PSP Authorization Agreement

PAYMENT SERVICE PROVIDER

AUTHORIZATION AGREEMENT

Value-Added Services Deployment Authorization

between

ZEAL IO LIMITED

and

[PSP Name — as provided during account activation]

Effective Date: Date of account activation

PARTNERSHIP OVERVIEW

THIS PAYMENT SERVICE PROVIDER AUTHORIZATION AGREEMENT

is made on the Effective Date (as defined in the Acceptance section) (the “Effective Date”)

BETWEEN:

(1) Zeal IO Limited, a company incorporated in England and Wales under company number 11998285, whose registered office is at 85 Great Portland Street, First Floor, London, W1W 7LT, UK (“Zeal”); and

(2) The entity identified in Schedule 0 (the “PSP”).

Each a “Party” and together the “Parties”.

BACKGROUND

(A) Zeal operates a technology platform delivering value-added services on payment terminals, including transaction reporting, loyalty programs, analytics, and marketing services. Zeal does not provide payment acquiring, payment processing, or payment gateway services.

(B) The PSP maintains contractual relationships with Merchants for payment acceptance and/or processing services.

(C) The PSP wishes to authorize Zeal to deploy value-added services on Terminals at Merchant locations within the PSP’s network, share Merchant Data with Zeal, and receive access to the PSP Portal for merchant insights and, where applicable, compensation.

(D) This Agreement incorporates and is subject to the Zeal Global Partnership Terms and Conditions (“Global T&Cs”) and the Zeal Privacy Policy, as described in Section 19.

IT IS AGREED as follows:

SCHEDULE 0: DEAL VARIABLES

This Schedule 0 sets out the key commercial and operational variables for this Agreement. PSP Details in Part 1 are populated from information provided during the account activation process and from publicly available records (including Companies House). The PSP may update these details through the PSP Portal or by written notice to Zeal.

PART 1: PSP DETAILS

PART 2: LIABILITY

Unlimited Liabilities (Section 14.3): Death/personal injury (negligence); Fraud; Wilful misconduct/gross negligence; Deliberate breach of Section 8.1 (non-solicitation); Any liability that cannot be excluded by law.

PART 3: TERM AND TERMINATION

PART 4: DISPUTE RESOLUTION

1. DEFINITIONS AND INTERPRETATION

1.1 Definitions

In this Agreement, unless the context otherwise requires:

“Applicable Data Protection Laws” means: (a) the UK GDPR; (b) the Data Protection Act 2018; (c) the Privacy and Electronic Communications (EC Directive) Regulations 2003; and (d) any other applicable data protection or privacy legislation.

“Zeal Distribution Partner” means a terminal distributor, TMS operator, payment application provider, or similar entity within Zeal’s distribution network that has entered into a binding agreement with Zeal (including a ZMS Controller Partnership Agreement) and is authorised by Zeal to upload Merchant Data and deploy Zeal Software. Zeal Distribution Partners are also referred to as “ZMS Controllers” in certain Zeal agreements and documentation.

“Business Day” means a day other than a Saturday, Sunday, or public holiday in England.

“Card Scheme” means Visa, Mastercard, American Express, or any other payment card scheme.

“Commercial Terms Addendum” means the separate PSP Commercial Terms Addendum entered into between the Parties setting out the PSP’s compensation structure (which may include revenue share, milestone bonuses, and related commercial provisions), which upon execution forms part of this Agreement. For the avoidance of doubt, the PSP shall have no entitlement to revenue share or other compensation under this Agreement unless and until a Commercial Terms Addendum has been executed by both Parties.

“Confidential Information” means all information disclosed by one Party to the other that is marked as confidential or should reasonably be understood to be confidential, including business plans, pricing, customer data, and technical specifications.

“Consumer” means an individual who uses a Merchant’s services and whose payment transaction data may be processed through the Zeal Platform.

“Data Processing Addendum” or “DPA” means the data processing terms incorporated by reference, available at https://getzeal.io/legal/dpa.

“Free Tier Services” means Zeal’s basic value-added services provided to Merchants at no charge, including transaction reporting and basic analytics.

“Global T&Cs” means Zeal’s Global Partnership Terms and Conditions available at https://getzeal.io/terms/global.

“Gross SaaS Revenue” means gross revenue received by Zeal from SaaS Services provided to Merchants within the PSP’s network, before any deductions.

“Intellectual Property Rights” means patents, rights to inventions, copyright, trade marks, trade names, domain names, rights in designs, database rights, rights in confidential information, know-how, and all other intellectual property rights.

