Salary Service Addendum

1. 1. INTRODUCTION
      1. To the extent any Order Form relates to the provision of Salary Services, this Salary Service Addendum, and the associated Order Form(s) which refers to it, create a legally binding agreement (the Agreement) between (1) the customer (referenced herein as Employer); and (2) Wagestream Limited, a company registered in England and Wales, with company number 11173225, VAT number 893 7650 72, and whose registered office is 7-9 Rathbone Street W1T 1LY, London, United Kingdom (Wagestream) (each a Party and together, the Parties). In the event of a conflict between (i) the terms of an Order Form and this Salary Service Addendum, the Order Form shall prevail, and (ii) the terms of this Agreement and the terms of your Subscription Agreement with Fourth the Agreement shall prevail in relation to the Salary Service only (the Wagestream Service). This Agreement supersedes any previous Salary Service Addendum or equivalent agreement entered into between Fourth (in its own right and as agent for and on behalf of Wagestream) and the Employer relating to the Wagestream Service.
   2. THE SERVICE
      1. Wagestream agrees, in its sole discretion, to make:
         1. interest free loan advances to the Employer (each, an Advance), to enable the Employer to make Flexible Pay Payments to Enrolled Employees. The aggregate value of the outstanding Advances will not exceed the Credit Limit. Each Advance will be made at the time and in the amount necessary to fund an individual Request. Each Advance shall be treated as a separate Advance, identifiable and distinct from all other Advances made to the Employer, and repayable on the last day of the Salary Period in which it was made or otherwise in accordance with paragraph 4.2 below; and
         2. the Build Feature available to Enrolled Employees; and
         3. the Workplace Savings Feature available to Enrolled Employees.
   3. TERM AND APPOINTMENT
      1. This Agreement takes effect on the Effective Date. This Agreement will last for the duration of your Fourth Contract unless (i) terminated in accordance with paragraph 8 below; or (ii) your Fourth Contract expires or terminates in which case, unless otherwise agreed in writing, this Agreement will terminate with immediate effect. Any termination of this Agreement will be without prejudice to any right or remedy or any other rights that have accrued up to the time of such termination.
      2. The Employer appoints Wagestream to provide the Services to the Employer for the Term. The Employer also appoints Wagestream as its agent, and expressly authorises it to:
         1. provide the Services to the Enrolled Employees in accordance with these terms;
         2. open one or more accounts in the Employer’s name with one or more UK FCA authorised firms (Third Party Account Provider) , in each case on their standard terms; and
         3. operate these accounts in a way that is consistent with those terms and these terms. (If there is a conflict between a Third Party Account Provider’s terms and these terms, the former will prevail.)
   4. WAGESTREAM’S OBLIGATIONS
      1. Wagestream agrees that it will:
         1. operate and maintain the Platform, make it available for use, and provide Platform-use support to the Enrolled Employees;
         2. accept every Request, unless:
            1. when aggregated with the Enrolled Employee’s previous Requests, it exceeds the Maximum Proportion;
            2. it is made during the period that begins at the start of the Reconciliation Day and ends at the end of the last day of the Salary Period;
            3. the balance in the Employer’s Account is insufficient to meet the whole Request, and Wagestream is unwilling or unable to make an Advance, or a further Advance; and/or
            4. Wagestream believes a third-party might have access to the Enrolled Employee’s Account;
         3. if a Request is accepted, instruct the Third Party Account Provider to make a corresponding payment from the Employer’s Account to the Bank Account;
         4. when the Employer pays the Enrolled Employee’s Net Salary into the Employer’s Account, instruct the Third Party Account Provider to make a same-day payment of an amount that is equal to (in each case, if relevant):
            1. if an Enrolled Employee chooses to use a Build Account:
               1. (if an Enrolled Employee’s Contribution exceeds the Permitted Amount), an amount up to the Permitted Amount from the Employer’s Account into the Enrolled Employee’s Build Account;
               2. (if an Enrolled Employee’s Contribution does not exceed the Permitted Amount), the Contribution from the Employer’s Account into the Enrolled Employee’s Build Account;
            2. when the Enrolled Employee chooses to use the Workplace Savings Feature, has signed up to the Workplace Savings Feature terms and conditions, and the Enrolled Employee has earned enough remuneration to satisfy the full amount requested for Workplace Savings:
               1. (if an Enrolled Employee’s Contribution exceeds the Permitted Amount), an amount up to the Permitted Amount from the Employer’s Account to the Hub Account for and on behalf of the Enrolled Employee; or
               2. (if an Enrolled Employee’s Contribution does not exceed the Permitted Amount), the Contribution from the Employer’s Account to the Hub Account for and on behalf of the Enrolled Employee; and
               3. where multiple requests are active, the transfer may be made as a single cumulative payment to the Hub Account, specifying the proportions of each Enrolled Employee’s interest to the Hub Account in doing so; and
