Platform Agreement

Grant. Subject to this Agreement and the Order, we grant you the non-exclusive, non-transferable right during the term to (a) integrate the Services into the Platform Application via our API; (b) offer and provision access to the Services for Connected Companies; and (c) use the Services on each Connected Company's behalf to the extent authorised under Sections 3 and 4.

Two direct relationships. We have a direct contractual relationship with (i) you, under this Agreement, and (ii) each Connected Company, under the CCA. The CCA governs the Connected Company's use of the Services; this Agreement governs your integration, your authority to act for Connected Companies, and your obligations to us.

White-label. Where the Order includes white-label branding, the Services may be presented under your brand (including your branded subdomain and logo) as described in the Service Description. Each party grants the other a non-exclusive, revocable licence to use its name, logo, and marks solely as needed for the agreed presentation and marketing, in accordance with the owner's brand guidelines. Neither party may alter the other's marks or use them to imply an endorsement or relationship beyond this Agreement.

Regulatory presentation. You must not present the Services, the Platform Application, or yourself in a way that suggests that you or BankConnector provides regulated payment services, holds funds, or is a bank or payment institution. Marketing statements about the Services must be consistent with the Service Description and this Agreement's first paragraph.

Channel exclusivity. Connected Companies provisioned under this Agreement access the Services exclusively through the Platform's arrangement. Nothing in this Agreement obliges us to offer, or prohibits you from restricting, a direct relationship between us and a Connected Company during the term of this Agreement. Section 9.5 governs what happens on termination.

CCA acceptance is mandatory. Before a Connected Company's workspace is activated, and in every case before any Connection Activity is performed for it, you must ensure that the Connected Company has accepted the CCA through the acceptance flow described in the Documentation.

Evidence and process control. You will maintain records evidencing each acceptance and provide them to us on request. If we reasonably determine that your acceptance process does not create a binding agreement, you must modify the process as we reasonably require.

Unlimited liability for failure to bind. Your liability for failure to ensure a binding CCA acceptance under Sections 3.1–3.2 is not limited or excluded by anything in this Agreement, including Section 11.

Onboarding information. You will provide accurate information about each Connected Company as required for provisioning, and promptly update it. We may decline, suspend, or terminate a Connected Company's workspace where we reasonably believe its use creates a legal, security, or sanctions risk.

Authorised activity only. You may perform Connection Activity for a Connected Company only to the extent the Connected Company has authorised it and has not withdrawn that authorisation. We treat Connection Activity relayed by you through the API as initiated by the Connected Company.

Flow-down minimum content. Your Platform Provider Agreement with each Connected Company must, at minimum: (a) describe how the Platform Application accesses and uses Connected Company Data and the Connection Activity you may perform on the company's behalf; (b) contain the company's authorisation for you to perform that activity and to share Connected Company Data with us; (c) disclose all fees you charge the company for or in connection with the Services; and (d) identify BankConnector as the provider of the underlying service in your privacy notices, with a reference to our privacy policy. You will demonstrate compliance with this Section on our reasonable request.

Refusal right. We may decline to act on an instruction from you that we reasonably believe exceeds the Connected Company's authorisation, violates law, or conflicts with the CCA.

No third-party beneficiaries. Connected Companies are not third-party beneficiaries of this Agreement and may not bring claims under it. Your rights under this Agreement (including indemnities) may not be exercised on behalf of a Connected Company.

Your responsibility. As between you and us, you are responsible for all Connection Activity on Connected Company workspaces provisioned under this Agreement, whether initiated by you or not, and you are jointly and severally liable with each Connected Company for its obligations to us under the CCA, except, in each case, to the extent a loss is caused by our breach of this Agreement, the CCA, or the Security Policy.

First-line support. You provide first-line support to Connected Companies. We provide second-line support to you under the SLA & Support Policy. We have no direct support obligation to Connected Companies unless stated in the Order.

