Cardholder Data. (a) As between Bank and Dillard's, Cardholder Data shall be the property of and exclusively owned by Bank. Dillard's acknowledges and agrees that it has no proprietary interest in the Cardholder Data. (b) Bank's privacy policy applicable to the Cardholder Data is the Program Privacy Policy. Any modifications to the Program Privacy Policy shall be approved by the Marketing Committee, provided that the Program Privacy Policy shall comply with Applicable Law at all times. (c) Bank shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.11. Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting customers listed in the Cardholder Data for Private Label Credit Cards, Enhancement Products listed in Schedule 4.11, and any other products and services approved by the Marketing Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein. (d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.11. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder Data. Bank may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely: (i) to its subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.11, provided that each such subcontractor agrees to be bound by this Section 4.11, or a comparable contractual commitment with the same effect; (ii) to its Affiliates and its Affiliates' employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section; provided that (A) any such Person is bound by terms substantially similar to this Section as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of each such Person with the terms of this Section; or (iii) to any Governmental Authority with authority over Bank (A) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, Bank (1) provides at least 10 Business Days' prior notice of such proposed disclosure to Dillard's if reasonably possible under the circumstances and (2) seeks to redact Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure. (e) Subject to Applicable Law and the Program Privacy Policy, Bank shall report to Dillard's on a weekly basis, in a format agreed to by the parties in advance, (i) for any customer who has applied for a Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card and did not opt out, regardless of the marketing channel of such application, the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer. (ii) for any Cardholder, (1) the Cardholder's name, address, email address, telephone number, social security number and Account number;
Appears in 1 contract
Sources: Private Label Credit Card Program Agreement (Dillards Inc)
Cardholder Data. (a) As between Bank and Dillard'sBon-Ton, subject to Section 2.16, the Cardholder Data shall be the property of and exclusively owned by Bank. Dillard's Bon-Ton acknowledges and agrees that it has no proprietary interest in the Cardholder Data.
(b) Bank's privacy policy applicable to the Cardholder Data is the Program Privacy Policy. Any modifications to the Program Privacy Policy shall be approved by the Marketing Committee, provided that the Program Privacy Policy shall comply with Applicable Law at all times.
(c) Bank shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.11. Bank may use the Cardholder Data in compliance with this Agreement, Applicable Law and the privacy policy adopted by Bon-Ton and Bank for the Program ("Program Privacy Policy solely (i) for purposes of soliciting customers listed in the Cardholder Data for Private Label Credit Cards, Enhancement Products listed in Schedule 4.11, and any other products and services approved by the Marketing Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable LawPolicy"). Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein.
(db) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.11. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder Data. Bank may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.11Data, provided that each such subcontractor agrees to be bound by this Section 4.112.15, or a comparable contractual commitment with the same effect;
(ii) to its Affiliates and its Affiliates' employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section; provided that (A) any such Person is bound by terms substantially similar to this Section as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of each such Person with the terms of this Section; or
(iii) to any Governmental Authority governmental authority with authority over Bank (A) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the fullest extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, Bank (1) provides at least 10 Business Days' prior notice of such proposed disclosure to Dillard's if reasonably possible under the circumstances and (2) seeks to redact Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure.
(ec) Subject to Applicable Law and the Program Privacy Policy, Bank shall report to Dillard's Bon-Ton on a weekly Monthly basis, or such shorter period as reflected on Schedule 2.7(g) in a format agreed to by the parties in advance,:
(i) for any customer who has applied for a Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card and did not opt out, regardless of the marketing channel of such application, the customer's name, address, email addressaddress (if applicable), telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.; and
(ii) for any Cardholder, (1) the Cardholder's name, address, email address, telephone number, social security number and Account number;
Appears in 1 contract
Cardholder Data. (a) As between Bank and Dillard'samong the Parties hereto, the Cardholder Data shall be the property of and exclusively owned by the Bank. Dillard's The Company acknowledges and agrees that that, subject to its rights pursuant to Section 17.2, it has no proprietary interest in the Cardholder Data.
(b) Bank's privacy policy The Program Privacy Policy applicable to the Cardholder Data is the Program Privacy Policyattached as Schedule 6.2(b) hereto. Any modifications to the Program Privacy Policy shall be approved by the Marketing Strategic Operating Committee, provided that that, the Program Privacy Policy shall comply with Applicable Law at all timestimes and shall not provide for any reduction in the access to, or disclosure or use of Cardholder Data by the Company and its Affiliates as compared with the Program Privacy Policy in effect on the Effective Date.
(c) Bank shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.11. The Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting customers listed in the Cardholder Data for Private Label Credit Cards, Enhancement Products listed in Schedule 4.11, and any other products and services approved by the Marketing Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein****).
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.11. The Bank shall not, directly or indirectly, sell sell, transfer, or otherwise transfer any right in rent (or permit others to do same), the Cardholder Data, and shall not, directly or indirectly, disclose the Cardholder Data, except for disclosure in compliance with Applicable Law and the Program Privacy Policy solely: (****)
(e) From and after the Effective Date, subject to Applicable Law and the Program Privacy Policy, the Bank shall provide the Company with unlimited access, through the Bank’s data analysts, to all Cardholder Data obtained by the Bank in connection with the Program, which includes at least the items listed below as set forth in greater detail on Schedule 6.2(e). In addition, subject to Applicable Law, and as reasonably requested by the Company, the Bank shall provide the Company with an updated copy of the master file or such elements thereof as may be requested by the Company. (****) (****)
(f) (****)
(g) (****)
(h) The Company may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its subcontractors Service Providers authorized in accordance with this Agreement solely on a “need to know” basis in connection with a permitted use of such the Cardholder Data under this pursuant to Section 4.11, provided that each such subcontractor agrees to be bound by this Section 4.11, or a comparable contractual commitment with the same effect;6.2(g)(****)
(ii) to its Affiliates (including, for this purpose, the ▇▇▇▇ Group) and its Affiliates' employees, agents, attorneys and accountants with their Representatives on a “need to know such Cardholder Data know” basis in connection with a permitted use of such the Cardholder Data under this Section; provided that pursuant to Section 6.2(g)(A) any such Person is bound by terms substantially similar to this Section as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of each such Person with the terms of this Section; or****)
(iii) to any Governmental Authority with authority over Bank the Company or its Affiliates, or their respective Service Providers (A****)
(iv) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent as otherwise permitted by Applicable Law, Bank (1) provides at least 10 Business Days' prior notice of such proposed disclosure to Dillard's if reasonably possible under the circumstances and (2) seeks to redact Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure.
(e) Subject to Applicable Law and the Program Privacy Policy, Bank shall report to Dillard's on a weekly basis, in a format agreed to by the parties in advance,; (****).
(i) for any customer who has applied for a Credit CardWith respect to the sharing, had the opportunity to make an opt out choice, was not approved for a Credit Card use and did not opt out, regardless disclosure of the marketing channel Cardholder Data following the termination of such applicationthis Agreement:
(i) the rights and obligations of the Parties under this Section 6.2 shall continue through any Termination Period and, the customer's nameif applicable, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.any interim servicing period pursuant to Section 17.2(h);
(ii) if the Company exercises its purchase rights under Section 17.2, the Bank shall transfer its right, title and interest in the Cardholder Data to the Company or its Nominated Purchaser as part of such transaction, and the Bank’s right to use and disclose the Cardholder Data shall terminate upon the termination of the Termination Period and, promptly following such termination of the Termination Period, the Bank shall return or destroy all Cardholder Data and shall certify such return or destruction to the Company upon request; provided, however, that, if the Bank is obligated to retain any Cardholder Data pursuant to requirements of Applicable Law or the Bank’s disaster recovery plan, or internal retention policies, the Bank shall maintain the strict confidentiality and security of such Cardholder Data and shall not use such Cardholder Data for any Cardholderother purpose; provided further, that if the Bank is performing interim servicing for the Nominated Purchaser pursuant to Section 17.2(h), the Bank may continue to use Cardholder Data to the extent necessary to perform such servicing; and
(1iii) if the Cardholder's nameCompany provides notice that it shall not exercise its purchase rights under Section 17.2, addressor otherwise fails to exercise its option within the time period specified in Section 17.2, email addressthe Company’s right to use and disclose the Cardholder Data shall terminate, telephone numberand the restrictions hereunder on the Bank’s use and disclosure of Cardholder Data shall terminate, social security number except that in no event may the Bank or any of its Affiliates disclose Cardholder Data to any retailer or use Cardholder Data in any way for the benefit of any retailer or retail credit card program or in any manner inconsistent with the limitations on the Bank’s rights to dispose of the Program Assets pursuant to Section 17.4. The foregoing provisions shall in no way be construed as to extend the Bank’s rights to use the Company Licensed Marks, the Company’s name or any Intellectual Property of the Company, all of which rights shall be expressly limited as set forth in Article X and Account number;shall terminate as set forth in Section 17.4(c).
Appears in 1 contract
Sources: Credit Card Program Agreement (Signet Jewelers LTD)
Cardholder Data. (a) As between Bank and Dillard'samong the Parties hereto, the Cardholder Data shall be the property of and exclusively owned by CEBA Bank. Dillard's acknowledges and agrees that it has no proprietary interest in the Cardholder Data.
(b) Bank's The privacy policy applicable notice provided to Cardholders pursuant to the Cardholder Data is the Program Privacy Policy. Any modifications to ▇▇▇▇▇-▇▇▇▇▇-▇▇▇▇▇▇ Act constituting part of the Program Privacy Policy shall be approved by in the Marketing Committee, provided that form attached hereto as Schedule 6.2(b). Any changes to such privacy notice or to the Program Privacy Policy described therein shall comply be made only in accordance with Applicable Law at all timesArticle III.
(c) Bank shall not use, or permit to be used, the Cardholder Data, except as provided in this Section 4.116.2. Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting soliciting, marketing or servicing (in each case, solely as directed by the FDS Companies or the Operating Committee) customers listed in the Cardholder Data for Private Label FDS Credit Cards, Enhancement Products listed in Schedule 4.11Approved Ancillary Products, and any other products and services approved by the Marketing Operating Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunderhereunder (including its rights to use such information as contemplated by Section 16.4), or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein.
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.116.2. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder DataData other than to FDS or any of its Affiliates or to a Nominated Purchaser pursuant to Section 16.2. Bank may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its authorized subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.116.2, provided that each such authorized subcontractor agrees in writing to maintain all such Cardholder Data as strictly confidential in perpetuity and not to use or disclose such information to any Person other than Bank or an FDS Company, except as required by Applicable Law or any Governmental Authority (after giving Bank and the FDS Companies prior notice and an opportunity to defend against such disclosure); provided, further, that each such authorized subcontractor maintains, and agrees in writing to maintain, an information security program that is designed to meet the objectives of the Guidelines, including, at a minimum, maintenance of an information security program that is designed to: (w) ensure the security and confidentiality of the Cardholder Data; (x) protect against any anticipated threats or hazards to the security or integrity of the Cardholder Data; (y) protect against unauthorized access to or modification, destruction, disclosure or use of the Cardholder Data; and (z) ensure the proper disposal of Cardholder Data; and provided, further, that each such authorized subcontractor agrees to be bound by this Section 4.11notify promptly Bank and the FDS Companies of any unauthorized disclosure, use, or a comparable contractual commitment disposal of, or access to, Cardholder Data and to cooperate with Bank and the same effectFDS Companies in any investigation thereof and remedial action with respect thereto;
(ii) to its Affiliates Affiliates, and its and such Affiliates' ’ employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this SectionSection 6.2; provided that (A) any such Person is bound by terms substantially similar to this Section 6.2 as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of by each such Person with the terms of this SectionSection 6.2; or
(iii) to any Governmental Authority with authority over Bank (A) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, Bank (1) provides at least 10 ten (10) Business Days' ’ prior notice of such proposed disclosure to Dillard's FDS if reasonably possible under the circumstances circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure; or
(iv) to any consumer reporting agency in accordance with the federal Fair Credit Reporting Act.
(e) Subject to Applicable Law and the Program Privacy Policy, Bank shall report transmit to Dillard's the FDS Companies on a weekly basisreal-time basis throughout each day by a secure data feed into FDS Systems designated by FDS from time to time, in a format formats agreed to by the parties Parties in advance,advance from time to time:
(i) for any customer who has applied for a an FDS Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card and did not opt out, regardless of the marketing channel of such application, : (A) the customer's ’s name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.; (B) an indication of whether or not the customer has been approved for an FDS Credit Card; and (C) if the customer has been approved for an FDS Credit Card, the FDS Credit Card issued (or to be issued) to such customer (i.e., specify the type of FDS Credit Card and the FDS Licensed ▇▇▇▇ to be used on such FDS Credit Card);
(ii) for any each Cardholder, joint-Cardholder and authorized buyer, (1A) the Cardholder's such person’s name, address, email address, telephone number, social security number and Account number; (B) any reported change to any of the foregoing information; (C) transaction and experience data; and (D) any such other Cardholder Data as the FDS Companies may reasonably request;
(iii) the Cardholder’s name and account number for any Account that is delinquent;
(iv) the Cardholder’s name and account number for any Account that has been closed; and
(v) the Cardholder Data for all categories of information available on the FDS Companies’ credit Systems as of the date hereof.
(f) Subject to Applicable Law and the Program Privacy Policy, Bank shall transmit by a secure data feed into FedCustomer (or other FDS Systems designated by FDS from time to time), in a format agreed to by the Parties, on an as billed basis, all information contained in the Billing Statements and all other Cardholder Data for all categories of information available on FedCustomer as of the date hereof (including, for each Cardholder, joint-Cardholder and authorized buyer, name, address, email address, telephone number, information as to creditworthiness and changes to any of the foregoing information).
(g) Bank shall reasonably cooperate with the FDS Companies to provide FDS and its Affiliates with the maximum ability permissible under Applicable Law and the Program Privacy Policy to receive, use and disclose the Cardholder Data, including, as reasonably necessary or appropriate, through use of consents, opt-in provisions or opt-out provisions, in each case as directed by the FDS Companies. Without limiting the foregoing, FDS and each of its Affiliates may receive, use and disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy (i) for purposes of promoting the Program or promoting FDS Goods and Services, (ii) as otherwise necessary to carry out its obligations under this Agreement, and (iii) as otherwise permitted by Applicable Law.
(h) The FDS Companies may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy. Each of the FDS Companies may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its existing subcontractors as of the Effective Date and to authorized subcontractors that enter into agreements with an FDS Company after the Effective Date (“Future Subcontractors”) in connection with a permitted use of such Cardholder Data under this Section 6.2, provided that each such Future Subcontractor agrees in writing to maintain all such Cardholder Data as strictly confidential in perpetuity and not to use or disclose such information to any Person other than an FDS Company or Bank, except as required by Applicable Law or any Governmental Authority (after giving the FDS Companies prior notice and an opportunity to defend against such disclosure); provided, further, that each such Future Subcontractor maintains, and agrees in writing to maintain, an information security program that is designed to meet the objectives of the Guidelines, including, at a minimum, maintenance of an information security program that is designed to: (w) ensure the security and confidentiality of the Cardholder Data; (x) protect against any anticipated threats or hazards to the security or integrity of the Cardholder Data; (y) protect against unauthorized access to or modification, destruction, disclosure or use of the Cardholder Data; and (z) ensure the proper disposal of Cardholder Data; and provided, further, that each such Future Subcontractor agrees to notify promptly Bank and the FDS Companies of any unauthorized disclosure, use, or disposal of, or access to, Cardholder Data and to cooperate with Bank and the FDS Companies in any investigation thereof and remedial action with respect thereto;
(ii) to its Affiliates, and its and such Affiliates’ employees, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section 6.2; provided that (A) any such Person is bound by terms substantially similar to this Section 6.2 as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) the FDS Companies shall be responsible for the compliance by each such Person with the terms of this Section 6.2; or
(iii) to any Governmental Authority with authority over such FDS Company (A) in connection with an examination of such FDS Company; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that such FDS Company seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, such FDS Company (1) provides at least ten (10) Business Days’ prior notice of such proposed disclosure to Bank if reasonably possible under the circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure.