“Losses” means all losses, liabilities, damages, costs, charges, and expenses (including reasonable legal fees).

“Managed MIDs” means the Merchant Identification Numbers within the PSP’s network that are within the scope of this Agreement, as may be updated through the PSP Portal.

“Merchant” means a business that accepts payment cards through Terminals and has a contractual relationship with the PSP for payment services.

“Merchant Data” means the data relating to Merchants specified in Section 3.3.

“Net SaaS Revenue” means Gross SaaS Revenue less: (a) payment processing fees; (b) refunds and chargebacks; (c) discounts and promotional credits; and (d) VAT and other applicable sales taxes.

“Opt-Out” means a Merchant’s exercise of its right to discontinue Zeal Services.

“Paid MID” means a MID associated with a Merchant that has registered on the Zeal Platform, accepted Zeal’s Merchant Terms of Service, and made at least one payment for Paid Tier Services.

“Paid Tier Services” means Zeal’s premium value-added services requiring Merchant registration and payment.

“PSP Portal” means Zeal’s web-based portal providing the PSP with access to merchant insights, analytics, MID management, and reporting.

“SaaS Services” means Zeal’s subscription-based services including loyalty SaaS, premium analytics, branded mobile apps, and advanced reporting. Excludes Free Tier Services, brand-funded campaigns, CPM revenue, instant redemption fees, data licensing, and professional services.

“Terminal” means a payment terminal on which Zeal Software may be deployed.

“Token” means a surrogate value replacing the PAN for card identification without exposing the actual card number.

“Transaction Data” means data derived from payment transactions at Terminals, including transaction amounts, dates, MCCs, and Tokens. Excludes PANs, CVV/CVC codes, PINs, or payment authorization data.

“Value-Added Services” or “VAS” means the non-payment services delivered through the Zeal Platform, including transaction reporting, loyalty programs, analytics, and consumer engagement tools.

“Zeal Management System” or “ZMS” means Zeal’s proprietary system through which ZMS Controllers manage Terminal deployments and Merchant Data uploads.

“Zeal Platform” means Zeal’s proprietary technology platform for delivering Value-Added Services.

“Zeal Software” means the software applications deployed on Terminals to enable Value-Added Services.

“ZMS Controller” means a terminal distributor, TMS operator, payment application ISV, or similar entity that has entered into a ZMS Controller Partnership Agreement with Zeal. For the purposes of this Agreement, ZMS Controllers form part of Zeal’s network of Zeal Distribution Partners.

1.2 Interpretation

In this Agreement: (a) references to Sections and Schedules are to sections of, and schedules to, this Agreement; (b) headings are for convenience only and do not affect interpretation; (c) words in the singular include the plural and vice versa; (d) “including” means “including without limitation”; (e) references to “writing” include email; and (f) references to any statute include all amendments and re-enactments.

2. NATURE OF ZEAL SERVICES

2.1 Value-Added Services Only

Zeal provides Value-Added Services through payment terminals. For the avoidance of doubt, Zeal does NOT provide: (a) payment acquiring services; (b) payment processing services; (c) payment gateway services; or (d) any services requiring authorization as a payment institution, electronic money institution, or equivalent regulated entity under the Payment Services Regulations 2017 or equivalent legislation.

2.2 Regulatory Position

Zeal operates as a technology service provider, not as a payment services provider. Zeal does not handle, process, or store PANs, CVV/CVC codes, PINs, or any data required for payment authorization. Where Zeal processes Tokens as part of Transaction Data, such Tokens are used solely for recognizing returning Consumers, generating analytics, and enabling loyalty program functionality.

2.3 Protection of Payment Relationship

The PSP retains full ownership of and responsibility for its payment processing relationships with Merchants. Nothing in this Agreement transfers, diminishes, or competes with such relationships. Zeal’s activities in relation to Transaction Data are strictly limited to observing such data for delivering Value-Added Services.

3. AUTHORIZATION AND DATA SHARING

3.1 Grant of Authorization

Subject to the terms of this Agreement, the PSP hereby authorizes Zeal to: (a) receive, store, and process Merchant Data and Transaction Data from Terminals associated with Managed MIDs; (b) deploy Zeal Software on Terminals associated with Managed MIDs; (c) provide Free Tier Services to Merchants within the PSP’s network; (d) offer Paid Tier Services to Merchants (subject to Merchant acceptance of Zeal’s Merchant Terms of Service); and (e) contact Merchants using shared contact information to promote Zeal’s Value-Added Services in accordance with Section 6.5.

