Terms of Service

These Terms of Service ("Terms") govern your access to and use of the GiroTap platform, APIs, JavaScript widgets, dashboards, and related services (collectively, the "Service") operated by CONFIG MONEY LIMITED, a company incorporated in England and Wales under company number 16474180, with its registered office at 124-128 City Road, London, EC1V 2NX, United Kingdom ("GiroTap", "we", "us", or "our"). Please read these Terms carefully before using the Service.

1. Acceptance of Terms

By registering for a GiroTap account, integrating the Service into your website or application, or otherwise accessing or using any part of the Service, you ("Merchant", "you", or "your") agree to be legally bound by these Terms, the associated Data Processing Agreement, the Privacy Policy, and any other policies referenced herein. If you do not agree to any part of these Terms, you must not access or use the Service.

If you are entering into these Terms on behalf of a legal entity, you represent and warrant that you have the authority to bind that entity, and references to "you" include both you personally and that entity.

2. Definitions

In these Terms, unless the context requires otherwise, the following terms have the meanings set out below:

• "Customer" means an end user who initiates a payment to a Merchant through the Service.
• "Mandate" means a SEPA Direct Debit mandate granted by a Customer to a Merchant (and, by extension, to GiroTap and its processing partners) authorising the collection of funds from the Customer's bank account in accordance with the SEPA Core Direct Debit Scheme Rulebook.
• "SEPA Direct Debit" or "SDD" means the Single Euro Payments Area Direct Debit scheme operated under the rulebooks published by the European Payments Council.
• "Evidence Bundle" means the cryptographic record assembled by the Service in connection with a Customer's authorisation of a payment, including biometric attestations, passkey signatures, timestamps, device metadata, and related artefacts used to defend against chargeback claims.
• "Widget" means the JavaScript component provided by GiroTap that Merchants embed on their checkout surfaces to initiate payments.
• "Merchant Account" means the administrative account created by or on behalf of a Merchant through which the Merchant accesses the Service.
• "Payment" means a SEPA Direct Debit collection initiated through the Service on behalf of a Merchant.
• "Processing Partner" means any third-party financial institution, payment service provider, or open banking provider engaged by GiroTap to deliver elements of the Service, including but not limited to those listed in Section 11.
• "Applicable Law" means all laws, regulations, and binding scheme rules relevant to the provision and use of the Service, including the Payment Services Regulations, PSD2, the SEPA Regulation, UK and EU anti-money laundering and consumer protection legislation, and data protection laws.

3. Description of the Service

GiroTap provides a payment acceptance platform that enables European merchants to collect funds from Customers by way of SEPA Direct Debit. The Service comprises:

• A JavaScript Widget and REST API through which Merchants initiate Payments.
• A consent and authentication flow in which Customers authorise Payments using biometric verification and passkey-based cryptographic signatures.
• A Mandate management layer that creates, stores, and references SEPA Direct Debit mandates.
• An Evidence Bundle service that assembles cryptographic records of Customer authorisation for use in chargeback defence.
• A merchant dashboard providing Payment status, reporting, webhook configuration, and operational controls.

GiroTap is a technology provider. GiroTap does not itself hold Customer funds; the underlying movement of money is carried out by one or more regulated Processing Partners in accordance with the SEPA scheme and relevant Applicable Law.

4. Eligibility

To use the Service, you must:

• Be a legal entity validly incorporated and in good standing in a jurisdiction within the European Economic Area, the United Kingdom, or another jurisdiction that we expressly approve in writing.
• Operate a bona fide business that sells goods or services lawfully to Customers in the SEPA zone.
• Have the legal capacity and authority to enter into these Terms and to accept Payments via SEPA Direct Debit.
• Complete our onboarding, know-your-customer ("KYC"), know-your-business ("KYB"), and anti-money laundering ("AML") checks, including providing accurate information about your ultimate beneficial owners, directors, company documentation, and business model.
• Maintain a legitimate SEPA-eligible bank account in the name of the business for settlement.