(i) With respect to the sharing, use and disclosure of the Cardholder Data following the termination of this Agreement:
(i) the rights and obligations of the Parties under this Section 6.2 shall continue through any Termination Period;
(ii) if FDS exercises its rights under Section 16.2, Bank shall transfer its right, title and interest in the Cardholder Data to FDS or its Nominated Purchaser as part of such transaction, and Bank’s right to use and disclose the Cardholder Data shall terminate upon the termination of the Termination Period; and
(iii) if FDS provides notice that it shall not exercise its rights under Section 16.2, FDS and its Affiliates’ right to use and disclose the Cardholder Data hereunder shall terminate upon the termination of the Termination Period.
Appears in 1 contract
Cardholder Data. (a) As between Bank and Dillard'samong the Parties hereto, the Cardholder Data shall be the property of and exclusively owned by Bank. Dillard's acknowledges and agrees that it has no proprietary interest in the Cardholder Data.
(b) Bank's privacy policy The Program Privacy Policy applicable to the Cardholder Data is the Program Privacy Policyattached as Schedule 6.2 hereto. Any modifications to the Program Privacy Policy shall be approved by the Marketing Management Committee, provided that the Program Privacy Policy shall comply with Applicable Law at all times.
(c) Bank shall not use, or permit to be used, the Cardholder Data, except as provided in this Section 4.116.2. Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting or marketing (in each case, solely as directed by Pier 1 or the Management Committee) or servicing customers listed in the Cardholder Data for Private Label Pier 1 Credit Cards, Enhancement Products listed in Schedule 4.11Approved Ancillary Products, and any other products and services approved by the Marketing Management Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein.
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.116.2. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder DataData other than to Pier 1 or any of its Affiliates, or to its Nominated Purchaser or a successor of Bank by merger or acquisition. Bank may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its authorized subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.116.2, provided that each such authorized subcontractor agrees in a written agreement satisfactory to Pier 1 and Bank to maintain all such Cardholder Data as strictly confidential and not to use or disclose such information to any Person other than Bank or Pier 1, except as required by Applicable Law or any Governmental Authority (after giving Bank and Pier 1 prior notice and an opportunity to defend against such disclosure); provided, further, that each such authorized subcontractor maintains, and agrees in writing to maintain, an information security program that is designed to meet all requirements of Applicable Law, including, at a minimum, maintenance of an information security program that is designed to: (w) ensure the security and confidentiality of the Cardholder Data; (x) protect against any anticipated threats or hazards to the security or integrity of the Cardholder Data; (y) protect against unauthorized access to or use of the Cardholder Data; and (z) ensure the proper disposal of Cardholder Data; and provided, further, that each such authorized subcontractor agrees to be bound by this Section 4.11notify promptly Bank and Pier 1 of any unauthorized disclosure, use, or a comparable contractual commitment disposal of, or access to, Cardholder Data and to cooperate with the same effectBank and Pier 1 in any investigation thereof and remedial action with respect thereto;
(ii) to its Affiliates Affiliates, and its and such Affiliates' employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this SectionSection 6.2; provided that (A) any such Person is bound by terms substantially similar to this Section 6.2 as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of by each such Person with the terms of this Section; orSection 6.2;
(iii) to any Governmental Authority with authority over Bank (A) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the fullest extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, Bank (1) provides at least 10 ten (10) Business Days' prior notice of such proposed disclosure to Dillard's Pier 1 if reasonably possible under the circumstances circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure; or
(iv) to the extent permitted in the Risk Management Policies and Operating Procedures, to any consumer reporting agency in accordance with the federal Fair Credit Reporting Act.
(e) Subject Bank shall cooperate with Pier 1 to provide Pier 1 and its Affiliates with the maximum ability permissible under Applicable Law and the Program Privacy PolicyPolicy to receive, Bank shall report to Dillard's on a weekly basisuse and disclose the Cardholder Data, including, as necessary or appropriate, through use of consents or opt-out provisions, in a format agreed to each case as directed by Pier 1. Without limiting the parties foregoing, Pier 1 and its Affiliates may receive, use and disclose the Cardholder Data in advance,
compliance with Applicable Law and the Program Privacy Policy (i) for purposes of promoting the Program or promoting Pier 1 Goods and Services, (ii) as otherwise necessary to carry out its obligations under this Agreement, and (iii) as otherwise permitted by Applicable Law. Notwithstanding the foregoing, no Party hereto shall be required to provide any customer who has applied information on a personally identifiable basis if the provision of such personally identifiable information would cause such Party to be considered a "consumer reporting agency" for a Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card and did not opt out, regardless purposes of the marketing channel of such application, the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customerFair Credit Reporting Act.
(iif) for any CardholderIf Pier 1 or a Nominated Purchaser exercises its rights under Section 16.2, (1) Bank shall transfer its right, title and interest in the CardholderCardholder Data to Pier 1 or its Nominated Purchaser as part of such transaction, and Bank's name, address, email address, telephone number, social security number right to use and Account number;disclose the Cardholder Data shall terminate upon the termination of this Agreement.
Appears in 1 contract
Sources: Credit Card Program Agreement (Pier 1 Imports Inc/De)
Cardholder Data. (a) As between Bank and Dillard'samong the Parties hereto, the Cardholder Data shall be the property of and exclusively owned by the Bank. Dillard's The Company acknowledges and agrees that that, subject to its rights pursuant to Section 17.2, it has no proprietary interest in the Cardholder Data.
(b) Bank's privacy policy The Program Privacy Policy applicable to the Cardholder Data is the Program Privacy Policyattached as Schedule 6.2(b) hereto. Any modifications to the Program Privacy Policy shall be approved by the Marketing Strategic Operating Committee, provided that that, the Program Privacy Policy shall comply with Applicable Law at all timestimes and shall not provide for any reduction in the access to, or disclosure or use of Cardholder Data by the Company and its Affiliates as compared with the Program Privacy Policy in effect on the Effective Date.
(c) Bank shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.11. The Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting customers listed in the Cardholder Data for Private Label Credit Cards, Enhancement Products listed in Schedule 4.11, and any other products and services approved by the Marketing Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein[****].
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.11. The Bank shall not, directly or indirectly, sell sell, transfer, or otherwise transfer any right in rent (or permit others to do same), the Cardholder Data, and shall not, directly or indirectly, disclose the Cardholder Data, except for disclosure in compliance with Applicable Law and the Program Privacy Policy solely:
(i) [****].
(e) Subject to Applicable Law and the Program Privacy Policy, the Bank shall provide the Company with unlimited access, through the Bank’s data analysts, to all Cardholder Data obtained by the Bank in connection with the Program, which includes at least the items listed below as set forth in greater detail on Schedule 6.2(e). Bank In addition, subject to Applicable Law, and as reasonably requested by the Company, [****]:
(i) [****]. [****]
(f) [****].
(g) [****].
(h) The Company may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its subcontractors Service Providers authorized in accordance with this Agreement solely on a “need to know” basis in connection with a permitted use of such the Cardholder Data under this pursuant to Section 4.116.2(g), provided that each such subcontractor agrees to be bound by this Section 4.11, or a comparable contractual commitment with the same effect[****];
(ii) to its Affiliates (including, for this purpose, the ▇▇▇▇ Group) and its Affiliates' employees, agents, attorneys and accountants with their Representatives on a “need to know such Cardholder Data know” basis in connection with a permitted use of such the Cardholder Data under this Sectionpursuant to Section 6.2(g); provided that (A) any such Person is bound by terms substantially similar to this Section as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of each such Person with the terms of this Section; or[****];
(iii) to any Governmental Authority with authority over Bank the Company or its Affiliates, or their respective Service Providers [****]; or
(Aiv) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent as otherwise permitted by Applicable Law, Bank (1) provides at least 10 Business Days' prior notice of such proposed disclosure to Dillard's if reasonably possible under the circumstances and (2) seeks to redact Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure.
(e) Subject to Applicable Law and the Program Privacy Policy, Bank shall report to Dillard's on a weekly basis, in a format agreed to by the parties in advance,; [****].
(i) for any customer who has applied for a Credit CardWith respect to the sharing, had the opportunity to make an opt out choice, was not approved for a Credit Card use and did not opt out, regardless disclosure of the marketing channel Cardholder Data following the termination of such applicationthis Agreement:
(i) the rights and obligations of the Parties under this Section 6.2 shall continue through any Termination Period and, the customer's nameif applicable, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.any interim servicing period pursuant to Section 17.2(h);
(ii) if the Company exercises its purchase rights under Section 17.2, the Bank shall transfer its right, title and interest in the Cardholder Data to the Company or its Nominated Purchaser as part of such transaction, and the Bank’s right to use and disclose the Cardholder Data shall terminate upon the termination of the Termination Period and, promptly following such termination of the Termination Period, the Bank shall return or destroy all Cardholder Data and shall certify such return or destruction to the Company upon request; provided, however, that, if the Bank is obligated to retain any Cardholder Data pursuant to requirements of Applicable Law or the Bank’s disaster recovery plan, or internal retention policies, the Bank shall maintain the strict confidentiality and security of such Cardholder Data and shall not use such Cardholder Data for any Cardholderother purpose; provided further, that if the Bank is performing interim servicing for the Nominated Purchaser pursuant to Section 17.2(h), the Bank may continue to use Cardholder Data to the extent necessary to perform such servicing; and
(1iii) if the Cardholder's nameCompany provides notice that it shall not exercise its purchase rights under Section 17.2, addressor otherwise fails to exercise its option within the time period specified in Section 17.2, email addressthe Company’s right to use and disclose the Cardholder Data shall terminate, telephone numberand the restrictions hereunder on the Bank’s use and disclosure of Cardholder Data shall terminate, social security number except that in no event may the Bank or any of its Affiliates disclose Cardholder Data to any retailer or use Cardholder Data in any way for the benefit of any retailer or retail credit card program or in any manner inconsistent with the limitations on the Bank’s rights to dispose of the Program Assets pursuant to Section 17.4. The foregoing provisions shall in no way be construed as to extend the Bank’s rights to use the Company Licensed Marks, the Company’s name or any Intellectual Property of the Company, all of which rights shall be expressly limited as set forth in Article X and Account number;shall terminate as set forth in Section 17.4(c).
Appears in 1 contract
Sources: Private Label Credit Card Program Agreement (Signet Jewelers LTD)
Cardholder Data. (a) As between Bank and Dillard'sCompany, Cardholder Data shall be the property of and exclusively owned by Bank. Dillard's acknowledges In its capacity as servicer, Company shall maintain all Cardholder Data and agrees that it has no proprietary interest in the shall provide Bank with full access to Cardholder Data.
(b) Bank's The initial privacy policy notice applicable to the Cardholder Data is attached as Schedule 6.2(b), which shall be separate from the privacy notice(s) that Bank maintains for its other portfolios. Bank shall cooperate with Company to provide Company the maximum ability permissible under Applicable Law and Network Rules to use and disclose Cardholder Data, including, as necessary or appropriate, through the Program Privacy PolicyNotice and/or the use of disclosures, consents, opt-in provisions or opt-out provisions. Any modifications to the Program Privacy Policy Notice shall be approved by the Marketing Committeeboth parties, provided that the Program Privacy Policy Notice at all times shall (i) comply with Applicable Law at all timesand (ii) provide Company access to and the right to use Cardholder Data to the fullest extent permitted by Applicable Law and Network Rules, including for its business purposes.
(c) Bank shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.116.2. Bank may use the Cardholder Data and any other information derived from the Cardholder Data in compliance with Applicable Law Law, the Network Rules and the Program Privacy Policy solely Notice, solely: (i) as necessary to exercise its rights or carry out its obligations hereunder; (ii) for purposes of soliciting customers listed in promoting the Cardholder Data Program or promoting Goods and/or Services available for Private Label Credit Cards, Enhancement Products listed in Schedule 4.11, and purchase on an Account at or through any other products and services approved by the Marketing Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or Company Channel; (iii) for purposes of performing analysis and modeling, provided, however, that Cardholder Data used for analysis and modeling other than with respect to the Program shall be Non-Personally Identifiable Information, shall be aggregated with data from other portfolios, and shall not be used in connection with or for the benefit of any co-branded or private label credit program that is or may be offered by Bank on behalf of or in association with any Competing Retailer; or (iv) as required by necessary or appropriate for purposes of compliance with Applicable Law, regulatory examination, internal auditing functions, risk assessment or management functions, Network Rules or as otherwise set forth in 12 CFR 40.15(a)(1)-(7). Bank has no rights to shall not use the Cardholder Data for marketing or any other purposes except as expressly provided herein. Notwithstanding the foregoing, each party acknowledges that Bank may independently gather information from individuals independent of the Program, including from Persons who may or may not also be Cardholders, and that Bank and its Affiliates may have rights to use and disclose such information independent of whether such information also constitutes Cardholder Data or Company Guest Data under this Agreement; provided, however, except as expressly permitted pursuant to this Agreement, Bank and its Affiliates may not, in any event, take into account that a Person is a Cardholder or intentionally target for solicitation such customers through the use of the Cardholder Data. Bank shall not commingle Cardholder Data into any Bank marketing database except as provided in this Section 6.2(c).
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.11. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder Data6.2. Bank may disclose the Cardholder Data in compliance with Applicable Law and Law, the Network Rules, the Program Privacy Policy Notice and the Credit Card Agreement, solely:
(i) to its subcontractors (including Company in its capacity as servicer) in connection with a permitted use of such Cardholder Data under this Section 4.11, 6.2; provided that (A) each such subcontractor agrees is subject to an obligation to maintain the confidential status of Cardholder Data at least as restrictive as that set forth herein, and (B) Bank shall be bound by this Section 4.11, responsible for the compliance of each such subcontractor (other than Company in its capacity as servicer or a comparable contractual commitment any subcontractor of Company in such capacity) with the same effect;terms of this Section.
(ii) to its Affiliates Affiliates, and its Affiliates' to employees, agents, attorneys attorneys, auditors and accountants of Bank and its Affiliates, with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section; provided that (A) any each such Person is bound by terms substantially similar subject to this Section as a condition an obligation to maintain the confidential status of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; at least as restrictive as that set forth herein, and (B) Bank shall be responsible for the compliance of each such Person with the terms of this Section; or;
(iii) to a potential third-party purchaser with respect to any written off Cardholder Indebtedness or otherwise to the extent permitted under this Agreement, or to a trustee in connection with a securitization transaction to the extent permitted under this Agreement; or
(iv) to any Governmental Authority with asserting authority over Bank or any of its Affiliates (A) in connection with an examination of BankBank or any such Affiliate; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process, provided, however, that Bank shall seek the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure and with respect to clause (B) Bank shall provide reasonable advance notice to Company to the extent reasonably practicable under the circumstances.
(e) Bank shall not, directly or indirectly, sell, or otherwise transfer any right in or to the Cardholder Data, except (i) with respect to any written off Cardholder Indebtedness, (ii) to any potential third-party purchaser to the extent permitted hereunder, and (iii) to a trustee in connection with a securitization transaction related to the Accounts to the extent permitted hereunder, provided that, such trustee shall be bound by a confidentiality agreement affording protections substantially similar to the confidentiality and use provisions of this Agreement with such modifications as may be customary for confidentiality agreements in connection with such securitizations (and any material modifications shall be submitted for approval of Company, which approval shall not be unreasonably delayed, conditioned or withheld).
(f) Subject to Applicable Law, Bank shall provide the information below to Company on a daily basis:
(i) [***]
(ii) [***] 57
(iii) [***]
(iv) [***] To the extent that Company, as servicer for Bank, has access to the information Bank is obligated to provide under this Section 6.2(f), the parties acknowledge and agree that Bank shall be deemed to have fulfilled its obligation hereunder.
(g) Company shall not use, or permit to be used, Cardholder Data, except as provided in this Section 6.2(g) and subject to the other provisions and procedures of this Agreement, including ARTICLE V and Section 3.5. Company may use the Cardholder Data and any other information derived from the Cardholder Data in compliance with Applicable Law, the Network Rules and the Program Privacy Notice (i) for purposes of promoting the Program or promoting Goods and/or Services available for purchase on an Account at or through any Company Channel, (ii) for all commercially reasonable purposes in the same manner as Company uses Company Guest Data, (iii) as otherwise necessary to carry out its obligations under this Agreement, and (iv) as otherwise permitted by Applicable Law, the Network Rules and the Program Privacy Notice. Company shall maintain protocols regarding Cardholder Data intended to ensure that (i) Cardholder Data is logically isolated (and accordingly always separately identifiable) from Company’s other data and (ii) the use and disclosure of Cardholder Data is limited as provided by Applicable Law and this Agreement.
