Merchant Terms of Service

Synapto Terms

Version 3.0
Published 30 October 2026
Applies to existing merchants from 1 December 2026
Synapto Ltd · Company no. 15637813
9a Crosswall, London EC3N 2JY

PLEASE READ THE TERMS OF THIS AGREEMENT CAREFULLY BEFORE ACCESSING THE SYNAPTO PLATFORM OR ANY SERVICES MADE AVAILABLE THROUGH IT

Download these terms as a PDF

2.1The following definitions and rules of interpretation apply in this Agreement:

"Acceptable Use Policy" means Synapto's acceptable use policy (available here: https://www.synaptopay.com/acceptable-use-policy);

"Affiliate" means, in relation to a party, any entity that directly or indirectly controls, is controlled by, or is under common control with that party;

"Agreement" means the terms of this agreement together with any Bespoke Pricing Agreement, any applicable Subscribed Service Specific Terms and any policies referred to therein;

"Authorised Users" means the individuals (being employees or contractors of the Merchant) authorised by the Merchant to use the Services in accordance with the terms of this Agreement;

"Bespoke Pricing Agreement" means any written agreement between Synapto and the Merchant (including an order form, rate card, or an exchange of emails between authorised representatives of each party in accordance with Clause 29.3(b)) that sets out fees for the Synapto Services which differ from those in Clause 11.2;

"Business Day" means a day other than a Saturday, Sunday or bank or public holiday in England;

"Card Storage Fee" has the meaning given in Clause 11.2(b);

"Commencement Date" means the date on which the Merchant clicks to accept this Agreement;

"Confidential Information" means all information of a confidential nature (in any form) disclosed by or on behalf of a party or a Third-Party Partner, including information relating to its business, customers, pricing, technology and the Services, and any information marked as, or which would reasonably be understood to be, confidential;

"Contract Year" means each period of 12 months starting on the Commencement Date or on any anniversary of it;

"Customer Personal Data" means any personal data relating to the Merchant's customers (including cardholders, payers and recipients of payment links and invoices) which Synapto processes on behalf of the Merchant in providing the Services, as further described in Part A of Schedule 1;

"Data Protection Legislation" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, in each case as amended or replaced from time to time, and the terms "controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given to them in the UK GDPR;

"Feedback" has the meaning given in Clause 16.4;

"Fees" means the fees payable by the Merchant to Synapto as set out in Clause 11 (Fees) and/or the applicable Subscribed Service Specific Terms;

"Force Majeure" means an event or sequence of events beyond a party’s reasonable control preventing or delaying it from performing its obligations under our Agreement (provided that an inability to pay is not Force Majeure), including any matters relating to transfer of data over public communications networks and any delays or problems associated with any such networks or with the internet;

"Gateway Transaction Fee" has the meaning given in Clause 11.2(a);

"Intellectual Property Rights" means any and all copyright, rights in inventions, patents, know-how, trade secrets, trademarks and trade names, service marks, design rights, rights in get-up, database rights and rights in data, semiconductor chip topography rights, utility models, domain names and all similar rights and, in each case: (a) whether registered or not; (b) including any applications to protect or register such rights; (c) including all renewals and extensions of such rights or applications; (d) whether vested, contingent or future; and (e) wherever existing;

"IPR Claim" has the meaning given in Clause 16.6;

"Merchant Data" means all data (in any form) that is provided to Synapto or uploaded to any part of the Synapto Platform by the Merchant or by any Authorised User or any data that is generated as a result of the Merchant or any Authorised User’s use of its own data in the Services (but excluding Feedback);

"Merchant Systems" means all software and systems used by or on behalf of the Merchant or any of its direct or indirect sub-contractors, or any Authorised User in connection with the provision or receipt any of the Services or that the Services otherwise, link, inter-operate or interface with or utilise (in each case whether directly or indirectly);

"Onboarding Services" has the meaning given in Clause 8.1;

"Payouts Service" means any Subscribed Service consisting of payouts, Embedded Bank Accounts (as defined in Schedule 2) or other regulated banking or payment services provided by Griffin Bank Limited or any other regulated Third-Party Partner, as identified on the Synapto Platform or in the relevant Subscribed Service Specific Terms;

