ZAP Philippines - The No. 1 Loyalty Program in the Philippines

MERCHANT AGREEMENT WITH ZAP

ZAP has developed, owns, and operates an online platform with various modules and functionalities that market and promote goods and services
ZAP has offered the use of the online platform and its various modules and functionalities to Merchant and Merchant has accepted ZAP’s offer under the terms and conditions of this Agreement

For and in consideration of the foregoing premises and the terms hereafter set forth, the Parties agree as follows:

Definition of Terms
1. Agreement refers to this Agreement including its annexes and schedules, as may be amended from time to time.
2. Effective Date shall have the meaning set out in clause 5.
3. Term shall have the meaning set out in clause 5.
4. Module refers to a specific functionality or feature of the Platform made available by ZAP to Merchant, such as but not limited to ZAP Loyalty and ZAP E-Store. The terms and conditions governing a Module are set out in the relevant annexures.
5. Platform refers to the online platform developed by and owned and operated by ZAP, including its various Modules that market and promote goods and services
6. Device refers to a phone, computer or tablet provided by Merchant for use with the Platform.
7. ZAP POS App refers to the application developed by and owned and operated by ZAP, which the Merchant must install on its Device in order to access and use the Platform.
8. ZAP Account refers to an online active account with ZAP.
9. ZAP Transaction refers to a transaction of a ZAP User that is processed through the Platform or a Module.
Scopes of Services
1. Use of the Platform. ZAP shall grant Merchant access to and use of the Platform and Merchant agrees to access and use the Platform in accordance with the terms hereof.
2. Technical Requirements. The Platform requires a Device with an internet connection. Merchant shall be responsible for obtaining and maintaining the Device and internet connection for each of its branches. ZAP shall not be liable should Merchant be unable to access the Platform due to a defective Device or internet connection.
3. Future Enhancements. ZAP shall have the right, at its sole discretion, to further enhance and develop the Platform and/or to add, remove or modify any Module from time to time. If such modification shall negatively impact the Merchant’s program or operations, ZAP shall inform the Merchant at least 7 days beforehand.
4. Merchant’s Access and Information. Merchant shall be solely responsible for the use of Merchant’s ZAP Account, Device, ZAP POS App, the Platform and Modules.
5. Transaction Credits. Transactions in a Module such as (but not limited to) earning or redeeming points or other activities as may be prescribed by ZAP, have the equivalent value of one (1) credit (Transaction Credit). Merchant will be unable to perform transactions on the Platform and/or Module unless it has sufficient Transaction Credits in its ZAP Account. Unused Transaction Credits will expire and be forfeited at the termination of this Agreement.
Term
1. This Agreement shall take effect upon registration of the ZAP Account (the Effective Date), and shall remain in effect until Merchant deactivates its ZAP Account (the Term).
Representations Each Party represents and warrants to the other Party that:
1. it has full power and authority to enter into, execute, and deliver this Agreement
2. the execution, performance and delivery of this Agreement and any other instrument or transaction pursuant hereto, have been duly authorized by all requisite action.
Intellectual Property
1. Information. Information collected and stored by ZAP pursuant to this Agreement shall be the shared property of ZAP and Merchant. ZAP shall ensure Merchant has full access to such information, including the ability to export the same, for the Term of this Agreement. ZAP shall keep such information strictly confidential and shall not share any merchant or user identifiable data with any third party. In handling such information, each of ZAP and Merchant undertake that it shall comply with Republic Act No. 10173 (the Data Privacy Act) and its implementing rules and regulations.
2. Compliance with Intellectual Property laws. The Merchant warrants and represents that it shall only use the Platform for lawful and legitimate purposes. In accordance with Section 9.8, Merchant shall be solely responsible and shall hold ZAP free and harmless for any fraud and/or misrepresentation connected to Merchant’s use of the Platform, including Merchant’s use of any intellectual property rights.
3. Other Intellectual Property. All processes, systems, software, applications, procedures, and methods developed by ZAP in relation to the delivery of its obligations under this Agreement, and all intellectual property rights connected thereto are the sole property of ZAP.
Default
1. Breach. In case of a Party’s breach (the Defaulting Party) of any or all conditions, covenants or terms of this Agreement, the Defaulting Party shall have ten (10) days from being notified of such breach to cure and rectify the same (the Cure Period). If the Defaulting Party does not remedy the breach within the Cure Period, the other Party (the Non-Defaulting Party) shall have the right to terminate this Agreement by giving written notice thereof to the Defaulting Party.
2. Interest. Without prejudice to the right of the Non- Defaulting Party to terminate this Agreement, any and all amounts that remain unpaid after the relevant due date shall incur a penalty interest equivalent to three percent (3%) per month until full payment thereof.