(h) Company shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 6.2(h). Company may disclose the Cardholder Data in compliance with Applicable Law, the Network Rules, the Program Privacy Notice and the Credit Card Agreement, solely:
(i) to its subcontractors in connection with a permitted use of such Cardholder Data under this Section 6.2; provided that Bank (A) each such subcontractor is subject to an obligation to maintain the confidential status of Cardholder Data at least as restrictive as that set forth herein, and (B) Company shall be responsible for the compliance of each such subcontractor with the terms of this Section;
(ii) to its Affiliates, and to employees, agents, attorneys, auditors and accountants of Company or its Affiliates, with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section; provided that (A) each such Person is subject to an obligation to maintain the confidential status of Cardholder Data at least as restrictive as that set forth herein, and (B) Company shall be responsible for the compliance of each such Person with the terms of this Section;
(iii) to any Governmental Authority asserting authority over Company (A) in connection with an examination of Company; or (B) pursuant to a specific requirement to provide for such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided, however, that Company seeks the full protection of confidential treatment for any such disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), Company shall provide reasonable advance notice to Bank to the extent reasonably practicable under the circumstances; or
(iv) as otherwise permitted by Applicable Law, Bank the Program Privacy Notice and the Network Rules (1and subject to any other applicable provisions of this Agreement, including ARTICLE V and Section 3.5); provided that, for the avoidance of doubt, the parties agree that Company shall not disclose, or permit to be disclosed, any Cardholder Data (or information derived therefrom) provides to a prospective Nominated Purchaser except at least 10 Business Days' prior notice of such proposed disclosure to Dillard's if reasonably possible the time, under the circumstances and (2) seeks to redact Cardholder Data to in accordance with the fullest extent possible under Applicable Law governing such disclosureprocedures set forth in Section 15.2(h).
(e) Subject to Applicable Law and the Program Privacy Policy, Bank shall report to Dillard's on a weekly basis, in a format agreed to by the parties in advance,
(i) for any customer who has applied for a Credit CardWith respect to use and disclosure of Cardholder Data following expiration or termination of this Agreement, had the opportunity to make an opt out choice, was not approved for a Credit Card following shall apply:
(i) The rights and did not opt out, regardless obligations of the marketing channel of such applicationparties under this Section 6.2 shall continue through the Termination Date and, if applicable, the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on end of the application or prescreened response submitted by the customerInterim Servicing Period.
(ii) for any CardholderIf Company exercises its rights under Section 15.2, Bank shall transfer its right, title and interest in the Cardholder Data to Company or its Nominated Purchaser as part of such transaction, and (1subject to Bank’s documentation retention or other obligations under Applicable Law) Bank’s right to use and disclose the Cardholder's nameCardholder Data shall terminate on the Termination Date.
(iii) If Company does not exercise its Purchase Option under Section 15.2, addressCompany’s right to use and disclose the Cardholder Data shall terminate only to the extent required by Applicable Law.
(j) The parties shall reasonably cooperate to use, email addressdisclose and share Non-Personally Identifiable Information regarding the Program, telephone numberas mutually agreed upon from time to time to, social security number among other things, monitor Program performance, comply with funding requirements (e.g. rating agency and Account number;master trust filing requirements) and support planning and financial reporting processes.
(k) Nothing in this Section 6.2 shall restrict Company’s use of Company Guest Data.
Appears in 1 contract
Cardholder Data. (a) As between Bank and Dillard'samong the Parties hereto, the Cardholder Data shall be the property of and exclusively owned by the Bank. Dillard's acknowledges and agrees that it has no proprietary interest in the Cardholder Data.
(b) Bank's privacy policy The Privacy Policy applicable to the Cardholder Data is the Program Privacy Policyattached as Schedule 6.2(b) hereto. Any modifications to the Program Privacy Policy shall be approved by the Marketing Committee, provided that the Program Privacy Policy Operating Committee in accordance with Section 3.2 and shall comply with Applicable Law at all times.
(c) Bank shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.11. The Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting soliciting, marketing or servicing (in each case, solely as directed by the Company or the Operating Committee) customers listed in the Cardholder Data for Private Label Company Credit Cards, Enhancement Products listed in Schedule 4.11Approved Ancillary Products, and any other products and services approved by the Marketing Operating Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law, or (iv) for purposes of performing analysis and modeling, provided, however, that Cardholder Data used for analysis and modeling other than with respect to the Program shall be non-personally identifiable information, shall be aggregated with data from other portfolios, and shall not be used in connection with or for the benefit of any co-branded or private label credit program that is or may be offered by Bank on behalf of or in association with any retailer. The Bank has no rights to to, and shall not, in any event,use the Cardholder Data for marketing or any other purposes except as expressly provided hereinin this Section 6.2(c).
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.11. The Bank shall not, directly or indirectly, sell disclose, sell, transfer, or otherwise transfer any right in rent (or permit others to do same), the Cardholder Data. Bank may disclose the Cardholder Data , except in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its subcontractors Service Providers authorized in accordance with this Agreement solely on a “need to know” basis in connection with a permitted use of such the Cardholder Data under this pursuant to Section 4.116.2(c), provided that each such subcontractor Service Provider agrees in a written agreement to be bound (a) maintain all such Cardholder Data as strictly confidential and not to use or disclose such information to any Person other than the Bank or the Company, except as required by this Applicable Law or any Governmental Authority (after giving the Bank and the Company prior notice and an opportunity to defend against such disclosure); and (b) maintain an information security program that is designed to meet all requirements of Applicable Law, including, at a minimum, all requirements set forth in Section 4.11, or a comparable contractual commitment with the same effect6.1(b);
(ii) to its Affiliates and its Affiliates' employees, agents, attorneys and accountants with their Representatives on a “need to know such Cardholder Data know” basis in connection with a permitted use of such the Cardholder Data under this Sectionpursuant to Section 6.2(c); provided that (A) any such Person is bound by terms substantially similar to this Section as a condition the Bank communicates the confidential nature of employment or of access to the Cardholder Data to such Persons, such Persons are bound (by agreement or by their professional obligations imposing comparable terms; responsibilities) to maintain the confidentiality of the Cardholder Data in accordance with the provisions of this Agreement, and (B) the Bank shall be responsible for the compliance of by each such Person with the terms of this SectionSection 6.2; or001549-0001-13793-Active.14250169.10
(iii) to any Governmental Authority with authority over the Bank (A) in connection with an examination of the Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that the Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, the Bank (1) provides at least 10 ten (10) Business Days' prior notice of such proposed disclosure to Dillard's the Company if reasonably possible under the circumstances circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure; or
(iv) to the extent permitted in the Risk Management Policies and Operating Procedures, to any consumer reporting agency in accordance with the federal Fair Credit Reporting Act.
(e) Subject to Applicable Law and the Privacy Policy, the Bank shall provide the Company with reasonable access, through the Bank's data analysts, to all Cardholder Data obtained by the Bank in connection with the Program, which includes at least the items listed below. In addition, subject to Applicable Law, and as reasonably requested by Company, the Bank shall provide Company with an updated copy of the master file or such elements thereof as may be requested by Company. Subject to Applicable Law and the Program Privacy Policy, the Bank shall report transmit to Dillard's the Company on a weekly basisreal-time basis throughout each day by a secure data feed into Company Systems designated by the Company from time to time, in a format formats agreed to by the parties Parties in advance,advance from time to time:
(i) for any customer who has applied for a Company Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card and did not opt out, regardless of the marketing channel of such application, : (A) the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.; and (B) if the customer has been approved for a Company Credit Card, the Company Credit Card Account identification number issued (or to be issued) to such customer;
(ii) for any each Cardholder, joint-Cardholder and authorized buyer, (1) the Cardholdersuch person's name, address, email address, telephone number, social security number and Account identification number; (2) any reported change to any of the foregoing information; (3) transaction and experience data; and (4) any such other Cardholder Data as the Company may reasonably request;
(iii) the Cardholder's name and Account identification number for any Account that has been closed;
(iv) the Cardholder Data for all categories of information available to the Company as of the date hereof prior to giving effect to this Agreement; and
(v) analytical output that the Bank or any of its Affiliates has derived or may derive from their databases that might enhance the Company's understanding of its customers and that the Company reasonably believes could be used to improve the marketing of the Company or the Program. Notwithstanding the foregoing, no Party hereto shall be required to provide any information on a personally identifiable basis if the provision of such personally identifiable information would cause such Party to be considered a “consumer reporting agency” for purposes of the Fair Credit Reporting Act.
(f) The Bank shall cooperate with the Company to provide the Company and its Affiliates with the maximum ability permissible under Applicable Law and the Privacy Policy to receive, use and disclose the Cardholder Data, including, as necessary or appropriate, through use of consents, opt-in provisions or opt-out provisions, in each case as directed by the Company. Without limiting the foregoing, the Company and each of its Affiliates may receive, use and disclose the Cardholder Data in compliance with Applicable Law and the Privacy Policy (i) for purposes of promoting the Program or promoting Goods and Services, (ii) for all commercially reasonable purposes in the same manner as Shopper Data, (iii) as otherwise necessary to carry out its obligations under this Agreement, and (iv) as otherwise permitted by Applicable Law. 001549-0001-13793-Active.14250169.10
(g) The Company may disclose the Cardholder Data in compliance with Applicable Law and the Privacy Policy solely:
(i) to its Service Providers authorized in accordance with this Agreement solely on a “need to know” basis in connection with a permitted use of the Cardholder Data pursuant to Section 6.2(f), provided that each such Service Provider agrees in a written agreement reasonably satisfactory to the Company to (a) maintain all such Cardholder Data as strictly confidential and not to use or disclose such information to any Person other than the Bank or the Company, except as required by Applicable Law or any Governmental Authority (after giving the Bank and the Company prior notice and an opportunity to defend against such disclosure); (b) maintain an information security program that is designed to meet all requirements of Applicable Law, including, at a minimum, all requirements set forth in Section 6.1(b); and (c) notify promptly the Bank and the Company of any unauthorized disclosure, use, or disposal of, or access to, Cardholder Data and to cooperate with the Bank and the Company in any investigation thereof and remedial action with respect thereto; and provided, further, that the Company shall be responsible for the compliance of each such Service Provider with the terms of this Section 6.2
(ii) to its Affiliates and its and their Representatives on a “need to know” basis in connection with a permitted use of the Cardholder Data pursuant to Section 6.2(f); provided that the Company communicates the confidential nature of the Cardholder Data to such Persons, such Persons are bound (by agreement or their professional responsibilities) to maintain the confidentiality of the Cardholder Data in accordance with the provisions of this Agreement, and the Company shall be responsible for the compliance by each such Person with the terms of this Section 6.2;
(iii) to any Governmental Authority with authority over the Company (A) in connection with an examination of the Company; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that the Company seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, the Company (1) provides at least ten (10) Business Days' prior notice of such proposed disclosure to the Bank if reasonably possible under the circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure; or
(iv) as otherwise permitted by Applicable Law and the Privacy Policy.
(h) With respect to the sharing, use and disclosure of the Cardholder Data following the termination of this Agreement:
(i) the rights and obligations of the Parties under this Section 6.2 shall continue through any Termination Period and, if applicable, any interim servicing period pursuant to Section 17.2(h);
(ii) if the Company exercises its purchase rights under Section 17.2, the Bank shall transfer its right, title and interest in the Cardholder Data to the Company or its Nominated Purchaser as part of such transaction, and the Bank's right to use and disclose the Cardholder Data shall terminate upon the termination of the Termination Period and, promptly following such termination of the Termination Period, the Bank shall return or destroy all Cardholder Data and shall certify such return or destruction to the Company upon request; provided, however, that, if the Bank is obligated to retain any Cardholder Data pursuant to requirements of Applicable Law or the Bank's disaster recovery plan, the Bank shall maintain the strict confidentiality and security of such Cardholder Data and shall not use such Cardholder Data for any other purpose; and
(iii) if the Company provides notice that it shall not exercise its purchase rights under Section 17.2, the Company's right to use and disclose the Cardholder Data shall terminate only to the extent required by Applicable Law, and the restrictions hereunder on the Bank's use and disclosure of Cardholder Data shall terminate, except that in no event may the Bank disclose Cardholder Data to any retailer or use Cardholder Data in any way for the benefit of any retailer or retail credit card program or in any manner inconsistent with the limitations on the 001549-0001-13793-Active.14250169.10 Bank's rights to dispose of the Program Assets pursuant to Section 17.4. The foregoing provisions shall in no way be construed as to extend the Bank's rights to use the Company Licensed Marks, the Company's name or any intellectual property of the Company, all of which rights shall be expressly limited as set forth in Article X and shall terminate as set forth in Section 17.4(c).
Appears in 1 contract
Sources: Credit Card Program Agreement (Coldwater Creek Inc)
Cardholder Data. (a) As between Bank and Dillard'samong the Parties hereto, the Cardholder Data shall be the property of and exclusively owned by CEBA Bank. Dillard's acknowledges and agrees that it has no proprietary interest in the Cardholder Data.
(b) Bank's The privacy policy applicable notice provided to Cardholders pursuant to the Cardholder Data is the Program Privacy Policy. Any modifications to ▇▇▇▇▇-▇▇▇▇▇-▇▇▇▇▇▇ Act constituting part of the Program Privacy Policy shall be approved by in the Marketing Committee, provided that form attached hereto as Schedule 6.2(b). Any changes to such privacy notice or to the Program Privacy Policy described therein shall comply be made only in accordance with Applicable Law at all timesArticle III.
(c) Bank shall not use, or permit to be used, the Cardholder Data, except as provided in this Section 4.116.2. Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting soliciting, marketing or servicing (in each case, solely as directed by the FDS Companies or the Operating Committee) customers listed in the Cardholder Data for Private Label FDS Credit Cards, Enhancement Products listed in Schedule 4.11Approved Ancillary Products, and any other products and services approved by the Marketing Operating Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunderhereunder (including its rights to use such information as contemplated by Section 16.4), or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein.
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.116.2. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder DataData other than to FDS or any of its Affiliates or to a Nominated Purchaser pursuant to Section 16.2. Bank may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its authorized subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.116.2, provided that each such authorized subcontractor agrees in writing to maintain all such Cardholder Data as strictly confidential in perpetuity and not to use or disclose such information to any Person other than Bank or an FDS Company, except as required by Applicable Law or any Governmental Authority (after giving Bank and the FDS Companies prior notice and an opportunity to defend against such disclosure); provided, further, that each such authorized subcontractor maintains, and agrees in writing to maintain, an information security program that is designed to meet the objectives of the Guidelines, including, at a minimum, maintenance of an information security program that is designed to: (w) ensure the security and confidentiality of the Cardholder Data; (x) protect against any anticipated threats or hazards to the security or integrity of the Cardholder Data; (y) protect against unauthorized access to or modification, destruction, disclosure or use of the Cardholder Data; and (z) ensure the proper disposal of Cardholder Data; and provided, further, that each such authorized subcontractor agrees to be bound by this Section 4.11notify promptly Bank and the FDS Companies of any unauthorized disclosure, use, or a comparable contractual commitment disposal of, or access to, Cardholder Data and to cooperate with Bank and the same effectFDS Companies in any investigation thereof and remedial action with respect thereto;
(ii) to its Affiliates Affiliates, and its and such Affiliates' employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this SectionSection 6.2; provided that (A) any such Person is bound by terms substantially similar to this Section 6.2 as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of by each such Person with the terms of this SectionSection 6.2; or
(iii) to any Governmental Authority with authority over Bank (A) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, Bank (1) provides at least 10 ten (10) Business Days' prior notice of such proposed disclosure to Dillard's FDS if reasonably possible under the circumstances circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure; or
(iv) to any consumer reporting agency in accordance with the federal Fair Credit Reporting Act.
(e) Subject to Applicable Law and the Program Privacy Policy, Bank shall report transmit to Dillard's the FDS Companies on a weekly basisreal-time basis throughout each day by a secure data feed into FDS Systems designated by FDS from time to time, in a format formats agreed to by the parties Parties in advance,advance from time to time:
(i) for any customer who has applied for a an FDS Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card and did not opt out, regardless of the marketing channel of such application, : (A) the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.; (B) an indication of whether or not the customer has been approved for an FDS Credit Card; and (C) if the customer has been approved for an FDS Credit Card, the FDS Credit Card issued (or to be issued) to such customer (i.e., specify the type of FDS Credit Card and the FDS Licensed ▇▇▇▇ to be used on such FDS Credit Card);
(ii) for any each Cardholder, joint-Cardholder and authorized buyer, (1A) the Cardholdersuch person's name, address, email address, telephone number, social security number and Account number; (B) any reported change to any of the foregoing information; (C) transaction and experience data; and (D) any such other Cardholder Data as the FDS Companies may reasonably request;
(iii) the Cardholder's name and account number for any Account that is delinquent;
(iv) the Cardholder's name and account number for any Account that has been closed; and
(v) the Cardholder Data for all categories of information available on the FDS Companies' credit Systems as of the date hereof.