"Permitted Purpose" means the ordinary business purposes of the Merchant provided such ordinary business purpose does not involve the sale of goods or services which infringe the Intellectual Property Rights of a third party, or which are illegal under applicable laws;

"Permitted Usage Rights" means any use restrictions set out in the Subscribed Service Specific Terms;

"PCI DSS" means the Payment Card Industry Data Security Standard issued by the PCI Security Standards Council, as updated from time to time;

"Relief Event" means any act or omission by the Merchant, any breach of this Agreement by the Merchant, or any Force Majeure;

"Services" means the Synapto Services and any Subscribed Services which the Merchant opts to receive via the Synapto Platform;

"Sub-processor" means any third party engaged by Synapto to process Customer Personal Data on Synapto's behalf;

"Subscribed Services" means the specific services selected by the Merchant via the Synapto Platform and provided to the Merchant by Synapto or its relevant Third-Party Partner, subject to the terms of this Agreement and any Third-Party Terms;

"Subscribed Service Specific Terms" means, in respect of each Subscribed Service, the specific additional terms (if any) provided by Synapto to the Merchant at the time the Merchant opts to receive a Subscribed Service (which may be updated by Synapto from time to time on notice to the Merchant) and which shall apply to the receipt of the relevant Subscribed Service under the terms of this Agreement;

"Subscription Period" means:

(a)in relation to the Synapto Services, the period commencing on the Commencement Date and continuing until the termination of this Agreement in accordance with its terms; and

(b)in relation to each Subscribed Service, means the term set out in the relevant Third-Party Terms or the Subscribed Service Specific Terms;

"Synapto Gateway" means the payment gateway made available by Synapto through the Synapto Platform for the processing of card transactions;

"Synapto Platform" means Synapto's desktop user interface available here: https://dashboard.synaptopay.com, its mobile application and its POS terminal application;

"Synapto Services" means the licence to access and use the Synapto Platform granted in accordance with Clause 5.1 together with any Onboarding Services and Support Services offered by Synapto in accordance with Clauses 8 and 10;

"UK GDPR" has the meaning given to it in section 3(10) of the Data Protection Act 2018;

"Update" means a software maintenance update, patch or bug-fix, or a new version or release of the Synapto Platform intended to have new or improved functionality;

"Territory" means the United Kingdom and such additional territory as may be agreed in writing by Synapto from time to time;

"Third-Party Partner" means Synapto's third-party partner who provides a relevant Subscribed Services to the Merchant, subject to the Third-Party Terms;

"Third-Party Software" means third-party software provided to the Merchant as part of the Subscribed Services;

"Third-Party Terms" means a Third-Party Partner's terms and conditions which the Merchant must accept in order to receive the relevant Subscribed Services.

2.2In this Agreement:

(a)headings are included for convenience only and shall have no effect on interpretation;

(b)a reference to a ‘party’ includes that party’s successors and permitted assigns;

(c)a reference to a ‘person’ includes a natural person, corporate or unincorporated body (in each case whether or not having separate legal personality) and that person’s personal representatives, successors and permitted assigns;

(d)words in the singular include the plural and vice versa;

(e)any words that follow ‘include’, ‘includes’, ‘including’, ‘in particular’ or any similar words and expressions shall be construed as illustrative only and shall not limit the sense of any word, phrase, term, definition or description preceding those words;

(f)a reference to any legislation or legislative provision is a reference to it as amended, extended, re-enacted or consolidated from time to time; and

(g)a reference to a Schedule is to a schedule to this Agreement, and the Schedules form part of this Agreement. Schedule 2 applies only as set out in paragraph 1 of that Schedule.

2.3Any obligation of Synapto under this Agreement to comply or ensure compliance by any person or the Services with any law shall be limited to compliance only with laws within the Territory as generally applicable to businesses and to providers of software as a service solutions. Such obligations shall not be construed to create any obligation on Synapto (or anyone acting on its behalf) or any part of the Services to comply with any laws or regulations which apply solely to specific commercial or other activities (such as insurance, legal advice or banking or other professional services) or which apply solely to a specific commercial or non-commercial sector (or part thereof) (such as the public, legal, accountancy, actuarial, insurance, banking or financial service sectors), except as expressly provided in the terms. Nothing in this Clause 2.3 limits Synapto's obligations under the Payment Card Industry Data Security Standard (PCI DSS) or the rules of the card schemes, to the extent those obligations apply to the Services provided by Synapto.

