Our security measures

2C2P will only use User Data as permitted by any agreements between you and us, or as otherwise directed or authorized by you. You will protect all Data you receive through our services, may not disclose or distribute any such Data, only use such Data in conjunction with our services and as permitted by any agreements between you and us. Neither party may use any Personal Data to market to customers unless it has received the express consent from a specific customer to do so. You may not disclose Payment Data to others except in connection with processing transactions requested by customers and consistent with applicable laws and Payment Method rules.

If you use payment processing services to accept payment card transactions, you must comply with the Payment Card Industry Data Security Standards (“PCI-DSS”). The PCI Standards include requirements to maintain materials or records that contain payment card or transaction data in a safe and secure manner with access limited to authorized personnel. The specific steps you will need to take to comply with the PCI Standards will depend on your implementation of the payment processing services.

If you elect to store or hold “Account Data”, as defined by the PCI Standards which includes customer card account number or expiration date, you must maintain a system that is compliant with the PCI Standards. If you do not comply with the PCI Standards, or if we, any Payment Method Provider or Payment Method Acquirer are unable to verify your compliance with the PCI Standards, we may suspend your 2C2P Account or terminate this Security Policy. If you intend to use a third party service provider to store or transmit Account Data, you must not share any data with the service provider until you verify that the third party holds sufficient certifications under the PCI Standards and notify us of your intention to share Account Data with the service provider. Further, you agree to never store or hold any “Sensitive Authentication Data”, as defined by the PCI Standards (including CVC or CVV2) at any one time. You can find more information about the PCI Standards on the PCI Council’s website.

2C2P is responsible for protecting the security of Data in our possession. and we will maintain commercially reasonable administrative, technical, and physical procedures to protect User Data and Personal Data stored in our servers from unauthorized access, accidental loss, modification, or breach, and we will comply with applicable laws and Payment Method Rules when we handle User Data and Personal Data.

While we implement appropriate technical and organizational measures designed to protect Data against unauthorized access, use, disclosure, alteration, or destruction, no method of transmission or storage can be guaranteed to be completely secure. You are responsible for implementing appropriate security measures within your own systems and environments, including measures necessary to protect your and your customers’ credentials, devices, networks, and access to our services. In our sole discretion, we may take any action, including suspension of your 2C2P Account, to maintain the integrity and security of our services or Data, or to prevent harm to you, us, customers, or others.

You are solely responsible for the security of any Data on your website, your servers or otherwise within your access or control. You will comply with applicable laws and Payment Method Rules when handling or maintaining User Data and Personal Data and will provide evidence of your compliance to us upon our request.

You are responsible for assessing the security requirements of your business and selecting and implementing security procedures and Security Controls appropriate to mitigate your exposure to security incidents. We may provide Security Controls as part of our Services or suggest that you implement specific Security Controls. However, your responsibility for securing your business is not diminished by any Security Controls that we provide or suggest, and if you believe that the Security Controls we provide are insufficient, then you must separately implement additional controls that meet your requirements.

For the purpose of this Security Policy, “Services” means payment processing, payment acceptance, payment facilitation, collection, disbursement, settlement, and other payment-related products and services, including any associated platforms, systems, applications, APIs, software, tools, functionalities, and support services, provided or made available by 2C2P from time to time.

We may provide or recommend security controls, tools, processes, or applications to help you reduce the risk of fraud and unauthorized transactions. However, no security measure can prevent all fraud, and we do not guarantee that you or your customers will never experience fraud or unauthorized transactions. These security controls may be provided or developed by 2C2P, its affiliates, or third-party providers.

You are responsible for reviewing the security controls we recommend and deciding which measures are appropriate for your business and risk profile. You should also maintain any additional security measures, procedures, and controls that are reasonably necessary to protect your business, customers, and transactions.

If you disable, do not properly implement, or do not appropriately use the recommended security controls, this may increase the risk of unauthorized transactions, fraud, disputes, chargebacks, financial losses, and other related risks.

If a transaction is identified as potentially fraudulent, we may require you to void or refund the transaction where the relevant products or services have not yet been provided.

Where a transaction has already been completed before the potential fraud is identified, you may be required to provide relevant invoices, transaction records, and other supporting documents to demonstrate that the transaction was legitimate and that the products or services were provided.