3.2 Methods of Data Upload

Merchant Data may be uploaded through: (a) PSP Portal Direct Upload; or (b) Zeal’s distribution network, as set out in Section 5. The PSP may also upload Merchant Data directly at any time. Revenue share is calculated across all Paid MIDs regardless of upload method.

3.3 Merchant Data

3.4 Data Accuracy and Scope Management

The PSP shall use reasonable efforts to ensure Merchant Data is accurate and up-to-date, and shall notify Zeal of material changes. The PSP may add or remove Managed MIDs at any time through the PSP Portal. Removal takes effect within five (5) Business Days, subject to Section 6 (Merchant Notice and Opt-Out).

4. PSP REPRESENTATIONS AND WARRANTIES

4.1 Authority Representations

The PSP represents and warrants that: (a) it has full power and authority to enter into and perform this Agreement; (b) this Agreement constitutes valid and binding obligations; (c) it has the legal authority under its Merchant Agreements to share Merchant Data with Zeal, authorize deployment of Zeal Software on Terminals, and permit Zeal’s processing of Transaction Data; (d) it has obtained any required consents, approvals, or authorizations to share Merchant Data and authorize Zeal Software deployment; (e) the sharing of Merchant Data does not breach any Merchant Agreement, acquirer agreement, Card Scheme Rules, or applicable law; and (f) it has obtained any required consents, approvals, or authorizations to share Merchant contact information with Zeal for service notifications and promotional communications relating to Zeal’s Value-Added Services.

4.2 Ongoing Obligations

The PSP undertakes to: (a) maintain all necessary authorizations throughout the Term; (b) notify Zeal promptly if any authorization is withdrawn or becomes subject to conditions affecting Zeal’s ability to provide the Services; (c) cooperate with Zeal in good faith; and (d) ensure that its Merchant Agreements (entered into or renewed after the Effective Date) contain provisions sufficient to permit the activities contemplated by this Agreement.

4.3 Card Scheme Compliance

The PSP is responsible for Card Scheme compliance in relation to its payment processing activities. Zeal is responsible for ensuring Zeal Software does not interfere with payment application functionality and complies with applicable Card Scheme Rules. Each Party shall promptly notify the other of any Card Scheme inquiry or compliance issue relating to this Agreement.

5. DEPLOYMENT AND DATA UPLOAD

5.1 Zeal Distribution Network

Zeal may fulfil its obligations under this Agreement through its network of authorised distribution partners (“Zeal Distribution Partners”), including terminal distributors, TMS operators, and payment application providers that have entered into binding agreements with Zeal. The PSP may also upload Merchant Data directly through the PSP Portal at any time.

5.2 Zeal’s Obligations Regarding Distribution Partners

Zeal is responsible for ensuring all Zeal Distribution Partners are bound by contractual obligations no less protective than those in this Agreement, including data protection obligations equivalent to the DPA. A current list of Zeal Distribution Partners is available at https://getzeal.io/partners or upon request. Zeal shall notify the PSP of any new Distribution Partner at least fourteen (14) days before that partner processes the PSP’s Merchant Data. The PSP may object on reasonable grounds within that period.

5.3 Liability

Zeal remains fully responsible and liable for the acts and omissions of its Zeal Distribution Partners as if they were Zeal’s own acts and omissions. The PSP’s contractual relationship for the purposes of this Agreement is with Zeal, and the PSP is not required to enter into any separate agreement with any Zeal Distribution Partner.

6. SERVICE TIERS AND MERCHANT NOTIFICATION

6.1 Free Tier Services

Upon deployment of Zeal Software, Merchants shall automatically receive Free Tier Services at no charge. Free Tier Services do not necessarily require Merchant registration. The lawful basis for processing Transaction Data is the legitimate interest of Merchants in receiving analytics regarding their business operations, as documented in Zeal’s Legitimate Interests Assessment (https://getzeal.io/legal/lia-free-tier).

6.2 Free Tier Activation Notification

To support the legitimate interests basis and ensure transparency:

(a) The PSP shall provide Merchant business email addresses (and sole trader personal emails where applicable) as part of Merchant Data. The PSP warrants it has Merchant consent to share such email addresses with Zeal for service notifications.

(b) Zeal shall send an email notification to the Merchant within twenty-four (24) hours of first deployment. The notification shall explain the Services, describe data collection and usage, include links to the Merchant Terms of Service, Privacy Policy, and Legitimate Interests Assessment, and provide prominent opt-out instructions.

