PayPal Point of Sale Agreement for Platform Sellers

This PayPal Point of Sale agreement (the “Terms”) is a contract between you, the entity or individual who enters this agreement, and PayPal, Inc. (“PayPal”, “we” or “us”) and applies to your use of the PayPal services to accept PayPal payments, credit cards and debit cards into your PayPal Platform Seller Account using the PayPal point of sale device and/or software (the “Services”) distributed by a third-party platform or marketplace (the “Platform”). You must read, agree with and accept all of the terms and conditions contained in the PayPal Point of Sale Terms. By using the Services, you agree to comply with all of the terms and conditions in these Terms, so please read all of the terms and conditions carefully.

These Terms, along with the PayPal Platform Seller Account Agreement and any other agreement in which you have entered into with PayPal (collectively "PayPal Agreements"), apply to your use of the Services. If any inconsistency exists between the terms of the PayPal Platform Seller Account Agreement and these Terms, these Terms shall control your use of the Services.

You agree that PayPal may amend these Terms at any time by arranging with the Platform to provide you with notice of amended terms and by posting a revised version on our website. You appoint the Platform as your agent for purposes of receiving notice of amendments to this Agreement and your use of the Services after the effective date of the posted amendment shall constitute acceptance of such amendment. If you do not agree with any change to these Terms, you may terminate your use of the Services at any time.

The terms with respect to getting, using and replacing your Device are set forth in your agreement with the Platform. To register for the Services, you must contact your Platform, provide certain information, and agree to these Terms. Once you are approved for the Services, your Platform will issue your Device(s) to you. If your Device(s) do not work, contact your Platform.

Because your customer is present at the time of your use of the Services, you may be required to obtain a customer signature on non-PIN credit or debit card transactions greater than twenty-five dollars ($25). Obtaining this signature may assist you in defending against a chargeback in the event a customer claims the transaction was unauthorized. You must also provide customers with a receipt upon request. Customers may choose an electronic receipt delivered via email or SMS rather than a paper receipt. You must obtain your customers’ consent prior to using the Services to send an email or SMS text to them.

You agree that any transaction that you submit through the Services shall have an accurate and true description of the goods and services being purchased. You also agree to comply with any instructions provided to you along with your Device.

The Services enable you to accept Card transactions using the Device. If your Device is modified contrary to the manufacturer’s software or hardware guidelines, you may not use the Device to accept Card transactions.

The fees for your use of the Services are set forth in your agreement with the Platform. PayPal does not control and is not responsible for Platform fees charged to you. PayPal’s fees will either be disclosed to you separately by the Platform or will be consolidated with the fees for the Platform. Whether disclosed separately or consolidated with the Platform’s fees, you promise to pay such fees and your payment of such fees constitutes valid consideration for purposes of this Agreement between you and PayPal. PayPal will have the right to deduct from your Platform Seller Account balance both PayPal’s fees for your use of the Services and the Platform’s fees communicated to us by the Platform. PayPal may deduct the fees for your use of the Services and the Platform’s fees even if there are insufficient funds to cover such fees in your Platform Seller Account balance. If your Platform Seller Account balance becomes negative, you authorize PayPal to debit the amount owed from your Settlement Account, as more fully described in the PayPal Platform Seller Account Agreement. In the event that PayPal is unable to recover any fee amount that is due from your Platform Seller Account, PayPal may terminate your use of the Services within 30 days of the date that the fee was due and you will remain obligated to pay PayPal for any unpaid amounts.

The PayPal Privacy Policy applies to your use of PayPal Point of Sale. The protection of your information is important to PayPal. Likewise, information you receive from us about your customers must be kept confidential, stored securely and only used for purposes related to PayPal Here and as agreed to in the PayPal Privacy Policy. As a reminder, information you receive may not be used to send unsolicited email or SMS messages to a user without the user’s express consent.

If you are using PayPal software such as an API, developer's toolkit or other software application that you have downloaded to your computer, device, or other platform, then PayPal grants you a revocable, non-exclusive, non-transferable license to use PayPal's software in accordance with the documentation. This license grant includes the software and all updates, upgrades, new versions and replacement software for your personal use only. You may not rent, lease or otherwise transfer your rights in the software to a third party. You must comply with the implementation and use requirements contained in all PayPal documentation accompanying the PayPal services. If you do not comply with PayPal's implementation and use requirements you will be liable for all resulting damages suffered by you, PayPal and third parties. You agree not to alter, reproduce, adapt, distribute, display, publish, reverse engineer, translate, disassemble, decompile or otherwise attempt to create any source code which is derived from the software. You acknowledge that all rights, title and interest to PayPal's software are owned by PayPal. Any third party software application you use on the PayPal website is subject to the license you agreed to with the third party that provides you with this software. PayPal does not own, control nor have any responsibility or liability for any third party software application you elect to use on the PayPal website and/or in connection with the PayPal services. If you are using the PayPal services on the PayPal website, or other website or platform hosted by PayPal, or a third party, and are not downloading PayPal's software or using third party software applications on the PayPal website, then this section does not apply to your use of the hosted PayPal services.

