General Terms of Use for Services and Content of Rox Pay Websites and Platforms

These terms describe the General Terms of Use ("GTU") for products and services made available to the user by Rox Pay S.p.A. ("Rox") and companies belonging to the same corporate group through their online channels.

Different terms and conditions may apply to specific Rox websites and/or platforms or to integrated partner websites and platforms; in such cases, please refer to the GTU provided therein.

Accessing or using Rox websites and/or platforms and/or any product or service for which the user registers implies acceptance of these General Terms of Use. If the user does not agree with, or does not intend to accept, these GTU, the user should not register, should not continue browsing Rox websites and/or platforms, and should not proceed with any related purchase.

These General Terms of Use apply exclusively to commercial relationships between companies, professionals, and other economic operators acting in the exercise of their entrepreneurial, commercial, artisanal, or professional activity.

As clarified by case law, the term "professional" includes both natural persons and legal entities (public or private) using the contract not necessarily in the core exercise of the business or profession, but for a purpose connected to the exercise of entrepreneurial or professional activity.

These terms do NOT apply to consumers under Article 3 of Legislative Decree 206/2005; separate conditions apply to consumers.

To accept these GTU, the user must have the legal capacity to enter into binding contracts. Users of legal age may enter into contracts for the purchase of Rox services and/or content on behalf of a minor interested in using such services. Minors aged 14 or older may register on Rox websites with the consent of their parent/guardian.

By completing the registration form, the user declares they are of legal age and/or have obtained consent to act from their parent/guardian.

Articles 16 to 33 concern the acquiring and payment processing services offered by Rox Pay S.p.A. through its own platform or through third-party processors, including Adyen (the "Payment Services"), and apply to entities requesting their activation (the "Merchant"). Solely as regards those services, in the event of a conflict with the other provisions of the GTU, the provisions of those articles shall prevail.

This document refers to the digital resources made available on Rox websites and/or platforms, including software, content, apps, and other digital products or services.

Rox websites and/or platforms contain information, text, software, photos, videos, graphics, music, audio, editorial content, and other materials ("Materials") protected by copyright, trademarks, patents, and other intellectual property rights ("Intellectual Property Rights"). Any right, title, and interest in such Materials and Intellectual Property Rights belongs exclusively to Rox or its licensors and suppliers.

Rox authorizes users to view and, where directly available (via "print"/"download" buttons or links), download (create a local copy on the user's device) and print the Materials exclusively for business and professional purposes connected to the use of the services.

Users may occasionally and non-systematically include limited portions of Materials in business papers, reports, and presentations, provided this is not in competition with the commercial value of such Materials. In any case, users must include trademarks and notices present on Rox websites/platforms and provide proper attribution, citing the relevant authors/editors/translators and the source (indicating "© Rox Italia – https://roxpay.eu").

Except as expressly permitted by Rox, users may not use, modify, adapt, reformat, download, upload, reproduce, transmit, publish, display, perform, transfer, or redistribute Materials in any form, format, or medium, or via any technology, without prior written authorization from Rox and other intellectual property owners.

Users may not reproduce, use, sell, transmit, publish, send, disclose, or distribute Materials to third parties, including other members of the same organization, whether for a fee or otherwise.

Except as expressly permitted in licenses for specific services/content, users may not publish Materials in newsgroups, distribution lists, bulletin boards, content aggregators, file storage services, or any other online destination.

Users may not reproduce illustrations, charts, photographs, diagrams, text portions, chapters, or e-books included in the Materials.

To request authorization to reproduce Materials for purposes other than those expressly permitted, or for questions about proper attribution, please email info@roxpay.eu.

Rox may modify or discontinue any part, feature, or content of its websites/platforms for the following justified reasons:

• Compliance with new legal/regulatory requirements
• Necessary technical or security improvements
• Updates for compatibility with new technologies
• Changes imposed by essential third-party service providers
• Market condition changes significantly affecting operating costs

For substantial changes affecting the parties' rights and obligations, Rox will provide at least 30 days' notice via written communication or another durable medium, specifying:

• The nature and extent of the changes
• The effective date
• The reasons justifying the changes
• The user's right to withdraw without penalties within 30 days of the notice

If substantial content or functionality is removed, Rox will provide alternative materials where technically possible.