If we determine that you have knowingly participated in, facilitated, or otherwise been involved in fraudulent transactions, we may suspend or terminate your account and, where appropriate, report the relevant information to the 2C2P Acquirer or applicable card schemes for further action, including potential inclusion in relevant negative or monitoring files.

You are responsible for losses arising from fraudulent transactions made using lost, stolen, or compromised payment credentials or accounts in connection with your business, including any resulting disputes or chargebacks. Where appropriate, we may assist you in attempting to recover lost funds, but such assistance does not transfer responsibility for the losses to 2C2P.

You are also responsible for losses resulting from the loss, theft, or compromise of your account credentials, including your username or password, as well as any unauthorized access to, use of, or changes to your 2C2P Account.

To the extent permitted by applicable law, 2C2P will not be responsible for losses arising from such unauthorized access, use, or changes, except to the extent that such losses are directly caused by 2C2P’s wilful or intentional misconduct.

Where 2C2P incurs losses or liabilities as a result of the unauthorized use of your lost, stolen, or compromised credentials or account, you agree to reimburse 2C2P for those losses or liabilities, to the extent permitted by applicable law.

We maintain appropriate card acceptance, risk management, and data security measures in accordance with applicable laws, regulations, and card scheme rules. These measures are designed to help reduce the risk of fraud, financial loss, and other risks to 2C2P, our merchants, customers, and end-users.

We take a risk-based approach, which means that the level of review and controls applied may vary depending on the nature and level of risk associated with your business. This may include:

• Applying appropriate merchant application and verification processes, including enhanced checks for higher-risk businesses.
• Requesting additional information, references, or supporting documents where necessary to better understand and assess the risks associated with a business.
• Applying risk-based approval criteria to assess whether a merchant has the financial capacity and appropriate controls to manage refunds, disputes, chargebacks, and other potential liabilities.
• Where appropriate, establishing and maintaining reserves for higher-risk card-not-present merchants. If a merchant ceases business, we may maintain such reserves at a level reasonably required to cover potential future chargebacks and other outstanding liabilities.

As part of our ongoing monitoring, our Risk and Fraud teams may review changes to your business, including changes to your business model, products or services, transaction patterns, or other circumstances that may affect the risk associated with your account or our ability to provide the Services.

Where we identify a material change in risk, we may conduct a further assessment and, where appropriate, introduce additional or revised measures to manage that risk. We will seek to ensure that such measures remain proportionate to the level and nature of the risk identified.

We may also monitor merchant websites and URLs associated with the Services for prohibited activities, inappropriate content, or content that may pose a legal, regulatory, security, or reputational risk to 2C2P, the applicable card schemes, or other stakeholders.

We may, subject to applicable laws, regulations, card scheme rules, and this Security Policy, suspend or restrict your access to the Services, restrict or withhold funds, or terminate the Services and/or this Security Policy with immediate effect where we reasonably believe that this is necessary to manage a significant risk or where any of the following circumstances apply:

• You are engaging in illegal, fraudulent, unethical, or otherwise prohibited or inappropriate activities.
• You misuse the Services or breach this Security Policy.
• We suspect or identify fraudulent, suspicious, or otherwise potentially harmful activity.
• You do not meet your financial obligations relating to refunds, disputes, chargebacks, or other amounts payable under this Security Policy.
• Your business has ceased, or you have indicated that you intend or may cease to operate.
• You become, or are at risk of becoming, insolvent or subject to insolvency, administration, restructuring, liquidation, receivership, or similar proceedings, or your business is dissolved, except as part of a bona fide merger, amalgamation, or reconstruction.
• There is a change, or anticipated change, in applicable laws, regulations, card scheme rules, or other circumstances that may materially affect our ability to provide the Services or perform our obligations under this Security Policy.
• We are required to do so by applicable law, a court order, or a direction, rule, requirement, or request from a competent regulatory or governmental authority.

Where reasonably practicable and permitted by applicable law, we may provide you with notice or an explanation of the action taken. However, there may be circumstances where we are unable to provide prior notice or disclose specific details, including where doing so could compromise fraud prevention, security, regulatory, or legal requirements.