               4. where an Enrolled Employee’s request does not meet all of the conditions or requirements as specified in this Agreement and the Workplace Savings Feature terms and conditions, Wagestream will reject the request in full and will not arrange the transfer in respect of it;
            3. the cost of any Spending Request(s) from the Employer’s Account to the relevant Supplier;
            4. the relevant Balancing Payment, from the Employer’s Account to the Bank Account; and
            5. the Transaction Fees, from the Employer’s Account to Wagestream;
         5. if Wagestream has chosen to make the Build Feature available, on or soon after every Reconciliation Day, run a Prize Draw for the previous Salary Period; pick the Winner(s); and transfer the Winnings to the corresponding Build Account(s);
         6. by the end of the Salary Period instruct the Third Party Account Provider to repay the Advances (if any); and,
         7. if there are insufficient funds to repay the Advance(s), Wagestream will, subject to paragraph 4.2, invoice for the additional amounts as envisaged in paragraph 5.1.2.
      2. Where Wagestream has not been able to recover any Flexible Pay Payment from amounts credited to the Employer’s Account relating to the relevant Enrolled Employee in the two Salary Periods directly following the Salary Period in which the Advance was made for whatever reason (including because the relevant Enrolled Employee has left the employment of the Employer) then Wagestream will invoice the Employer for the outstanding amount under paragraph 5.1.2.
      3. Wagestream reserves the right to withhold the provision of the Service from an Enrolled Employee at any time, for any reason. If it does this, Wagestream will give immediate notice to the Employer.
      4. Wagestream agrees that it will comply with its obligations under the Data Processing Agreement, and applicable law; and use all commercially reasonable efforts to make the Service available at all times, except for scheduled downtime, and interruptions caused by events beyond Wagestream’s control.
      5. Wagestream has policies in place to ensure we meet our regulatory and third party obligations (including money laundering laws and regulations). To comply with these, we may at any time request information from you through our relationship with you, including, evidence of your identity (or directors or partners of your business and/or your ultimate beneficial owners) and related information (such as incorporation and financial information). We may suspend services to meet these obligations and/or terminate the Agreement with immediate effect if any information provided in response to those requests means we cannot comply with our policies.
   5. THE EMPLOYER’S OBLIGATIONS
      1. The Employer agrees that it will:
         1. pay every Net Salary of each Enrolled Employee into the Employer’s Account on the Reconciliation Day;
         2. pay the Service Fees including any VAT and (if there is a difference between the aggregate value of the outstanding Advances, and the amount transferred under and in accordance with paragraph 4.1.6 for example which Wagestream has not been able to recover under paragraph 4.2) repay the outstanding amount of the Advances within 30 calendar days of receiving a Wagestream invoice for either or both of these things;
         3. subject to paragraph 5.1.2, repay every Advance made within a Salary Period to an account nominated by Wagestream by the end of the corresponding Salary Period;
         4. comply with its obligations under the Data Processing Agreement and the applicable law;
         5. in good faith, raise awareness of the Service to its employees using the Awareness Materials;
         6. (in good time before every Reconciliation Day) securely deliver, or ensure that an appropriate third-party securely delivers, accurate Payroll Data to Wagestream, with the scope, nature and type of Payroll Data, and the delivery method, to be agreed between the Parties, from time to time;
         7. as soon as reasonably practicable, give Wagestream notice if it has a good reason to believe that (a) an Enrolled Employee will leave its employment for any reason, and/or might be the subject of a Transfer of Undertakings (Protection of Employees) Regulations 2006 transfer; or (b) an Enrolled Employee’s salary date and/or circumstances will change in a way that will or might reduce their Net Salary; or (c) it becomes aware of any other fact or matter that will or might affect Wagestream’s ability to process payments for an Enrolled Employee;
         8. take all reasonable steps to prevent unauthorised access to and/or use of the Platform, and tell Wagestream immediately if it becomes aware that unauthorised access and/or use has or might have occurred;
         9. (if it gives notice under paragraph 5.1.7), tell the Enrolled Employees that it has done so.
   6. PROPRIETARY RIGHTS
      1. Wagestream grants the Employer a non-exclusive, non-transferable, non-sublicensable licence for the term of the Agreement to (a) access and use the Platform; and (b) raise awareness of the Platform to its employees using the Awareness Materials.
      2. The Employer agrees that it will not, and that it will not permit or allow others to:
         1. copy, modify, translate or create derivative works from the Platform or Awareness Materials;
         2. reverse engineer, decompile, disassemble or otherwise attempt to reconstruct, identify or discover the source code, user interface techniques or algorithms that support the Platform,
         3. lend, lease, sell or use the Platform or Awareness Materials with or for the benefit of others;
         4. attempt to circumvent any licence, timing or use restrictions in or on the Platform;