Rox assumes no liability for improper use of its services/platforms by users. Rox does not endorse third-party products, services, or information and assumes no direct or indirect liability for any damages or losses caused by or related to the use of, or reliance on, content, goods, or services provided by third parties.

The inclusion of links to third-party sites does not imply authorization by those sites' owners, nor sponsorship or endorsement of Rox websites/platforms.

Payment services, the wallet, and identity checks are provided through Adyen N.V., the licensed payment institution that holds the funds: by using those services the user also accepts Adyen's general terms (adyen.com/legal/terms-and-conditions) and acknowledges its privacy notice, as detailed in article 16.

Certain platform services, in particular the open banking features (by way of example: account information, payment initiation, and related services), are also provided through the APIs and services of Fabrick S.p.A.: by using them the user acknowledges the disclosure in article 34 and accepts the applicable Fabrick terms referred to therein.

Rox websites/platforms may provide features allowing users to upload or send comments, ideas, articles, information, data, text, software, music, audio, photographs, videos, messages, and other materials ("User Content").

Users may only submit lawful, original content (or content they are authorized to submit) and must comply with applicable privacy laws (EU Regulation 2016/679 – GDPR). The user remains solely responsible for the content. Rox may (but is not obliged to) refuse or remove content in objectively determined cases (e.g., third-party rights infringement, unlawful/defamatory content, GTU violations).

Reporting inappropriate/unlawful content: admin@roxpay.eu

Rox does not guarantee the accuracy, integrity, or quality of User Content and assumes no liability for errors, omissions, third-party rights violations, or unlawful conduct arising from such content.

If users submit content, they authorize Rox to store, archive, publish, transmit, use, and distribute such content for service purposes. Rox may disclose user content together with personal data only where required by law or where reasonably necessary (legal proceedings, enforcement, rights protection, security, etc.).

Users agree not to use Rox websites/platforms for unlawful purposes or in breach of these GTU, including (by way of example): impersonation, unsolicited promotional materials/spam, use of bots/scrapers or automated methods to access/copy/monitor content, bypassing access controls, security breaches, unauthorized access attempts, interference with proper operation, disproportionate traffic loads, violations of applicable laws, or conduct that damages the commercial value of Rox services.

Users warrant that registration and access information is true, complete, accurate, and up-to-date, and that any changes will be communicated within 15 days.

If information is (or becomes) untrue or non-compliant, Rox may suspend/terminate access with 30 days' notice and an opportunity for the user to rectify their position.

Credentials (username/password) must not be shared or disclosed. Users are responsible for all use via their credentials and for keeping them secure. Suspected misuse must be reported immediately (e.g., to info@roxpay.eu).

Rox may suspend access with at least 30 days' notice for GTU breaches or harmful use.

Rox warrants: service operation according to communicated technical specifications; technical support for paid services according to stated service levels; conformity of digital services to agreed contractual requirements.

To the maximum extent permitted by law: Rox's liability is limited to direct damages up to the amount paid by the user for the specific service that caused the damage in the previous 12 months; indirect damages, lost profits, data loss, business interruption, consequential and punitive damages are excluded; liability is excluded for force majeure, third-party service disruptions, cyberattacks, and network infrastructure not controlled by Rox.

Rox is not liable (e.g.) for data loss due to user hardware malfunctions; service interruptions due to scheduled maintenance communicated at least 24 hours in advance; damages from improper use or GTU violations; incompatibility with unsupported software/hardware.

Users are responsible for backing up their data and implementing appropriate security measures.

Users agree to indemnify and hold Rox harmless from claims, costs, demands, damages, losses, expenses, and liabilities arising from violations of these GTU, third-party rights, or applicable laws when using Rox websites/platforms.

For complaints related to goods or services purchased online from Rox websites, users may complete the online form on the Rox Support website.

For disputes between professionals, the parties may use alternative dispute resolution tools provided by applicable law.

Rox may send notices via email, publications on its websites/platforms, on its Technical Support website, and/or by conventional mail.

Contacts:

Online: https://www.roxpay.eu/

Postal address: Viale G. Marconi 67/A, Poggibonsi (SI), Italy

Email: info@roxpay.eu

Newsletter: provided free of charge upon request; you can unsubscribe at any time via the reserved area option or by emailing info@roxpay.eu.

These GTU create personal obligations/rights for the user (non-assignable). Rox may assign or delegate its obligations/rights.