These measures help us manage identified and emerging risks responsibly while protecting 2C2P, our merchants, customers, and other stakeholders from potential financial, regulatory, operational, and reputational harm.

We recognise that merchants and their customers may, from time to time, have concerns regarding a payment transaction. These may include an unrecognised or unauthorised transaction, an incorrect charge, non-delivery of goods or services, or circumstances where the goods or services provided materially differ from what was agreed.

Payment dispute management is the process through which such concerns are reviewed and assessed in accordance with applicable payment scheme rules, contractual obligations and regulatory requirements. The process is intended to provide appropriate protection to customers while ensuring that merchants are given a fair opportunity to substantiate legitimate transactions.

A customer may contact their issuing bank or payment provider where, for example:

• A transaction is not recognised or is believed to be unauthorised.
• The same transaction has been processed more than once.
• Goods or services were not received or materially differed from what was agreed.
• A transaction was processed after a cancellation or termination of a service or subscription.
• The amount charged differs from the amount authorised or otherwise agreed.

The availability and basis of a dispute will depend on the circumstances of the transaction and the applicable payment scheme rules and requirements.

1. Dispute Initiation

The customer should contact their issuing bank or payment provider as soon as reasonably practicable. The customer may be required to provide relevant transaction details and supporting information, such as receipts, order confirmations, cancellation records, delivery information or communications with the merchant.

2. Review and Investigation

The issuing bank or payment provider will assess the information provided and determine whether the transaction meets the applicable criteria for a payment dispute. Where appropriate, the dispute may be submitted through the relevant payment network or to the merchant’s acquiring bank or payment provider for further review.

3. Merchant Response

Where a dispute is presented to the merchant, the merchant may be provided with an opportunity to respond and submit relevant evidence. Depending on the nature of the dispute, this may include proof of delivery or fulfilment, transaction records, customer authentication information, refund or cancellation records, and relevant communications with the customer.

Merchants should retain appropriate transaction and fulfilment records to support the resolution of payment disputes and provide requested information within the applicable timeframe.

4. Assessment and Determination

The information and evidence provided by the relevant parties will be assessed against the applicable payment scheme rules, contractual requirements and regulatory obligations.

The outcome will depend on the circumstances of the individual case and the evidence available. The submission of a payment dispute does not, by itself, establish that a transaction is invalid or guarantee a refund or reversal.

5. Outcome

The relevant bank or payment provider will communicate the outcome in accordance with the applicable process. Where a dispute is upheld, a refund, reversal or other adjustment may be processed in accordance with the applicable rules. Where the dispute is not upheld, the original transaction may remain valid and no reversal may be made.

Dispute resolution timelines vary depending on the nature and complexity of the dispute, the information required and the applicable payment scheme or regulatory requirements.

Some disputes may be resolved relatively quickly, while others may require additional investigation, evidence or review and therefore take longer.

Merchants and customers can help minimise delays by providing complete, accurate and relevant information within the required timeframe.

Merchants should take reasonable steps to support an efficient and fair dispute resolution process, including:

• Maintaining accurate transaction, order, delivery and fulfilment records.
• Retaining relevant customer communications, refund and cancellation records.
• Responding promptly to requests for information or supporting evidence.
• Providing complete and accurate information relevant to the dispute.
• Processing legitimate refunds or cancellations in accordance with the applicable terms and agreed policies.
• Taking appropriate measures to prevent unauthorised or fraudulent transactions.

Where appropriate, merchants are encouraged to resolve genuine customer concerns directly, particularly those relating to refunds, cancellations, delivery or service fulfilment. This does not limit a customer’s right to raise a dispute with their bank or payment provider where permitted under the applicable rules.

We are committed to supporting a payment dispute process that is fair, transparent, secure and consistent, while complying with applicable payment scheme rules, contractual obligations and regulatory requirements.

Each dispute is assessed on its individual circumstances and the information and evidence available. A dispute is a review and resolution process, rather than an automatic refund mechanism, and the initiation of a dispute does not, by itself, determine the validity of a transaction.

In Simple Terms:

Customer raises a concern → Transaction is reviewed → Merchant may provide supporting evidence → Information is assessed against the applicable rules → Outcome is determined and communicated.

This process is designed to balance appropriate customer protection with fair treatment of merchants and the protection of legitimate transactions.