         5. interfere with or disrupt the integrity or performance of the Platform or Service or the data on which they and/or Wagestream relies; or
         6. attempt to gain unauthorised access to the Platform, Service or related systems, networks or controls.
      3. Except for the limited rights granted in paragraph 6.1, Wagestream retains all right, title and interest, including all intellectual property rights, in and to the Platform, the Service, Feedback and the Awareness Materials. The Employer acknowledges that the Platform contains Wagestream’s valuable trade secrets, the improper use or disclosure of which would cause Wagestream irreparable harm. Accordingly, the Employer agrees to use the Platform solely as authorised in and by these terms. The Employer acknowledges that the licence granted herein is not a sale and does not transfer the title or ownership of the Platform or any part(s) of it to the Employer or anyone else. Wagestream reserves all rights not expressly granted hereunder.
      4. The Employer grants Wagestream a licence to use the Contact Information and Payroll Data to provide the Services. The Employer also represents and continuously warrants that: (a) it is lawfully entitled to do this; (b) it owns and/or is lawfully entitled to share the Contact Information and Payroll Data in this way and that, by doing so, it does not violate the rights of, or breach its obligations to, any third-party; and (c) the Contact Information and Payroll Data is materially accurate, complete and up to date.
   7. CONFIDENTIAL INFORMATION
      1. The Parties agree:
         1. not to use the Confidential Information, and not to disclose it to a third-party, unless (i) required to do so by applicable law, or (ii) permitted to do so by these terms as set out in paragraph 7.1.2;
         2. to take all reasonable care to maintain the confidentiality of the Confidential Information, including by restricting access to it to those who (a) reasonably need access for a purpose that is consistent with these terms; and (b) (in the case of Affiliates, contractors, sub-processors and agents) have signed an agreement with the receiving Party containing protections no less stringent than those herein.
      2. Notwithstanding paragraph 7.1, Wagestream may provide Confidential Information to a Third Party Account Provider , if (in Wagestream’s reasonable opinion) it is necessary for it to do so, to enable the Third Party Account Provider to carry out the instructions Wagestream gives to Third Party Account Provider, under or in accordance with these terms.
      3. Without prejudice to paragraph 7.2, each Party agrees that, before disclosing the Confidential Information of the other Party under or in accordance with paragraph 7.1.1(i), it will give that other Party prior notice of the relevant disclosure (to the extent permitted by applicable law); and if the other Party so wishes, and at the other Party’s costs, it may take reasonable steps to contest or restrict the disclosure.
   8. TERMINATION AND THE EFFECT OF TERMINATION
      1. If Wagestream makes the Workplace Savings Feature or the Build Feature available, (a) Wagestream may withdraw that feature; and (b) the Employer may require Wagestream to withdraw that feature, in each case, by giving 1 month’s written notice to the other Party. If the Build Feature or Workplace Savings Feature is withdrawn, that will not affect or interrupt the continuity or balance of the Agreement. However, where this Agreement is terminated:
         1. any funds held in the Enrolled Employees’ Build Accounts will be transferred to their corresponding Bank Accounts and they will lose access to their Build Accounts; however,
         2. it will not affect an Enrolled Employee’s entitlement to the Workplace Savings Feature. An Enrolled Employee’s agreement to use Workplace Savings will continue unaffected, unless terminated in accordance with the Workplace Savings T&C’s, albeit their ability to make further placements of funds may be altered (in accordance with the Workplace Savings T&C’s).
      2. Without affecting any other right or remedy available to it, or any rights that have accrued up to the time of such termination, either Party may terminate the Agreement:
         1. by giving the other 6 months’ written notice to terminate; or
         2. with immediate effect, by giving written notice to the other Party at any time, if the other Party: (a) commits a material breach of this Agreement and (if such breach is remediable) fails to remedy that breach within 30 calendar days of being asked in writing to do so; (b) becomes the subject of a voluntary arrangement under section 1 of the Insolvency Act 1986; (c) is unable to pay its debts as they fall due within the meaning of section 123 of the Insolvency Act 1986; (d) has a receiver, manager, administrator or administrative receiver appointed over all or any parts of its undertaking, assets or income; (e) is subject to a resolution for its winding up; (f) is subject to a petition presented to a court for a winding up or for an administrative order; or (g) suspends or ceases, or threatens to suspend or cease, carrying on all or a substantial part of its business.
      3. Without prejudice to paragraph 8.2, Wagestream may also terminate the Agreement with immediate effect, by giving written notice to the Employer at any time, if (i) a person acquires shares or voting rights in the Employer, or a parent of the Employer, and (a) the number of shares or voting rights then held by the acquirer is more than 50% of the shares or voting rights in the Employer, or a parent of the Employer; or (b) the acquirer is then able to exercise significant influence over the management of the Employer or (ii) the Service Fees are not paid for three months in a row or otherwise an aggregate amount owed by the Employer to Wagestream equal to three months of Service Fees is outstanding and not paid.