(f) Subject to Applicable Law and the Program Privacy Policy, Bank shall transmit by a secure data feed into FedCustomer (or other FDS Systems designated by FDS from time to time), in a format agreed to by the Parties, on an as billed basis, all information contained in the Billing Statements and all other Cardholder Data for all categories of information available on FedCustomer as of the date hereof (including, for each Cardholder, joint-Cardholder and authorized buyer, name, address, email address, telephone number, information as to creditworthiness and changes to any of the foregoing information).
(g) Bank shall reasonably cooperate with the FDS Companies to provide FDS and its Affiliates with the maximum ability permissible under Applicable Law and the Program Privacy Policy to receive, use and disclose the Cardholder Data, including, as reasonably necessary or appropriate, through use of consents, opt-in provisions or opt-out provisions, in each case as directed by the FDS Companies. Without limiting the foregoing, FDS and each of its Affiliates may receive, use and disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy (i) for purposes of promoting the Program or promoting FDS Goods and Services, (ii) as otherwise necessary to carry out its obligations under this Agreement, and (iii) as otherwise permitted by Applicable Law.
(h) The FDS Companies may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy. Each of the FDS Companies may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its existing subcontractors as of the Effective Date and to authorized subcontractors that enter into agreements with an FDS Company after the Effective Date ("Future Subcontractors") in connection with a permitted use of such Cardholder Data under this Section 6.2, provided that each such Future Subcontractor agrees in writing to maintain all such Cardholder Data as strictly confidential in perpetuity and not to use or disclose such information to any Person other than an FDS Company or Bank, except as required by Applicable Law or any Governmental Authority (after giving the FDS Companies prior notice and an opportunity to defend against such disclosure); provided, further, that each such Future Subcontractor maintains, and agrees in writing to maintain, an information security program that is designed to meet the objectives of the Guidelines, including, at a minimum, maintenance of an information security program that is designed to: (w) ensure the security and confidentiality of the Cardholder Data; (x) protect against any anticipated threats or hazards to the security or integrity of the Cardholder Data; (y) protect against unauthorized access to or modification, destruction, disclosure or use of the Cardholder Data; and (z) ensure the proper disposal of Cardholder Data; and provided, further, that each such Future Subcontractor agrees to notify promptly Bank and the FDS Companies of any unauthorized disclosure, use, or disposal of, or access to, Cardholder Data and to cooperate with Bank and the FDS Companies in any investigation thereof and remedial action with respect thereto;
(ii) to its Affiliates, and its and such Affiliates' employees, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section 6.2; provided that (A) any such Person is bound by terms substantially similar to this Section 6.2 as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) the FDS Companies shall be responsible for the compliance by each such Person with the terms of this Section 6.2; or
(iii) to any Governmental Authority with authority over such FDS Company (A) in connection with an examination of such FDS Company; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that such FDS Company seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, such FDS Company (1) provides at least ten (10) Business Days' prior notice of such proposed disclosure to Bank if reasonably possible under the circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure.
(i) With respect to the sharing, use and disclosure of the Cardholder Data following the termination of this Agreement:
(i) the rights and obligations of the Parties under this Section 6.2 shall continue through any Termination Period;
(ii) if FDS exercises its rights under Section 16.2, Bank shall transfer its right, title and interest in the Cardholder Data to FDS or its Nominated Purchaser as part of such transaction, and Bank's right to use and disclose the Cardholder Data shall terminate upon the termination of the Termination Period; and
(iii) if FDS provides notice that it shall not exercise its rights under Section 16.2, FDS and its Affiliates' right to use and disclose the Cardholder Data hereunder shall terminate upon the termination of the Termination Period.
Appears in 1 contract
Sources: Credit Card Program Agreement (Federated Department Stores Inc /De/)
Cardholder Data. (a) As Without limiting Sun Country’s rights under Section 16.2, as between Bank and Dillard'sSun Country, Cardholder Data shall be the property of and exclusively owned by Bank. Dillard's acknowledges and agrees that it has no proprietary interest in the Bank shall maintain all Cardholder Data, including the Program master file.
(b) Bank's privacy policy applicable The Parties acknowledge and agree that it is their intention to establish and maintain a Program Privacy Policy that provides Sun Country the maximum access to, and rights to use and disclose, Cardholder Data that is the Program Privacy Policypermitted by Applicable Law. Any modifications to Bank shall ensure that (i) the Program Privacy Policy shall be approved by the Marketing Committee, provided that the Program Privacy Policy shall comply complies with Applicable Law at all times, including following any such modifications and (ii) the Program Privacy Policy shall at all times provide Sun Country the maximum access to, and rights to use and disclose, Cardholder Data not prohibited by Applicable Law, including following any such modifications.
(c) Bank shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.11. Bank may use the Cardholder Data solely in compliance with Applicable Law and the Program Privacy Policy solely Policy: (i) for purposes of soliciting customers listed in the Cardholder Data for Private Label Credit Cards, Enhancement Products listed in Schedule 4.11, to exercise Bank’s rights and any other products and services approved by the Marketing Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder; (ii) to develop strategies and models for marketing, fraud, collections and risk-management; or (iii) as required by Applicable Law. for internal Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided hereinanalytics and related reporting; [*].
(d) Other than to Sun Country as provided herein, Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.116.2. Without limiting the provisions of Section 16.2, Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder Data. Bank may disclose the Cardholder Data in compliance with Applicable Law and Law, the Program Privacy Policy Policy, and the Credit Card Agreement, solely:
(i) to its subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.11, 6.2; provided that (A) each such subcontractor agrees to be bound by this Section 4.116.2, or a comparable contractual commitment with the same effect, and (B) Bank shall be responsible for the compliance of each such subcontractor with the terms of this Section;
(ii) to its Affiliates and Bank’s and its Affiliates' ’ employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section; provided that (A) any such Person is bound by terms substantially similar to this Section as a condition of employment or of access to such Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of each such Person with the terms of this SectionSection 6.2; or
(iii) to any Governmental Authority with authority over Bank Bank: (A) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, Bank (1) provides at least 10 ten (10) Business Days' ’ prior notice of such proposed disclosure to Dillard's Sun Country if reasonably possible under the circumstances and circumstances, (2) seeks to redact such Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure, and (3) Bank does not oppose any action by Sun Country to object or intervene in any legal proceeding in which production of Cardholder Data is compelled so long as Sun Country’s interests are not contrary to the interests of Bank in connection with such Governmental Authority inquiry, as reasonably determined by Bank.
(e) Subject to Applicable Law and the Program Privacy Policy, Bank shall report provide Sun Country at no cost with the information set forth on Schedule 6.2(e) and in accordance with the frequency set forth therein. Notwithstanding the foregoing, the Parties acknowledge that it is their intent that Sun Country not receive information that subjects Sun Country to Dillard's on any Payment Card Industry Data Security Standards applicable to a weekly basisfinancial institution. In addition, Bank shall provide to Sun Country at no cost such additional Cardholder Data as Sun Country may reasonably request, subject to [*] Indicates portions omitted pursuant to a request for confidential treatment filed separately with the Commission. Bank approval which will not be unreasonably withheld or delayed. With respect to all such Cardholder Data Bank provides to Sun Country, Bank shall also provide Sun Country with details sufficient to inform Sun Country as to whether (i) Cardholders reside in states subject to Regulation P, and whether such Cardholders had a format reasonable opportunity to opt-out under Regulation P but have not opted-out, (ii) Cardholders reside in states providing opt-out, and whether such Cardholders had a reasonable opportunity to opt-out but have not opted-out, and (iii) Cardholders reside in states requiring opt-in and whether such Cardholders have provided such opt-ins as further set forth in Schedule 6.2(e).
(f) Bank shall use commercially reasonable efforts to provide Sun Country the maximum ability permissible under Applicable Law to use and disclose Cardholder Data (including Cardholder information and purchasing data as mutually agreed to by the parties Parties but in advance,no event less than portfolio aggregate information that includes spend in the top 25 MCCs) for any purpose permitted by Applicable Law, including through the Program Privacy Policy and/or the use of consents, opt-in provisions, or opt-out provisions.
(g) Sun Country may, and may permit its Affiliates to, use and disclose the Cardholder Data in compliance with Applicable Law: (i) for purposes of promoting the Program or promoting goods and services sold by or through Sun Country, (ii) to exercise its rights and carry out its obligations under this Agreement; and (iii) as otherwise required by Applicable Law.
(h) Sun Country may disclose the Cardholder Data in compliance with Applicable Law solely:
(i) to its subcontractors in connection with a permitted use of such Cardholder Data under this Section 6.2; provided that: (A) each such subcontractor agrees to be bound by this Section 6.2, or a comparable contractual commitment with the same effect, and (B) Sun Country shall be responsible for the compliance of each such subcontractor with the terms of this Section 6.2;
(ii) to its Affiliates and Sun Country’s and its Affiliates’ employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section; provided that: (A) any such Person is bound by terms substantially similar to this Section as a condition of employment or of access to such Cardholder Data or by professional obligations imposing comparable terms; and (B) Sun Country shall be responsible for the compliance of each such Person with the terms of this Section 6.2;
(iii) to any Governmental Authority with authority over Sun Country: (A) in connection with an examination of Sun Country; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Sun Country seeks the full protection of confidential treatment for any customer who has applied for a Credit Cardsuch disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, had and with respect to clause (B), to the opportunity extent permitted by Applicable Law, Sun Country (1) provides at least ten (10) Business Days’ prior notice of such proposed disclosure to make an opt out choiceBank if reasonably possible under the circumstances, was (2) seeks to redact such Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure, and (3) Sun Country does not approved for a Credit Card oppose any action by Bank to object or intervene in any legal proceeding in which production of Cardholder Data is compelled so long as Bank’s interests are not contrary to the interests of Sun Country in connection with such Governmental Authority inquiry, as reasonably determined by Sun Country.
(i) With respect to use and did not opt outdisclosure of Cardholder Data following the termination of this Agreement:
(i) If Sun Country exercises its Purchase Option under Section 16.2, regardless Bank shall transfer its right, title, and interest in the Cardholder Data to Sun Country or its Nominated Purchasers as part of such purchase transaction, and Bank’s right to use and disclose the Cardholder Data shall terminate as of the marketing channel Program Purchase Date, except as necessary to perform Bank’s obligations pursuant to Section 16.2(i) and to comply with requirements of such application, Applicable Law or a Governmental Authority. [*] Indicates portions omitted pursuant to a request for confidential treatment filed separately with the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customerCommission.
(ii) If Sun Country does not exercise its Purchase Option under Section 16.2 or the Nominated Purchasers and Bank do not consummate the purchase transaction in connection with Sun Country’s exercise of its Purchase Option, upon the termination of this Agreement, Sun Country shall not use any Cardholder Data in the twelve (12) months following the termination of this Agreement to solicit Cardholders for any Cardholder, (1) the Cardholder's name, address, email address, telephone number, social security number and Account number;a Credit Card.
Appears in 1 contract
Sources: Credit Card Program Agreement (Sun Country Airlines Holdings, Inc.)
Cardholder Data. (a) As between Bank and Dillard'sCompany, Cardholder Data shall be the property of and exclusively owned by Bank. Dillard's acknowledges In its capacity as servicer, Company shall maintain all Cardholder Data and agrees that it has no proprietary interest in the shall provide Bank with full access to Cardholder Data.
(b) Bank's The initial privacy policy notice applicable to the Cardholder Data is attached as Schedule 6.2(b), which shall be separate from the privacy notice(s) that Bank maintains for its other portfolios. Bank shall cooperate with Company to provide Company the maximum ability permissible under Applicable Law and Network Rules to use and disclose Cardholder Data, including, as necessary or appropriate, through the Program Privacy PolicyNotice and/or the use of disclosures, consents, opt-in provisions or opt-out provisions. Any modifications to the Program Privacy Policy Notice shall be approved by the Marketing Committeeboth parties, provided that the Program Privacy Policy Notice at all times shall (i) comply with Applicable Law at all timesand (ii) provide Company access to and the right to use Cardholder Data to the fullest extent permitted by Applicable Law and Network Rules, including for its business purposes.
(c) Bank shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.116.2. Bank may use the Cardholder Data and any other information derived from the Cardholder Data in compliance with Applicable Law Law, the Network Rules and the Program Privacy Policy solely Notice, solely: (i) as necessary to exercise its rights or carry out its obligations hereunder; (ii) for purposes of soliciting customers listed in promoting the Cardholder Data Program or promoting Goods and/or Services available for Private Label Credit Cards, Enhancement Products listed in Schedule 4.11, and purchase on an Account at or through any other products and services approved by the Marketing Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or Company Channel; (iii) for purposes of performing analysis and modeling, provided, however, that Cardholder Data used for analysis and modeling other than with respect to the Program shall be Non-Personally Identifiable Information, shall be aggregated with data from other portfolios, and shall not be used in connection with or for the benefit of any co-branded or private label credit program that is or may be offered by Bank on behalf of or in association with any Competing Retailer; or (iv) as required by necessary or appropriate for purposes of compliance with Applicable Law, regulatory examination, internal auditing functions, risk assessment or management functions, Network Rules or as otherwise set forth in 12 CFR 40.15(a)(1)-(7). Bank has no rights to shall not use the Cardholder Data for marketing or any other purposes except as expressly provided herein. Notwithstanding the foregoing, each party acknowledges that Bank may independently gather information from individuals independent of the Program, including from Persons who may or may not also be Cardholders, and that Bank and its Affiliates may have rights to use and disclose such information independent of whether such information also constitutes Cardholder Data or Company Guest Data under this Agreement; provided, however, except as expressly permitted pursuant to this Agreement, Bank and its Affiliates may not, in any event, take into account that a Person is a Cardholder or intentionally target for solicitation such customers through the use of the Cardholder Data. Bank shall not commingle Cardholder Data into any Bank marketing database except as provided in this Section 6.2(c).
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.11. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder Data6.2. Bank may disclose the Cardholder Data in compliance with Applicable Law and Law, the Network Rules, the Program Privacy Policy Notice and the Credit Card Agreement, solely:
(i) to its subcontractors (including Company in its capacity as servicer) in connection with a permitted use of such Cardholder Data under this Section 4.11, 6.2; provided that (A) each such subcontractor agrees is subject to an obligation to maintain the confidential status of Cardholder Data at least as restrictive as that set forth herein, and (B) Bank shall be bound by this Section 4.11, responsible for the compliance of each such subcontractor (other than Company in its capacity as servicer or a comparable contractual commitment any subcontractor of Company in such capacity) with the same effect;terms of this Section.
(ii) to its Affiliates Affiliates, and its Affiliates' to employees, agents, attorneys attorneys, auditors and accountants of Bank and its Affiliates, with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section; provided that (A) any each such Person is bound by terms substantially similar subject to this Section as a condition an obligation to maintain the confidential status of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; at least as restrictive as that set forth herein, and (B) Bank shall be responsible for the compliance of each such Person with the terms of this Section; or;
(iii) to a potential third-party purchaser with respect to any written off Cardholder Indebtedness or otherwise to the extent permitted under this Agreement, or to a trustee in connection with a securitization transaction to the extent permitted under this Agreement; or
(iv) to any Governmental Authority with asserting authority over Bank or any of its Affiliates (A) in connection with an examination of BankBank or any such Affiliate; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process, provided, however, that Bank shall seek the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure and with respect to clause (B) Bank shall provide reasonable advance notice to Company to the extent reasonably practicable under the circumstances.
(e) Bank shall not, directly or indirectly, sell, or otherwise transfer any right in or to the Cardholder Data, except
(i) with respect to any written off Cardholder Indebtedness, (ii) to any potential third-party purchaser to the extent permitted hereunder, and (iii) to a trustee in connection with a securitization transaction related to the Accounts to the extent permitted hereunder, provided that, such trustee shall be bound by a confidentiality agreement affording protections substantially similar to the confidentiality and use provisions of this Agreement with such modifications as may be customary for confidentiality agreements in connection with such securitizations (and any material modifications shall be submitted for approval of Company, which approval shall not be unreasonably delayed, conditioned or withheld).
