Purpose
Paymob provides all services to the Merchant in accordance with the Terms and Conditions, the below terms and conditions are meant to govern the commercial and business relationship between the Parties in relation to the services. Merchant agrees to comply with these Terms and Conditions as may be updated from time to time by Paymob.
Services
As described in the forms attached to this Terms and Conditions.
Mail Order/Telephone Order Transactions
- The Merchant accepts it shall identify the Cardholder at the Merchants own risk for mail, telephone Payment Transactions. The Merchant may enter Payment Transactions received by mail, by telephone, by fax, or in person from the Cardholder using the manual data entry screen available via the Payment Client or by using the manual key entry on the POS Terminal. Any Authorization obtained from Paymob does not guarantee that the Payment Transaction is being authorized by the person whose Card number and name appears on the Card or mail order document or whose Card number and name is obtained over the telephone or via the internet. Merchant agrees that receiving any approval code from Paymob does not guarantee validity of the Payment Transaction and that the Payment Transaction presented to Paymob will be handled by Paymob in its ordinary course of business. It is hereby agreed that if charge over mail, telephone or internet is disputed by the Cardholder for any reason, such charge shall be subject to an immediate charge back.
Representations and Warranties
- The Merchant hereby warrants, represents, and undertakes to Paymob that:
- It is a duly incorporated company or legal entity validly existing under the law of its jurisdiction of incorporation and has taken all necessary actions (corporate or otherwise) to authorize its entry into, to observe and perform its obligations under this Terms and Conditions.
- The execution of this Terms and Conditions, delivery and performance of the obligations contemplated by this Terms and Conditions do not and will not contravene or conflict with its constitutional documents, any existing contractual and/or legal obligations owed by the Merchant, or any agreement binding on its assets or result in a breach of any law, regulation, judgment, order.
- It has all requisite power, authority, licenses, and approvals to enter into and perform its obligations under this Terms and Conditions.
- In its capacity under this Terms and Conditions, it acts as a principal and for its own account and not as agent, fiduciary, advisor, or trustee or in any other capacity on behalf of any third party and has made its own independent decisions to enter into this Terms and Conditions and as to whether the Terms and Conditions is appropriate or proper for it is based upon its own judgement and upon advice from such advisers as it has deemed necessary.
- It will at all times comply with all applicable laws and regulations (including but not limited to the laws of the UAE, regulations, circulars and notices and any amendments thereto);
- This Terms and Conditions is valid, legally binding, and enforceable against it in accordance with its terms.
- All Payment Transactions tendered to Paymob will represent the obligations of the Cardholders to the Merchant for bona-fide ransact- tions in the amount set forth thereon for goods sold and/or Services rendered only.
- It shall establish a fair policy for the exchange of incomplete or illegible return of goods and/or services purchased pursuant by virtue of Payment Transactions and shall give exact credit upon each such return by means of Refund Vouchers only.
- It shall process exact refund through the “Refund” function on a POS Terminal or if a POS Terminal does not support the “Refund” function, send written request to Paymob with details of Payment transaction to initiate refund.
- It shall not make cash advances or withdrawals to any Cardholder.
- It shall notify Paymob of or any sale, restructure, acquisition, merger, or any other material change in nature or size of its business.
- It shall not infringe upon the Intellectual Property Rights of Paymob or the Card Associations, nor otherwise use the mark or logo of Cards in such a manner as to create the impression that the Merchant’s goods and/or services are sponsored, produced, affiliated with, offered, or sold by Paymob and/or any of the Card Associations.
- It shall use its best endeavors to assist Paymob, if requested from time to time, in preventing or detecting fraud and undertakes to inform Paymob, as soon as reasonably practicable, of any fraudulent activity the Merchant becomes aware or any such activities which, in the opinion of the Merchant would involve fraud, misrepresentation or other illegal activities in relation to a Card.
- Not to sell, purchase, provide or exchange Card account number information in the form of Card transaction document, mailing lists, tapes, journal rolls, or other media obtained by reasons of a Card transaction to any third party;.
- It must not request or use a Card account number for any purpose that it knows or should have known to be fraudulent or in violation of rules, operating regulations, procedure, or policies available or which are communicated by Paymob from time to time.
- It shall not sell, store, share, purchase, provide, or exchange Cardholder and Card information or account number information in any form to any third party other than Paymob or authorized personnel or pursuant to an official court order. The Merchant must keep all systems and media containing account information, Cardholder or Card information, Cardholder or Card transaction information in media form in a secure manner in alignment with PCI DSS requirements to prevent access by or disclosure to any third party other than Paymob. The Merchant must destroy in the appropriate manner, all such media that will render unreadable which the Merchant no longer deems necessary to store.