If any clause is held invalid or unenforceable, the remainder remains valid. Rox may seek appropriate remedies in case of breach or unauthorized use.

These GTU form an integral part of the registration form and are available under "Terms and Conditions" on the Rox Italia main website.

These GTU are governed by and construed in accordance with the laws in force in the Republic of Italy.

For contracts between professionals: the exclusive competent court for disputes arising in connection with these GTU is the Court of Siena, unless otherwise agreed by the parties.

Neither party is liable for any delay in, or failure to perform, its obligations where this is caused by events beyond its reasonable control, including by way of example: natural disasters, fire, flooding, epidemics and public health measures, war, terrorism, riots, strikes and industrial action including at third parties, failures of electricity or telecommunication networks, faults or unavailability of data centres and cloud services, malfunctions, suspensions or decisions of payment institutions, banks, card schemes, payment system operators and banking interfaces, cyberattacks including denial-of-service attacks and ransomware, as well as measures of public authorities or changes in law that make performance impossible or unlawful.

For the duration of the event the affected obligations are suspended without liability. The prevented party shall inform the other without delay, stating the nature of the event and its foreseeable effects, and shall take the steps that can reasonably be expected to limit its consequences and restore performance. If the impediment lasts more than thirty consecutive days, either party may terminate the contract by written notice and without charge, without prejudice to payment for services already rendered.

Insolvency or financial difficulty of a party, failure to pay amounts due, and events whose effects could have been avoided with ordinary diligence do not qualify as force majeure.

The Payment Services are provided through Adyen N.V., a payment institution authorised and supervised by the Dutch central bank (De Nederlandsche Bank), which holds the funds, executes settlements, and carries out identity (KYC) checks on account holders. Rox Pay does not hold user funds.

By activating a personal or business account and using the Payment Services, the user accepts, in addition to these GTU, Adyen's general terms and conditions (adyen.com/legal/terms-and-conditions), which Rox Pay signs on the user's behalf when the corresponding legal entity is created at Adyen. Acceptance is recorded with date, time, and IP address for evidentiary purposes.

Solely as regards the relationship between the user and Adyen — custody of funds, execution of payments, due diligence obligations — Adyen's terms prevail in the event of a conflict. The processing of personal data carried out by Adyen as an independent controller is described in its privacy notice (adyen.com/policies-and-disclaimer/privacy-policy).

Adyen may at any time request additional documentation, restrict the operation of an account, or refuse to open one under its own acceptance policy. Rox Pay cannot override such decisions and will inform the user to the extent permitted by anti-money laundering legislation.

Activation of the Payment Services is subject to passing a pre-screening procedure structured in two phases:

Immediate verification, based on available information, of any predetermined risk factors (red flags) relating to the website, the declared activity, the jurisdiction of the company and the beneficial owner, geographic consistency, online presence and reputation, identity consistency, and the sectors and products. The presence of even a single red flag results in the rejection of the request, with a summary reason kept on record, save for authorized exceptional cases.

Request and analysis of the minimum mandatory documentation, including, by way of example and not limited to: certificate of incorporation, list of beneficial owners, identity documents and proof of residence of the beneficial owner, bank details and account statements, a detailed description of products and services, dispute reports, tax registration, and sector licenses and authorizations.

Eligibility also depends on the country of establishment of the Merchant and of its beneficial owners and on the sector in which it operates. The list of supported countries and of the accepted, restricted, and prohibited business categories is published and periodically updated at the Accepted business categories page: the Merchant must review it before requesting activation and check that its activity is covered. For restricted categories, activation requires additional documentation and remains subject to a case-by-case assessment; for prohibited categories, the request is rejected.

The Merchant undertakes to provide Rox Pay, within the assigned deadline, with all requested documentation, complete and truthful, and to promptly communicate any subsequent change that may affect the risk assessment. Failure to submit, or incomplete submission of, the documentation within the assigned deadline entitles Rox Pay to suspend or refuse the onboarding.

A request for activation grants no right to the opening of the Payment Services, the outcome of which also depends on Adyen's checks and acceptance policy. Operation is permitted only once activation has been completed: until then collection features, credentials for the programming interfaces and payouts may be unavailable or restricted, even where the account has already been created and the procedure is under way. Rox Pay is not liable for the time required by its own or Adyen's checks, nor for delays caused by documentation submitted by the Merchant or by third parties, and is not required to give reasons for a negative outcome beyond what anti-money laundering law permits.