(f) Subject to Applicable Law, Bank shall provide the information below to Company on a daily basis:
(i) [*]
(ii) [*]
(iii) [*]
(iv) [*] To the extent that Company, as servicer for Bank, has access to the information Bank is obligated to provide under this Section 6.2(f), the parties acknowledge and agree that Bank shall be deemed to have fulfilled its obligation hereunder.
(g) Company shall not use, or permit to be used, Cardholder Data, except as provided in this Section 6.2(g) and subject to the other provisions and procedures of this Agreement, including ARTICLE V and Section 3.5. Company may use the Cardholder Data and any other information derived from the Cardholder Data in compliance with Applicable Law, the Network Rules and the Program Privacy Notice (i) for purposes of promoting the Program or promoting Goods and/or Services available for purchase on an Account at or through any Company Channel, (ii) for all commercially reasonable purposes in the same manner as Company uses Company Guest Data, (iii) as otherwise necessary to carry out its obligations under this Agreement, and (iv) as otherwise permitted by Applicable Law, the Network Rules and the Program Privacy Notice. Company shall maintain protocols regarding Cardholder Data intended to ensure that (i) Cardholder Data is logically isolated (and accordingly always separately identifiable) from Company’s other data and (ii) the use and disclosure of Cardholder Data is limited as provided by Applicable Law and this Agreement.
(h) Company shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 6.2(h). Company may disclose the Cardholder Data in compliance with Applicable Law, the Network Rules, the Program Privacy Notice and the Credit Card Agreement, solely:
(i) to its subcontractors in connection with a permitted use of such Cardholder Data under this Section 6.2; provided that Bank (A) each such subcontractor is subject to an obligation to maintain the confidential status of Cardholder Data at least as restrictive as that set forth herein, and (B) Company shall be responsible for the compliance of each such subcontractor with the terms of this Section;
(ii) to its Affiliates, and to employees, agents, attorneys, auditors and accountants of Company or its Affiliates, with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section; provided that (A) each such Person is subject to an obligation to maintain the confidential status of Cardholder Data at least as restrictive as that set forth herein, and (B) Company shall be responsible for the compliance of each such Person with the terms of this Section;
(iii) to any Governmental Authority asserting authority over Company (A) in connection with an examination of Company; or (B) pursuant to a specific requirement to provide for such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided, however, that Company seeks the full protection of confidential treatment for any such disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), Company shall provide reasonable advance notice to Bank to the extent reasonably practicable under the circumstances; or
(iv) as otherwise permitted by Applicable Law, Bank the Program Privacy Notice and the Network Rules (1and subject to any other applicable provisions of this Agreement, including ARTICLE V and Section 3.5); provided that, for the avoidance of doubt, the parties agree that Company shall not disclose, or permit to be disclosed, any Cardholder Data (or information derived therefrom) provides to a prospective Nominated Purchaser except at least 10 Business Days' prior notice of such proposed disclosure to Dillard's if reasonably possible the time, under the circumstances and (2) seeks to redact Cardholder Data to in accordance with the fullest extent possible under Applicable Law governing such disclosureprocedures set forth in Section 15.2(h).
(e) Subject to Applicable Law and the Program Privacy Policy, Bank shall report to Dillard's on a weekly basis, in a format agreed to by the parties in advance,
(i) for any customer who has applied for a Credit CardWith respect to use and disclosure of Cardholder Data following expiration or termination of this Agreement, had the opportunity to make an opt out choice, was not approved for a Credit Card following shall apply:
(i) The rights and did not opt out, regardless obligations of the marketing channel of such applicationparties under this Section 6.2 shall continue through the Termination Date and, if applicable, the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on end of the application or prescreened response submitted by the customerInterim Servicing Period.
(ii) for any CardholderIf Company exercises its rights under Section 15.2, Bank shall transfer its right, title and interest in the Cardholder Data to Company or its Nominated Purchaser as part of such transaction, and (1subject to Bank’s documentation retention or other obligations under Applicable Law) Bank’s right to use and disclose the Cardholder's nameCardholder Data shall terminate on the Termination Date.
(iii) If Company does not exercise its Purchase Option under Section 15.2, addressCompany’s right to use and disclose the Cardholder Data shall terminate only to the extent required by Applicable Law.
(j) The parties shall reasonably cooperate to use, email addressdisclose and share Non-Personally Identifiable Information regarding the Program, telephone numberas mutually agreed upon from time to time to, social security number among other things, monitor Program performance, comply with funding requirements (e.g. rating agency and Account number;master trust filing requirements) and support planning and financial reporting processes.
(k) Nothing in this Section 6.2 shall restrict Company’s use of Company Guest Data. Section 6.3.
Appears in 1 contract
Sources: Credit Card Program Agreement
Cardholder Data. (a) As between Bank and Dillard'samong the Parties hereto, the Cardholder Data shall be the property of and exclusively owned by Bank. Dillard's acknowledges and agrees that it has no proprietary interest in the Cardholder Data.
(b) Bank's privacy policy The Program Privacy Policy applicable to the Cardholder Data is the Program Privacy Policyattached as Schedule 6.2 hereto. Any modifications to the Program Privacy Policy shall be approved by the Marketing Management Committee, provided that the Program Privacy Policy shall comply with Applicable Law at all times.
(c) Bank shall not use, or permit to be used, the Cardholder Data, except as provided in this Section 4.116.2. Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting or marketing (in each case, solely as directed by Pier 1 or the Management Committee) or servicing customers listed in the Cardholder Data for Private Label Pier 1 Credit Cards, Enhancement Products listed in Schedule 4.11Approved Ancillary Products, and any other products and services approved by the Marketing Management Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein.
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.116.2. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder DataData other than to Pier 1 or any of its Affiliates, or to its Nominated Purchaser or a successor of Bank by merger or acquisition. Bank may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its authorized subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.116.2, provided that each such authorized subcontractor agrees in a written agreement satisfactory to Pier 1 and Bank to maintain all such Cardholder Data as strictly confidential and not to use or disclose such information to any Person other than Bank or Pier 1, except as required by Applicable Law or any Governmental Authority (after giving Bank and Pier 1 prior notice and an opportunity to defend against such disclosure); provided, further, that each such authorized subcontractor maintains, and agrees in writing to maintain, an information security program that is designed to meet all requirements of Applicable Law, including, at a minimum, maintenance of an information security program that is designed to: (w) ensure the security and confidentiality of the Cardholder Data; (x) protect against any anticipated threats or hazards to the security or integrity of the Cardholder Data; (y) protect against unauthorized access to or use of the Cardholder Data; and (z) ensure the proper disposal of Cardholder Data; and provided, further, that each such authorized subcontractor agrees to be bound by this Section 4.11notify promptly Bank and Pier 1 of any unauthorized disclosure, use, or a comparable contractual commitment disposal of, or access to, Cardholder Data and to cooperate with the same effectBank and Pier 1 in any investigation thereof and remedial action with respect thereto;
(ii) to its Affiliates Affiliates, and its and such Affiliates' ’ employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this SectionSection 6.2; provided that (A) any such Person is bound by terms substantially similar to this Section 6.2 as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of by each such Person with the terms of this Section; orSection 6.2;
(iii) to any Governmental Authority with authority over Bank (A) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the fullest extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, Bank (1) provides at least 10 ten (10) Business Days' ’ prior notice of such proposed disclosure to Dillard's Pier 1 if reasonably possible under the circumstances circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure; or
(iv) to the extent permitted in the Risk Management Policies and Operating Procedures, to any consumer reporting agency in accordance with the federal Fair Credit Reporting Act.
(e) Subject Bank shall cooperate with Pier 1 to provide Pier 1 and its Affiliates with the maximum ability permissible under Applicable Law and the Program Privacy PolicyPolicy to receive, Bank use and disclose the Cardholder Data, including, as necessary or appropriate, through use of consents or opt-out provisions, in each case as directed by Pier 1. Without limiting the foregoing, Pier 1 and its Affiliates may receive, use and disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy (i) for purposes of promoting the Program or promoting Pier 1 Goods and Services, (ii) as otherwise necessary to carry out its obligations under this Agreement, and (iii) as otherwise permitted by Applicable Law. Notwithstanding the foregoing, no Party hereto shall report be required to Dillard's provide any information on a weekly basispersonally identifiable basis if the provision of such personally identifiable information would cause such Party to be considered a “consumer reporting agency” for purposes of the Fair Credit Reporting Act.
(f) With respect to the sharing, in a format agreed to by use and disclosure of the parties in advance,Cardholder Data following the termination of this Agreement:
(i) for any customer who has applied for a Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card rights and did not opt out, regardless obligations of the marketing channel of such application, the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.Parties under this Section 6.2 shall continue through any Termination Period; and
(ii) for any Cardholderif Pier 1 exercises its rights under Section 16.2, (1) Bank shall transfer its right, title and interest in the Cardholder's nameCardholder Data to Pier 1 or its Nominated Purchaser as part of such transaction, address, email address, telephone number, social security number and Account number;Bank’s right to use and disclose the Cardholder Data shall terminate upon the termination of the Termination Period.
Appears in 1 contract
Sources: Credit Card Program Agreement (Pier 1 Imports Inc/De)
Cardholder Data. (a) As between Bank Subject to the provisions of Section 6.1(a) and Dillard'sSection 6.3(a) hereof, as among the Parties hereto, the Cardholder Data shall be the property of and exclusively owned by Bank. Dillard's acknowledges and agrees that it has no proprietary interest in the Cardholder Data.
(b) Bank's privacy policy The Privacy Policy applicable to the Cardholder Data is the Program Privacy Policyattached as Schedule 6.2 hereto. Any modifications to the Program Privacy Policy shall be approved by the Marketing Operating Committee, ; provided that the Program Privacy Policy shall comply with Applicable Law at all times; provided, further, that the Privacy Policy shall provide Belk and its Affiliates with the maximum availability and use of Cardholder Data, including the ability for Belk and its Affiliates to provide Cardholder Data to their vendors and Licensees.
(c) Bank shall not use, or permit to be used, the Cardholder Data, except as provided in this Section 4.116.2. Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting or marketing (in each case, solely as directed by Belk or the Operating Committee) or servicing customers listed in the Cardholder Data for Private Label Belk Credit Cards, Enhancement Products listed in Schedule 4.11Approved Ancillary Products, and any other products and services approved by the Marketing Operating Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein.
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.116.2. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder DataData other than to Belk or one of its Affiliates. Bank may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its authorized subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.116.2, provided that each such authorized subcontractor agrees in a written agreement reasonably satisfactory to be bound Bank to maintain all such Cardholder Data as strictly confidential and not to use or disclose such information to any Person other than Bank or Belk, except as required by this Section 4.11Applicable Law or any Governmental Authority (after giving Bank and Belk prior notice and an opportunity to defend against such disclosure); provided, further, that each such authorized subcontractor maintains, and agrees in writing to maintain, an information security program that is designed to meet all requirements of Applicable Law, including, at a minimum, maintenance of an information security program that is designed to: (A) ensure the security and confidentiality of the Cardholder Data; (B) protect against any anticipated threats or hazards to the security or integrity of the Cardholder Data; (C) protect against unauthorized access to or use of the Cardholder Data; and (D) ensure the proper disposal of Cardholder Data; and provided, further, that each such authorized subcontractor or Bank agrees to notify promptly Bank and Belk of any unauthorized disclosure, use, or a comparable contractual commitment disposal of, or access to, Cardholder Data and to cooperate with the same effectBank and Belk in any investigation thereof and remedial action with respect thereto;
(ii) to its Affiliates Affiliates, and its and such Affiliates' employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this SectionSection 6.2; provided that (A) any such Person is bound by terms substantially similar to this Section 6.2 as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of by each such Person with the terms of this Section; orSection 6.2;
(iii) to any Governmental Authority with authority over Bank (A) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, Bank (1) provides at least 10 ten (10) Business Days' prior notice of such proposed disclosure to Dillard's Belk if reasonably possible under the circumstances circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure; or
(iv) to the extent permitted in the Risk Management Policies and Operating Procedures, to any consumer reporting agency in accordance with the federal Fair Credit Reporting Act.
(e) Subject To the extent Bank has access to the following information in accordance with the provisions of this Agreement and subject to Applicable Law and the Program Privacy Policy, Bank shall report transmit to Dillard's Belk on a weekly basis, daily basis and in a format formats agreed to by the parties Parties in advance,advance from time to time:
(i) for any customer who has applied for a Belk Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card and did not opt out, regardless of the marketing channel of such application, : (A) the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.; (B) an indication of whether or not the customer has been approved for a Belk Credit Card; and (C) if the customer has been approved for a Belk Credit Card, the Belk Credit Card issued (or to be issued) to such customer;
(ii) for any each Cardholder, joint-Cardholder and authorized buyer, (1A) the Cardholdersuch person's name, address, email address, telephone number, social security number and Account numberNumber;
Appears in 1 contract
Cardholder Data. (a) As between Bank and Dillard'sKohl’s, Cardholder Data shall be the property of and exclusively owned by Bank. Dillard's Kohl’s acknowledges and agrees that it has no proprietary interest in the Cardholder Data.. [*]
(ba) Bank's The privacy policy applicable to the Cardholder Data is the Program Privacy PolicyPolicy attached as Schedule 6.3(b) hereto. Any modifications to the Program Privacy Policy shall be approved mutually determined by the Marketing Committeeparties pursuant to Sections 3.3 - 3.6, provided that the Program Privacy Policy shall comply with Applicable Law at all times.
(cb) Bank shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.116.3. Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting customers listed in the Cardholder Data for Private Label Credit Cards, Enhancement Products listed in Schedule 4.11, and any other products and services approved by the Marketing Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein.[*]
(dc) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.116.3(d). [*]
(d) Subject to Sections 6.3(f) and 6.4, any Cardholder Data provided by Bank shall notto Kohl’s under this Agreement, directly or indirectly, sell or otherwise transfer any right obtained by Kohl’s, in connection with its activities as a servicer for Bank under the Program, may be used and disclosed by Kohl’s solely as permitted by this Agreement solely for purposes of monitoring and overseeing the Program, [*].
(e) [*]
(f) Subject to Section 6.4, Kohl’s shall not use, or permit to be used, Cardholder Data, except as provided in this Section 6.3(g). [*]
(g) Subject to Section 6.3(f) and Section 6.4, Kohl’s shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 6.3(h). Bank Kohl’s may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.11, 6.3(g); provided that (A) each such subcontractor agrees to be bound by this Section 4.116.3, or a comparable contractual commitment with the same effect, and (B) Kohl’s shall be responsible for the compliance of each such subcontractor with the terms of this Section 6.3;
(ii) to its Affiliates and its Affiliates' ’ employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this SectionSection 6.3(g); provided that (A) any such Person is bound by terms substantially similar to this Section 6.3 as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank Kohl’s shall be responsible for the compliance of each such Person with the terms of this SectionSection 6.3; or
(iii) to any Governmental Authority with authority over Bank (A) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, Bank (1) provides at least 10 Business Days' prior notice of such proposed disclosure to Dillard's if reasonably possible under the circumstances and (2) seeks to redact Cardholder Data to the fullest extent possible under Applicable Law governing such disclosureKohl’s [*].
(eh) Subject With respect to Applicable Law use and disclosure of Cardholder Data following the Program Privacy Policy, Bank shall report to Dillard's on a weekly basis, in a format agreed to by the parties in advance,termination of this Agreement:
(i) for any customer who has applied for a Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card The rights and did not opt out, regardless obligations of the marketing channel of such application, the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customerparties under this Section 6.3 shall continue through any Termination Period.
(ii) If a purchase of Program Assets is consummated pursuant to Section 16.2, Bank shall transfer its right, title and interest in the Cardholder Data to Kohl’s or its Nominated Purchaser as part of such transaction, and Bank’s right to use and disclose the Cardholder Data shall terminate upon the termination of the Termination Period and in no event shall Bank solicit any Cardholder for any Cardholderloan, product, or service on the basis of such Person’s status as a Cardholder or any other information obtained in connection with the Program without Kohl’s prior written consent.
(1iii) the Cardholder's name, address, email address, telephone number, social security number and Account number;[*]
Appears in 1 contract
Cardholder Data. (a) As between Bank and Dillard'sthe Parties hereto, the Cardholder Data shall be the property of and exclusively owned by the Bank. Dillard's acknowledges and agrees that it has no proprietary interest in the Cardholder Data.