      4. When the Agreement ends, Wagestream will instruct the Third Party Account Provider to transfer any funds held in an Enrolled Employee’s Build Account to their Bank Account; the Employer’s rights and licences under this Agreement will end; and the amounts owed by the Employer to Wagestream under this Agreement will become immediately due and payable.
      5. Where the Loan(s) and/or Card(s) services are provided, on any termination of the Agreement, the Employer will continue to pay every Net Salary of each Enrolled Employee who has taken a Loan or Card into the Employer’s Account on the Reconciliation Day until the earlier of (i) such Enrolled Employee’s Loan and/or Card has been repaid in full, and (ii) such Enrolled Employee has ceased to be employed by the Employer.
      6. These specific Loan(s) and Card(s) provisions (and any associated provision in the Agreement required to give effect to these provisions) shall continue in full force and effect notwithstanding the termination of the Agreement until the earlier of (i) Wagestream has confirmed in writing to the Employer that the last Enrolled Employee who has taken a Loan and/or Card has repaid their Loan and/or Card in full, and (ii) the Employer has confirmed in writing to Wagestream that the last Enrolled Employee who has taken a Loan and/or Card has ceased to be employed by the Employer.
      7. Paragraphs 6.2, 6.3, and 7 to 14 will survive the termination of the Agreement.
   9. REPRESENTATIONS AND WARRANTIES
      1. Each Party represents and warrants to the other that it is duly organised, validly existing and in good standing; it has the right, power and authority to enter into this Agreement, grant the rights and licences hereunder, and perform its obligations hereunder; and the entry into this Agreement by its representative has been duly authorised.
   10. WARRANTY DISCLAIMER
       1. Save as expressly stated in these terms: (a) the Service is provided on an “as is” and “as available” basis and Wagestream does not warrant that it will be error-free or that it will work without interruptions; and (b) all warranties, representations, conditions and all other terms of any kind implied by statute or common law are, to the fullest extent permitted by applicable law, excluded from this Agreement.CONFIDENTIAL INFORMATION
   11. LIMITATION OF LIABILITY
       1. Wagestream accepts no liability or responsibility for the acts, omissions and/or default of the Third Party Account Provider, or any other third-party.
       2. Subject to paragraph 11.4, in no event will either Party have any liability (whether in contract, tort (including negligence or breach of statutory duty), misrepresentation, restitution or otherwise, or under any indemnity) for any (a) loss or damage to, or corruption of data, (b) lost revenues or profits, (c) damage to goodwill or (d) indirect, punitive, incidental, special or consequential loss or damage.
       3. Subject to paragraph 11.4, in no event will Wagestream’s total aggregate liability (whether in contract, tort (including negligence or breach of statutory duty), misrepresentation, restitution or otherwise, or under any indemnity) arising out of or related to this Agreement exceed the greater of (i) £50,000, and (ii) three times the Service Fees paid by the Employer to Wagestream during the 12 months immediately before the Employer’s relevant cause(s) of action arises.
       4. Nothing in this Agreement excludes or limits the liability of either Party for (a) death or personal injury, or (b) fraud or fraudulent misrepresentation, or (c) any other liability which cannot be excluded or limited by applicable law, or (d) in the case of the Employer, (i) for a breach of the licence restrictions in paragraph 6.2, or (ii) a failure to pay an invoice properly due hereunder.
       5. The Parties agree that the foregoing limitations represent a reasonable allocation of risk between them.
   12. INDEMNIFICATION
       1. Subject to paragraph 11, Wagestream will:
          1. at its own cost and expense, take all reasonable steps to defend the Employer from any claim, action, suit or proceedings (Claim) made or brought against the Employer by (i) an Enrolled Employee arising out of or in connection with Wagestream’s breach of its obligations under the Agreement or (ii) a third party arising out of an allegation Wagestream has infringed that third party’s intellectual property rights; and
          2. indemnify the Employer in respect of all damages, fines, penalties, costs and legal costs (Costs) reasonably incurred in connection with such Claim.
       2. Notwithstanding paragraph 12.1.2, Wagestream will not defend and/or indemnify the Employer against Claim caused (in full or in part) by the errors, omissions or malfeasance of the Employer, or the Employer’s breach of applicable law or of its obligations under this Agreement.
       3. Subject to paragraph 11, the Employer will:
          1. at its own cost and expense, take all reasonable steps to defend Wagestream from any Claim made or brought against Wagestream by an Enrolled Employee and/or a third-party arising out of or in connection with:
             1. Wagestream’s use of any Payroll Data, including delayed or erroneous Flexible Pay Payments, Balancing Payments, and incorrectly deducted Transaction Fees, if they were caused (in full or in part) by errors, gaps or inconsistencies in the Payroll Data provided by the Employer to Wagestream;