The Merchant represents and warrants that:

• (a) the activity carried out is lawful and compliant with the laws of the country of incorporation and of the countries in which it operates and collects payments;
• (b) the products and services offered do not fall into any of the categories prohibited by the acceptance policy of Rox Pay and of the payment processors it uses, including Adyen, as listed and periodically updated at the Accepted business categories page or in the contractual documentation;
• (c) the website is active, complete, and compliant with the minimum required standards, including, where applicable: Terms & Conditions, Privacy Policy, Cookie Policy, Refund Policy, Shipping Policy, clear product descriptions, transparent pricing, and genuine contact details;
• (d) the corporate and ownership structure is transparent and allows clear and complete identification of beneficial ownership;
• (e) all information and documents provided during onboarding and throughout the relationship are truthful, complete, and up-to-date;
• (f) the Merchant, its registered and operating offices, and its beneficial owners belong to one of the supported countries listed on the same page.

The Merchant undertakes to:

• (a) comply with applicable anti-money laundering and counter-terrorist financing legislation, including Italian Legislative Decree 231/2007 as amended, as well as international restrictive measures (UN, EU, OFAC, UKSL sanctions);
• (b) not use the Payment Services for transactions connected to countries, persons, or entities subject to international sanctions or included in FATF lists of high-risk jurisdictions or jurisdictions under increased monitoring;
• (c) comply with the requirements imposed by the payment processors used by Rox Pay, including the Adyen acceptance policy (the so-called "5 pillars"), as periodically updated;
• (d) immediately communicate to Rox Pay any change of beneficial ownership, corporate structure, business activity, website, or products offered;
• (e) retain transaction-related documentation for at least ten years and make it available upon request by Rox Pay or the competent authorities.

The Merchant is solely responsible for:

• (a) chargebacks and disputes raised by its end customers, for any reason whatsoever, including, by way of example: non-delivery, non-conforming product, fraud, and unrecognized transactions;
• (b) fines, penalties, or additional fees applied by the payment schemes or upstream processors as a result of a chargeback rate exceeding the supervisory thresholds;
• (c) the full reimbursement to Rox Pay of any amount Rox Pay is required to pay to the schemes, processors, or end customers in relation to the Merchant's transactions.

The Merchant acknowledges that Rox Pay reserves the right to withhold from funds being settled, or to require the establishment of a rolling reserve, the amounts necessary to cover the risk of chargebacks and disputes, in accordance with applicable law and the rules of the payment schemes. The amount, duration, and terms of the reserve will be communicated to the Merchant and will be proportionate to the risk profile.

Rox Pay reserves the right to:

• (a) continuously monitor the Merchant's transactions for the purposes of preventing money laundering, terrorist financing, and fraud;
• (b) immediately suspend the service in the event of: a well-founded suspicion of fraud, money laundering, or terrorist financing; exceeding the chargeback thresholds set by the schemes; breach of the representations and warranties under Article 18; inclusion of the Merchant, its beneficial owners, or its beneficiaries on international sanctions lists;
• (c) terminate the contract with immediate effect, by written notice to the Merchant, in the cases referred to in point (b) as well as in all cases where continuation of the relationship could expose Rox Pay to a legal, reputational, or regulatory risk deemed unacceptable.

Rox Pay also reserves the right to suspend the account and, where necessary, to terminate the contract if it establishes, including after activation, that the Merchant, its registered or operating office, or one of its beneficial owners does not belong to one of the supported countries, or that the activity actually carried out falls into a prohibited or non-eligible category under the Accepted business categories page, including where the country or the category ceases to be supported or where the activity declared during onboarding does not match the actual one. In the same cases Rox Pay may suspend crediting and payouts for the time needed to complete its checks and arrange for the amounts of the affected transactions to be returned to the payers.

In the event of suspension or termination for the reasons indicated above, the Merchant is not entitled to any indemnity or compensation and remains bound to fulfil all obligations arising prior to the suspension or termination.

The Merchant declares that it has reviewed the Anti-Money Laundering and Counter-Terrorist Financing Policy of Rox Pay S.p.A., available on the website or upon request, and undertakes to comply with its principles. The risk classification assigned to the Merchant according to Rox Pay's internal matrix determines the intensity of the due diligence obligations and the frequency of review, as detailed in the Policy itself.