You may not accept payments in violation of PayPal’s Acceptable Use Policy.

1. General. You are fully responsible for the security of data in your possession or control as a result of using the Services. You agree to comply with all applicable laws and rules in connection with your collection, security and dissemination of any personal, financial, Card, or transaction information (defined as “Data”).
2. Data Usage. Unless you receive the express consent of your customer, you may not retain, track, monitor, store or otherwise use Data beyond the scope of the specific transaction. Further, unless you get the express consent of PayPal, you agree that you will not use nor disclose the credit/debit card data for any purpose other than to support payment for your goods and services. Credit/debit card data must be completely removed from your systems, and any other place where you store credit/debit card data, within 24 hours after you receive an authorization decision unless you have received the express consent of your customer to retain the credit/debit card data for the sole purpose of processing recurring payments. To the extent that credit/debit card data resides on your systems and other storage locations, it should do so only for the express purpose of processing your transactions. All Data and other information provided to you by PayPal in relationship to the Services and all credit/debit card data will remain the property of PayPal, its Acquiring Bank or the Card Companies, as appropriate.
3. Password Security. You will not give, transfer, assign, sell, resell or otherwise dispose of the information and materials provided to you to utilize the Services. You are solely responsible for maintaining adequate security and control of any and all IDs, passwords, or any other codes that are issued to you by PayPal, each Acquiring Bank or the Card Companies.
4. PCI Compliance. You agree that at all times you shall be compliant with the Payment Card Industry Data Security Standards (PCI DSS) and the Payment Application Data Security Standards (PA DSS), as applicable. You agree to promptly provide us with documentation evidencing your compliance with PCI DSS and/or PA DSS, if requested by us. You also agree that you will use only PayPal-approved PCI compliant service providers in connection with the storage, or transmission of a cardholder’s account number, expiration date, and CVV2. You must not store CVV2 data at any time. Your customers’ credit/debit card data is handled by PayPal if you use the Device to swipe credit, debit and PayPal Payment cards. PayPal adheres to PCI DSS.
5. Audit. If PayPal believes that a security breach or compromise of Data has occurred, PayPal may require you to have a third party auditor that is approved by PayPal conduct a security audit of your systems and facilities and issue a report to be provided to PayPal, the Acquiring Banks and the Card Companies. In the event that you fail to initiate an audit within 10 Business Days of PayPal's request, PayPal may conduct or obtain such an audit at your expense.
6. Authorization.  You authorize PayPal to provide information about your business and individual Card transactions to third parties for the purpose of facilitating the acceptance and settlement of your Card transactions and in connection with items, including chargebacks, refunds, disputes, adjustments, and other inquiries.
7. Compliance with Data Protection Schedule.  You (as a “Merchant”) and we agree to comply with Schedule 1 below, which forms part of this Agreement. The terms of the Data Protection Schedule prevail over any conflicting terms in this Agreement relating to data protection and privacy.
8. Data Portability. Upon any termination or expiration of this Agreement, PayPal agrees, upon your written request, to provide your new acquiring bank or payment service provider (“Data Recipient”) with any available credit card information including personal data relating to your Customers (“Card Information”). In order to do so, you must provide PayPal with all requested information including proof that the Data Recipient is in compliance with the Association PCI-DSS Requirements and is level 1 PCI compliant. PayPal agrees to transfer the Card Information to the Data Recipient so long as the following applies: (a) you provide PayPal with proof that the Data Recipient is in compliance with the Association PCI-DSS Requirements (Level 1 PCI compliant) by providing PayPal a certificate or report on compliance with the Association PCI-DSS Requirements from a qualified provider and any other information reasonably requested by PayPal; (b) the transfer of such Card Information is compliant with the latest version of the Association PCI-DSS Requirements; and (c) the transfer of such Card Information is allowed under the applicable Association Rules, and any applicable laws, rules or regulations (including data protection laws).

"Acquiring Bank" means each of the financial institutions PayPal partners with to process your Card payments, including your PayPal Here transactions.