We may, in our sole discretion, refuse, suspend, or revoke eligibility at any time, including where we determine that continuing to provide the Service to you would expose GiroTap or any Processing Partner to legal, financial, operational, or reputational risk.

5. Account Registration and Security

You must provide accurate, current, and complete information when creating your Merchant Account, and you must update that information promptly if it changes. You are responsible for safeguarding your login credentials, API keys, webhook secrets, and any other authentication factors issued to you, and for all activity that occurs under your Merchant Account, whether or not authorised by you.

You must notify us without undue delay at sales@girotap.com if you become aware of any unauthorised access to, use of, or compromise of your Merchant Account or credentials. You must not share production API keys with any third party other than a vendor bound by appropriate confidentiality obligations and acting on your behalf.

6. Merchant Obligations

You agree that, at all times while you use the Service, you will:

• Provide accurate and complete data about Customers, transactions, and underlying commercial relationships, and not misrepresent the nature or purpose of any Payment.
• Use the Service only for lawful purposes and only to collect funds owed to you by Customers for genuine goods or services you have delivered or agreed to deliver.
• Comply with all Applicable Law, including consumer protection, distance selling, e-commerce, advertising, anti-money laundering, counter-terrorism financing, and economic sanctions laws.
• Adhere to the SEPA Core Direct Debit Scheme Rulebook and any related scheme rules in force from time to time, including mandate issuance, pre-notification, and refund handling requirements.
• Clearly display your legal name, contact details, refund policy, terms of sale, privacy policy, and any other information required to be provided to Customers under consumer law.
• Obtain freely given, informed, specific consent from each Customer before initiating any Payment, and retain records sufficient to demonstrate such consent where the Evidence Bundle does not already cover the relevant interaction.
• Promptly respond to Customer inquiries, disputes, and refund requests, and not use the Service to frustrate legitimate consumer rights.
• Maintain accurate books and records of transactions processed through the Service for the periods required by Applicable Law.
• Cooperate with any reasonable request from GiroTap or a Processing Partner for information or documentation required for compliance, audit, risk review, or regulatory purposes.

7. Permitted and Prohibited Uses

You must not use the Service, directly or indirectly, in connection with any of the following activities or categories:

• Any activity that is illegal under Applicable Law or that facilitates illegal activity by another party.
• Sale or distribution of controlled substances, narcotics, or prescription pharmaceuticals without proper licensing.
• Sale of weapons, explosives, ammunition, or related accessories, where restricted by law.
• Unlicensed gambling, lotteries, betting, or sweepstakes.
• Adult content or services that are illegal in the Customer's jurisdiction, and in all cases any content depicting minors or non-consensual acts.
• Sale of counterfeit, stolen, or infringing goods, or any product sold in violation of third-party intellectual property rights.
• Ponzi schemes, pyramid schemes, matrix programmes, multi-level marketing schemes with pay-to-join structures, and other get-rich-quick or high-yield investment programmes.
• Unregistered money services businesses, unlicensed virtual asset service providers, cash-for-crypto exchanges, and other activities requiring licensing that you do not hold.
• Businesses sanctioned by any government or international body with jurisdiction over GiroTap or any Processing Partner, or transactions involving sanctioned persons, territories, or goods.
• Any business category that GiroTap or a Processing Partner determines to be on the Mastercard MATCH list, the Visa Global Brand Protection Programme, or equivalent card-scheme risk lists, or any activity that would be prohibited if the card schemes applied.
• Activities that generate disproportionate levels of chargebacks, complaints, or fraud relative to volume.
• Attempts to circumvent, probe, reverse engineer, or disrupt the Service, its security controls, or the infrastructure on which it runs.
• Resale or sublicensing of the Service, or provision of payment services to sub-merchants, without our prior written consent.

We may investigate suspected violations of this Section, request additional information from you, and, if appropriate, suspend or terminate your access to the Service and report the matter to competent authorities.

8. Fees and Payment

During the private beta, use of the Service may be made available without charge or at preferential rates agreed in writing between you and GiroTap. Commercial pricing for general availability will be communicated in advance and will be set out in an order form, pricing schedule, or similar document.