(b) Bank's privacy policy The Program Privacy Policy applicable to the Cardholder Data is the Program Privacy Policyattached as Schedule 6.2(b) hereto. Any modifications to the Program Privacy Policy shall be approved by the Marketing Committeeboth Parties, provided that without limiting the Bank’s obligations pursuant to Section 4.6(b), the Bank shall have the sole right to effect such changes to the Program Privacy Policy to ensure that the Program Privacy Policy shall comply with Applicable Law at all times.
(c) Bank shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.11. The Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting and marketing in compliance with the provisions of this Agreement customers listed in the Cardholder Data for Private Label Company Credit Cards, Enhancement Products listed in Schedule 4.11Approved Ancillary Products, and any other mutually agreed products and services approved as agreed by the Marketing CommitteeParties pursuant to the terms hereof, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law, regulatory examinations and internal auditing, internal risk assessment and internal management functions or (iv) for purposes of performing analysis and modeling, provided, however, that Cardholder Data used for analysis and modeling other than with respect to the Program shall be non-personally identifiable information, shall be aggregated with data from other portfolios, and shall not be used in connection with or for the benefit of any credit program that is or may be offered by the Bank on behalf of or in association with any Scheduled Retailer. The Bank has no rights to to, and shall not, in any event, use the Cardholder Data for marketing or any other purposes except as expressly provided herein. Without limiting the foregoing, each Party acknowledges that the Bank may gather information from Persons Active.15844721.1 independent of the Program and without use of any information obtained in connection with or as a result of this Agreement or its relationship with the Company, including from Persons who may or may not also be Cardholders. The Bank and its Affiliates have the rights to use and disclose such information independent of whether such information constitutes Cardholder Data or Shopper Data under this Agreement.
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.11. The Bank shall not, directly or indirectly, sell disclose, sell, transfer, or otherwise transfer any right in rent (or permit others to do same), the Cardholder Data. , except that the Bank may disclose the Cardholder Data may, in compliance with Applicable Law and the Program Privacy Policy Policy, disclose Cardholder Data solely:
(i) to its subcontractors Service Providers authorized in accordance with this Agreement solely on a “need to know” basis in connection with a permitted use of such the Cardholder Data under this pursuant to Section 4.116.2(c), provided that each such subcontractor Service Provider agrees in a written agreement that obligates the Service Provider to adhere to requirements at least as restrictive as those set forth herein with regard to the confidentiality and use of, and protecting the security and integrity of, the Cardholder Data; and the Bank shall be bound responsible for the compliance by each such Person with the terms of this Section 4.11, or a comparable contractual commitment with the same effect6.2;
(ii) to its Affiliates and its Affiliates' employees, agents, attorneys and accountants with their Representatives solely on a “need to know such Cardholder Data know” basis in connection with a permitted use of such the Cardholder Data under this Sectionpursuant to Section 6.2(c); provided that (A) any such Person is bound by terms substantially similar to this Section as a condition the Bank communicates the confidential nature of employment or of access to the Cardholder Data to such Persons, such Persons are bound (by agreement or by their professional obligations imposing comparable terms; responsibilities) to maintain the confidentiality of the Cardholder Data in accordance with the provisions of this Agreement, and (B) the Bank shall be responsible for the compliance of by each such Person with the terms of this Section; orSection 6.2;
(iii) to any Governmental Authority with authority over the Bank or its Affiliates or their respective Service Providers (A) in connection with an examination of Bankthe Bank or its Affiliates or their respective Service Providers; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that the Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, the Bank (1) provides at least 10 ten (10) Business Days' ’ prior notice of such proposed disclosure to Dillard's the Company if reasonably possible under the circumstances circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure;
(iv) to the extent provided for in the Operating Procedures, to any consumer reporting agency in accordance with the federal Fair Credit Reporting Act; or
(v) to a potential third-party purchaser with respect to any Cardholder Indebtedness that is eligible for sale pursuant to this Agreement, or to a trustee in connection with a securitization transaction to the extent permitted under this Agreement.
(e) The Bank shall not, directly or indirectly, sell, or otherwise transfer any right in or to the Cardholder Data, except to the extent necessary in connection with a sale of Active.15844721.1 Cardholder Indebtedness or Accounts otherwise permitted hereunder; provided that the transferee thereof enters into a confidentiality agreement affording protections substantially similar to the confidentiality and use provisions of this Agreement with such modifications as are customary in connection with the intent and permitted purposes of the transfer.
(f) Subject to Applicable Law and the Program Privacy Policy, the Bank shall report provide the Company with reasonable access, through the Bank’s data analysts, to Dillard's the Cardholder Data obtained by the Bank in connection with the Program, which includes the items listed below and any other items mutually agreed by the Parties. In addition, subject to Applicable Law, and as reasonably requested by the Company, the Bank shall provide the Company with an updated copy of the master file or such elements thereof as may be requested by the Company. Subject to Applicable Law and the Program Privacy Policy, the Bank shall transmit to the Company on a weekly basisreal-time basis throughout each day by a secure data feed into Company Systems designated by the Company from time to time, in a format formats agreed to by the parties Parties in advance,advance from time to time the information obtained by the Bank in connection with the Program:
(i) for any customer who has applied for a Company Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card and did not opt out, regardless of the marketing channel of such application, Application: (A) the customer's ’s name, address, email address, telephone numbernumber (including cellular), social security number and all other commercially reasonable information supplied on the application Application or prescreened response submitted by the customer (excluding the customer.’s social security number and credit bureau scores); (B) an indication of whether or not the customer has been approved for a Company Credit Card; and (C) if the customer has been approved for a Company Credit Card, the Company Credit Card issued (or to be issued) to such customer;
(ii) for any Cardholdereach Cardholder and joint-Cardholder and for each authorized user (to the extent the Bank has access thereto and is permitted to share such information), (1A) the Cardholder's such person’s name, address, email address, telephone number, number (including cellular) and Account number (excluding the customer’s social security number and Account numbercredit bureau scores); (B) any reported change to any of the foregoing information; (C) transaction and experience data; and (D) any such other Cardholder Data as the Parties may mutually agree;
(iii) the Cardholder Data for all categories of information made available to the Company by GE as of the date hereof (as identified by the Company and GE prior to the date hereof); and
(iv) analytical output that the Bank has derived or may derive from the Bank’s database that might enhance the Company’s understanding of its customers and that the Company reasonably believes could be used to improve the marketing of the Company or the Program. Notwithstanding the foregoing, no Party hereto shall be required to provide any information on a personally identifiable basis if the provision of such personally identifiable information would cause such Party to be considered a “consumer reporting agency” for purposes of the Fair Credit Reporting Act. Active.15844721.1
(g) The Bank shall cooperate with the Company to provide the Company and its Affiliates with the maximum ability permissible under Applicable Law and the Program Privacy Policy to receive and use the Cardholder Data, including, as necessary or appropriate, through use of consents, opt-in provisions or opt-out provisions, as requested by the Company for purposes permitted hereunder. Without limiting the foregoing, the Company and each of its Affiliates may receive and use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) for purposes of promoting the Program or promoting Goods and Services, and
(ii) as otherwise necessary to carry out its obligations under this Agreement.
(h) The Company shall not, directly or indirectly, disclose, sell, transfer or rent (or permit others to do the same) Cardholder Data to any third party without the prior written permission of the Bank, except as provided in this Section 6.2(h). The Company may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its Service Providers authorized in accordance with this Agreement solely on a “need to know” basis in connection with a permitted use of the Cardholder Data pursuant to Section 6.2(g), provided that each such Service Provider agrees in a written agreement that obligates the Service Provider to adhere to requirements at least as restrictive as those set forth herein with regard to the confidentiality and use of, and protecting the security and integrity of, the Cardholder Data; and the Company shall be responsible for the compliance of each such Service Provider with the terms of this Section 6.2
(ii) to its Affiliates and its and their Representatives solely on a “need to know” basis in connection with a permitted use of the Cardholder Data pursuant to Section 6.2(g); provided that the Company communicates the confidential nature of the Cardholder Data to such Persons, such Persons are bound (by agreement or their professional responsibilities) to maintain the confidentiality of the Cardholder Data in accordance with the provisions of this Agreement, and the Company shall be responsible for the compliance by each such Person with the terms of this Section 6.2;
(iii) to any Governmental Authority with authority over the Company or its Affiliates (A) in connection with an examination of the Company or its Affiliates; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that the Company seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, the Company (1) provides at least ten (10) Business Days’ prior notice of such proposed disclosure to the Bank if reasonably possible under the circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure; or
(iv) to a prospective Nominated Purchaser at the time, under the circumstances Active.15844721.1 and in accordance with the procedures set forth in Section 17.2(e).
(i) With respect to the sharing, use and disclosure of the Cardholder Data following the termination of this Agreement:
(i) the rights and obligations of the Parties under this Section 6.2 shall continue through any Termination Period and, if applicable, any interim servicing period pursuant to Section 17.2(h);
(ii) if the Company exercises its purchase rights under Section 17.2, the Bank shall transfer its right, title and interest in the Cardholder Data to the Company or its Nominated Purchaser as part of such transaction, and the Bank’s right to use and disclose the Cardholder Data shall terminate upon the termination of the Termination Period, except for such use and disclosure as is necessary to comply with Applicable Law and except for such internal use as may be necessary to comply with the Bank’s disaster recovery requirements or normal audit requirements. Promptly following the Termination Period, the Bank shall return or destroy all Cardholder Data and shall certify such return or destruction to the Company upon request; provided, however, that, if the Bank is obligated to retain any Cardholder Data pursuant to requirements of Applicable Law or the Bank’s disaster recovery plan or record retention or audit requirements, the Bank shall maintain the strict confidentiality and security of such Cardholder Data and shall not use such Cardholder Data for any other purpose; and
(iii) if the Company provides notice that it shall not exercise its purchase rights under Section 17.2 or otherwise fails to exercise such purchase rights, the Company’s right to use and disclose the Cardholder Data shall terminate (it being understood that nothing herein shall restrict the Company’s right to use and disclose the Shopper Data following the Termination Date; provided, however the Company may not deliver any marketing or promotions to any Shopper on the basis that such Shopper is or was also a Cardholder), and the restrictions hereunder on the Bank’s use and disclosure of Cardholder Data shall terminate, except that in no event may the Bank disclose Cardholder Data to any retailer or use Cardholder Data in any way for the benefit of any Scheduled Retailer, or in any manner inconsistent with the limitations on the Bank’s rights pursuant to Section 17.3. The foregoing provisions shall in no way be construed as to extend the Bank’s rights to use the Company Licensed Marks, the Company’s name or any Intellectual Property of the Company, all of which rights shall be expressly limited as set forth in Article X and shall terminate as set forth in Section 17.3(c).
Appears in 1 contract
Cardholder Data. (a) As between Bank and Dillard'samong the Parties hereto, the Cardholder Data shall be the property of and exclusively owned by the Bank. Dillard's The Company acknowledges and agrees that that, subject to its rights pursuant to Section 17.2, it has no proprietary interest in the Cardholder Data.
(b) Bank's privacy policy The Program Privacy Policy applicable to the Cardholder Data is the Program Privacy Policyattached as Schedule 6.2(b) hereto. Any modifications to the Program Privacy Policy shall be approved by the Marketing Operating Committee, provided that the Program Privacy Policy shall comply with Applicable Law at all timestimes and shall not provide for any reduction in the access to, or disclosure or use of Cardholder Data by the Company and its Affiliates as compared with the Program Privacy Policy in effect on the Effective Date.
(c) Bank shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.11. The Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting customers listed in the Cardholder Data for Private Label Credit Cards, Enhancement Products listed in Schedule 4.11, and any other products and services approved by the Marketing Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein[****].
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.11. The Bank shall not, directly or indirectly, sell sell, transfer, or otherwise transfer any right in rent (or permit others to do same), the Cardholder Data, and shall not, directly or indirectly, disclose the Cardholder Data, except for disclosure in compliance with Applicable Law and the Program Privacy Policy solely: [****].
(e) Subject to Applicable Law and the Program Privacy Policy, the Bank shall provide the Company with unlimited access, through the Bank’s data analysts, to all Cardholder Data obtained by the Bank in connection with the Program, which includes at least the items listed below as set forth in greater detail on Schedule 6.2(e). Bank In addition, subject to Applicable Law, and as reasonably requested by the Company, [****]: [****].
(f) [****].
(g) [****].
(h) The Company may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its subcontractors Service Providers authorized in accordance with this Agreement solely on a “need to know” basis in connection with a permitted use of such the Cardholder Data under this pursuant to Section 4.116.2(g), provided that each such subcontractor agrees to be bound by this Section 4.11, or a comparable contractual commitment with the same effect[****];
(ii) to its Affiliates and its Affiliates' employees, agents, attorneys and accountants with their Representatives on a “need to know such Cardholder Data know” basis in connection with a permitted use of such the Cardholder Data under this Sectionpursuant to Section 6.2(g); provided that (A) any such Person is bound by terms substantially similar to this Section as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of each such Person with the terms of this Section; or[****];
(iii) to any Governmental Authority with authority over Bank the Company or its Affiliates, or their respective Service Providers [****]; or
(Aiv) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent as otherwise permitted by Applicable Law, Bank (1) provides at least 10 Business Days' prior notice of such proposed disclosure to Dillard's if reasonably possible under the circumstances and (2) seeks to redact Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure.
(e) Subject to Applicable Law and the Program Privacy Policy, Bank shall report to Dillard's on a weekly basis, in a format agreed to by the parties in advance,; [****].
(i) for any customer who has applied for a Credit CardWith respect to the sharing, had the opportunity to make an opt out choice, was not approved for a Credit Card use and did not opt out, regardless disclosure of the marketing channel Cardholder Data following the termination of such applicationthis Agreement:
(i) the rights and obligations of the Parties under this Section 6.2 shall continue through any Termination Period and, the customer's nameif applicable, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.any interim servicing period pursuant to Section 17.2(h);
(ii) if the Company exercises its purchase rights under Section 17.2, the Bank shall transfer its right, title and interest in the Cardholder Data to the Company or its Nominated Purchaser as part of such transaction, and the Bank’s right to use and disclose the Cardholder Data shall terminate upon the termination of the Termination Period and, promptly following such termination of the Termination Period, the Bank shall return or destroy all Cardholder Data and shall certify such return or destruction to the Company upon request; provided, however, that, if the Bank is obligated to retain any Cardholder Data pursuant to requirements of Applicable Law or the Bank’s disaster recovery plan, or internal retention policies, the Bank shall maintain the strict confidentiality and security of such Cardholder Data and shall not use such Cardholder Data for any Cardholderother purpose; provided further, that if the Bank is performing interim servicing for the Nominated Purchaser pursuant to Section 17.2(h), the Bank may continue to use Cardholder Data to the extent necessary to perform such servicing; and
(1iii) if the Cardholder's nameCompany provides notice that it shall not exercise its purchase rights under Section 17.2, addressor otherwise fails to exercise its option within the time period specified in Section 17.2, email addressthe Company’s right to use and disclose the Cardholder Data shall terminate, telephone numberand the restrictions hereunder on the Bank’s use and disclosure of Cardholder Data shall terminate, social security number except that in no event may the Bank or any of its Affiliates disclose Cardholder Data to any retailer or use Cardholder Data in any way for the benefit of any retailer or retail credit card program or in any manner inconsistent with the limitations on the Bank’s rights to dispose of the Program Assets pursuant to Section 17.4. The foregoing provisions shall in no way be construed as to extend the Bank’s rights to use the Company Licensed Marks, the Company’s name or any Intellectual Property of the Company, all of which rights shall be expressly limited as set forth in Article X and Account number;shall terminate as set forth in Section 17.4(c).
Appears in 1 contract
Sources: Credit Card Program Agreement (Signet Jewelers LTD)
Cardholder Data. (a) As between Bank and Dillard'samong the Parties hereto, the Cardholder Data shall be the property of and exclusively owned by Bank. Dillard's acknowledges and agrees that it has no proprietary interest in the Cardholder Data.
(b) Bank's privacy policy The Program Privacy Policy applicable to the Cardholder Data is the Program Privacy Policyattached as Schedule 6.2 hereto. Any modifications to the Program Privacy Policy shall be approved by the Marketing Management Committee, provided that the Program Privacy Policy shall comply with Applicable Law at all times.