“Business Days” mean(s) Monday through Friday, excluding holidays when PayPal’s offices are not considered open for business in the U.S.  Holidays include New Year's Day (January 1), Martin Luther King, Jr.’s Birthday (the third Monday in January), George Washington's Birthday (the third Monday in February), Memorial Day (the last Monday in May), Independence Day (July 4), Labor Day (the first Monday in September), Columbus Day (the second Monday in October), Veterans Day (November 11), Thanksgiving Day (the fourth Thursday in November) and Christmas Day (December 25).  If a holiday falls on a Saturday, PayPal observes the holiday on the prior Friday.  If the holiday falls on a Sunday, PayPal observes the holiday on the following Monday.

"Card Companies" means a company or group of financial institutions that promulgate rules to govern Card transactions via bankcard and payment networks including MasterCard, Visa, Discover, and American Express.

"Device" means any card reader device your Platform provides to you to use in connection with your use of the Services, which may include capabilities for magnetic swipe, chip and signature, and/or contactless payment acceptance.

"PayPal Platform Seller Account Agreement" means the online agreement you entered into with PayPal before you started using the payment processing services offered by PayPal, as it may have been amended from time to time. The PayPal Platform Seller Account Agreement currently in effect can be accessed via the Legal Agreements link in the footer of nearly every page on the PayPal website.

SCHEDULE 1

DATA PROTECTION SCHEDULE       

This Data Protection Schedule applies only to the extent that PayPal acts as a Service Provider to you.

Capitalized terms used but not defined in this Schedule shall have the meaning set out in the Agreement.

1 DEFINITIONS AND INTERPRETATION; SCHEDULE COMPOSITION1

1.1 Definitions and Interpretation. The following terms have the following meanings when used in this Schedule:

"Customer" means your customers who use the PayPal services in the United States and for the purposes of this Schedule, are data subjects.

"Customer Data" means the Personal Data that the Customer provides to you and you pass on to PayPal through the use by you of the PayPal services.

"Data Protection Laws"  means any data protection laws, regulations, and regulatory requirements applicable to PayPal’s provisions of the PayPal services, including without limitation, the California Consumer Privacy Act of 2018 (CCPA), including any implementing regulations issued by the California Attorney General.

"Personal Data". means any information relating to an identified or identifiable natural person (a “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

"process", "processes", and "processed" means any operation or set of operations performed upon Personal Data, including collection, recording, retention, sharing, organization, storage, access, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, making available, alignment, combination, blocking, deleting, erasure, or destruction.

“Security Incident" means the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data on systems managed by or otherwise controlled by PayPal.

“Service Provider” shall have the meaning set forth in the CCPA. 

1.2 Schedule Composition. This Schedule 1 is comprised of (i) sections 1 to 2, being the main body of the schedule; and(ii) Attachment 1. 

2 PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE SERVICES

2.1 PayPal as a Service Provider. 

2.1.1    PayPal is your Service Provider with respect to Customer Data, including the Personal Data of Customers and other natural persons, households, and entities only for the purposes specified in the Agreement.  You agree to provide to PayPal only the Customer Data that is necessary for PayPal to provide the payment processing services.  The parties acknowledge and agree that PayPal is permitted to use, reproduce and process Customer Data and payment transaction data for the following limited purposes:

• as reasonably necessary to provide and improve the payment processing services to you and your customers, including fraud protection tools;
• to monitor, prevent, and detect fraudulent payment transactions, and to prevent harm to you, PayPal, and to third parties;
• to comply with legal or regulatory obligations applicable to the Processing and retention of payment data to which PayPal is subject, including applicable anti-money laundering and identity verification obligations;
• to analyze, develop and improve PayPal’s products and services;
• internal usage, including but not limited to, data analytics and metrics;
• to compile and disclose Customer Data and payment transaction data in the aggregate where your individual or user Personal Data is not identifiable, including calculating your averages by region or industry; 
• complying with applicable legal requirements and assisting law enforcement agencies by responding to requests for the disclosure of information in accordance with laws; and
• any other purpose that PayPal notifies you and in accordance with Data Protection Laws.

2.1.2 PayPal shall comply with the requirements of the Data Protection Laws with respect to the use of Personal Data under this Agreement and shall not knowingly do anything or knowingly permit anything to be done with respect to the Personal Data which might lead to a breach by you of the Data Protection Laws.

2.1.3  With regard to any Customer Data to be processed by PayPal in connection with this Agreement, you will be solely responsible for determining the purposes for which and the manner in which Customer Data are, or are to be, processed.

2.1.4 The Parties acknowledge and agree that valuable consideration, monetary or otherwise, is being provided for the payment processing services being rendered by PayPal and not in exchange for you providing Personal Data in connection with the payment processing services.

2.1.5  Unless otherwise required or authorized by law and subject to any applicable exceptions, limitations, exemptions, and/or exclusions set forth in the CCPA or applicable Data Protection Laws, PayPal is prohibited from collecting, retaining, using, selling or disclosing Personal Information except as necessary for the purpose of performing the payment processing services specified in the Agreement between the parties.

