MasterCard Rules (PDF)

7.3.14 Indemnification
Service Providers
7.3 General Obligations
Program Service performed by any person or entity, which Program Service
directly or indirectly supports or otherwise benefits a Customer’s Program(s),
and regardless of whether such third party is or was registered with the
Corporation as a Service Provider or whether such third party is itself a
Customer, is Activity and thereby subjects the Customer to the indemnification
and other obligations set forth in Rule 3.3.
7.3.15 No Endorsement by the Corporation
In no event does compliance with these Service Provider Rules or enforcement
or any lack of or delay in enforcement thereof or the registration of a Service
Provider imply, suggest or otherwise mean that the Corporation endorses
any Service Provider or the nature or quality of Program Service or other
performance, or that the Corporation approves of, is a party to, or a participant
in, any act or omission by a Service Provider or other entity acting for or on
behalf of a Customer.
7.3.16 Audits
The Corporation or its designee may conduct one or more or regular or periodic
financial and procedural audits of the Customer, its Service Provider(s), or both,
at any time and from time to time for the purpose of determining compliance
with the Standards, including these Service Provider Rules. The Customer bears
all costs of any such audit or audits. The Customer and its Service Provider(s)
each must fully cooperate with and promptly supply the Corporation with all
information and material upon request.
7.3.17 Settlement Failure Obligation
A Service Provider that becomes aware of a settlement failure by the
Customer(s) for which the Service Provider performs Program Service must
promptly, and in no event later than 24 hours after becoming aware of such
failure, notify the Corporation in writing of such failure.
7.3.18 Data Security
A Service Provider must comply with all Standards and applicable laws and
regulations pertaining to the storage and/or safeguarding and/or transmission
of Card and Transaction data. If a Service Provider reasonably believes that an
unauthorized person accessed or may have accessed Card account, Cardholder,
or Transaction information in the possession or control of the Service Provider
or any other third party, the Service Provider must promptly notify the
Customer(s) for which it provides Program Service in writing of such belief and
the Customer must promptly notify the Corporation in writing of such belief.
©1969–2012 MasterCard. Proprietary. All rights reserved.
MasterCard Rules • 12 December 2012 7-11