- It shall ensure its Representatives do not have any criminal records.
- It shall keep copies of all Sales Slips and Sales Records for such time and in such manner as may be required by law, but in no event for less than five (5) years from the date of the Card Transaction or Electronic Commerce Transaction (as applicable), regardless of the expiry or early termination of this Terms and Conditions. Paymob shall have the right to inspect such copies within three (3) Business Days of requesting such inspection and the Merchant agrees to surrender such copies to Paymob. If the Merchant fails to make available any such copies, the Merchant agrees to indemnify Paymob in full for all damages, losses or costs which Paymob may sustain as a result of being unable to obtain such Sales Slips or Sales Records (as applicable);
- The process of any Payment Transaction or the presentation of any POS Record by the Merchant to Paymob shall constitute a warranty by the Merchant to Paymob that:
- All statements of fact therein are true the
- Card or POS Record is valid; and
- The sales are not subject to any dispute, set-off and/or counter- claim.
- Except as expressly authorized by Paymob in writing, neither the
- Merchant nor any Representative shall have any power:
- To bind, make any commitment or give any instructions on behalf of Paymob.
- To provide finance on behalf of Paymob or in any way pledge the Equipment’s.
- To settle any claims, demands or actions against Paymob. To contract on behalf of Paymob or
- To sell, purchase, provide or exchange Card account number information in the form of Card transaction documents, mailing lists, tapes, journal rolls, or other media obtained by reasons of a Card transaction to any third party.
- Upon demand made by Paymob the Merchant shall pay to Paymob the Fees in relation to the Merchant Services which include but not limited to the maintenance of POS Terminal, E-Commerce Services, Equipment, any rental for any devices, software, Value Added Services, value of Chargeback transactions, collateral, or deposit (if any) from time to time. The Merchant shall be required to pay all Fees due to Paymob under this Terms and Conditions by means of a cheque drawn in favor of Paymob or by electronic payment transfer to the account of Paymob. The Merchant shall under no circumstances make a cash payment to Paymob or to any of its representatives.
- The Merchant shall under no circumstances carry out Double-Swipe of Cards or store the Card data on any of its internal registers and other Equipment that has not been provided by Paymob. If any Cardholder data is stored as a result of Double-Swipe which is then compromised in anyway, Merchant shall be held responsible and shall indemnify Paymob on demand for any actual expenses imposed on Paymob by the Card Association or any regulatory authority as a result of the Merchant breach or non- compliance of Quick Reference Guide or any rules and regulations or any law arising out of the Payment Transaction initiated or made by the Merchant.
- The Merchant agrees to indemnify and keep Paymob indemnified and compensate Paymob in respect of all actual claims, costs and expenses suffered or incurred by Paymob as a consequence of the Merchant’s failure to comply with any of the Merchant obligations in this Terms and Conditions or in case of breach of any of the representations and warranties provided by it herein.
Security of Data and Data Protection
- Any system or media containing Card or Cardholder information, or Card Transaction Data shall be stored in a secure manner in compliance with PCI-DSS to prevent access by or disclosure to anyone other than Authorized Persons. Save to the extent necessary to comply with any legal requirement, the Merchant shall, and must ensure that any provider of a Payment Gateway shall, destroy all such information immediately following the expiry of the time period of this Terms and Conditions. The Merchant shall ensure that strong cryptography based on industry tested and accepted algorithms and certification is used when Card Transaction Data is transmitted to Paymob.
- The Merchant is responsible for the security of the POS Equipment while stored at the Merchant’s premises.
- The Merchant shall have in place physical controls and internal, external CCTV systems with sufficient coverage to monitor exit/entry points, and vulnerable or sensitive/confidential working areas where POS Equipment is stored or operated.
- The Merchant shall comply fully with all applicable laws relating to privacy and data protection, and security standards in any relevant jurisdiction which apply to the treatment of any and all data relating to Paymob information.
- The Merchant shall ensure that all personnel are provided with appropriate information security awareness, appropriate skills and training and education to ensure they understand their responsibilities regarding the confidentiality, integrity, and availability of Paymob information.
- The Merchant provider shall perform annual penetration testing and periodic vulnerability assessments on the IT infrastructure/systems where Paymob information is stored or processed, and assessment scan reports shall be shared with Paymob when requested.
- The Merchant shall ensure that network perimeter security systems (such as firewalls, IDS/IPS etc.) are implemented in relation to both internal and external traffic.
- The Merchant shall ensure that all user accounts are unique, justified,
authorized, and regularly reviewed.
- The Merchant shall ensure that secure mechanisms shall be implemented for transporting security log data from various system and network components to a centralized log management and security information and event management system, and logs shall be reviewed on daily bases.