             2. the acceptance or refusal of a Request under paragraph 4.1.2;
             3. any breach by the Employer of any of its obligations under this Agreement;
          2. indemnify Wagestream in respect of Costs reasonably incurred in connection with such Claim.
       4. The obligations on one Party (the Indemnifying Party) to defend and indemnify the other Party (the Indemnified Party) under this paragraph 12 shall not apply unless the Indemnified Party:
          1. promptly notifies the Indemnifying Party when it becomes aware of a Claim, and provides full written particulars;
          2. makes no comment or admission and takes no action that may adversely affect the Indemnifying Party’s ability to defend or settle the Claim;
          3. provides all assistance reasonably required by the Indemnifying Party, provided the Indemnifying Party pays the Indemnified Party’s reasonable costs; and
          4. gives the Indemnifying Party sole authority and absolute discretion to defend or settle the Claim as it sees fit.
   13. PROVISIONS FOR SERVICES IN IRELAND
       1. In respect of Services to be provided in Republic of Ireland to the Employer where explicitly agreed to by Wagestream in an Order Form, these will be provided by an Affiliate of Wagestream and the following amendments will be deemed to apply to this Agreement: references to “FCA” shall be deemed to be to “Central Bank of Ireland”, to “the Transfer of Undertakings (Protection of Employees) Regulations 2006” in paragraph 5.1.7 shall be deemed to be to “the European Communities (Protection of Employees on Transfer of Undertakings) Regulations 2003 (as amended)”, and to the “UK GDPR” (save the definition) in Schedule 2 shall be to the “EU GDPR” and the following commercial amendments shall apply: (i) the Build Feature is not available in the Republic of Ireland unless explicitly agreed to the contrary in an Order Form, and (ii) payments will be sent by SEPA and there is up to a 1 Working Day delay on both salary payments and transfers for the Republic of Ireland (so, for example, a Friday pay day may not be received until a Monday).
   14. MISCELLANEOUS
       1. With the Employer’s prior written permission, Wagestream has the right to advertise the fact that the Employer uses the Service (or any part of it), and to do so using the Employer’s trademarks, marks, and trade names. The Employer grants permission to Wagestream to share Awareness Materials directly with its employees.
       2. The Employer may not assign its rights or obligations under this Agreement without Wagestream’s prior written consent (such consent not to be unreasonably withheld). Subject to that, such rights shall pass to and such obligations shall be binding on the assignee. Wagestream may freely assign or transfer its rights and obligations under this Agreement.
       3. Neither party shall be in breach of this Agreement nor liable for delay in performing, or failure to perform, any of its obligations under this Agreement (other than a delay or failure by the Employer to make payments when due hereunder) if such delay or failure result from a Force Majeure Event or Relief Event. In the event of a Force Majeure Event the non-performing party must (i) as soon as reasonably practicable after the start of the Force Majeure Event notify the other party in writing of the Force Majeure Event, the date on which it started, its likely or potential duration, and the effect of the Force Majeure Event on its ability to perform any of its obligations under the Agreement; and (ii) use reasonable endeavours to mitigate the effect of the Force Majeure Event on the performance of its obligations.
       4. The Agreement is governed by and to be construed in accordance with English law. All disputes arising from or under this Agreement will be subject to the exclusive jurisdiction of the English courts. If any provision of the Agreement is held by a court of competent jurisdiction to be contrary to law, the remainder will remain in full force and effect.
       5. A waiver, amendment or modification of this Agreement will only be valid if made in writing and signed by both Parties. The waiver of a breach of any term of this Agreement will not be construed as a waiver of any other term or breach hereof.
       6. All amounts payable to Wagestream under this Agreement are stated to be exclusive of VAT. If any VAT is chargeable thereon and Wagestream is required to account for such VAT to the relevant tax authority, the Employer shall (either: (i) at the same time and in the same manner as the relevant payment; or (ii) if such VAT becomes chargeable following the relevant Reconciliation Day, within 10 Working Days of the issue by Wagestream of a supplementary VAT invoice) pay to Wagestream an amount equal to such VAT. Where relevant, Wagestream shall provide the Employer with an appropriate VAT invoice.
       7. The Employer shall pay all sums that it owes to Wagestream under this Agreement without any set-off, deduction or withholding of any kind, save as may be required by law.
       8. Nothing in these Terms is intended to, or shall operate to, create a partnership between the parties.
       9. Except as expressly provided in these Terms:
          1. neither party authorises the other party to act as agent for it; and
          2. neither party shall have authority to act in the name or on behalf of or otherwise to bind the other in any way (including the making of any representation or warranty, the assumption of any obligation or liability and the exercise of any right or power).
       10. The Agreement does not give rise to any rights under the Contracts (Rights of Third Parties) Act 1999.