The processing of personal data of the Merchant and of its representatives, beneficial owners, and end customers is carried out in compliance with EU Regulation 2016/679 (GDPR) and applicable Italian law, as detailed in Rox Pay's privacy notice. The Merchant in turn undertakes to process its own customers' data in compliance with applicable law and to provide its customers with an adequate and up-to-date privacy notice.

Where the Merchant is itself an authorized payment service provider using Rox Pay as a channel to access payment processors, the provisions of Articles 43, 44, and 45 of Italian Legislative Decree 231/2007 on contracted entities apply. In particular:

• (a) Rox Pay has the right to request and obtain from the Merchant documentation on the AML procedures adopted by the Merchant for the onboarding and monitoring of its own sub-merchants;
• (b) the Merchant undertakes to provide Rox Pay with an overview of its sub-merchant portfolio, indicating the prevailing business sectors, jurisdictions, and processing volumes;
• (c) the Merchant is required to promptly communicate to Rox Pay any relevant change to its portfolio that may affect the risk profile;
• (d) Rox Pay has the right to terminate with immediate effect should it ascertain significant deficiencies in the Merchant's AML controls or the presence, in the Merchant's portfolio, of sub-merchants operating in prohibited sectors or in high-risk jurisdictions.

The wallet is a payment account held in the name of the user or the company and opened with Adyen. The balances shown in the platform represent the funds available at Adyen; they are not a bank deposit and do not bear interest.

Wallet-to-wallet transfers, including settling a payment link from the wallet, are executed in real time and are irrevocable once authorised: any refund must be agreed between the parties and issued as a new transaction. A payment link cannot be settled from the recipient's own wallet.

The fees applicable to each operation (collection, wallet, payout, currency conversion) are those of the price list active for the user, available in the platform, and are withheld at the time of the operation or of settlement.

Payouts to a bank account are executed by Adyen to the verified IBAN linked to the account; crediting times depend on the interbank network. Rox Pay may hold a payout for as long as needed to complete anti-fraud and anti-money laundering checks.

The user is responsible for safeguarding their credentials and two-factor authentication. Operations carried out with valid credentials are presumed to be attributable to the user, subject to evidence to the contrary; any suspected unauthorised access must be reported without delay to info@roxpay.eu.

Collections are credited to the payment account opened with Adyen according to the settlement times of the payment method and scheme used; unless otherwise agreed, settlement normally occurs within two business days of capture of the transaction. Those times are indicative, depend on Adyen, the schemes and the interbank systems, and are not an obligation of result on Rox Pay.

A payout to a bank account may be executed provided that: (a) a valid, verified transfer instrument (IBAN) is linked to the account; (b) the available balance, net of reserves and otherwise restricted amounts, is sufficient; (c) no Rox Pay fees or invoices are overdue and unpaid; (d) any anti-fraud and anti-money laundering checks under way have been completed.

Rox Pay may suspend or postpone a crediting or a payout for as long as is strictly necessary to complete the checks above, to comply with measures of public authorities or with Adyen's instructions, without this constituting a breach and without any obligation to pay interest. No interest accrues in favour of the user on balances or on temporarily restricted funds.

Access to the payout function may also be subject to an initial availability period, starting from the moment a processed-volume threshold determined by Rox Pay is reached. The threshold, its duration, and every other parameter of the payout function are set by Rox Pay under its own risk and operating policies and may be changed over time as provided in article 33; current values are available in the platform.

Interim states of a transaction — by way of example "pending", "initiated" or "authorised" — are not equivalent to a final collection. The Merchant shall deliver goods or supply services only after the transaction is settled; Rox Pay is not liable for losses arising from delivery against transactions that are not yet settled.

Certain payment methods, in particular bank transfers and payments initiated from a bank account, direct debits and deferred payments, may be rejected, revoked or corrected by the payment service provider even after a positive outcome has been reported. In such cases the transaction is restored to its actual state and the relevant amount, together with the related fees, is reversed.

The data shown in the platform — balances, transaction states, fees and reports — is for information purposes and is subject to reconciliation against the records of Adyen, the schemes and the other providers, which prevail in the event of a discrepancy. Rox Pay may at any time correct erroneous, duplicated or incomplete entries and recover amounts credited in error, including by debiting the balance.

