DORA Amendment

This DORA Addendum ("Addendum") is entered into and supplements the existing Service Agreement between the Parties. This Addendum ensures compliance with the Digital Operational Resilience Act (DORA), specifically Article 30.

1 Scope and purpose

This Addendum applies to ICT services provided by Cardboard ("Provider") to the end user who is also a financial entity as defined by DORA ("Financial Entity"), specifically:

1. Virtual payment cards
2. Subscription tracking
3. Automated receipt collection

2 Service description

1. Provider delivers ICT services through its platform, enabling virtual card issuance and payment setup.
2. Core payment processing is performed by Adyen as the "Card Issuer".
3. Core payment processing and card transactions will continue to function independently of Provider's platform availability through Card Issuer's infrastructure.
4. Any material subcontracting of these services shall require prior written notification to the Financial Entity.

3 Data processing and protection

1. All data processing and storage locations shall be documented and communicated to the Financial Entity.
2. Provider shall notify Financial Entity in advance of any intended changes to processing locations.

4 Data protection

1. Provider shall ensure:

   1. Availability of payment setup services.
   2. Authenticity of payment processing data.
   3. Integrity of stored and processed payment data.
   4. Confidentiality of Financial Entity's payment data.
2. All data protection measures, including those for personal data, are further detailed in the Data Processing Agreement between the Parties, which remains in full force and effect.

5 Data access and recovery

1. Provider shall ensure:

   1. Access to Financial Entity's payment data in an easily accessible format.
   2. Data recovery capabilities for payment-related information.
   3. Data return procedures in case of contract termination.

6 Service levels

1. Core payment processing

   1. Provider relies on the Card Issuer for core payment processing and card issuing services.
   2. Card transactions will continue to function independently of Provider's platform availability.
   3. Core payment processing service levels are governed by Card Issuer's service level agreement.

2. Cardboard platform services

   1. New card issuance: Processing within 1 business day.
   2. Support response times: See the following section.

7 Incident management and support

1. Incident classification

   • Critical incidents: Issues affecting multiple customers' ability to set up new payments.
   • High priority: Issues affecting single customer's payment setup functionality.
   • Medium priority: System degradation without loss of core functionality.
   • Low priority: Cosmetic or non-essential feature issues.

2. Response time commitments

   • Critical incidents: Initial response within 1 hour during business hours
   • High priority: Initial response within 2 hours during business hours
   • Medium priority: Initial response within 4 business hours
   • Low priority: Initial response within 1 business day

3. Payment processing incidents

   1. Provider will immediately notify Financial Entity of any incidents reported by the Card Issuer affecting payment processing.
   2. Provider will serve as liaison between Financial Entity and the Card Issuer for incident resolution.
   3. Provider will maintain documentation of all payment-related incidents.

4. Platform service incidents

   1. Provider will maintain an incident management system for tracking and resolution.
   2. Regular status updates will be provided based on incident severity.
   3. Post-incident reports will be provided for Critical and High Priority incidents.

5. Support costs

   1. All incident support, including emergency support, is included in the standard service fees.
   2. No additional charges will be applied for incident management and resolution.

6. Communication protocols

   1. Primary contact for incident reporting: hello@cardboard.inc
   2. Secondary communication channels to be agreed upon with each Financial Entity.
   3. Regular incident status meetings for ongoing Critical Incidents.

8 Regulatory cooperation

1. Provider shall fully cooperate with:
   • Financial Entity's competent authorities
   • Resolution authorities
   • Persons appointed by such authorities

9 Termination rights

1. Upon termination:

   1. Provider will ensure orderly transition of any pending payment setups.
   2. Standard data export features will remain available during the notice period.

10 Security training

1. Provider shall:
   1. Participate in Financial Entity's ICT security awareness programs.
   2. Engage in digital operational resilience training as required.

11 Change management

1. Provider shall notify Financial Entity of any material changes to:
   • Payment setup infrastructure.
   • Integration with the Card Issuer's services.
   • Security controls affecting payment processes.
2. Notice period: Minimum 30 days for planned changes.
3. Emergency changes will be communicated as soon as practicable.

12 Monitoring and audit rights

1. Financial Entity shall have the right to:
1. Monitor Provider's performance
2. Conduct or commission audits with reasonable notice
3. Receive regular reports on service performance

13 Amendments

This Addendum may be amended by mutual written agreement of the Parties, subject to regulatory requirements.

Last updated: 2025-02-18. Effective date: 2025-03-24.