4.1Access to the Subscribed Services requires the following technical specifications to operate correctly:

(a)Supported Operating Systems: Synapto's mobile application shall support, at minimum, the two (2) most recent major versions of Android and iOS operating systems. Synapto's mobile application shall be optimized for the latest stable version of each operating system at the time of each release.

(b)Web Browser Requirements: For web-based access, Authorised Users must use modern, stable versions of web browsers, including but not limited to Google Chrome, Mozilla Firefox, Apple Safari and Microsoft Edge. Users are required to keep their web browsers updated to the latest stable version. Beta, developer preview, or any pre-release versions of operating systems or web browsers are explicitly not supported.

(c)Updates and Compatibility: Authorised Users are required to maintain their devices with the most recent stable version of their respective operating system and web browser to ensure optimal performance and security of the Synapto Platform. Authorised Users shall enable automatic updates for Synapto's mobile application, their device's operating system, and their web browser.

(d)Compliance: The Merchant acknowledges that failure to comply with these operating system and web browser requirements may result in degraded performance, limited functionality, or inability to use the Synapto Platform.

(e)Amendments: Synapto reserves the right to modify these requirements as necessary to maintain the security, functionality, and quality of the Synapto Platform on notice to the Merchant.

6.1Except as expressly permitted under this Agreement, or by law, the Merchant shall not:

(a)copy, modify, adapt, correct errors in, or create derivative works from, the Services;

(b)decode, reverse engineer, disassemble, decompile or otherwise translate, or make alterations to the Services, convert the Services, or otherwise seek to obtain or derive the source code, underlying ideas, algorithms, file formats or non-public APIs to the Services, other than as expressly permitted under sections 50B and 296A of the Copyright Designs and Patents Act 1988 (and then only upon advance notice in writing to us);

(c)assign, rent, transfer, provide or enable access, sub-licence, lease, resell, distribute, publish, broadcast, transmit, store, archive, display publicly to third parties, disclose or otherwise deal in or encumber the Services (in each case, whether or not for charge);

(d)remove or modify any copyright or similar notices, or any of Synapto’s or any other person’s branding, that the Services causes to be displayed when used;

(e)access or use the Services, or permit them to be accessed or used, by or on behalf of any third party, otherwise than for the Permitted Purpose; or

(f)attempt to circumvent or interfere with any security features of the Services or mechanisms intended to limit the Merchant's use; or.

6.2Access and use of the Synapto Services and/or Subscribed Services shall be limited to the Permitted Usage Rights only.

6.3The Merchant shall not exceed the Permitted Usage Rights.

6.4The Merchant shall access and use the Services at all times in accordance with any instructions or user guidance and all other terms of this Agreement.

6.5The Merchant shall notify Synapto in writing as soon as the Merchant becomes aware of any actual or suspected unauthorised use of the Services (including any use in excess of the Permitted Usage Rights).

8.1Synapto shall provide the Merchant with support to on-board the Merchant onto the selected Subscribed Services ("Onboarding Services"), which may include:

(a)collecting information from the Merchant or other available sources to assist the Merchant in the completion of any applications or other documentation required to subscribe to the Subscribed Services;

(b)submitting applications and other documentation or information to Synapto's relevant Third-Party Partners for the purposes of the Merchant applying for relevant Subscribed Services and onboarding with the relevant Third-Party Partner, including to facilitate the Third-Party Partner's AML/KYC checks;

(c)presenting the Merchant with relevant Third-Party Partner's Third-Party Terms in order to subscribe to the relevant Subscribed Services;

(d)storing relevant information and documentation within the Merchant's account on the Synapto Platform.

8.2The extent of Synapto's support as described in Clause 8.1 shall vary depending on the Subscribed Services the Merchant elects to subscribe to.

10.1Synapto will use reasonable efforts to provide technical support to the Merchant in relation to defects, errors or other technical issues with Synapto Platform. The Merchant can raise a request for support via the methods made available on the Synapto Platform.

10.2Synapto may offer additional support services for specific Subscribed Services. Such additional support is described in the relevant Subscribed Service Specific Terms and will be provided by Synapto for the duration of the relevant Subscribed Services.