(c) If the Merchant does not exercise its Opt-Out right within thirty (30) days of receipt, continued receipt of Free Tier Services shall constitute deemed acceptance of Zeal’s Merchant Terms of Service for Free Tier Services.

(d) Upon a valid Opt-Out request, Zeal shall: acknowledge receipt within two (2) Business Days; process the Opt-Out within five (5) Business Days; and cease collecting new Transaction Data from the Merchant’s Terminal(s). Zeal shall anonymize identifiable Personal Data relating to the opted-out Merchant within thirty (30) days, except where retention is required for legal, audit, or compliance purposes. Aggregated and Anonymised Data shall be retained.

(e) Zeal shall maintain records of all notification emails, including delivery status, opt-out dates, and deemed acceptance dates, for the duration of this Agreement plus six (6) years.

6.3 Paid Tier Services

Merchants may upgrade to Paid Tier Services by: (a) registering on the Zeal Terminal App or Merchant Portal; (b) accepting Zeal’s Merchant Terms of Service; and (c) subscribing to one or more SaaS Services. Merchants are not obligated to upgrade; the decision is entirely voluntary. Neither Party shall condition access to payment services on a Merchant’s decision regarding Paid Tier Services.

6.4 Direct Merchant Relationship

When a Merchant upgrades to Paid Tier Services, Zeal establishes a direct contractual relationship limited to Value-Added Services. This does not affect the PSP’s payment processing relationship. Zeal shall not use the direct relationship to market payment services or solicit switching (per Section 8). Where a Commercial Terms Addendum is in force, compensation shall continue in accordance with Section 10.

6.5 Merchant Communications

The PSP authorises Zeal to contact Merchants within the PSP’s network using Merchant contact information (including email addresses and phone numbers) shared under this Agreement, solely for the purposes of: (a) notifying Merchants of Free Tier Services and their opt-out rights; (b) promoting Zeal’s Value-Added Services, including invitations to register on the Zeal Platform, activate loyalty programmes, and subscribe to Paid Tier Services; and (c) providing service-related communications to Merchants who have registered on the Zeal Platform.

All Merchant communications under this Section shall: (i) clearly identify Zeal as the sender; (ii) relate exclusively to Zeal’s Value-Added Services and never to payment processing, acquiring, or gateway services; (iii) include a clear and functional unsubscribe mechanism; and (iv) comply with Applicable Data Protection Laws and applicable direct marketing regulations. The PSP may request that Zeal cease communications to specific Merchants by written notice, and Zeal shall action such requests within five (5) Business Days.

6.6 Merchant Opt-Out Rights

Merchants retain the right to opt out through: (a) request to the PSP (forwarded to Zeal within five (5) Business Days); (b) direct request to Zeal at support@getzeal.io; (c) such other channels as Zeal shall establish and maintain (including online opt-out forms); or (d) request through any Zeal Distribution Partner. Neither Party shall impede or create unreasonable barriers to Merchant opt-out requests.

6.7 Consumer Transparency

Zeal shall ensure Consumers receive appropriate privacy information in accordance with Applicable Data Protection Laws. Details of consumer enrolment flows, consent mechanisms, cross-merchant identification transparency, and data minimisation commitments are set out in Zeal’s Privacy Policy (https://getzeal.io/privacy) and Consumer Terms of Service (https://getzeal.io/consumer-terms). Each Party’s responsibilities for consumer transparency are allocated as follows: Merchants are responsible for point-of-sale signage; Zeal is responsible for privacy information during Zeal-controlled enrolment flows; the PSP supports Merchants in obtaining Zeal-provided signage materials.

7. PSP PORTAL

7.1 Portal Access and Features

Zeal shall provide the PSP with access to the PSP Portal, which enables: (a) MID upload and management, including bulk import and export; (b) merchant performance insights, including deployment status, adoption rates, and conversion analytics; (c) where a Commercial Terms Addendum is in force, compensation reporting, including statements, milestone tracking, and downloadable exports; and (d) network analytics, including aggregated transaction trends and benchmarking data.

7.2 Licence and Credentials

Zeal grants the PSP a non-exclusive, non-transferable, revocable licence during the Term to access the PSP Portal for internal business purposes. The PSP shall: (a) designate authorized users and maintain accurate account information; (b) ensure each account is used only by the designated individual; (c) maintain credential confidentiality; (d) promptly disable access for users who no longer require it; and (e) notify Zeal immediately of any unauthorized access.