(c) Bank shall not use, or permit to be used, the Cardholder Data, except as provided in this Section 4.116.2. Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting or marketing (in each case, solely as directed by the NMG Companies or the Management Committee) or servicing customers listed in the Cardholder Data for Private Label NMG Credit Cards, Enhancement Products listed in Schedule 4.11Approved Ancillary Products, and any other products and services approved by the Marketing Management Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein.
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.116.2. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder DataData other than to NMG or any of its Affiliates. Bank may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its authorized subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.116.2, provided that each such authorized subcontractor agrees in a written agreement satisfactory to NMG and Bank to maintain all such Cardholder Data as strictly confidential and not to use or disclose such information to any Person other than Bank or an NMG Company, except as required by Applicable Law or any Governmental Authority (after giving Bank and the NMG Companies prior notice and an opportunity to defend against such disclosure); provided, further, that each such authorized subcontractor maintains, and agrees in writing to maintain, an information security program that is designed to meet all requirements of Applicable Law, including, at a minimum, maintenance of an information security program that is designed to: (w) ensure the security and confidentiality of the Cardholder Data; (x) protect against any anticipated threats or hazards to the security or integrity of the Cardholder Data; (y) protect against unauthorized access to or use of the Cardholder Data; and (z) ensure the proper disposal of Cardholder Data; and provided, further, that each such authorized subcontractor agrees to be bound by this Section 4.11notify promptly Bank and the NMG Companies of any unauthorized disclosure, use, or a comparable contractual commitment disposal of, or access to, Cardholder Data and to cooperate with Bank and the same effectNMG Companies in any investigation thereof and remedial action with respect thereto;
(ii) to its Affiliates Affiliates, and its and such Affiliates' ’ employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this SectionSection 6.2; provided that (A) any such Person is bound by terms substantially similar to this Section 6.2 as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of by each such Person with the terms of this Section; orSection 6.2;
(iii) to any Governmental Authority with authority over Bank (A) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, Bank (1) provides at least 10 ten (10) Business Days' ’ prior notice of such proposed disclosure to Dillard's NMG if reasonably possible under the circumstances circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure; or
(iv) to the extent permitted in the Risk Management Policies and Operating Procedures, to any consumer reporting agency in accordance with the federal Fair Credit Reporting Act.
(e) To the extent Bank has access to the following information in accordance with the provisions of this Agreement and subject to Applicable Law and the Program Privacy Policy, Bank shall transmit to the NMG Companies at such times as may be requested by NMG and in formats agreed to by the Parties in advance from time to time:
(i) for any customer who has applied for an NMG Credit Card, regardless of the marketing channel of such application: (A) the customer’s name, address, email address, telephone number, social security number and all other information supplied on the application or prescreened response submitted by the customer; (B) an indication of whether or not the customer has been approved for an NMG Credit Card; and (C) if the customer has been approved for an NMG Credit Card or Non-Card Payment Plan, the NMG Credit Card or Non-Card Payment Plan issued (or to be issued) to such customer;
(ii) for each Cardholder, joint-Cardholder and authorized buyer, (1) such person’s name, address, email address, telephone number, social security number and Account number; (2) any reported change to any of the foregoing information; (3) transaction and experience data; and (4) any such other Cardholder Data as the NMG Companies may reasonably request;
(iii) the Cardholder’s name and account number for any Account that is delinquent;
(iv) the Cardholder’s name and account number for any Account that has been closed; and
(v) the Cardholder Data for all categories of information available on the NMG Companies’ credit Systems as of the date hereof. Notwithstanding the foregoing, no Party hereto shall be required to provide any information on a personally identifiable basis if the provision of such personally identifiable information would cause such Party to be considered a “consumer reporting agency” for purposes of the Fair Credit Reporting Act.
(f) Bank shall cooperate with the NMG Companies to provide NMG and its Affiliates with the maximum ability permissible under Applicable Law and the Program Privacy Policy to receive, use and disclose the Cardholder Data, including, as necessary or appropriate, through use of consents or opt-out provisions, in each case as directed by the NMG Companies. Without limiting the foregoing, NMG and each of its Affiliates may receive, use and disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy (i) for purposes of promoting the Program or promoting NMG Goods and Services, (ii) as otherwise necessary to carry out its obligations under this Agreement, and (iii) as otherwise permitted by Applicable Law.
(g) The NMG Companies may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy. Each of the NMG Companies may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its existing subcontractors as of the Effective Date and to authorized subcontractors that enter into agreements with an NMG Company after the Effective Date (“Future Subcontractors”) in connection with a permitted use of such Cardholder Data under this Section 6.2, provided that each such existing subcontractor and Future Subcontractor agrees in a written agreement satisfactory to NMG and Bank to maintain all such Cardholder Data as strictly confidential in perpetuity and not to use or disclose such information to any Person other than an NMG Company or Bank, except as required by Applicable Law or any Governmental Authority (after giving the NMG Companies prior notice and an opportunity to defend against such disclosure); provided, further, that each such existing subcontractor and Future Subcontractor maintains, and agrees in writing to maintain, an information security program that is designed to meet all requirements of Applicable Law, including, at a minimum, maintenance of an information security program that is designed to: (w) ensure the security and confidentiality of the Cardholder Data; (x) protect against any anticipated threats or hazards to the security or integrity of the Cardholder Data; (y) protect against unauthorized access to or use of the Cardholder Data; and (z) ensure the proper disposal of Cardholder Data; and provided, further, that each such existing subcontractor and Future Subcontractor agrees to notify promptly Bank and the NMG Companies of any unauthorized disclosure, use, or disposal of, or access to, Cardholder Data and to cooperate with Bank and the NMG Companies in any investigation thereof and remedial action with respect thereto;
(ii) to its Affiliates, and its and such Affiliates’ employees, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section 6.2; provided that (A) any such Person is bound by terms substantially similar to this Section 6.2 as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) the NMG Companies shall be responsible for the compliance by each such Person with the terms of this Section 6.2; or
(iii) to any Governmental Authority with authority over such NMG Company (A) in connection with an examination of such NMG Company; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that such NMG Company seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, such NMG Company (1) provides at least ten (10) Business Days’ prior notice of such proposed disclosure to Bank if reasonably possible under the circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure.
(eh) Subject With respect to Applicable Law the sharing, use and disclosure of the Program Privacy Policy, Bank shall report to Dillard's on a weekly basis, in a format agreed to by Cardholder Data following the parties in advance,termination of this Agreement:
(i) for any customer who has applied for a Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card rights and did not opt out, regardless obligations of the marketing channel of such application, the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.Parties under this Section 6.2 shall continue through any Termination Period;
(ii) for any Cardholderif NMG exercises its rights under Section 17.2, Bank shall transfer its right, title and interest in the Cardholder Data to NMG or its Nominated Purchaser as part of such transaction, and Bank’s right to use and disclose the Cardholder Data shall terminate upon the termination of the Termination Period; and
(1iii) if NMG provides notice that it shall not exercise its rights under Section 17.2, NMG and its Affiliates’ right to use and disclose the Cardholder's name, address, email address, telephone number, social security number and Account number;Cardholder Data hereunder shall terminate upon the termination of the Termination Period.
Appears in 1 contract
Sources: Credit Card Program Agreement (Neiman Marcus, Inc.)
Cardholder Data. (a) As between Bank and Dillard'samong the Parties hereto, the Cardholder Data shall be the property of and exclusively owned by Bank. Dillard's acknowledges and agrees that it has no proprietary interest in the Cardholder Data.
(b) Bank's privacy policy The Program Privacy Policy applicable to the Cardholder Data is the Program Privacy Policyattached as Schedule 6.2 hereto. Any modifications to the Program Privacy Policy shall be approved by the Marketing Management Committee, provided that the Program Privacy Policy shall comply with Applicable Law at all times.
(c) Bank shall not use, or permit to be used, the Cardholder Data, except as provided in this Section 4.116.2. Bank may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting or marketing (in each case, solely as directed by the NMG Companies or the Management Committee) or servicing customers listed in the Cardholder Data for Private Label NMG Credit Cards, Enhancement Products listed in Schedule 4.11Approved Ancillary Products, and any other products and services approved by the Marketing Management Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein.
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.116.2. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder DataData other than to NMG or any of its Affiliates. Bank may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its authorized subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.116.2, provided that each such authorized subcontractor agrees in a written agreement satisfactory to NMG and Bank to maintain all such Cardholder Data as strictly confidential and not to use or disclose such information to any Person other than Bank or an NMG Company, except as required by Applicable Law or any Governmental Authority (after giving Bank and the NMG Companies prior notice and an opportunity to defend against such disclosure); provided, further, that each such authorized subcontractor maintains, and agrees in writing to maintain, an information security program that is designed to meet all requirements of Applicable Law, including, at a minimum, maintenance of an information security program that is designed to: (w) ensure the security and confidentiality of the Cardholder Data; (x) protect against any anticipated threats or hazards to the security or integrity of the Cardholder Data; (y) protect against unauthorized access to or use of the Cardholder Data; and (z) ensure the proper disposal of Cardholder Data; and provided, further, that each such authorized subcontractor agrees to be bound by this Section 4.11notify promptly Bank and the NMG Companies of any unauthorized disclosure, use, or a comparable contractual commitment disposal of, or access to, Cardholder Data and to cooperate with Bank and the same effectNMG Companies in any investigation thereof and remedial action with respect thereto;
(ii) to its Affiliates Affiliates, and its and such Affiliates' ’ employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this SectionSection 6.2; provided that (A) any such Person is bound by terms substantially similar to this Section 6.2 as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of by each such Person with the terms of this Section; orSection 6.2;
(iii) to any Governmental Authority with authority over Bank (A) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, Bank (1) provides at least 10 ten (10) Business Days' ’ prior notice of such proposed disclosure to Dillard's NMG if reasonably possible under the circumstances circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure; or
(iv) to the extent permitted in the Risk Management Policies and Operating Procedures, to any consumer reporting agency in accordance with the federal Fair Credit Reporting Act.
(e) Subject To the extent Bank has access to the following information in accordance with the provisions of this Agreement and subject to Applicable Law and the Program Privacy Policy, Bank shall report transmit to Dillard's on a weekly basis, the NMG Companies at such times as may be requested by NMG and in a format formats agreed to by the parties Parties in advance,advance from time to time:
(i) for any customer who has applied for a an NMG Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card and did not opt out, regardless of the marketing channel of such application, : (A) the customer's ’s name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.; (B) an indication of whether or not the customer has been approved for an NMG Credit Card; and (C) if the customer has been approved for an NMG Credit Card or Non-Card Payment Plan, the NMG Credit Card or Non-Card Payment Plan issued (or to be issued) to such customer;
(ii) for any each Cardholder, joint-Cardholder and authorized buyer, (1) the Cardholder's such person’s name, address, email address, telephone number, social security number and Account number;
Appears in 1 contract
Sources: Credit Card Program Agreement (Neiman Marcus Group Inc)
Cardholder Data. (a) As between Bank and Dillard'sCompany, Cardholder Data shall be the property of Bank; provided, however, that if any particular Cardholder Data shall also constitute Shopper Data, Company shall be permitted to use such Shopper Data in accordance with the provisions of this Agreement applicable to Shopper Data and exclusively owned by Bank. Dillard's acknowledges and agrees without regard to any additional restrictions that it has no proprietary interest in the may be applicable to Cardholder Data.
, and that Shopper Data shall be the property of Company in accordance with Section 6.3. For avoidance of doubt, some data can constitute both Cardholder Data and Shopper Data for purposes of this Agreement, in which case Bank shall have a property interest and use rights in such data as Cardholder Data under Section 6.2 and Company shall have a property interest and use rights in that same data as Shopper Data under Section 6.3. In addition, in its capacity as servicer, Company shall maintain all Cardholder Data and shall provide Bank with full access to Cardholder Data; provided that such access shall be through reports and data feeds consistent with Company’s data security policies but shall not include access to Company’s Systems beyond the ability to view data to the extent provided pursuant to Section 4.10 and Section 4.18(d). (b) Bank's privacy policy The initial Program Privacy Notice applicable to the Cardholder Data is attached as Schedule 6.2(b), which shall be separate and distinct from the privacy notice(s) that Bank * 48 maintains for its other portfolios. Bank shall cooperate with Company to provide Company the maximum ability permissible under Applicable Law and the Program Privacy PolicyNotice to obtain, use and disclose Shopper Data and Cardholder Data, including through the sharing of such data as permitted pursuant the Program Privacy Notice and through the use of disclosures, consents, opt-in provisions or opt-out provisions. Any modifications to the Program Privacy Policy Notice shall be approved by the Marketing Committeeboth parties, provided that the Program Privacy Policy shall comply with (i) modifications required by a change in Applicable Law at all times.
following the Effective Date shall be approved and incorporated in accordance with the provisions of Section 4.8 and (cii) Bank shall not use, or permit unreasonably object to be used, Cardholder Data, except as provided in this Section 4.11. Bank may any modifications thereto permissible by Applicable Law that shall broaden Company’s ability to receive and use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting customers listed in the Cardholder Data for Private Label Credit Cards, Enhancement Products listed in Schedule 4.11, and any other products and services approved by the Marketing Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided hereinobtained from Bank.
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.11. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder Data. Bank may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely:
(i) to its subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.11, provided that each such subcontractor agrees to be bound by this Section 4.11, or a comparable contractual commitment with the same effect;
(ii) to its Affiliates and its Affiliates' employees, agents, attorneys and accountants with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section; provided that (A) any such Person is bound by terms substantially similar to this Section as a condition of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance of each such Person with the terms of this Section; or
(iii) to any Governmental Authority with authority over Bank (A) in connection with an examination of Bank; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law, Bank (1) provides at least 10 Business Days' prior notice of such proposed disclosure to Dillard's if reasonably possible under the circumstances and (2) seeks to redact Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure.
(e) Subject to Applicable Law and the Program Privacy Policy, Bank shall report to Dillard's on a weekly basis, in a format agreed to by the parties in advance,
(i) for any customer who has applied for a Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card and did not opt out, regardless of the marketing channel of such application, the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.
(ii) for any Cardholder, (1) the Cardholder's name, address, email address, telephone number, social security number and Account number;
Appears in 1 contract
Sources: Credit Card Program Agreement
Cardholder Data. (a) As between Bank and Dillard'sCompany, Cardholder Data shall be the property of and exclusively owned by Bank. Dillard's acknowledges In its capacity as servicer, Company shall maintain all Cardholder Data and agrees that it has no proprietary interest in the shall provide Bank with full access to Cardholder Data.
(b) Bank's The initial privacy policy notice applicable to the Cardholder Data is attached as Schedule 6.2(b), which shall be separate from the privacy notice(s) that Bank maintains for its other portfolios. Bank shall cooperate with Company to provide Company the maximum ability permissible under Applicable Law and Network Rules to use and disclose Cardholder Data, including, as necessary or appropriate, through the Program Privacy PolicyNotice and/or the use of disclosures, consents, opt-in provisions or opt-out provisions. Any modifications to the Program Privacy Policy Notice shall be approved by the Marketing Committeeboth parties, provided that the Program Privacy Policy Notice at all times shall (i) comply with Applicable Law at all timesand (ii) provide Company access to and the right to use Cardholder Data to the fullest extent permitted by Applicable Law and Network Rules, including for its business purposes.
(c) Bank shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.116.2. Bank may use the Cardholder Data and any other information derived from the Cardholder Data in compliance with Applicable Law Law, the Network Rules and the Program Privacy Policy solely Notice, solely: (i) as necessary to exercise its rights or carry out its obligations hereunder; (ii) for purposes of soliciting customers listed in promoting the Cardholder Data Program or promoting Goods and/or Services available for Private Label Credit Cards, Enhancement Products listed in Schedule 4.11, and purchase on an Account at or through any other products and services approved by the Marketing Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or Company Channel; (iii) for purposes of performing analysis and modeling, provided, however, that Cardholder Data used for analysis and modeling other than with respect to the Program shall be Non-Personally Identifiable Information, shall be aggregated with data from other portfolios, and shall not be used in connection with or for the benefit of any co-branded or private label credit program that is or may be offered by Bank on behalf of or in association with any Competing Retailer; or (iv) as required by necessary or appropriate for purposes of compliance with Applicable Law, regulatory examination, internal auditing functions, risk assessment or management functions, Network Rules or as otherwise set forth in 12 CFR 40.15(a)(1)-(7). Bank has no rights to shall not use the Cardholder Data for marketing or any other purposes except as expressly provided herein. Notwithstanding the foregoing, each party acknowledges that Bank may independently gather information from individuals independent of the Program, including from Persons who may or may not also be Cardholders, and that Bank and its Affiliates may have rights to use and disclose such information independent of whether such information also constitutes Cardholder Data or Company Guest Data under this Agreement; provided, however, except as expressly permitted pursuant to this Agreement, Bank and its Affiliates may not, in any event, take into account that a Person is a Cardholder or intentionally target for solicitation such customers through the use of the Cardholder Data. Bank shall not commingle Cardholder Data into any Bank marketing database except as provided in this Section 6.2(c).