Data Privacy

The Parties hereby adhere to the provisions of Republic Act 10173, otherwise known as the Data Privacy Act of 2012, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (collectively, “DPA”), recognizing the importance of appropriate privacy protections for consumer data.
Relationship of the Parties under the DPA. During the effectivity of this Agreement, ZAP acts as the personal information processor, and collects, stores, and otherwise processes personal data upon the instruction and control of the Merchant, who acts as the personal information controller.
Data Outsourcing Arrangement. ZAP, as personal information processor, shall collect and process the personal data of the registered users of the Platform on behalf of the Merchant. Merchant may access such information through its ZAP Account on the Platform and on any of the Modules.
Purpose of the Processing. During the effectivity of this Agreement, ZAP shall process the personal data on behalf of the Merchant only for the following purposes:
1. Storage of the data for access by the Merchant
2. Demographic analysis
3. Market analysis
4. Operation of ZAP Loyalty
5. To address customer concerns with regard to the Platform
6. To carry out ZAP’s lawful business activities, including company audits or investigation of a complaint or security threat
7. To comply with statutory and regulatory requirements, including directives, issuances by, or obligations of ZAP to any competent authority, regulator, supervisory body, enforcement agency, exchange, court, quasi-judicial body or tribunal;
8. To enable ZAP to exercise sound corporate governance over its businesses, ensure that risks arising therefrom are duly identified, measured, managed and mitigated, and enhance risk assessment and prevent fraud;
9. Establish, exercise, or defend legal claims; and
10. Fulfill any other purposes directly related or necessary to the performance of the above-stated purposes.
Personal Data to be Collected and Processed on Behalf of Merchant

Customer Data: Name, Gender, Date of Birth, Mobile Number, Email Address, City, Membership Date, Member ID, Transaction History with Merchant
Other Customer Data as instructed to be collected and processed by Merchant

Geographic Location of the Processing. Personal data is collected and processed in the country where the Merchant resides. The same Personal Data is stored by ZAP’s cloud storage service provider, Amazon Services Cloud, wherever its servers are located.
Obligations of ZAP. During the effectivity of this Agreement, ZAP shall:
1. Process the personal data only upon the documented authorization of the Merchant, including transfers of personal data to another country or an international organization, unless such transfer is authorized by law;
2. Ensure that an obligation of confidentiality is imposed on persons authorized to process the personal data;
3. Implement appropriate security measures and comply with the DPA;
4. Not engage another processor without prior authorization from the Merchant: Provided, that any such engagement shall ensure that the same obligations for data protection under the contract or legal act are implemented, taking into account the nature of the processing;
5. Not share the data with another controller without prior instruction from the Merchant;
6. Assist the Merchant, by appropriate technical and organizational measures and to the extent possible, fulfill the obligation to respond to requests by data subjects relative to the exercise of their rights;
7. Assist the Merchant in enforcing any practices and/or policies that the merchant may employ or adopt to ensure compliance with the DPA, taking into account the nature of processing and the information available to ZAP;
8. Make available to the Merchant all information necessary to demonstrate compliance with the obligations laid down in the DPA, and allow for and contribute to data privacy-related audits, including inspections, conducted by the Merchant or another auditor mandated by the latter;
9. Immediately inform the Merchant if, in its opinion, an instruction infringes the DPA.
10. As soon as practicable and within a reasonable period, report security incidents to the Merchant.
11. Implement the following information security measures:
  1. Secure hashing of customer credentials.
  2. Customer login controls to prevent brute force logins and password recovery.
  3. Automated application of security related OS and application fixes.
  4. Utilization of application and employee specific keys to limit per access to the infrastructure.
  5. Two-Factor Authentication requirement for ZAP employees with access to private infrastructure.
  6. Private network to disallow public server access to private components of the infrastructure.
Indemnity
1. The Merchant agrees to indemnify ZAP and its directors and employees, and to hold them free and harmless from and against any and all claims, threats, suits, damages, penalties, liabilities, costs and expenses (including, without limitation, legal fees, costs and disbursements) incurred, suffered or expended by or threatened against ZAP arising from or in connection with the performance and carrying-out of the Merchant’s instructions, save where such losses arose as a result of the gross negligence and willful misconduct on the part of ZAP.
2. The Merchant agrees to hold ZAP and its directors and employees, as non-parties to any agreement the Merchant may have with the customer, free and harmless from and against any and all claims, threats, suits, damages, penalties, liabilities, costs and expenses (including, without limitation, legal fees, costs and disbursements) incurred, suffered or expended by or threatened against ZAP arising from or in connection with any agreement the Merchant may have with the customer.
Data Sharing Agreement. Upon the termination or expiration of this Agreement, the Parties agree and understand that the Merchant shall cease to be the personal information controller and ZAP shall cease to be the Merchant’s personal information processor. Any data retained by ZAP after such termination or expiration shall be covered by a data sharing agreement, substantially in the form attached as Annex C, and any processing by ZAP shall be made in its capacity as a personal information controller.