7.3 Service Level and Acceptable Use

Zeal shall use reasonable efforts to maintain PSP Portal availability of 99.0%, measured monthly, excluding scheduled maintenance (communicated at least 72 hours in advance where practicable). The PSP shall comply with the Acceptable Use Policy set out in Schedule 3. Zeal may suspend Portal access in accordance with Section 15 (Suspension) for breach of the Acceptable Use Policy.

8. ZEAL COVENANTS

8.1 Non-Solicitation of Payment Switching

Zeal covenants that it shall NOT: (a) solicit or induce any Merchant to switch its payment processing, acquiring, or gateway relationship away from the PSP; (b) offer, sell, or provide payment acquiring, payment processing, or payment gateway services; (c) share Merchant contact information with any third party for marketing payment services; or (d) use Merchant Data or Transaction Data for any purpose other than providing and promoting Value-Added Services in accordance with Section 6.5 and delivering PSP Portal insights (for the avoidance of doubt, this restriction does not apply to Aggregated or Anonymised Data).

8.2 Remedy for Breach

The PSP may terminate this Agreement immediately upon written notice if Zeal breaches any covenant in Section 8.1, in addition to any other remedies available at law or in equity.

8.3 Covenant Survival

The covenants in Section 8.1 shall survive termination for twenty-four (24) months.

9. DATA PROTECTION

9.1 Compliance

Each Party shall comply with its obligations under Applicable Data Protection Laws in connection with the processing of Personal Data under this Agreement.

9.2 Data Processing Roles

Where either Party acts as Processor on behalf of the other, the DPA shall apply.

9.3 Key Data Protection Obligations

(a) Each Party shall maintain appropriate privacy notices disclosing relevant data processing. (b) Each Party shall implement and maintain appropriate technical and organisational security measures. (c) Each Party shall notify the other without undue delay (within 24 hours) of any Security Incident affecting data shared under this Agreement. (d) The Parties shall cooperate to respond to data subject rights requests within statutory timeframes. (e) Neither Party shall transfer Personal Data outside the UK without appropriate safeguards. (f) Zeal shall retain Merchant Data and Transaction Data in accordance with the retention periods set out in Zeal’s Privacy Policy (https://getzeal.io/privacy) and for such additional period as required for audit and legal compliance purposes; Aggregated and Anonymised Data may be retained indefinitely.

10. COMMERCIAL TERMS AND PAYMENT

10.1 Commercial Terms Addendum

Where the Parties enter into a Commercial Terms Addendum, the PSP’s compensation (which may include revenue share, milestone bonuses, or other fees) shall be as set out in that Addendum. The Commercial Terms Addendum shall reference this Agreement and, upon execution, shall form part of this Agreement. For the avoidance of doubt, the PSP shall have no entitlement to revenue share or any other compensation under this Agreement unless and until a Commercial Terms Addendum has been executed by both Parties.

10.2 Precedence

In the event of conflict between the Commercial Terms Addendum and this Agreement on any matter relating to compensation, revenue share, fees, or payment, the Commercial Terms Addendum shall prevail. The Commercial Terms Addendum may be amended or replaced independently of this Agreement, subject to written agreement between the Parties. Termination of the Commercial Terms Addendum shall not affect this Agreement, which shall continue in force. For the avoidance of doubt, where a Commercial Terms Addendum is terminated but this Agreement continues, the PSP shall not be entitled to any compensation accruing after the date of termination of the Addendum.

10.3 Reporting

Where a Commercial Terms Addendum is in force, Zeal shall calculate the PSP’s compensation monthly and provide statements through the PSP Portal in accordance with the terms of that Addendum.

10.4 Payment

Payment terms, including calculation methodology, payment frequency, statement delivery, dispute resolution, interest on late payments, and tax treatment, shall be as set out in the Commercial Terms Addendum. In the absence of a Commercial Terms Addendum, this Section 10.4 shall have no operative effect.

11. INTELLECTUAL PROPERTY

11.1 Ownership

All Intellectual Property Rights in the Zeal Platform, Zeal Software, PSP Portal, ZMS, and any Aggregated or Anonymised Data remain Zeal’s exclusive property. All Intellectual Property Rights in Merchant Data and proprietary PSP data remain the PSP’s property. Zeal’s rights to use such data are limited to the licences expressly granted in this Agreement.

11.2 Licence to Deploy

Zeal grants the PSP a non-exclusive, non-transferable licence during the Term to facilitate deployment of Zeal Software on Terminals for enabling Value-Added Services.

