification. This service aims to validate that a government issued document is authentic and it has not been tampered with. The current form of this service analyzes a picture of the document based on the known descriptors of such type of documents. The descriptors are defined by each country and are specific to the type of document being validated.
- Out of Wallet Questions. This service poses a set of questions crafted to assess the likelihood that a Customer owns the information that is presented as part of an identity validation process (e.g. a KYC process). The questions are crafted based on public databases with the intention that should only be answered by the owner of the information. The questions are selected based on collected public information associated to the individual’s data presented at the time of the identification process. For example if the data presented at evaluation supposedly belongs to Xxxx Xxxxx, and a particular Xxxx Xxxxx, then the database has associated data that describes John’s past, and a set of questions are crafted based on the historic information. The likelihood of these questions being answered by the true Xxxx Xxxxx and only Xxxx Xxxxx is very high, and therefore the success of the answers dictate the likelihood of dealing with the true Xxxx Xxxxx.
IDM reserves the right to make changes in the Consumer Account Origination Service from time to time provided, however, no changes will reduce the features or functionality in any material respects. In addition, IDM will provide no less than fifteen (15) days prior written notice for changes that could impact negatively Client’s operation, except for urgent maintenance and support changes that are critical patches or required to improve the availability or robustness of the Services.
2
C. Anti-Money Laundering (AML) Monitoring Service. IDM’s real time service assists Client with complying with the anti-money laundering regulations that require Client to monitor transactions, keep a record of the transaction and identify suspicious transactions that potentially identify money laundering activities (“Anti- Money Laundering (AML) Monitoring Service”). The service evaluates transactions and aggregations of transactions and via a policy and other algorithms alerts Client of potential suspicious activities. These alerts may be further evaluated by Client’s analyst to decide whether a Suspicious Activity Report (SAR) needs to be filed with the appropriate government institution (varies by country). The service also keeps a record of the transactions to assist with Client’s compliance with the “keep record” aspect of the applicable regulations. The Anti Money Laundering (AML) Monitoring Service shall include the following features:
- Automated SAR filing. The service is able to prepopulate the SAR form as specified by the Financial Crimes Enforcement Network (FinCEN), the government regulating body in the United States of America, to assist Client in Client’s filing requirements.
IDM reserves the right to make changes in the Anti-Money Laundering (AML) Monitoring Service from time to time provided, however, no changes will reduce the features or functionality in any material respects. In addition, IDM will provide no less than fifteen (15) days prior written notice for changes that could impact negatively Client’s operation, except for urgent maintenance and support changes that are critical patches or required to improve the availability or robustness of the Services.
D. Merchant Risk Service. IDM’s risk management service, which allows payment processors to assess the risk of a merchant application based on the information presented at sign-up. IDM can verify based on the Antifraud Reputation Pool (as hereinafter defined) that the information presented is consistent with public records, that there has not been a recorded fraudulent history, and other risk indicators. In addition, IDM provides real• time alerts when there is risk exhibited by one or more merchants of a merchant portfolio by monitoring and applying data analysis to their transactions (“Merchant Risk Service”).
IDM reserves the right to make changes in the Merchant Risk Service from time to time provided, however, no changes will reduce the features or functionality in any material respects. In addition, IDM will provide no less than fifteen (15) days prior written notice for changes that could impact negatively Client’s operation, except for urgent maintenance and support changes that are critical patches or required to improve the availability or robustness of the Services.
E. KYC Plugin. The KYC Plugin is a software that can be embedded into a web application that guides Client’s through the data acquisition process of KYC Transaction Data. It evaluates the data collected, presenting the results based on the set of rules specified in the IDM system.
1.2 Additional Services. IDM offers certain Additional Services which are complimentary to the IDM Service as identified in the IPUI. Certain of the Additional Services include additional terms and conditions of service (“Third Party Terms”) which supplement this Agreement and are set forth in the IPUI and are incorporated herein by reference. In the event of a conflict between the terms of this Agreement and the Third Party Terms, the Third Party Terms shall control with respect to the Additional Services.