10.3Synapto shall use reasonable endeavours to notify the Merchant in advance of scheduled maintenance on the Synapto Platform but the Merchant acknowledges that it may receive no advance notification for downtime caused by Force Majeure or for other emergency maintenance.

10.4The Merchant acknowledges that the Synapto Services do not include:

(a)any services, systems or equipment required to access the internet (and that the Merchant is solely responsible for procuring access to the internet and for all costs and expenses in connection with internet access, communications, data transmission and wireless or mobile charges incurred by it in connection with use of the Services);

(b)dedicated data back up or disaster recovery facilities (and the Merchant should ensure it at all times maintains backups of all Merchant Data); or

(c)legal, accounting or other professional or regulated services and that, except as expressly stated in our Agreement, no assurance is given that the Services will comply with or satisfy any legal or regulatory obligation of any person.

10.5The Merchant acknowledges that the Services rely on third-party hosting providers, cloud infrastructure services, content-delivery networks, telecommunications networks and other external service providers chosen by Synapto from time to time ("Third-Party Infrastructure"). Synapto does not guarantee the uninterrupted availability of Third-Party Infrastructure and, subject to Clause 19.5 and to the fullest extent permitted by law, shall have no liability for any unavailability, interruption, degradation, delay, data loss or failure of the Services caused (in whole or in part) by Third-Party Infrastructure, including outages, scheduled or emergency maintenance and security incidents affecting it, provided that Synapto uses reasonable endeavours to select reputable providers and to restore the Services once the relevant Third-Party Infrastructure becomes available.

12.1Synapto may at its absolute discretion make updated versions of the documents referred to in Clause 3 or other documents referred to in any part of this Agreement ("New Versions") from time to time by notifying the Merchant of such update by e-mail (together with a copy of the update or a link to a copy of the update) or by any other reasonable means which Synapto elect.

12.2New Versions will replace the preceding version of the same document(s) for the purposes of this Agreement from the date 30 days after they are published on the Synapto Platform (or at such later date as Synapto may specify).

12.3The Merchant acknowledges that Synapto is entitled to modify the features and functionality of the Synapto Platform. Synapto will use reasonable endeavours to ensure that any such modification does not materially adversely affect the use of the relevant Subscribed Service(s) by Synapto's customers generally.

12.4Synapto may, without limitation to the generality of Clause 12.3, establish new limits on the Services (or any part), including limiting the volume of data which may be used, stored or transmitted in connection with the Services, remove or restrict application programming interfaces or make alterations to data retention periods, provided such changes are introduced by a New Version to the relevant impacted contractual documents.

14.1Synapto warrants that:

(a)the Synapto Platform will operate materially in accordance with its description available at www.synaptopay.com when used in accordance with this Agreement under normal use and normal circumstances during the Subscription Period; and

(b)Synapto will provide the Synapto Services with reasonable care and skill.

14.2If the Merchant receives any Updates to the Synapto Platform under this Agreement, such Update will be covered under the warranty at clause 14.1.

14.3If there is a breach of the warranty in clause 14.1, provided that the Merchant notifies Synapto without delay in writing and provides sufficient information to enable Synapto to reproduce any errors, Synapto will, at its option:

(a)use reasonable endeavours to correct the errors in the Synapto Services within a reasonable time; or

(b)terminate this Agreement.

14.4The warranty in Clause 14.1 is subject to the Merchant complying with its obligations under, and using the Services in accordance with, this Agreement and is also subject to the limitations and exclusions set out in Clause 19. In addition, the warranty shall not apply to the extent that any error in the Services arises as a result of:

(a)incorrect access or use of the Services by the Merchant or any Authorised User (including any failure to follow any instructions set out on Synapto’s website);

(b)access to or use of the Services other than for the purposes for which they are intended;

(c)modification or alteration of the Services without Synapto's written consent;

(d)access or use of the Services with other software or on equipment with which it is incompatible;

(e)any act by any third party (including hacking or the introduction of any virus or malicious code);

(f)any breach of this Agreement by the Merchant (or by any Authorised User);

(g)failure to notify Synapto of any error within a reasonable period of time of it first occurring; or

(h)failure to install any Update recommended and made available by Synapto.