11.3 Trademarks and Publicity

Each Party grants the other a non-exclusive, revocable licence to use its trademarks for routine marketing, sales, and customer communications related to the Services, subject to compliance with brand guidelines and advance notice. Either Party may withdraw this standing consent on reasonable written notice. Neither Party shall issue press releases identifying the other without prior written consent; either Party may reference the partnership in general terms.

11.4 Feedback

If the PSP provides suggestions or feedback regarding the Zeal Platform (“Feedback”), Zeal may use such Feedback without restriction or compensation.

12. AUDIT RIGHTS

Where a Commercial Terms Addendum is in force, upon thirty (30) days’ written notice, and not more than once per calendar year, the PSP may appoint an independent auditor to verify compensation calculations. If an audit reveals underpayment exceeding 5%, Zeal shall bear the audit costs and pay the shortfall plus interest. If Zeal reasonably suspects Merchant Data has been uploaded in breach of this Agreement, it may request compliance documentation from the PSP (response due within ten (10) Business Days). Data protection audit rights are set out in the DPA.

13. CONFIDENTIALITY

13.1 Obligations

Each Party shall: (a) keep the other Party’s Confidential Information confidential; (b) not disclose Confidential Information to third parties without prior written consent; (c) use Confidential Information only for performing this Agreement; and (d) protect Confidential Information with at least the same degree of care used for its own confidential information.

13.2 Permitted Disclosures

A Party may disclose Confidential Information: (a) to professional advisors bound by confidentiality; (b) as required by law, regulation, or court order (with prompt notice where legally permitted); or (c) to Affiliates bound by no less protective obligations.

13.3 Survival

Confidentiality obligations survive termination for five (5) years; obligations regarding trade secrets continue indefinitely. Upon termination, the Receiving Party shall return or destroy Confidential Information, except copies required by law.

14. LIMITATION OF LIABILITY

14.1 Exclusion of Indirect Losses

NEITHER PARTY SHALL BE LIABLE FOR ANY indirect, incidental, special, or consequential damages; loss of profits, revenue, business, or anticipated savings; loss of data (except as expressly provided); loss of goodwill or reputation; or punitive or exemplary damages, regardless of the cause of action, even if advised of the possibility of such damages.

14.2 Liability Cap

Subject to Section 14.3, each Party’s total aggregate liability shall not exceed the greater of: (a) the fees paid or payable by Zeal to the PSP under the Commercial Terms Addendum in the twelve (12) months preceding the event giving rise to liability; and (b) £10,000.

14.3 Unlimited Liabilities

Nothing in this Agreement limits liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) wilful misconduct or gross negligence; (d) deliberate breach of Section 8.1 (non-solicitation); or (e) any liability that cannot be excluded by law.

15. INDEMNIFICATION

15.1 PSP Indemnity

The PSP shall indemnify Zeal against Losses arising from: (a) breach of the PSP’s representations or obligations; (b) lack of authority to share Merchant Data or authorize Zeal Software deployment; (c) violation of Applicable Data Protection Laws; or (d) Card Scheme penalties arising from the PSP’s breach of Card Scheme Rules (to the extent not caused by Zeal).

15.2 Zeal Indemnity

Zeal shall indemnify the PSP against Losses arising from: (a) claims that Zeal Software infringes third-party Intellectual Property Rights (excluding claims arising from unauthorized modifications, unapproved combinations, or use in violation of this Agreement); (b) breach of Section 8 (Zeal Covenants); (c) Security Incidents caused by Zeal’s breach of security obligations; or (d) Zeal’s violation of Applicable Data Protection Laws.

15.3 Procedure

The indemnified Party shall: (a) promptly notify the indemnifying Party; (b) give the indemnifying Party sole control of the defence; and (c) provide reasonable assistance at the indemnifying Party’s cost. Each Party shall use reasonable efforts to mitigate Losses.

16. TERM, TERMINATION, AND SUSPENSION

16.1 Term

This Agreement commences on the Effective Date and continues for the Initial Term specified in Schedule 0. Thereafter, it automatically renews for successive Renewal Periods unless either Party gives written notice of non-renewal at least the notice period specified in Schedule 0 before the end of the then-current term.

16.2 Termination for Convenience

After the Initial Term, either Party may terminate for convenience by giving the notice period specified in Schedule 0.

16.3 Termination for Cause

Either Party may terminate immediately upon written notice if the other Party: (a) commits a material breach not remedied within thirty (30) days of notice; (b) suffers an insolvency event; (c) ceases or threatens to cease carrying on business; or (d) undergoes a change of control to a direct competitor (notice within sixty (60) days of awareness). Either Party may also terminate upon thirty (30) days’ notice if a regulatory authority or Card Scheme requires cessation of the activities contemplated by this Agreement.