Personal Data of Merchant Personnel. Merchant warrants that it has obtained the consent of its personnel to disclose their personal Data to ZAP pursuant to this Agreement.

The following personal data shall be disclosed by the Merchant to ZAP, including but not limited to:

Merchant Details	Brand Name Company Name Company Contact Number Company Email Address	Name of Point Person Position of Point Person Contact Number of Point Person Email Address of Point Person
Merchant Contract	Name of Merchant Authorized Representative / Signatory Position of Merchant Authorized Representative / Signatory Signature of Merchant Authorized Representative
Merchant Access Database	Merchant / Branch Name of Person with Access to Merchant Dashboard Account Position of Person with Access to Merchant Dashboard Account Contact Number of Person with Access to Merchant Dashboard Account Email Address of Person with Access to Merchant Dashboard Account Name of Branch Contact Person Position of Branch Contact Person Email Address of Branch Contact Person Contact Number of Branch Contact Person ZAP Dashboard Login
Employee Access Database	Name of Employee Position of Employee Mobile Number of Employee ZAP Staff Code

Such personal data shall only be used to fulfill the obligations of this Agreement. Notwithstanding the items enumerated in Section 9.10.1, ZAP reserves the right to request further information from the Merchant, as ZAP deems necessary and reasonable.

Miscellaneous
1. Relationship of the Parties. The relationship between the Parties is that of independent contractors. Nothing herein shall be construed as creating a partnership, agency, joint venture, or employee-employee relationship between the Parties.
2. Entire Agreement. This Agreement constitutes the whole agreement between the Parties and supersedes any previous agreements or arrangements, oral or written, between them relating to the subject matter hereof. No variations of this Agreement shall be effective unless made in writing and signed by the Parties.
3. Severability. If any provision or part of a provision of this Agreement shall be or be found by any authority or court of competent jurisdiction to be, invalid or unenforceable, such invalidity or unenforceability shall not affect the other provisions or parts of such provisions of this Agreement, all of which shall remain in full force and effect.
4. No Waiver. No failure of the Parties to exercise, and no delay or forbearance in exercising, any right or remedy in respect of any provision of this Agreement shall operate as a waiver of such right or remedy.
5. Assignment. This Agreement and a Party’s rights, interests and obligations herein shall not be assigned to other persons.
6. Counterparts. This Agreement may be executed in one or more counterparts, and by the Parties on separate counterparts, and each such counterpart shall constitute an original of this Agreement, but all the counterparts shall together constitute one and the same instrument.
7. Governing Law and Venue. This Agreement will be governed, construed and enforced in accordance with Philippine law. In the event of any dispute arising from or in connection with this Agreement, the appropriate court in Makati City shall have exclusive jurisdiction over the case to the exclusion of all other courts.