1.3 Client Support. IDM will provide Client access to IDM’s professionals for Client support to resolve maintenance and support issues relating to Client’s use of the Service. Telephone support to IDM’s help desk is available Monday through Friday from 9:00 am Pacific Time to 5:00 pm Pacific Time (“Business Hours”). One hour email response is available for critical issues during Business Hours and next business day email response is available for non-critical maintenance and support issues and critical issues raised outside of Business Hours by contacting IDM’s help desk at [***]. IDM shall use its reasonable commercial efforts to expeditiously resolve maintenance and support issues relating to Client’s use of the Services.
3
1.4 Updates and Additional Features. Included with the IDM Services are any corrections, modifications and enhancements (“Updates”). IDM may incorporate the Updates to the IDM Services at any time and from time to time without prior notification of Client. Additional features to the IDM Services may be added by IDM from time to time (“Additional Features”). Client shall have the option of accepting such Additional Features if such Additional Features involve additional fees and/or entering into a new agreement.
1.5 Service Level Agreement. IDM’s service level agreement for the IDM Services and those service level agreements for the Additional Services are set forth in the IPUI and are incorporated herein. Claims under the Additional Services service level agreements shall relate solely to the applicable Additional Service.
1.6 Client Data Retention. IDM offers the option to retain data associated with Client’s access of information sent by Client to IDM and actions performed by Client on such data within IDM’s systems (collectively “Client Data”). Client may decide not to store the Client Data in the system. Clients can also request a CSV export of all Client Data for the previous year.
2. OBLIGATIONS OF CLIENT
2.1 Implementation and Integration.
A. Within thirty (30) days of entering into this Agreement, Client shall modify its application programming interface to provide Transaction Data as described in IDM’s Application Programing Interface (“API”) as updated from time to time. Additionally, within thirty (30) days of entering into this Agreement, Client shall certify to IDM that Client has integrated with IDM’s API correctly and is providing transaction feedback. Prior to IDM providing production credentials to Client, IDM shall verify Client’s certification by having IDM’s implementation team (1) do an API integration validation on API request and response (additional details will be provided after issuing the API keys) and (2) validate that transaction monitoring feedback is occurring.
B. Client shall modify its software that it runs on its Customer’s browsers to perform device fingerprinting. Device fingerprinting technology may place a cookie or a flash shared object (FSO) in the Customer’s browser or device.
2.2 Security.
A. Client must implement a one-way cryptographic hash function and data mask as directed by IDM on the Payment Method prior to Client sending the information to IDM. Client acknowledges that as a result IDM will never obtain from Client the actual details within the Payment Method and will not be able to reconstruct the actual payment details.
B. Client must utilize SSL/TLS encryption as directed by IDM in order to send the Transaction Data to IDM.
C. In the event Client uses the KYC Plugin, all information from the plugin to the IDM system already conforms to the items referenced above.
2.3 Customer Notification. If required by applicable law or Client’s privacy or data use policies, Client shall be responsible to inform Customers that the Transaction Data is being provided to IDM in order for IDM to provide the Services on behalf of Client and for IDM to use the Transaction Data as otherwise provided for in the Agreement.
4
2.4 Transaction Data. IDM pools and maintains certain hashed elements of the Transaction Data along with other data attributes provided by other clients (“IDM Identity Integrity Pool”) in order to match transaction information for the purpose of determining fraud, reputation, and identity as it relates to Transactions. Client acknowledges that once such Transaction Data is part of the IDM Identity Integrity Pool it is neither identifiable as coming from Client nor separately removable. In providing the Service, IDM warrants that no data is provided to any of its clients that allow that client to profile another client’s customer’s purchasing behaviors or to obtain any personal information of another client’s customers. All data is solely used for purposes of determining fraud, reputation, and identity as it relates to Transactions. Client grants IDM a perpetual, non-terminable, royalty free license to utilize the Transaction Data as part of the IDM Identity Integrity Pool. All data is solely used for purposes of determining fraud, reputation, and identity as it relates to Transactions. IDM may provide, directly or indirectly, to Customer (including to third party notification services with whom Customer has subscribed) those aspects of the Customer’s Transaction Data which indicate the likelihood of a fraudulent Transaction.