16.4 Suspension

Zeal may suspend the PSP’s access to the PSP Portal and/or Services if: (a) the PSP breaches a material term and fails to cure within five (5) Business Days of notice; (b) Zeal is required to do so by law or Card Scheme directive; (c) suspension is necessary to prevent fraud, security threats, or material harm; or (d) the PSP fails to pay undisputed amounts for ten (10) Business Days after notice. Zeal shall provide reasonable advance notice and reinstate access promptly upon resolution.

17. CONSEQUENCES OF TERMINATION

17.1 Effect of Termination

Upon termination: (a) PSP Portal access shall be disabled; (b) all licences terminate; (c) Zeal shall cease new Terminal deployments within the PSP’s network; and (d) each Party shall return or destroy Confidential Information per Section 13.3.

17.2 Wind-Down Period

Unless terminated for cause by the PSP, there shall be a wind-down period as specified in Schedule 0 during which: (a) Zeal continues providing Services to existing Paid Tier Merchants; (b) compensation (if any) under the Commercial Terms Addendum continues to accrue; (c) Zeal shall not onboard new Merchants; and (d) the Parties cooperate on transition. Following the wind-down, Zeal may continue providing Services to Merchants with active paid subscriptions, and compensation under the Commercial Terms Addendum (if applicable) shall continue for Merchants acquired during the Term.

17.3 Survival

The following Sections survive termination: 1 (Definitions), 8 (Zeal Covenants, for the survival period), 9 (Data Protection, to extent necessary), 11 (IP ownership), 13 (Confidentiality), 14 (Limitation of Liability), 15 (Indemnification), 17 (Consequences of Termination), and 20 (General Provisions).

18. COMPLIANCE

18.1 Laws and Regulations

Each Party shall comply with all applicable laws and regulations, including anti-bribery laws (including the Bribery Act 2010), economic sanctions and export controls, and the Modern Slavery Act 2015 (to the extent applicable).

18.2 Prohibited Conduct

Neither Party shall: (a) offer, give, or receive any bribe or improper payment; (b) deal with any person or entity subject to sanctions; or (c) take any action that would cause the other Party to violate applicable laws.

19. GLOBAL TERMS AND CONDITIONS

19.1 Incorporation

The Global T&Cs are incorporated by reference and apply to this Agreement. The PSP acknowledges it has received, read, and agrees to be bound by the Global T&Cs.

19.2 Updates

Zeal may update the Global T&Cs from time to time. Material changes will be notified 30 days in advance. If the PSP objects to a material change, it may terminate upon sixty (60) days’ written notice, provided such notice is given within thirty (30) days of receiving notice of the change.

19.3 Order of Precedence

In the event of conflict: (a) Schedule 0 and the Commercial Terms Addendum (highest); (b) the body of this Agreement; (c) Schedules (other than Schedule 0); (d) the Global T&Cs; (e) the DPA; (f) the Privacy Policy; (g) other Zeal policies referenced herein (lowest).

20. GENERAL PROVISIONS

20.1 Notices

All notices shall be in writing and sent to the addresses specified in Schedule 2. Notices are effective: (a) on delivery if delivered by hand; (b) on the next Business Day if sent by email; or (c) two (2) Business Days after posting if sent by recorded delivery post.

20.2 Assignment

Neither Party may assign this Agreement without prior written consent, except that either Party may assign to an Affiliate or in connection with a merger, acquisition, or sale of substantially all assets, provided the assignee assumes all obligations.

20.3 Entire Agreement

This Agreement, including all Schedules, the Commercial Terms Addendum (where applicable), the Global T&Cs, and the Privacy Policy, constitutes the entire agreement between the Parties and supersedes all prior agreements relating to its subject matter.

20.4 Amendment

This Agreement may only be amended in writing agreed by both Parties. Zeal may propose amendments by providing at least thirty (30) days’ written notice to the PSP. The PSP’s continued use of the PSP Portal after such notice period constitutes acceptance of the amended terms. If the PSP does not agree to the amendment, it may terminate this Agreement in accordance with Section 16. For the avoidance of doubt, this Section 20.4 does not apply to Commercial Terms Addenda, which may only be amended in accordance with their own terms.

20.5 Waiver

Failure to exercise any right is not a waiver of that right.

20.6 Severability

If any provision is held invalid, the remaining provisions continue in full force.