14.5The Merchant acknowledges that Synapto does not give any warranty or representation and does not accept any liability (howsoever arising whether under contract, tort, in negligence or otherwise) in relation to:

(a)the Subscribed Services;

(b)the Services meeting the Merchant’s individual needs or business requirements, whether or not such needs or requirements have been communicated to us;

(c)the Services operating in a manner which is uninterrupted or free from minor errors or defects; or

(d)the Services being compatible with any third-party software or with any particular hardware.

14.6Subject to Clause 19.5, the provisions of Clause 14.3 set out the Merchant’s sole and exclusive remedy (howsoever arising, whether in contract, tort, negligence or otherwise) for any breach of Clause 14.1 or for any other error or defect in, defective performance or inability to use the Services or any part of them.

14.7Other than as set out in this clause 14, and subject to Clause 19.5, all warranties, conditions, terms, undertakings or obligations whether express or implied and including any implied terms relating to quality, fitness for any particular purpose, reasonable care and skill or ability to achieve a particular result are excluded to the fullest extent allowed by applicable law.

14.8If the Merchant accesses the Synapto Platform through a third-party, Synapto accepts no responsibility for the Merchant's ability to access (or continue to access) the Synapto Platform through such third-party. If any relevant engagement between the Merchant and a third-party through which the Merchant accesses the Synapto Platform ends, the Merchant shall promptly notify Synapto.

16.1The Merchant acknowledges that all Intellectual Property Rights in the Services are owned by or licensed to Synapto, that the right to access and use the Services is licensed (not sold) to the Merchant and that the Merchant shall have no other rights other than those granted under the terms of this Agreement. The Merchant shall have no right to access the Services in source code form. To the extent that the Merchant, any of its Affiliates or any person acting on its or their behalf acquires any Intellectual Property Rights in any part of the Services, the Merchant shall assign or procure the assignment of such Intellectual Property Rights with full title guarantee (including by way of present assignment of future Intellectual Property Rights) to Synapto or such third party as Synapto may elect. The Merchant shall execute all such documents and do such things as Synapto may consider necessary to give effect to this Clause 16.1.

16.2The Merchant and Authorised Users may be able to store or transmit Merchant Data using one or more Services and the Services may interact with Merchant Systems. The Merchant hereby grants a royalty-free, non-transferable, non-exclusive licence for Synapto (and each of its direct and indirect sub-contractors including its Third-Party Partners) to use, copy and otherwise utilise the Merchant Data and Merchant Systems to the extent necessary to perform or provide the Services or to exercise or perform Synapto’s rights, remedies and obligations under this Agreement.

16.3To the extent Third-Party Software is made available to, or used by or on behalf of the Merchant or any Authorised User in connection with the use or provision of any Subscribed Service, such use of Third-Party Software shall be subject to any additional third party terms in accordance with Clause 9.2.

16.4Synapto may use any feedback and suggestions for improvement relating to the Services provided by the Merchant or any Authorised User without charge or limitation ("Feedback"). The Merchant hereby assigns (or shall procure the assignment of) all Intellectual Property Rights in the Feedback with full title guarantee (including by way of present assignment of future Intellectual Property Rights) to Synapto at the time such Feedback is first provided to Synapto.

16.5The Merchant hereby waives (and shall ensure all relevant third parties have waived) all rights to be identified as the author of any work, to object to derogatory treatment of that work and all other moral rights in the Intellectual Property Rights assigned to Synapto under this Agreement.

16.6If Synapto has reason to believe that a third-party claim may be brought by any third party alleging that the Synapto Services infringe any Intellectual Property Rights of a third party (an "IPR Claim"), Synapto may at its sole option and expense, and the Merchant shall permit Synapto to:

(a)modify or replace the Synapto Services to avoid infringement or alleged infringement; or

(b)terminate this Agreement.

16.7Subject to Clause 19.5, the provisions of this Clause 16 set out the Merchant’s sole and exclusive remedy (howsoever arising, including in contract, tort, negligence or otherwise) for any IPR Claim.