^{Version: Salary Service Addendum 2024_1}

SCHEDULE 1: INTERPRETATION AND DEFINITIONS

In this Agreement:

1. A reference to a Party includes that Party’s successors and permitted assignees;
2. An obligation not to do something, includes an obligation not to allow that thing to be done;
3. The singular includes the plural, and vice versa; and
4. Words and phrases used in this Agreement with an initial capital have the meaning given to them in the table

SCHEDULE 2: DATA PROCESSING AGREEMENT

1. 1. PROCESSING OF COMPANY PERSONAL DATA
      1. Wagestream shall:
         1. comply with the Data Protection Laws in Processing Personal Data; and
         2. not Process Personal Data other than on the Employer’s instructions (subject always to clause 1.7) and as necessary for the fulfilment of the Agreement and the Terms of Service with the Enrolled Employee and as required by Applicable Law.
      2. To the extent permitted by Applicable Law, Wagestream shall inform the Employer of:
         1. any Processing to be carried out under clause 1.1(b); and
         2. the relevant legal requirements that require it to carry out such Processing, before the relevant Processing of that Personal Data, by Wagestream.
      3. The Employer instructs Wagestream, to Process Personal Data as necessary:
         1. to perform the Awareness Plan in respect of the Services;
         2. to detect the eligibility of employees of the Employer for the Services;
         3. to provide the Services to the Employer and the Enrolled Employees (including to improve and update the Services, including through surveys, and to carry out Processing initiated by the Employer and Enrolled Employees in their use of the Services); and
         4. to perform Wagestream’s obligations and exercise Wagestream’s rights under the Agreement.
      4. Annex 2 to this Schedule sets out certain information regarding Wagestream’s Processing of Personal Data as required by Article 28(3) of the UK GDPR.
      5. The Employer may amend Annex 2 on written notice to Wagestream as the Employer reasonably considers necessary to meet the requirements of Applicable Law.
      6. Where Wagestream receives an instruction from the Employer that, in its reasonable opinion, infringes the Data Protection Laws, Wagestream shall inform the Employer.
      7. The Employer acknowledges and agrees that any instructions issued by the Employer with regards to the Processing by Wagestream of Personal Data pursuant to or in connection with the Agreement shall:
         1. be strictly required for the sole purpose of ensuring compliance with the Data Protection Laws; and
         2. not relate to the scope of the Service or otherwise materially change the services to be provided by Wagestream under the terms of the Agreement. The Employer shall reimburse all costs incurred by Wagestream in complying with such instructions. Notwithstanding anything to the contrary herein, Wagestream may terminate the Agreement in its entirety upon written notice to the Employer with immediate effect if Wagestream considers (in its absolute discretion) that:
            1. it is unable to adhere to, perform or implement any instructions issued by the Employer due to the technical limitations of its systems, equipment and/or facilities; and/or
            2. to adhere to, perform or implement any such instructions would require disproportionate effort (whether in terms of time, cost, available technology, manpower or otherwise).
      8. The Employer represents and warrants on an ongoing basis that, for the purposes of Article 6 of the UK GDPR, there is, and will be throughout the Term, a legal basis for the Processing by Wagestream of Personal Data in accordance with this Schedule and the Agreement (including any and all instructions issued by the Employer from time to time in respect of such Processing).
      9. Notwithstanding any other provision of this Schedule or the Agreement, the Employer hereby grants to Wagestream a non-exclusive, sublicensable, transferable, perpetual, irrevocable, worldwide licence to use Anonymised Data for its own business purposes, including to develop the Services.
   2. WAGESTREAM PERSONNEL
      1. Wagestream shall take reasonable steps to ensure the reliability of any employee, agent or contractor who may Process Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know or access the relevant Personal Data for the purposes described in this Schedule, and to comply with Applicable Law, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
   3. SECURITY
      1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Wagestream shall in relation to the Personal Data implement appropriate technical and organisational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the UK GDPR.
      2. In assessing the appropriate level of security, Wagestream shall take account in particular of the risks presented by Processing, in particular from a Personal Data Breach.
   4. SUBPROCESSING
      1. The Employer authorises Wagestream to appoint Subprocessors in accordance with this clause D.
      2. Wagestream may continue to use those Subprocessors already engaged by Wagestream as at the Effective Date and who are set out in the Subprocessor list located here.
      3. Wagestream shall give the Employer notice of the appointment of any new Subprocessor via the Wagestream Portal, including reasonable details of the Processing to be undertaken by the Subprocessor. If, within ten Working Days of that notice, the Employer notifies Wagestream in writing of any objections (on reasonable grounds) to the proposed appointment:
         1. Wagestream shall use commercially reasonable efforts to make available a commercially reasonable change in the provision of the Services which avoids the use of that proposed Subprocessor; and
         2. where (i) such a change cannot be made within sixty days from Wagestream’s receipt of the Employer notice, and/or (ii) no commercially reasonable change is available, and/or (iii) the Employer declines to bear the cost of the proposed change, notwithstanding anything in the Agreement, either Party may by written notice to the other with immediate effect terminate the Agreement either in whole or to the extent that it relates to the Services which require the use of the proposed Subprocessor.
      4. With respect to each Subprocessor, Wagestream shall ensure that the arrangement between Wagestream and the Subprocessor is governed by a written contract including terms which meet the requirements of Article 28(3) of the UK GDPR.
   5. DATA SUBJECT RIGHTS