2.5 Use of Service. Client will not intentionally authorize, enable or engage in any unauthorized implementation of the Services, including the use, display, syndication, sublicensing or delivery of the Services to any third party unless approved in writing by IDM. The Service does not constitute a “consumer report” for purposes of the Fair Credit Reporting Act (FCRA). Client may not use the Service in whole or in part as a factor in determining consumer eligibility for credit, insurance, employment, tenancy, or any another FCRA purpose.
2.6 Marketing. Client shall reasonably cooperate with IDM to promote the IDM Services, in a manner mutually agreed by Client and IDM, including, at no cost to Client, participating in marketing campaigns to promote the IDM Services such as issuing blog articles, participating in e-mail campaigns, issuing press releases, placing IDM’s AML compliance logo in Client’s website, etc.
[ X ] 2.7. European Union General Data Protection Regulations. If the box next to this Section is checked Client acknowledges that it will be sending IDM Customer Information of Customers located in the European Union and therefore that the European Union’s General Data Protection Regulations apply to that information. Therefore, the terms of IDM’s Data Protection Agreement accessed by clicking this hyperlink, are incorporated into this Agreement.
3. SERVICE FEES
3.1 Fees. Client shall pay to IDM the fees (the “Fees”) for the Service set forth on the Fee Statement, attached hereto as Exhibit A and incorporated herein (“Fee Statement”). The Fees are subject to increase in the event that Client elects to obtain Additional Features in accordance with Section 1.4 hereof. IDM may modify the Fees, from time to time, upon written notice to Client to reflect any changes in the prices charged by the Additional Services providers for the Additional Services. The Fee Statement also specifies the timing of when the Fees are due and payable.
3.2 Payment. Invoices for the Fees shall be due and payable upon Client’s receipt of the invoice. All payments of invoiced amounts must be paid in full in United States dollars, to IDM at 000 Xxxx Xxxxxx, Xxxx Xxxx, XX 00000 or at such other address as IDM notifies Client in writing. All payments shall be made in the manner specified on Exhibit B, attached hereto and incorporated herein. Client shall supply IDM all required information required to process payments in accordance with the selected payment methodology. In case any such payment is not paid in full when due, in addition to any other remedy otherwise available to IDM, IDM may impose interest on overdue Fees and other charges at the rate of 2.5% per month (or, if less, the maximum amount permitted by law), or both, until Client is current on all payments. If payment is not received 15 days post invoice, IDM reserves the right to terminate access to the Service(s), at its sole discretion, until payment is satisfied.
5
3.3 Taxes. Client shall be responsible for all taxes or levies of whatever nature arising out of or in connection with this Agreement, in particular including without limitation any sales or use taxes in effect, but excluding taxes based on IDM’s net income
4. DATA SECURITY
4.1 IDM follows reasonable industry practices for network and application security. IDM receives no payment card information, but instead receives a one-way salted cryptographic hash of the account number. All Transaction Data is sent securely using HTTPS using the IDM API. All data is stored in a secure, monitored hosting center under PCI Level 1 standards. Access to Transaction Data is restricted to authorized parties and IDM personnel.
4.2 IDM shall at all times maintain a program to ensure the security and confidentiality of Transaction Data and Client’s Customer information. This program shall protect against any anticipated threats or hazards to the security or integrity of this information, protect against any unauthorized access to or use of the information and be in compliance with all applicable state and federal laws. IDM shall promptly notify Client regarding any security breach that compromises Transaction Data or Client’s Customer Information and work diligently to mitigate the impact of such a breach.
5. LIMITED WARRANTY, LIMITED REMEDY, AND LIMITED LIABILITY
5.1 Service Defects. Client shall report to IDM any failure of the Services to conform substantially to its specifications (“Defects”). IDM agrees to employ commercially reasonable efforts to remedy Defects.
5.2 Warranty. Each party hereby represents and warrants to the other that (i) such party has the right, power and authority to enter into this Agreement and to fully perform all its obligations hereunder; and (ii) the making of this Agreement does not violate any agreement existing between such party and any third party.
5.3 Disclaimer. THE SERVICES ARE PROVIDED “AS IS.” IDM DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE AND MAKES NO WARRANTY REGARDING RESULTS THAT MAY BE OBTAINED OR THAT THE SERVICES WILL MEET ALL OF CLIENT’S REQUIREMENTS. IDM MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY RELATING TO THE SERVICE. IDM SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT, AND ALL WARRANTIES ARISING BY STATUTUE OR OTHERWISE IN LAW OR FROM A COURSE OF DEALING OR USE OF TRADE, AS TO ANY MATTER. THE PARTIES EXPRESSLY ACKNOWLEDGE THAT THIS DISCLAIMER OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS AGREEMENT.