18.1The Merchant shall indemnify Synapto and its Affiliates against all losses, damages, liabilities, fines, penalties, costs (including reasonable legal and professional fees) and expenses arising out of or in connection with:

(a)any breach by the Merchant or its Authorised Users of Clause 6 (Limitations on use), the Acceptable Use Policy, Clause 24 (Data protection) or Clause 25 (Card security and stored cards);

(b)the Merchant's goods or services, or any dispute between the Merchant and any of its customers (including in relation to refunds and chargebacks);

(c)any claim by a third party that the Merchant Data, or Synapto's use of it in accordance with this Agreement, infringes that third party's rights; or

(d)the Merchant's breach of applicable law.

18.2Synapto shall notify the Merchant promptly of any third-party claim for which it intends to seek an indemnity, take reasonable steps to mitigate its losses, and not settle any such claim without the Merchant's prior consent (not to be unreasonably withheld or delayed).

18.3This Clause 18 is without prejudice to Synapto's other rights and remedies under this Agreement.

20.1Synapto may suspend access to the Services (or any part) to all or some of the Authorised Users if:

(a)Synapto suspects that there has been any misuse of the Services or breach of this Agreement;

(b)the Merchant fails to pay any sums due to Synapto by the due date for payment; or

(c)required by law, by court or governmental or regulatory order.

20.2Fees shall remain payable during any period of suspension notwithstanding that the Merchant or some or all of the Authorised Users may not have access to the Services.

22.1Immediately on termination or expiry of this Agreement (for any reason):

(a)the licences and rights granted by Synapto shall terminate and the Merchant shall (and, if applicable, shall procure that each Authorised User shall) stop accessing and using the Subscribed Services via the Synapto Platform (and ensure that any Authorised Users stop accessing and using the Subscribed Services via the Synapto Platform);

(b)any Subscribed Services provided by Synapto (and not by a Third-Party Partner) shall cease;

(c)Synapto may delete or suspend access to any accounts that the Merchant holds with Synapto and any Authorised User accounts;

(d)the Merchant is not entitled to a refund or other payment, except as otherwise stated in the relevant Subscribed Service Specific Terms; and

(e)Merchant Data will be treated in accordance with Clause 23.5.

22.2The Merchant shall be responsible for backing up the Merchant Data regularly and extracting it from the Synapto Platform prior to the termination or expiry of this Agreement.

22.3Termination or expiry of this Agreement shall not affect any accrued rights and liabilities of either party at any time up to the date of termination or expiry and shall not affect any provision of this Agreement that is expressly or by implication intended to continue beyond termination.

22.4In the event of the termination or expiry of this Agreement or any part of it, the Merchant's engagements with Third-Party Partners shall continue in accordance with the relevant Third-Party Terms except the Merchant shall no longer be entitled to receive the Subscribed Services (or the related Synapto Services) which are impacted by the termination (or partial termination) via the Synapto Platform. The Merchant will need to liaise with the relevant Third-Party Partner in relation to the on-going use of such Subscribed Services.

22.5Any Clause which by its nature is intended to survive termination or expiry of this Agreement shall survive the termination or expiry of this Agreement.

24.1Each party shall comply with Data Protection Legislation in connection with this Agreement.

24.2The parties acknowledge that:

(a)the Merchant is the controller and Synapto is the processor of Customer Personal Data;

(b)Synapto is a controller of the personal data of the Merchant's directors, officers, owners, Authorised Users and other personnel which it processes to onboard and verify the Merchant, manage the Merchant's account, prevent fraud and financial crime and comply with its legal obligations, as described in Synapto's privacy notice at https://www.synaptopay.com/privacy-policy; and

(c)where Synapto shares personal data with a Third-Party Partner at the Merchant's request or in order to provide a Subscribed Service, the Third-Party Partner processes that personal data as an independent controller in accordance with the relevant Third-Party Terms.

24.3The Merchant shall ensure that it has all lawful bases, notices and consents necessary (including any consent required to save a customer's card details) to enable the lawful processing of Customer Personal Data by Synapto and its Sub-processors under this Agreement, and that its instructions to Synapto comply with Data Protection Legislation.