      1. Taking into account the nature of the Processing, Wagestream shall provide the Employer with such assistance as may be reasonably necessary and technically possible in the circumstances, to assist the Employer in fulfilling its obligation to respond to Data Subject Requests.
      2. Wagestream shall:
         1. promptly notify the Employer if Wagestream receives a Data Subject Request; and
         2. ensure that Wagestream does not respond to any Data Subject Request except on the documented instructions of the Employer or as required by Applicable Law, in which case Wagestream shall to the extent permitted by Applicable Law inform the Employer of that legal requirement before Wagestream responds to the Data Subject Request.
   6. PERSONAL DATA BREACH
      1. Wagestream shall notify the Employer without undue delay upon Wagestream becoming aware of a Personal Data Breach affecting the Personal Data, providing the Employer with sufficient information (insofar as such information is within Wagestream’s possession) to allow the Employer to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.
      2. Wagestream shall co-operate with the Employer and take such reasonable commercial steps as may be directed by the Employer to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
   7. DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION
      1. Wagestream shall provide reasonable assistance to the Employer with any data protection impact assessments, and prior consultations with Supervisory Authorities, which the Employer reasonably considers to be required of the Employer by Article 35 or 36 of the UK GDPR, in each case solely in relation to Processing of Personal Data by, and taking into account the nature of the Processing and information available to, Wagestream.
   8. DELETION OR RETURN OF COMPANY PERSONAL DATA
      1. Subject to clause 8.2, Wagestream shall promptly and in any event within ten Working Days of the date of cessation of any Services involving the Processing of Personal Data (Cessation Date), Delete and/or procure the Deletion of all copies of those Personal Data. If requested by the Employer, Wagestream shall provide written certification to the Employer that it has fully complied with this clause 8.1 within ten Working Days of the date of such request.
      2. Wagestream may retain the Employer Personal Data after the cessation date to the extent required by Applicable Law and only to the extent and for such period as required by Applicable Law and always provided that Wagestream shall ensure the confidentiality of all such Personal Data and shall ensure that such Personal Data is only Processed as necessary for the purpose(s) specified in the Applicable Law requiring its storage and for no other purpose.
   9. AUDIT RIGHTS
      1. Subject to clauses 9.2 to 9.3, Wagestream shall make available to the Employer on request information reasonably necessary to demonstrate compliance with this Schedule, and shall allow for and contribute to audits, including inspections, by the Employer or an auditor mandated by the Employer in relation to the Processing of the Personal Data, by Wagestream.
      2. Information and audit rights of the Employer only arise under clause 9.1 to the extent that the Agreement does not otherwise give information and audit rights meeting the relevant requirements of the Data Protection Laws.
      3. The Employer shall give Wagestream reasonable notice of any audit or inspection to be conducted under clause 9.1 (which shall in no event be less than thirty (30) days’ notice unless required by a Supervisory Authority pursuant to clause 9.3(f)(ii)) and shall use its best efforts (and ensure that each of its mandated auditors uses its best efforts) to avoid causing, and hereby indemnifies Wagestream in respect of, any damage, injury or disruption to Wagestream’s premises, equipment, personnel, data, and business (including any interference with the confidentiality or security of the data of Wagestream’s other Employer customers or the availability of the Services to such other customers) while its personnel are on those premises in the course of such an audit or inspection. Wagestream need not give access to its premises for the purposes of such an audit or inspection:
         1. to any individual unless he or she produces reasonable evidence of identity and authority;
         2. to any auditor whom Wagestream has not given its prior written approval (not to be unreasonably withheld);
         3. unless the auditor enters into a non-disclosure agreement with Wagestream on terms acceptable to Wagestream;
         4. where, and to the extent that, Wagestream considers, acting reasonably, that to do so would result in interference with the confidentiality or security of the data of Wagestream’s other Employer customers or the availability of the Service to such other customers;
         5. outside normal business hours at those premises; or
         6. on more than one (1) occasion in each period of twelve (12) months during the Term, except for any additional audits or inspections which the Employer:
            1. reasonably considers necessary because of a Personal Data Breach; or
            2. is required to carry out by the Data Protection Laws or a Supervisory Authority,
         7. where the Employer has not identified the Personal Data Breach or the relevant requirement in its notice to Wagestream of the audit or inspection.
      4. The Parties shall discuss and agree the costs of any inspection or audit to be carried out by or on behalf of the Employer pursuant to this clause I in advance of such inspection or audit and, unless otherwise agreed in writing between the Parties, The Employer shall bear any third party costs in connection with such inspection or audit and reimburse Wagestream for all costs incurred by Wagestream and time spent by Wagestream (at Wagestream’s then- current professional services rates) in connection with any such inspection or audit.
   10. RESTRICTED TRANSFERS
       1. Some of our group entities and Subprocessors to whom we may transfer Personal Data are located outside the UK and/or European Economic Area (EEA). Consequently, the Personal Data that we process may be transferred to, and stored at, a destination outside the UK and/or EEA. Whenever we transfer Personal Data out of the UK and/or EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
          1. we will only transfer Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data by the European Commission pursuant to Article 45.
          2. where we transfer Personal Data to a group entity or Subprocessor which is located other than in such a country, we will use Standard Contractual Clauses or an International Data Transfer Agreement.