5.4 Sole Remedy. If IDM fails to correct Defects or breaches this Agreement, then Client’s sole and exclusive remedy shall be termination of this Agreement. The remedies expressly granted herein constitute the sole remedy against IDM for any claims concerning the Service or this Agreement.
5.5 Limited Liability. IDM’S TOTAL CUMULATIVE LIABILITY TO CLIENT UNDER THIS AGREEMENT OR ARISING FROM THE SERVICES SHALL BE LIMITED TO AN AMOUNT EQUAL TO ALL FEES PAID BY CLIENT TO IDM DURING THE PRIOR NINE (9) MONTHS. CLIENT RELEASES IDM FROM ALL OBLIGATIONS, LIABILITY, CLAIMS OR DEMANDS IN EXCESS OF THE LIMITATION. IDM SHALL NOT BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL, INDIRECT, ECONOMIC OR PUNITIVE DAMAGES, OR LOSS OF PROFIT EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
6
5.6 Indemnification.
A. Client shall indemnify and hold IDM harmless from any claims (i) arising out of Client’s use of the Service or (ii) brought by Customers or third parties arising out of the Service or Client’s failure to obtain Customer consent to the collection of the Transaction Data, the transmission of the Transaction Data to IDM, the use of the Transaction Data to provide the Service and the decision to proceed or not proceed with a transaction based on the Service, except for those claims that are a result of IDM’s willful misconduct or gross negligence.
B. IDM shall indemnify and hold Client harmless from any claims (i) that the IDM Service infringes on the intellectual property rights of any third party or (ii) breaches of the data security provisions of Section 4 hereto which result in the unauthorized dissemination of Customer data.
6. TERM AND TERMINATION
6.1 Term. The initial term of this Agreement shall commence on the Effective Date and continue for an initial term of three (3) years. Thereafter, this Agreement shall automatically renew for successive one year renewal terms unless either party provides thirty (30) days written notice of termination prior to the end of such initial three years term or any renewal term. The initial term and any renewal term(s) are referred to in this Agreement as the “Term.”
6.2 Termination for Cause. Either party may terminate this Agreement if any of the following events occur: (i) the other party materially breaches this Agreement (after receiving written notice of such breach and 30 days opportunity to cure); (ii) this Agreement is in violation of applicable law; or (iii) the other party becomes insolvent, enters into bankruptcy or other similar proceedings, or attempts to make an assignment for the benefit of creditors. In the event of a termination under Section 6.2(i), subject to the other terms and conditions of this Agreement, either party shall be eligible to seek those remedies available to it in accordance with applicable laws.
6.3 Post Termination Retention of Client Data. In the event that IDM terminates this Agreement for Cause, IDM shall have no obligation to retain the Client Data or provide access to the Client Data to Client. Upon a termination of this Agreement for other than if IDM terminates for Cause, at the option of Client, IDM shall either provide a CSV export of all of the Client Data or IDM shall continue to retain such Client Data so long as Client pays the Post Termination Client Data Storage Fee as set forth on the Fee Statement. If Client fails to pay any year’s Post Termination Client Data Storage Fee within 90 days following its due date, IDM shall delete the applicable Client Data.
6.4 Survival. The provisions regarding data ownership and licensing, disclaimer of warranties, limitations of liability, indemnification, termination, and any existing payment obligations shall survive the expiration or termination of this Agreement for any reason. All other rights and obligations of the parties shall cease upon termination of this Agreement.
7. NONINTERFERENCE
During and after the Term, neither Party shall not take any action to harm the other Party’s business relationship with any persons, partners, or company.
8. GOVERNING LAW; DISPUTES
8.1 Governing Law. This Agreement shall be governed by the laws of the state of California, without reference to any conflict-of-laws provisions. In no event shall this Agreement be governed by the United Nations Convention on Contracts for the International Sale of Goods. All proceedings arising under this Agreement shall be held in Palo Alto, California.