Notices relay. Where Connected Companies interact only with the Platform Application, you will promptly relay to them the notices we ask you to relay (including changes to the CCA and Policies and security notifications). We may also notify Connected Companies directly.

Integration quality. You will integrate and maintain the Platform Application in accordance with the Documentation, keep your integration compatible with the then-current supported API versions (we give at least 90 days' notice of a deprecation, except where a shorter period is required for security), and not use the API in a manner that circumvents documented limits or controls.

Security. You will protect your API credentials, apply the Security Policy's customer-side controls, notify us without undue delay of any suspected compromise affecting the Services or Connected Company Data, and not introduce malicious code into the Services.

Compliance. Section 6 of the Customer Agreement (Customer Obligations and Compliance) applies to you mutatis mutandis. For clarity: financial-crime compliance for payments rests with each Connected Company and its Banks; you must not represent otherwise to Connected Companies.

Restrictions. You will not (a) offer the Services to a Connected Company other than through the Platform Application and the flows described in the Documentation; (b) use the Services to build a competing product; (c) reverse engineer any part of the Services except as permitted by mandatory law; (d) perform security testing without our prior written consent; or (e) publish benchmarks of the Services without our consent.

Roles. For Connected Company Data, the Connected Company is the controller and we are its processor under the DPA (incorporated into the CCA). Your access to and use of Connected Company Data is governed by your Platform Provider Agreement and your own compliance with data protection law; we are not responsible for your handling of Connected Company Data.

Platform Data. We process Platform Data to operate the relationship and the Services. Usage Data provisions of the Customer Agreement (Section 5.4) apply.

Platform-billed. Unless the Order states otherwise, we invoice you for all fees arising from Connected Company workspaces provisioned under this Agreement, at the rates in the Order. Your pricing towards Connected Companies is your own business decision, subject to the disclosure duty in Section 4.2(c). Sections 7.1–7.4 of the Customer Agreement (invoicing, taxes, fee changes, no set-off) apply mutatis mutandis.

No deduction. We never deduct fees from payment flows; all fees are invoiced.

Term. As per Section 8 of the Customer Agreement (12-month renewals, 30 days' non-renewal notice), applied to this Agreement.

Suspension. Section 9.1 of the Customer Agreement applies mutatis mutandis. We may additionally suspend provisioning of new Connected Companies, or an individual Connected Company workspace, where the suspension ground is specific to it.

Termination for cause. Section 9.2 of the Customer Agreement applies mutatis mutandis. We may additionally terminate this Agreement with immediate effect if you persistently fail to meet Section 3 (binding of Connected Companies) or Section 4.2 (flow-down) after written notice.

Effects between you and us. Access to the API and provisioning ceases; accrued fees survive; surviving sections mirror the Customer Agreement.

Continuity for Connected Companies. On termination or expiry of this Agreement: (a) each Connected Company's CCA remains in force for a transition period of up to 90 days; (b) during that period, we may, after notice to you, offer each Connected Company either a direct agreement with us or an arrangement through another platform, and you will not obstruct a Connected Company's transition during this period; and (c) a Connected Company that does not transition is wound down under the CCA's wind-down and export terms. Where this Agreement is terminated for your material breach, we may shorten the transition period to protect Connected Companies or the Services.

Sections 11.1–11.5 of the Customer Agreement apply mutatis mutandis, with the cap in Section 11.2 measured by the fees paid or payable by you in the 12 months preceding the first event giving rise to liability.

Additional uncapped items. In addition to the carve-outs in Section 11.3 of the Customer Agreement, your liability under Section 3.3 (failure to bind) is uncapped.

By you. You will defend and indemnify BankConnector against third-party claims (including claims by Connected Companies) arising from (a) the Platform Application and your products and services; (b) your Platform Provider Agreements or your marketing of the Services; (c) your breach of Sections 2.4, 3, 4, or 6; or (d) disputes between you and a Connected Company.

By us. Section 12.2 of the Customer Agreement (IP indemnity) applies to you mutatis mutandis.

Procedure. Section 12.3 of the Customer Agreement applies.