ANNEX 1: ADDITIONAL DEFINED TERMS

This Annex 1 contains definitions referenced in this Schedule and not already defined in the Agreement.

ANNEX 2: DETAILS OF PROCESSING OF PERSONAL DATA

This Annex includes certain details of the Processing of Personal Data as required by Article 28(3) UK GDPR.

Subject matter and duration of the Processing of Personal Data:

The subject matter and duration of the Processing of the Personal Data are set out in the Agreement and this Schedule.

The nature and purpose of the Processing of Personal Data:

For the purposes of providing the Wagestream Service the Employer shall act as the Data Controller and Wagestream shall act as its Processor, operating upon the written instructions of the Employer, up to the point of the Employee accepting the Terms of Service, after which Wagestream will become a Controller for the purposes of operating the Wagestream Service as per terms of the Agreement.

The obligations and rights of the Employer

The obligations and rights of the Employer are set out in the Agreement and this Schedule.

SCHEDULE 3: THIRD PARTY ACCOUNT PROVIDERS TERMS

Standard terms of the Third Party Providers’ for the use of the accounts of PayrNet and Modulr are available here:

PayrNet: https://legal.wagestream.co.uk/PayrNetElectronicMoneyAccountTerms_20191004.pdf
Modulr: https://wagestream.com/en/modulr