Once commercial pricing is in effect, you agree to pay all fees, charges, and reimbursable amounts associated with your use of the Service, including per-transaction fees, monthly subscription fees (if any), fees levied by Processing Partners that we pass through, returned-item fees, chargeback handling fees, and any applicable taxes. Unless otherwise agreed, fees are invoiced in Euro (EUR) and may be deducted from funds settled to you or invoiced separately.

You are responsible for any taxes imposed on your use of the Service, except for taxes on GiroTap's net income. Fees are exclusive of VAT, which will be added where applicable.

9. Mandates and Direct Debit Processing

Payments are collected under SEPA Direct Debit Mandates established through the Service. Each Mandate authorises the Merchant (and GiroTap acting on the Merchant's behalf through a Processing Partner) to debit the Customer's bank account for specified amounts in accordance with the SEPA Core Direct Debit Scheme Rulebook.

You acknowledge and agree that:

• You are the creditor of record for Payments initiated under Mandates created through your Merchant Account, and you bear the underlying legal and commercial relationship with the Customer.
• You must provide the Customer with a pre-debit notification that complies with the SEPA Core Direct Debit Scheme Rulebook (typically at least one day before collection, unless an alternative period has been agreed with the Customer in accordance with the rulebook). Where GiroTap offers a pre-notification feature, you remain responsible for ensuring that the notification content and timing are correct for your business.
• You must not modify, reuse, or present Mandates for purposes other than those to which the Customer consented.
• Mandates may expire, lapse, or become invalid in accordance with scheme rules (for example, where no collection has occurred within 36 months), and you may need to obtain a fresh Mandate from the Customer before resuming collections.
• Returned direct debits, rejections, and reversals are a normal part of SEPA processing. You are responsible for the gross and net financial consequences of any returned or reversed Payment, including associated fees.

10. Chargebacks, Refunds, and Disputes

Under the SEPA Core Direct Debit scheme, a Customer is entitled to request a no-questions-asked refund from their bank for up to eight (8) weeks from the date on which the Customer's account was debited. For unauthorised collections (for example, where no valid Mandate existed), the Customer may request a refund for up to thirteen (13) months from the debit date. These refund rights are established by the SEPA scheme and cannot be waived by the Merchant.

Where a Payment is refunded, reversed, or successfully disputed, the corresponding amount, together with any associated return or handling fees, will be recovered from you. We may recover such amounts by deducting them from future settlements, by invoicing you, or by direct debit from your nominated bank account.

For unauthorised-claim disputes within the 13-month window, GiroTap will make available the relevant Evidence Bundle and supporting metadata to help you demonstrate that the Payment was authorised by the Customer. While a well-formed Evidence Bundle (including biometric attestations and passkey signatures) can provide a strong defence, GiroTap makes no guarantee regarding the outcome of any dispute, and the final decision rests with the Customer's bank and the applicable scheme participants. You remain responsible for the ultimate financial outcome of all disputes.

You agree to maintain chargeback and dispute rates at levels that we reasonably consider acceptable. We may impose reserves, additional verification, or other risk controls, or may suspend or terminate the Service to you, if your rates exceed these levels.

11. Third-Party Services

The Service relies on components and capabilities provided by third parties, including (without limitation):

• Paynovate and/or other regulated payment institutions, which provide SEPA Direct Debit scheme access and settlement rails.
• Lunchflow, GoCardless, and/or other authorised open banking providers, which provide PSD2 account information and bank linking services used during onboarding and Mandate creation.
• TrulyYou, which provides biometric enrolment and verification infrastructure used within the consent flow.
• Infrastructure, hosting, email, monitoring, and analytics vendors required to operate the Service securely.

Your use of the Service may be subject to terms, policies, or technical requirements imposed by these Processing Partners. We will use reasonable efforts to communicate material requirements to you. GiroTap is not responsible for the acts or omissions of third parties outside its reasonable control, although we will work in good faith with Processing Partners to resolve issues that materially affect the Service.