24.4In relation to Customer Personal Data, Synapto shall:

(a)process it only on the documented instructions of the Merchant, which are set out in this Agreement and given by the Merchant's use and configuration of the Services, unless required to do otherwise by applicable law (in which case Synapto shall inform the Merchant of that legal requirement before processing, unless that law prohibits it from doing so);

(b)inform the Merchant promptly if, in its opinion, an instruction infringes Data Protection Legislation;

(c)ensure that all persons authorised to process it are subject to appropriate obligations of confidentiality;

(d)implement appropriate technical and organisational measures to protect it in accordance with Article 32 of the UK GDPR, including encryption of Customer Personal Data in transit and at rest;

(e)taking into account the nature of the processing, assist the Merchant by appropriate technical and organisational measures, insofar as this is possible, in responding to requests from data subjects to exercise their rights under Data Protection Legislation;

(f)assist the Merchant in ensuring compliance with its obligations under Articles 32 to 36 of the UK GDPR, taking into account the nature of the processing and the information available to Synapto;

(g)notify the Merchant without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, and provide such information as the Merchant reasonably requires to meet its own notification obligations;

(h)at the Merchant's choice, delete or return Customer Personal Data at the end of the provision of the Services in accordance with Clause 23.5, unless applicable law requires its storage; and

(i)make available to the Merchant all information reasonably necessary to demonstrate compliance with this Clause 24 and allow for and contribute to audits in accordance with Clause 24.7.

24.5The Merchant gives Synapto general authorisation to engage Sub-processors. The Sub-processors engaged at the date of this Agreement are listed in Part B of Schedule 1. Synapto shall:

(a)give the Merchant at least 30 days' notice of any intended addition or replacement of a Sub-processor, during which the Merchant may object on reasonable data protection grounds and, if the parties are unable to resolve the objection, terminate this Agreement by written notice before the change takes effect;

(b)impose on each Sub-processor, by written contract, data protection obligations which are no less protective than those set out in this Clause 24; and

(c)remain liable to the Merchant for the performance of each Sub-processor's obligations.

24.6Synapto shall not transfer Customer Personal Data outside the United Kingdom (including to a Sub-processor) unless the transfer is to a country or framework covered by adequacy regulations under Data Protection Legislation (including the UK Extension to the EU-US Data Privacy Framework) or is subject to appropriate safeguards under Article 46 of the UK GDPR, such as the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

24.7Synapto shall respond to the Merchant's reasonable written requests for information, including security questionnaires, relating to its processing of Customer Personal Data. The Merchant (or an independent auditor appointed by it and bound by obligations of confidentiality) may carry out an on-site audit of Synapto's compliance with this Clause 24 no more than once in any 12-month period, on at least 30 days' written notice, during Synapto's normal business hours and at the Merchant's cost, but only where:

(a)the information made available by Synapto is reasonably insufficient to demonstrate its compliance with this Clause 24;

(b)a personal data breach affecting Customer Personal Data has occurred; or

(c)an audit is required by a regulator or supervisory authority.

26.1Synapto shall maintain the confidentiality of the Merchant Data and shall not without the prior written consent of the Merchant or in accordance with this Agreement, disclose or copy the Merchant Data other than as necessary for the performance of the Services or its express rights and obligations under this Agreement.

26.2The Merchant shall keep Synapto's and any Third-Party Partner's Confidential Information secret and treat such Confidential Information with the same level of security, skill and care that it applies to its own Confidential Information, but in no event less than a reasonable degree of care. The Merchant shall not at any time disclose to any person any of Synapto's or its Third-Party Partner's Confidential Information except as permitted by Clause 26.3. The Merchant will only use Synapto's and any Third-Party Partner's Confidential Information solely for the purpose of receiving the Services provided under this Agreement (or in the case of a Third-Party Partner's Confidential Information, the Subscribed Services provided under the relevant Third-Party Terms).

26.3Synapto and the Merchant (in each case, the "Recipient") may disclose Confidential Information (including Merchant Data):

(a)to their employees, officers, representatives, contractors, subcontractors or advisers who need to know such information for the purposes of exercising the Recipient's rights and/or performing its obligations under or in connection with this Agreement; and

(b)as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority, provided that in all of the cases set out in this Clause 26.3(b) the Recipient proposing disclosure, will (i) to the extent legally permissible, exercise reasonable efforts to notify the other party prior to such disclosure, and (ii) co-operate with any reasonable endeavours, as permitted by applicable law, by the other party to limit disclosure or seek protection against disclosure; and

(c)where Synapto is the Recipient, to a Third-Party Partner for the purpose of Synapto performing its obligations under this Agreement.