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.11. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder Data6.2. Bank may disclose the Cardholder Data in compliance with Applicable Law and Law, the Network Rules, the Program Privacy Policy Notice and the Credit Card Agreement, solely:
(i) to its subcontractors (including Company in its capacity as servicer) in connection with a permitted use of such Cardholder Data under this Section 4.11, 6.2; provided that (A) each such subcontractor agrees is subject to an obligation to maintain the confidential status of Cardholder Data at least as restrictive as that set forth herein, and (B) Bank shall be bound by this Section 4.11, responsible for the compliance of each such subcontractor (other than Company in its capacity as servicer or a comparable contractual commitment any subcontractor of Company in such capacity) with the same effect;terms of this Section.
(ii) to its Affiliates Affiliates, and its Affiliates' to employees, agents, attorneys attorneys, auditors and accountants of Bank and its Affiliates, with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section; provided that (A) any each such Person is bound by terms substantially similar subject to this Section as a condition an obligation to maintain the confidential status of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; at least as restrictive as that set forth herein, and (B) Bank shall be responsible for the compliance of each such Person with the terms of this Section; or;
(iii) to a potential third-party purchaser with respect to any written off Cardholder Indebtedness or otherwise to the extent permitted under this Agreement, or to a trustee in connection with a securitization transaction to the extent permitted under this Agreement; or
(iv) to any Governmental Authority with asserting authority over Bank or any of its Affiliates (A) in connection with an examination of BankBank or any such Affiliate; or (B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process, provided, however, that Bank shall seek the full protection of confidential treatment for any disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure and with respect to clause (B) Bank shall provide reasonable advance notice to Company to the extent reasonably practicable under the circumstances.
(e) Bank shall not, directly or indirectly, sell, or otherwise transfer any right in or to the Cardholder Data, except (i) with respect to any written off Cardholder Indebtedness, (ii) to any potential third-party purchaser to the extent permitted hereunder, and (iii) to a trustee in connection with a securitization transaction related to the Accounts to the extent permitted hereunder, provided that, such trustee shall be bound by a confidentiality agreement affording protections substantially similar to the confidentiality and use provisions of this Agreement with such modifications as may be customary for confidentiality agreements in connection with such securitizations (and any material modifications shall be submitted for approval of Company, which approval shall not be unreasonably delayed, conditioned or withheld).
(f) Subject to Applicable Law, Bank shall provide the information below to Company on a daily basis:
(i) [*]
(ii) [*]
(iii) [*]
(iv) [*] To the extent that Company, as servicer for Bank, has access to the information Bank is obligated to provide under this Section 6.2(f), the parties acknowledge and agree that Bank shall be deemed to have fulfilled its obligation hereunder.
(g) Company shall not use, or permit to be used, Cardholder Data, except as provided in this Section 6.2(g) and subject to the other provisions and procedures of this Agreement, including ARTICLE V and Section 3.5. Company may use the Cardholder Data and any other information derived from the Cardholder Data in compliance with Applicable Law, the Network Rules and the Program Privacy Notice (i) for purposes of promoting the Program or promoting Goods and/or Services available for purchase on an Account at or through any Company Channel, (ii) for all commercially reasonable purposes in the same manner as Company uses Company Guest Data, (iii) as otherwise necessary to carry out its obligations under this Agreement, and (iv) as otherwise permitted by Applicable Law, the Network Rules and the Program Privacy Notice. Company shall maintain protocols regarding Cardholder Data intended to ensure that (i) Cardholder Data is logically isolated (and accordingly always separately identifiable) from Company’s other data and (ii) the use and disclosure of Cardholder Data is limited as provided by Applicable Law and this Agreement.
(h) Company shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 6.2(h). Company may disclose the Cardholder Data in compliance with Applicable Law, the Network Rules, the Program Privacy Notice and the Credit Card Agreement, solely:
(i) to its subcontractors in connection with a permitted use of such Cardholder Data under this Section 6.2; provided that Bank (A) each such subcontractor is subject to an obligation to maintain the confidential status of Cardholder Data at least as restrictive as that set forth herein, and (B) Company shall be responsible for the compliance of each such subcontractor with the terms of this Section;
(ii) to its Affiliates, and to employees, agents, attorneys, auditors and accountants of Company or its Affiliates, with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this Section; provided that (A) each such Person is subject to an obligation to maintain the confidential status of Cardholder Data at least as restrictive as that set forth herein, and (B) Company shall be responsible for the compliance of each such Person with the terms of this Section;
(iii) to any Governmental Authority asserting authority over Company (A) in connection with an examination of Company; or (B) pursuant to a specific requirement to provide for such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided, however, that Company seeks the full protection of confidential treatment for any such disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), Company shall provide reasonable advance notice to Bank to the extent reasonably practicable under the circumstances; or
(iv) as otherwise permitted by Applicable Law, Bank the Program Privacy Notice and the Network Rules (1and subject to any other applicable provisions of this Agreement, including ARTICLE V and Section 3.5); provided that, for the avoidance of doubt, the parties agree that Company shall not disclose, or permit to be disclosed, any Cardholder Data (or information derived therefrom) provides to a prospective Nominated Purchaser except at least 10 Business Days' prior notice of such proposed disclosure to Dillard's if reasonably possible the time, under the circumstances and (2) seeks to redact Cardholder Data to in accordance with the fullest extent possible under Applicable Law governing such disclosureprocedures set forth in Section 15.2(h).
(e) Subject to Applicable Law and the Program Privacy Policy, Bank shall report to Dillard's on a weekly basis, in a format agreed to by the parties in advance,
(i) for any customer who has applied for a Credit CardWith respect to use and disclosure of Cardholder Data following expiration or termination of this Agreement, had the opportunity to make an opt out choice, was not approved for a Credit Card following shall apply:
(i) The rights and did not opt out, regardless obligations of the marketing channel of such applicationparties under this Section 6.2 shall continue through the Termination Date and, if applicable, the customer's name, address, email address, telephone number, social security number and all other commercially reasonable information supplied on end of the application or prescreened response submitted by the customerInterim Servicing Period.
(ii) for any CardholderIf Company exercises its rights under Section 15.2, Bank shall transfer its right, title and interest in the Cardholder Data to Company or its Nominated Purchaser as part of such transaction, and (1subject to Bank’s documentation retention or other obligations under Applicable Law) Bank’s right to use and disclose the Cardholder's nameCardholder Data shall terminate on the Termination Date.
(iii) If Company does not exercise its Purchase Option under Section 15.2, addressCompany’s right to use and disclose the Cardholder Data shall terminate only to the extent required by Applicable Law.
(j) The parties shall reasonably cooperate to use, email addressdisclose and share Non-Personally Identifiable Information regarding the Program, telephone numberas mutually agreed upon from time to time to, social security number among other things, monitor Program performance, comply with funding requirements (e.g. rating agency and Account number;master trust filing requirements) and support planning and financial reporting processes.
(k) Nothing in this Section 6.2 shall restrict Company’s use of Company Guest Data.
Appears in 1 contract
Cardholder Data. (a) As between Bank and Dillard'sCompany, Cardholder Data shall be the property of Bank; provided, however, that if any particular Cardholder Data shall also constitute Shopper Data, Company shall be permitted to use such Shopper Data in accordance with the provisions of this Agreement applicable to Shopper Data and exclusively owned by Bank. Dillard's acknowledges and agrees without regard to any additional restrictions that it has no proprietary interest in the may be applicable to Cardholder Data, and that Shopper Data shall be the property of Company in accordance with Section 6.3. For avoidance of doubt, some data can constitute both Cardholder Data and Shopper Data for purposes of this Agreement, in which case Bank shall have a property interest and use rights in such data as Cardholder Data under Section 6.2 and Company shall have a property interest and use rights in that same data as Shopper Data under Section 6.3. In addition, in its capacity as servicer, Company shall maintain all Cardholder Data and shall provide Bank with full access to Cardholder Data; provided that such access shall be through reports and data feeds consistent with Company’s data security policies but shall not include access to Company’s Systems beyond the ability to view data to the extent provided pursuant to Section 4.10 and Section 4.18(d).
(b) Bank's privacy policy The initial Program Privacy Notice applicable to the Cardholder Data is attached as Schedule 6.2(b), which shall be separate and distinct from the privacy notice(s) that Bank maintains for its other portfolios. Bank shall cooperate with Company to provide Company the maximum ability permissible under Applicable Law and the Program Privacy PolicyNotice to obtain, use and disclose Shopper Data and Cardholder Data, including through the sharing of such data as permitted pursuant the Program Privacy Notice and through the use of disclosures, consents, opt-in provisions or opt-out provisions. Any modifications to the Program Privacy Policy Notice shall be approved by the Marketing Committeeboth parties, provided that the Program Privacy Policy shall comply with (i) modifications required by a change in Applicable Law at all timesfollowing the Effective Date shall be approved and incorporated in accordance with the provisions of Section 4.8 and (ii) Bank shall not unreasonably object to any modifications thereto permissible by Applicable Law that shall broaden Company’s ability to receive and use Cardholder Data obtained from Bank.
(c) Bank may use the Cardholder Data and any other information derived from the Cardholder Data in compliance with Applicable Law and the Program Privacy Notice, solely as set forth in clause (c) of Schedule 6.2.
(d) Bank shall disclose, or permit to be disclosed, the Cardholder Data in compliance with Applicable Law, the Program Privacy Notice and the Credit Card Agreement, solely as set forth in clause (d) of Schedule 6.2.
(e) Bank shall not, directly or indirectly, sell, or otherwise transfer any right in or to the Cardholder Data, except (i) with respect to any written off Cardholder Indebtedness in compliance with clause (d)(ii) above, (ii) to any potential third-party purchaser to the extent permitted hereunder, and (iii) to a Person in connection with a securitization transaction related to the Accounts to the extent permitted hereunder, provided that, such Person shall be bound by a confidentiality agreement affording protections substantially similar to the confidentiality and use provisions of this Agreement with such modifications as may be customary for confidentiality agreements in connection with such securitizations (and any material modifications shall be submitted to Company for approval, which approval shall not be unreasonably delayed, conditioned or withheld).
(f) Bank shall provide to Company the information set forth in clause (f) of Schedule 6.2 in accordance with the terms thereof.
(g) Company shall not use, or permit to be used, Cardholder Data, except as provided in this Section 4.116.2(g) and subject to the other provisions and procedures of this Agreement, unless such information shall also constitute Shopper Data, as provided in Section 6.3. Bank Company may use the Cardholder Data and any other information derived from the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely Notice (i) for purposes of soliciting customers listed in promoting the Cardholder Data Program, including promoting Nordstrom Goods and/or Services available for Private Label Credit Cards, Enhancement Products listed in Schedule 4.11, and purchase on an Account at or through any other products and services approved by the Marketing CommitteeCompany Channel, (ii) in connection with or for the purpose of promoting the Loyalty Program, (iii) for analytics and reporting related to the Program, (iv) for all commercially reasonable purposes in the same manner as otherwise necessary Company uses Shopper Data, (v) to exercise its rights or carry out its obligations or exercise its rights hereunderunder this Agreement, or and (iiivi) as required for any other purpose to the maximum extent permitted by Applicable LawLaw and the Program Privacy Notice. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein.
(d) Bank Company shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this Section 4.11. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder Data. Bank may disclose the Cardholder Data only in compliance with Applicable Law and Law, the Program Privacy Policy Notice and the Credit Card Agreement, solely:
(i) to its subcontractors in connection with a permitted use of such Cardholder Data under this Section 4.11Affiliates, provided that each such subcontractor agrees and to be bound by this Section 4.11, or a comparable contractual commitment with the same effect;
(ii) to its Affiliates and its Affiliates' employees, agents, attorneys attorneys, auditors, accountants and accountants other advisors of Company or its Affiliates, with a need to know such Cardholder Data in connection with a permitted use of such Cardholder Data under this SectionSection 6.2 and to its service providers and subcontractors in connection with a permitted use of such Cardholder Data under this Section 6.2; provided that (A) any each such Person is bound by terms substantially similar subject to this Section as a condition an obligation to maintain the confidential status of employment or of access to Cardholder Data or by professional obligations imposing comparable terms; and at least as restrictive as that set forth herein, (B) Bank each such Person is subject to an obligation to maintain an information security program that is designed to meet all requirements of Applicable Law, and, at a minimum, all requirements set forth in Section 6.1(c), and (C) Company shall be responsible for the compliance of each such Person with the terms of this Section; or;
(iiiii) to any Governmental Authority with asserting authority over Bank Company (A) in connection with an examination of BankCompany; or (B) pursuant to a specific requirement to provide for such Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided provided, however, that Bank seeks Company shall seek the full protection of confidential treatment for any such disclosed Cardholder Data to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), Company shall provide reasonable advance notice to Bank to the extent reasonably practicable under the circumstances; or
(iii) as otherwise permitted by Applicable Law, Bank (1) provides at least 10 Business Days' prior notice of such proposed disclosure to Dillard's if reasonably possible under the circumstances and (2) seeks to redact Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure.
(e) Subject to Applicable Law and the Program Privacy PolicyNotice (and subject to any other applicable provisions of this Agreement, Bank including ARTICLE V, Section 3.5 and Section 4.8); provided that Company shall report not disclose or permit to Dillard's on be disclosed any Cardholder Data (or information derived therefrom) to a weekly basisprospective Nominated Purchaser, except under the circumstances or in a format agreed accordance with the procedures set forth in Section 15.2(f).
(h) With respect to by use and disclosure of Cardholder Data following expiration or termination of this Agreement, the parties in advance,following shall apply:
(i) for any customer who has applied for a Credit Card, had the opportunity to make an opt out choice, was not approved for a Credit Card rights and did not opt out, regardless obligations of the marketing channel of such applicationparties under this Section 6.2 shall continue through the Termination Date and, to the customer's nameextent necessary to exercise the parties’ respective rights and obligations, address, email address, telephone number, social security number and all other commercially reasonable information supplied on the application or prescreened response submitted by the customer.during any Interim Servicing Period;
(ii) for if Company exercises its Purchase Option under Section 15.2 Bank shall transfer its right, title and interest in the Cardholder Data to Company or its Nominated Purchaser as part of such transaction and remove all the Cardholder Data from any Cardholderlist of Persons used by Bank or a third party in connection with solicitation of Credit Cards, debit cards, or other products bearing a Bank Licensed ▇▇▇▇, and (1subject to Bank’s documentation retention policy (which shall in all events prohibit all use and disclosure of the Cardholder Data except as required to comply with Applicable Law) or other obligations under Applicable Law) Bank’s right to use and disclose the Cardholder's nameCardholder Data shall terminate on the Termination Date. Notwithstanding the foregoing, addressnothing in this Section 6.2(h)(ii) shall obligate Bank or any third party to remove data from any marketing list information about any Person that Bank obtained independently from (and without any use of or reference to) this Program or restrict Bank’s use of such independently obtained information; and
(iii) if Company does not exercise its Purchase Option under Section 15.2, email addressCompany’s right to use and disclose the Cardholder Data (but not Shopper Data, telephone numberincluding Program Generated Shopper Data) shall terminate except as required to comply with Applicable Law as of the Termination Date or the end of any Interim Servicing Period and promptly thereafter Company shall return or destroy in a commercially reasonable and technically feasible manner such Cardholder Data (but not Shopper Data, social security number including Program Generated Shopper Data) and Account number;shall certify such return or destruction to Bank upon request.
(i) The parties shall reasonably cooperate to use, disclose and share Non-Personally Identifiable Information regarding the Program, as mutually agreed upon from time to time to, among other things, monitor Program performance, comply with funding requirements (e.g. rating agency and master trust filing requirements) and support planning and financial reporting processes.
(j) Nothing in this Section 6.2 shall restrict Company’s use of Shopper Data.
Appears in 1 contract