We may substitute, add, or discontinue Processing Partners from time to time. Where such a change materially affects your use of the Service, we will use reasonable efforts to give you advance notice.

12. Intellectual Property

GiroTap and its licensors retain all right, title, and interest in and to the Service, including all software, APIs, documentation, user interfaces, trademarks, logos, designs, workflows, and know-how embodied in it, and all improvements, derivative works, and feedback relating thereto. No rights are granted to you other than the limited, non-exclusive, non-transferable, revocable licence to access and use the Service during the term of these Terms for the sole purpose of accepting Payments from your Customers in accordance with these Terms.

You retain all right, title, and interest in and to the content and data you submit to the Service, including your customer records, branding assets, and business content ("Merchant Data"). You grant GiroTap a worldwide, non-exclusive, royalty-free licence to host, process, transmit, display, and otherwise use Merchant Data solely to provide, secure, maintain, and improve the Service, to comply with Applicable Law, and to enforce these Terms.

You may not, and may not permit any third party to: (a) copy, modify, translate, or create derivative works of the Service; (b) reverse engineer, decompile, or disassemble any part of the Service, except to the extent such restriction is prohibited by Applicable Law; (c) remove or obscure any proprietary notices; or (d) use the Service to build a competing product or service.

13. Confidentiality

Each party may receive non-public information belonging to the other in connection with these Terms ("Confidential Information"), including technical, commercial, financial, product, and customer information. Each party agrees to: (a) use the Confidential Information of the other solely to exercise its rights and perform its obligations under these Terms; (b) protect such information with at least the same degree of care it uses to protect its own confidential information (and in no event less than reasonable care); and (c) not disclose such information to any third party except to employees, contractors, and advisers who need to know it and who are bound by confidentiality obligations no less protective than those in this Section.

The obligations in this Section do not apply to information that: (i) is or becomes publicly available other than through a breach of these Terms; (ii) was lawfully known to the receiving party before disclosure; (iii) is independently developed without reference to the disclosing party's Confidential Information; or (iv) is required to be disclosed by law, regulation, or court order, provided that the receiving party gives reasonable advance notice (where permitted) to allow the disclosing party to seek protective measures.

14. Data Processing and Privacy

GiroTap processes personal data relating to you and to your Customers in connection with the Service. Our processing of personal data is governed by our Privacy Policy and, where GiroTap acts as a processor on your behalf, by the Data Processing Agreement ("DPA") incorporated into these Terms by reference.

You are responsible for ensuring that you have a lawful basis for providing Customer personal data to the Service, for providing Customers with the information required under data protection law, and for respecting Customer rights in relation to their personal data. You warrant that any personal data you submit to the Service has been collected and shared with us in compliance with Applicable Law.

GiroTap implements technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, and will notify you of personal data breaches affecting Merchant Data in accordance with the DPA.

15. Warranties and Disclaimers

Each party warrants that it has the legal authority to enter into these Terms and to perform its obligations under them.

GiroTap warrants that it will provide the Service with reasonable skill and care and in a manner consistent with generally accepted industry practice for comparable services. Subject to this Section, the Service is provided on an "as is" and "as available" basis. To the maximum extent permitted by Applicable Law, GiroTap disclaims all other warranties, express, implied, statutory, or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, non-infringement, title, and any warranties arising from a course of dealing or usage of trade.

Without limiting the foregoing, GiroTap does not warrant that the Service will be uninterrupted, error-free, or secure, that defects will be corrected, that the Service will meet your specific requirements, or that any particular Payment will settle, clear, or avoid reversal. During the private beta period, you acknowledge that the Service may contain bugs, incomplete features, or behaviour that is still under active development.

16. Limitation of Liability

Subject to the remainder of this Section, to the maximum extent permitted by Applicable Law:

• Neither party shall be liable to the other for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, anticipated savings, business, goodwill, opportunity, or data, even if advised of the possibility of such damages.
• GiroTap's aggregate liability to you arising out of or in connection with these Terms, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed the greater of (i) the total amount of fees paid by you to GiroTap in the twelve (12) months immediately preceding the event giving rise to the claim; and (ii) one thousand euro (€1,000).