20.7 Third Party Rights

This Agreement does not confer any rights on third parties under the Contracts (Rights of Third Parties) Act 1999.

20.8 Relationship

The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship.

20.9 Governing Law and Jurisdiction

This Agreement is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction. Before commencing litigation, the Parties shall attempt to resolve disputes through escalation to senior management; if unresolved within thirty (30) days, either Party may commence proceedings.

20.10 Electronic Acceptance

This Agreement may be accepted electronically through Zeal’s account activation process. Acceptance by checking the designated acceptance box and completing the activation process shall constitute a valid electronic signature and a binding agreement under the Electronic Communications Act 2000 and the eIDAS Regulation (as retained in UK law), with the same legal effect as a handwritten signature. The PSP Details in Schedule 0 shall be populated from information provided during the activation process and from publicly available records.

20.11 Subcontracting

Zeal may subcontract performance provided it remains responsible for subcontractor acts and omissions. PSP consent is required for subcontracting of Personal Data processing (as set out in the DPA).

20.12 Force Majeure

Neither Party shall be liable for failure to perform obligations (other than payment obligations) caused by events beyond its reasonable control. If force majeure continues for more than ninety (90) days, either Party may terminate upon notice.

SCHEDULE 1: COMMERCIAL TERMS

The PSP’s compensation and payment terms (which may include revenue share, milestone bonuses, and related commercial provisions) are set out in a separate PSP Commercial Terms Addendum entered into between the Parties. The Commercial Terms Addendum shall reference this Agreement and, upon execution, shall form part of this Agreement.

In the absence of a Commercial Terms Addendum, no compensation shall be payable to the PSP under this Agreement. The absence of a Commercial Terms Addendum does not affect the validity or enforceability of this Agreement, which shall continue in force on its own terms.

SCHEDULE 2: NOTICES

Notices to Zeal

Legal and Contractual Notices:

Zeal IO Limited

Address: 85 Great Portland Street, First Floor, London, W1W 7LT, UK

Email: legal@getzeal.io

Attention: Legal Department

Operational Notices:

Email: partnerships@getzeal.io | Attention: Partnerships Team

Security Incident Notifications:

Email: security@getzeal.io | Attention: Security Team

Notices to the PSP

Legal and Contractual Notices:

As specified in Schedule 0 Part 1

Address: As specified in Schedule 0 Part 1 (PSP Registered Address)

Email: As specified in Schedule 0 Part 1 (PSP Official Email)

Attention: Legal Department (or as notified in writing)

Operational Notices:

Email: As specified in Schedule 0 Part 1 (PSP Official Email), unless separately notified

SCHEDULE 3: ACCEPTABLE USE POLICY

This Acceptable Use Policy applies to the PSP’s use of the PSP Portal.

1. Permitted Use

The PSP may use the PSP Portal only for: managing Merchant Data and MIDs within scope of the Agreement; viewing reports and analytics; and administering user access within its organisation.

2. Prohibited Activities

The PSP shall NOT: access or attempt to access another PSP’s data or accounts; use automated scripts, bots, or scrapers; attempt to circumvent security controls; upload malicious code or harmful content; use the Portal for any unlawful purpose; share login credentials; reverse engineer the Portal; or interfere with other users’ access.

3. Credential Security

The PSP shall: use strong, unique passwords; enable multi-factor authentication where available; not share credentials between users; report lost or compromised credentials immediately to security@getzeal.io; and promptly disable accounts for departed personnel.

4. Consequences of Breach

Breach of this Policy may result in: suspension or termination of Portal access; termination of the Agreement for cause; liability for any resulting Losses; and reporting to relevant authorities where required by law.

ACCEPTANCE

By checking the acceptance box and completing the account activation process, the PSP confirms that: (a) the individual accepting has the authority to bind the PSP to this Agreement; (b) the PSP has had the opportunity to review this Agreement in full; and (c) such acceptance constitutes a valid and binding agreement equivalent to a written signature under the Electronic Communications Act 2000 and the eIDAS Regulation (as retained in UK law). The Effective Date shall be the date on which the PSP completes the account activation process.

Zeal shall maintain a record of each acceptance, including the name, email address, and role of the individual who accepted, the timestamp of acceptance, the IP address from which acceptance was made, and the version of this Agreement that was accepted. Such records shall constitute conclusive evidence of the PSP’s agreement to these terms.

— End of Agreement —

Version 4.4 | February 2026

© 2026 Zeal IO Limited. All rights reserved.

‍

‍

‍

‍

‍

‍