In the event of a malfunction, unavailability of a provider or interruption of communications, the outcome of a transaction may remain temporarily unknown. Requests submitted with the same identifier are treated as a single transaction and do not give rise to a second charge: the Merchant shall check the actual state before repeating a transaction and shall report without delay any anomaly, duplication or unrecognised amount, and in any event within thirty days of the transaction date.

In addition to article 20, Rox Pay may require a security reserve, in an amount determined by reference to the risk profile, which remains restricted on the payment account and reduces the balance available for payouts and payments. The amount may be redetermined, upwards or downwards, as volumes, dispute rate, business sector, seasonality or business model change, on notice to the Merchant. The reserve may also be determined as a percentage of processed or collected amounts: the percentage, the cap, the duration and the release terms are set by Rox Pay's risk policies and may be changed over time as provided in article 33.

Rox Pay is entitled to set off its claims — fees and charges, refunds, chargebacks and related costs, advances granted, overdue invoices, amounts credited in error, penalties or fines imposed by schemes, processors or authorities in connection with the Merchant's activity — against the Merchant's available balances and against collections in the course of settlement, and to withhold payouts until they are fully covered.

Should the balance become negative, the Merchant shall restore it within five business days of request; upon expiry of that period without payment Rox Pay may suspend the Payment Services and take action to recover the debt, without prejudice to the indemnity obligation under article 20.

Upon termination of the relationship, for any reason, Rox Pay may retain the amounts needed to cover chargebacks, disputes, refunds and costs accrued or reasonably expected for the maximum dispute period allowed by the payment schemes, normally one hundred and eighty days, and in any event until pending matters are settled; the unused portion is released at the end of that period.

On an optional and discretionary basis, Rox Pay may make accelerated settlement available by advancing, out of its own funds, collections that are not yet settled. Activation is neither a credit facility nor a right of the Merchant and may be suspended or revoked at any time, including for individual transactions and without giving reasons.

The advance is subject to a maximum limit set by Rox Pay by reference to collections in the course of settlement and to the Merchant's historical volumes, to a single advance being outstanding at a time, and to the fee set out in the active price list, withheld at the time of the transaction.

By activating the feature the Merchant authorises Rox Pay to withhold and automatically collect from subsequent collections the amounts corresponding to the advance and its fee until they are fully repaid. The repayment obligation survives any chargeback, reversal, failed settlement or cancellation of the advanced transactions and, upon termination of the relationship, the outstanding amount becomes immediately due.

Rox Pay may set and change minimum and maximum limits per transaction, per payment method, per period and per beneficiary, by way of example for SEPA direct debits, wallet-to-wallet transfers, the maximum amount of a transaction and the amount available for accelerated payout. The limits in force are available in the platform or on request; changes required by security reasons, by the risk profile, by scheme requirements or by legal obligations apply with immediate effect.

Rox Pay continuously analyses operating and risk indicators, including refusal, refund and dispute rates, deviations in volumes and average transaction value, and behaviour consistent with card testing or fraudulent activity, and may as a result request information and documentation, restrict payment methods or volumes, create or increase the reserve under article 28 and suspend the service under article 21. Failure to exercise those rights in a given case is not a waiver.

The Merchant undertakes to give advance notice of material changes in expected volumes, business model, goods or services offered, sales channels and delivery methods, and to cooperate without delay with requests for clarification.

The Payment Services are provided with the professional diligence required, but continuous and uninterrupted availability of the platform, of the programming interfaces and of individual payment methods is not guaranteed, as it also depends on Adyen, the schemes, the banks and the other upstream providers. Unless specifically agreed in writing, no service levels and no penalties for unavailability are agreed.

Rox Pay may suspend access to the services in whole or in part for maintenance, whether scheduled with prior notice where possible or urgent and without notice, as well as where necessary to protect security, data integrity or the correct execution of transactions.

The Merchant acknowledges that the continuity of its own sales activity cannot rest on a single collection channel and undertakes to arrange alternative payment methods. To the extent permitted by law, Rox Pay is not liable for lost profit, sales not completed, fallback costs or other indirect damage arising from unavailability, malfunctions, authorisation refusals or interruptions attributable to third parties; the limitation of liability under article 9 continues to apply.