- The Merchant shall ensure that all necessary background checks in accordance with applicable local laws and internal policies have been performed when hiring any employees.
- The Merchant’s duly appointed subcontractors (if any) shall operate in accordance with non- disclosure clauses stipulated in agreements between the Merchant and the subcontractor. The Merchant shall not make Paymob information available to any subcontractor without the prior written approval of Paymob.
- In addition, subject to any regulations issued by the Central Bank of UAE and Data Protection Laws, Paymob may disclose all information provided in this Terms and Conditions and subsequent transaction data to:
- Other companies in our Group and to our agents or affiliates that are under obligation of confidentiality, so that they may record, analyze, assess, use, and retain same for the same purposes described above in relation to their own businesses, products, and services.
- The Card Associations where the Card Associations rules require us to do so or to any regulatory body as required under any Applicable Law or regulations.
- Any party, including its advisers, to whom we propose to transfer our business.
- Any party, including its advisers, to whom we transfer or assign, or propose to transfer or assign, our rights and obligations under this Terms and Conditions.
- Any party who participates or wishes to participate, wholly or in part, in the financing of any of our products and services.
- Any insurance company for the purpose of insuring risk.
- Paymob may collect personal data from merchants, and customers, such as names, contact information, and purchase history.
- This Terms and Conditions should constitute the Merchant’s necessary consent collect and use their data, including sending marketing materials and promotions. With Merchant’s consent, Paymob may send marketing materials, promotions, and related communications.
- Personal Data Undertaking
- This Undertaking (“Undertaking”) is provided by Paymob (“Data Disclosing Party”) to affirm its consent and agreement to the collection, storage, and sharing of its personal data with the Merchant (“Recipient Party”).
- Data Disclosing Party acknowledges and understands that its personal data may be collected, stored, and shared by Recipient Party in accordance with the applicable data protection laws and regulations.
- Data Disclosing Party provides its explicit consent for the collection, storage, and sharing of its personal data by Recipient Party. Data Disclosing Party confirms that it has been informed of its rights regarding the personal data being collected, stored, and shared, including but not limited to its right to access, rectify, erase, or restrict the processing of its personal data.
- Data Disclosing Party agrees that Recipient Party may share its personal data with third parties, including service providers, contractors, or regulatory authorities, as necessary and in compliance with applicable laws and regulations.
- Data Disclosing Party understands that its personal data may be transferred and processed outside the United Arab Emirates, including to countries that may have different data protection laws, and consents to such transfers as long as they are conducted in compliance with applicable laws and regulations.
- Data Disclosing Party acknowledges that it may withdraw its consent at any time by providing written notice to Recipient Party. However, Data Disclosing Party acknowledges that the withdrawal of consent may result in the inability to provide certain services or fulfil certain contractual obligations.
- This Undertaking shall remain in effect until expressly terminated or amended in writing by Data Disclosing Party.
Compliance PCI-DSS/PA-DSS
- The Merchant hereby undertakes that it shall notify Paymob immediately in writing if any of its payment applications are not compliant with the PA-DSS and/or PCI-DSS requirements and only use payment applications for the processing of Card Transactions or Electronic Commerce Transactions and any related matters that have been validated by the PCI SSC and comply with the PA-DSS and PCI-DSS.
- In respect of Card Transactions, the Merchant confirms that it will not swipe the payment card at integrated cash register or at any other in-house system unless after the authorization in respect of the transaction has been received. The Merchant also acknowledges that it will swipe the payment cards only for obtaining authorization to complete payment transaction.
- Additionally, in relation to a Card Present Environment, the Merchant hereby undertakes that it shall notify Paymob immediately if any Card Transaction Data or Cardholder Data compromise event has occurred at its location or systems due to an inadvertent process/system failure or external threat.
- The Merchant hereby undertakes that it will obtain the required PCI DSS certification in accordance with Card Associations rules or as notified so by Paymob.
- The Merchant hereby undertakes that it will ensure to not store any of the following, subsequent to Authorization:
- Full contents of any Cardholder Data taken from the Magnetic Stripe (on a Card, in a Chip, or elsewhere);
- CAV2/CVC2/CVV2/CID used to verify Card Not Present Transactions, or PIN or the encrypted PIN block.
- The Merchant acknowledges and agrees that it shall be liable in full (and shall indemnify Paymob on demand) for all and any losses, costs, claims, liabilities, damages, demands and expenses suffered or incurred by Paymob and arising from the Merchant’s failure to comply with any of the requirements under the PA-DSS and PCI-DSS and/or any fraud which may arise out of non- compliance with the provisions of Clause (18.).