2.2 Customer Requests.  PayPal shall, to the extent legally permitted, promptly notify you in the event PayPal receives a request from a Customer for access to, or correction, amendment, or deletion of, that Customer’s Personal Data. PayPal shall not respond to any such Customer request without your prior written consent except to confirm that the request relates to you and you hereby consent to such communication with your Customer by PayPal. PayPal shall provide you with commercially reasonable cooperation and assistance in relation to the handling of a Customer’s request for access to that Customer’s Personal Data, provided that such cooperation and assistance is legally permitted and to the extent you do not have access to such Customer Data through your use of the payment processing services. PayPal and you acknowledge and agree that PayPal is authorized under applicable law to retain and process such Customer Data pursuant to applicable law, including, without limitation, any applicable exceptions, limitations, exemptions, and/or exclusions set forth in the CCPA (including without limitation, those exceptions, limitations, exemptions and/or exclusions set forth in California Civil Code § 1798.145). 

2.3 PayPal Personnel.  PayPal shall ensure that its personnel engaged in the processing of Customer Data are informed of the confidential nature of the Customer Data, have received appropriate training on their responsibilities and have executed written confidentiality agreements. Such confidentiality obligations shall survive the termination of the applicable personnel’s engagement.  PayPal undertakes to provide its personnel with training as necessary from time to time with respect to PayPal's obligations in this Addendum so that PayPal personnel are aware of, and comply with, such obligations.  Access by PayPal's personnel to Customer Data is limited to those personnel performing payment processing services in accordance with the Agreement.

2.4 Technical and Organizational Measures.  PayPal shall, as a minimum, implement and maintain appropriate technical and organizational measures as described in Attachment 1 to this Addendum to keep Customer Data secure and to protect it against unauthorized or unlawful processing and accidental loss, destruction or damage in relation to the provision of the payment processing services. You understand and agree that the technical and organizational measures are subject to technical progress and development. In that regard, PayPal is expressly permitted to implement adequate alternative measures as long as the security level of the measures is maintained in relation to the provision of the payment processing services. In the event of any detrimental change, PayPal shall provide a notification together with any necessary documentation to you by email or publication on a website easily accessible by you.

2.5 Security Incidents.  If PayPal becomes aware of a Security Incident in connection with the processing of Customer Data and if there is a reasonable likelihood of materially harm to a material part of the PayPal systems relating to the payment processing services provided to you, PayPal will, in accordance with Data Protection Laws: (a) notify you of the Security Incident promptly and without undue delay; and (b) promptly take reasonable steps to minimize harm and secure Customer Data.

2.5.1 Details of Security Incident. Notifications made under this Section will describe, to the extent possible, reasonable details of the Security Incident, including steps taken to mitigate the potential risks.

2.5.2 Communication. PayPal will deliver its notification of any Security Incident to one or more of your administrators via email. You are solely responsible for maintaining accurate contact information and ensuring that any contact information is current and valid.

2.6 Deletion. Upon termination or expiration of the Agreement, PayPal will delete or return to you all Customer Data processed on behalf of you, and PayPal shall delete existing copies of such Customer Data except where authorized by Data Protection Laws or necessary to retain such Customer Data strictly for the purposes of compliance with applicable law.

2.7 Certification.  The Parties will at all times comply with applicable Data Protection Laws.  PayPal hereby certifies that it understands and agrees to the terms of this Data Protection Schedule in this Agreement.

2.8 Merchant Notices.  You undertake to provide all notices and obtain all consents necessary for PayPal’s use of Personal Data set out above.

ATTACHMENT 1
Technical and Organizational Measures

The following technical and organizational measures will be implemented:

1. Measures taken to prevent any unauthorized person from accessing the facilities used for data processing;
2. Measures taken to prevent data media from being read, copied, amended or moved by any unauthorized persons;
3. Measures taken to prevent the unauthorized introduction of any data into the information system, as well as any unauthorized knowledge, amendment or deletion of the recorded data;
4. Measures taken to prevent data processing systems from being used by unauthorized person using data transmission facilities;
5. Measures taken to guarantee that authorized persons when using an automated data processing system may access only data that are within their competence;
6. Measures taken to guarantee the checking and recording of the identity of third parties to whom the data can be transmitted by transmission facilities;
7. Measures taken to guarantee that the identity of the persons having had access to the information system and the data introduced into the system can be checked and recorded ex post facto at any time and by any authorized person;
8. Measures taken to prevent data from being read, copied, amended or deleted in an unauthorized manner when data are disclosed and data media transported;
9. Measures taken to safeguard data by creating backup copies.