26.4The provisions of this Clause 26 shall not apply to information which:

(a)is or comes into the public domain through no fault of the Recipient, its officers, employees, agents or contractors;

(b)is lawfully received by the Recipient from a third party free of any obligation of confidence at the time of its disclosure;

(c)is independently developed by the Recipient (or any of its Affiliates or any person acting on its or their behalf), without access to or use of such Confidential Information; or

(d)is required by law, by court or governmental or regulatory order to be disclosed.

26.5This Clause 26 shall survive the termination or expiry of our Agreement for a period of two years.

28.1Any notice given by a party under this Agreement shall be:

(a)in writing and in English;

(b)signed by, or on behalf of, the party giving it (except for notices sent by email); and

(c)where sent to the Merchant, the address provided to Synapto by the Merchant when the Merchant registered to access the Services.

28.2Notices may be given, and are deemed received:

(a)by hand: on receipt of a signature at the time of delivery;

(b)by Royal Mail Recorded Signed For post: at 9.00 am on the second Business Day after posting;

(c)by email: if sent before 5.00 pm on a Business Day, at the time of transmission; otherwise at 9.00 am on the next Business Day.

28.3Notices and other communications sent to Synapto shall be sent to:

28.3.1 Synapto Ltd, for the attention of the Chief Operating Officer, 9a Crosswall, London, EC3N 2JY; email: help@synaptopay.com This clause does not apply to notices given in legal proceedings or arbitration.

30.1Synapto may at any time assign, sub-contract, transfer, mortgage, charge, declare a trust of or deal in any other manner with any or all of Synapto’s rights or obligations under this Agreement, provided that Synapto gives the Merchant prior written notice.

30.2Except as expressly permitted by this Agreement, the Merchant shall not assign, transfer, sub-licence, mortgage, charge, declare a trust of or deal in any other manner with any or all of the Merchant rights or obligations under this Agreement (including the licence rights granted), in whole or in part, without Synapto’s prior written consent.

32.1If any provision of this Agreement (or part of any provision) is or becomes illegal, invalid or unenforceable, the legality, validity and enforceability of any other provision of this Agreement shall not be affected.

32.2If any provision of this Agreement (or part of any provision) is or becomes illegal, invalid or unenforceable but would be legal, valid and enforceable if some part of it was deleted or modified, the provision or part-provision in question shall apply with such deletions or modifications as may be necessary to make the provision legal, valid and enforceable. In the event of such deletion or modification, the parties shall negotiate in good faith in order to agree the terms of a mutually acceptable alternative provision.

34.1The Merchant shall comply with all applicable laws and shall maintain such authorisations and approvals as required from time to time to perform its obligations under or in connection with this Agreement.

34.2Without prejudice to the generality of Clause 34.1, the Merchant shall comply with all applicable laws, rules, and regulations governing export that apply to the Services and the Merchant Data (or any part), and shall not export or re-export, directly or indirectly, separately or as a part of a system, the Services or the Merchant Data (or any part) to, or access or use the Services or the Merchant Data (or any part) in, any country for which an export licence or other approval is required, without first obtaining such licence or other approval. The Merchant shall be solely responsible for ensuring its access, importation or use of the Services and the Merchant Data in or into any part of the Territory or elsewhere complies with all export laws.

34.3The Merchant shall, and shall ensure that its directors, officers and employees shall, comply with all applicable anti-bribery and anti-corruption laws (including the Bribery Act 2010) and all applicable economic and trade sanctions laws and regulations.

34.4The Merchant warrants that neither it nor any of its directors, officers or ultimate beneficial owners is a person or entity that is the subject of sanctions or is listed on any applicable sanctions list ("Sanctioned Person"), and shall notify Synapto promptly if this warranty ceases to be true. Synapto may suspend or terminate the provision of any of the Services where it reasonably considers that continuing to provide them would cause Synapto or any Third-Party Partner to breach applicable sanctions, anti-bribery or financial crime laws.

Each party represents and warrants to the other that it has the right, power and authority to enter into our Agreement and grant to the other the rights (if any) contemplated in this Agreement and to perform its obligations under this Agreement.

Part A: Description of the processing of Customer Personal Data

Part B: Sub-processors