7
8.2 Legal Fees and Expenses. In the event of any litigation arising under this Agreement, the substantially prevailing party in such litigation shall be reimbursed by the other party for all fees and expenses incurred, including reasonable attorneys’ fees, court costs, and accounting fees.
8.3 Injunctive Relief. Notwithstanding any provision of this Agreement to the contrary, if either Party violates Section 7 above, the other Party shall have the right to pursue injunctive relief. The parties stipulate that this is fair and reasonably necessary for the protection of both Party’s goodwill. If a court should decline to enforce this covenant, the parties request such court to reform this provision to restrict the other Party’s activities to the maximum extent the court finds enforceable.
9. GENERAL
9.1 Entire Agreement. This Agreement and its exhibits shall constitute the entire agreement between the parties with respect to the subject matter hereof and replaces all prior communications. This Agreement may not be modified or waived except in writing signed by both parties. This Agreement may be executed in one or more counterparts.
9.2 Assignment. This Agreement, and any rights or obligations hereunder, may not be assigned or sublicensed by Client without obtaining IDM’s prior written consent; provided that Client may assign its rights under this Agreement to a successor-in-interest by operation of law, whether by internal reorganization or otherwise upon notice to IDM.
9.3 Interpretation. If any provision of this Agreement is held invalid or unenforceable, the remainder of this Agreement shall nevertheless remain in full force and effect. The rule of construction that any ambiguities are to be resolved against the drafting party shall not be employed.
9.4 Notices. All notices pursuant to this Agreement shall be in writing and shall be sent via US mail, reputable overnight courier service or e-mail to the applicable addresses set forth below or at such other address as may be designated by the parties from time to time.
9.5 Waiver. IDM’s failure to enforce Client’s strict performance of any provision of this Agreement will not constitute a waiver of IDM’s right to subsequently enforce that provision, or any other provisions of this Agreement. No waiver of any provision hereof will be effective unless in writing and signed by the party against whom such waiver is sought to be enforced.
9.6 Headings. The headings and captions used in this Agreement are for convenience only and shall not in any way affect the interpretation of the provisions of this Agreement.
9,7 Remedies. No remedies in this Agreement are exclusive of any other remedies but will be cumulative and shall include all remedies available hereunder or under any other written agreement or in law or equity, including rights of offset.
9.8 Export Controls. Each party understands and acknowledges that the parties are subject to regulation by agencies of the U.S. government, including the U.S. Department of Commerce, which prohibits export or diversion of certain products, technology and technical data to certain countries.
9.9 Force Majeure. IDM shall not be held responsible for any delay or failure in performance hereunder caused in whole or in part by fire, strike, flood, embargo, labor dispute, delay or failure of any subcontract, act of sabotage, riot, accident, delay of carrier or Client, internet outages, voluntary or mandatory compliance with any governmental act, regulation or request, act of God or by public enemy, or any act or omission or other cause beyond IDM’s control. If any such contingency shall occur, this Agreement will be deemed extended by the length of time such contingency continues.
9.10 Relationship Among Parties. Client and IDM are independent contractors, and nothing in this Agreement creates any partnership, joint venture, agency, franchise, sales Client or employment relationship between Client and IDM. All financial and other obligations associated with Client’s business are the sole responsibility of Client.
9.11 Counterparts. This Agreement may be executed in counterparts, each of which will be deemed an original and all of which together shall constitute one instrument Executed as of the date first above written.
8
| IDM Global, Inc. | ||
| /s/ Xxxx XxXxxxx | ||
| By: | Xxxx XxXxxxx | |
| Its: | Head of Finance | |
| Address: | ||
| 000 Xxxx Xxxxxx | ||
| Xxxx Xxxx, XX 00000 | ||
| E-Mail Address | ||
[***] | ||
| CLIENT | ||
| /s/ Xxxxxx Xxxxxxx | ||
| 55 Global, Inc. | ||
| By: | Xxxxxx Xxxxxxx | |
| Its: | General Counsel and Chief Compliance Officer | |
| Address: | ||
| 00 Xxxx 00xx Xxxxxx, 00xx Xxxxx | ||
| Xxx Xxxx, XX 00000 | ||
| E-Mail Address | ||
[***] | ||
9