In the event of a malfunction Rox Pay shall use reasonable efforts to restore the service promptly and to reconcile the affected transactions in accordance with article 27. Features made available in trial, beta or pilot form are provided "as is", without warranty of operation, and may be changed or withdrawn at any time.

Rox Pay applies ongoing monitoring of the Merchant's risk profile based on operational and compliance indicators including, by way of example: transaction behaviour, refusal, refund and dispute rates, changes in volumes and average transaction value, business sector, sales channels, indications of fraud or abnormal activity, and compliance with documentation and information obligations.

Depending on the risk profile identified, Rox Pay may adopt proportionate temporary or permanent measures without this constituting an obligation to give prior notice or detailed justification where security, applicable law or payment-scheme requirements so require. Such measures may include, by way of example and without limitation: review or adjustment of applicable commissions, establishment or increase of a rolling reserve, delayed settlement of collections, operating limits on amounts, volumes, frequency or payment methods, requests for additional guarantees or documentation, enhanced monitoring, partial or total suspension of the Payment Services, and termination of the contract as provided in Articles 21 and 30.

Rox Pay will inform the Merchant, where reasonably possible, of the measures adopted and the conditions for their withdrawal or amendment. The Merchant acknowledges that Rox Pay does not guarantee fixed commission parameters, percentages, reserve amounts or operating thresholds: such elements may vary according to the risk profile and supervisory requirements, and failure to apply a measure in a specific case does not constitute a waiver of the right to apply it in other cases.

The operating parameters of the Payment Services — including, by way of example and without limitation: the threshold and duration of the initial payout availability period, the percentage, cap, duration and release terms of the reserves (rolling reserve and security reserve), settlement and crediting times, operating limits, risk thresholds, and the conditions of the optional features — are determined by Rox Pay under its own risk, compliance, and operating policies, also in consequence of the requirements of Adyen, of the payment schemes, and of the supervisory authorities.

Values that may be shown in the platform, in communications, or in commercial documentation are indicative only: they do not constitute promises, warranties, or binding contractual terms, and do not commit Rox Pay to maintaining them. The absence of a parameter or measure on a given profile does not preclude its later introduction.

Rox Pay may unilaterally change such parameters at any time. Changes are notified to the Merchant through the platform, by email, or by another durable medium and apply from the date stated in the notice; changes imposed by legal or supervisory obligations, by measures of public authorities, by the requirements of Adyen or of the payment schemes, or by security and risk-protection needs apply with immediate effect. Any advance notice given where not required by law is a courtesy measure only and creates no acquired right of the Merchant to the maintenance of the previous parameters.

Continued use of the Payment Services after notice of a change is deemed acceptance of it. A Merchant that does not intend to accept a change may cease using the Payment Services and withdraw from the contract by notifying Rox Pay, without penalties, without prejudice to the fulfilment of obligations arising prior thereto and to the application of the reserve and set-off provisions until pending matters are settled.

Certain services available on the Rox Pay platform — in particular the open banking features such as account information (AISP), payment initiation (PISP), and related services (by way of example: viewing balances and movements, initiating bank transfers, direct debits, and bank transfer payment links) — are also provided through the APIs and services of Fabrick S.p.A. By using those services the user acknowledges that part of the technical processing and execution is carried out by Fabrick as the payment service provider.

“Fabrick S.p.A. è un istituto di pagamento autorizzato dalla Banca d’Italia ad operare quale Account Information Service Provider (“AISP”) e Payment Initiation Service Provider (“PISP”) ai sensi della Direttiva 2015/2366/(UE) sui servizi di pagamento nel mercato interno, come successivamente implementata ai sensi del diritto nazionale, iscritta all’Albo degli Istituti di Pagamento con decorrenza 16 marzo 2020 con il codice 36780.5. Il reindirizzamento al sito di Fabrick non determina l’insorgere di alcun impegno in capo ai potenziali Clienti alla sottoscrizione di un contratto avente ad oggetto i Servizi Fabrick.”

To use those services the user may be redirected to Fabrick's website (www.fabrick.com) or to their bank's interfaces for authentication and consent. Use of the Fabrick Services is subject to Fabrick's terms and privacy notice, available in the Transparency section of its website (fabrick.com/it-it/trasparenza); solely as regards the relationship between the user and Fabrick — performance of the account information and payment initiation services and related obligations — Fabrick's terms prevail in the event of a conflict. Rox Pay remains the contact for these GTU and for the services it provides directly.