Nothing in these Terms excludes or limits either party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) any liability that cannot be excluded or limited by Applicable Law; or (d) payment obligations that are expressly set out in these Terms or any applicable order form.

17. Indemnification

You agree to defend, indemnify, and hold harmless GiroTap, its affiliates, and their respective officers, directors, employees, and agents from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising out of or related to: (a) your breach of these Terms or any Applicable Law; (b) the goods or services you sell to Customers, including any consumer claims relating to quality, delivery, description, or refund rights; (c) disputes between you and any Customer; (d) any Merchant Data you submit to the Service; and (e) your unauthorised or improper use of Mandates or the Service.

We will promptly notify you of any claim for which we seek indemnification, give you reasonable control over the defence and settlement of the claim (provided that you may not settle any claim that admits liability on our behalf without our prior written consent), and provide reasonable cooperation in the defence.

18. Term and Termination

These Terms take effect when you first accept them or first use the Service and remain in force until terminated in accordance with this Section.

You may terminate these Terms at any time by closing your Merchant Account through the dashboard or by giving us written notice at sales@girotap.com. We may terminate these Terms or suspend your access to the Service:

• Immediately, on notice, if you materially breach these Terms and (where the breach is capable of remedy) fail to remedy it within a reasonable period specified by us.
• Immediately, with or without notice, if we reasonably believe that continued provision of the Service to you would expose GiroTap, any Processing Partner, or any Customer to legal, financial, operational, or reputational risk, or would cause GiroTap to breach Applicable Law or scheme rules.
• At any time during the private beta, with reasonable notice, if we decide to change, pause, or discontinue the beta programme.
• For convenience, on thirty (30) days' written notice once the Service is generally available, unless a longer notice period has been separately agreed.

On termination, your right to access and use the Service ceases immediately, and you must remove all GiroTap Widget code and API integrations from your systems. Termination does not affect accrued rights or liabilities of either party, and any provision that by its nature should survive termination (including Sections on fees, intellectual property, confidentiality, data processing, warranties, liability, indemnification, and governing law) will continue in force.

19. Force Majeure

Neither party shall be liable for any failure or delay in performance (other than payment obligations) caused by events beyond its reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, strikes, epidemics, pandemics, government action, sanctions, failures of the internet or telecommunications networks, failures of Processing Partners, or the unavailability of financial market infrastructure. The affected party will use reasonable efforts to resume performance as soon as practicable.

20. Governing Law

These Terms and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with them or their subject matter or formation are governed by and construed in accordance with the laws of England and Wales.

21. Dispute Resolution

The parties will attempt in good faith to resolve any dispute arising out of or relating to these Terms by negotiation between senior representatives within thirty (30) days of written notice of the dispute. If the dispute is not resolved within that period, each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle it, except that GiroTap may bring proceedings in any jurisdiction where you are located in order to protect its intellectual property rights or to enforce a judgment.

Nothing in this Section prevents either party from seeking urgent interim or injunctive relief in any court of competent jurisdiction.

22. Changes to These Terms

We may update these Terms from time to time to reflect changes to the Service, to Applicable Law or scheme rules, or to our operational requirements. When we make material changes, we will provide reasonable advance notice, for example by email to the address associated with your Merchant Account or by a notice in the dashboard. Changes become effective on the date stated in the notice, and your continued use of the Service after that date constitutes acceptance of the updated Terms. If you do not agree to the changes, you must stop using the Service and may terminate your Merchant Account in accordance with Section 18.

23. General

These Terms, together with the Privacy Policy, the DPA, and any order form or schedule expressly incorporated by reference, constitute the entire agreement between you and GiroTap regarding the Service and supersede any prior agreements, understandings, or representations on the same subject. If any provision of these Terms is held to be invalid or unenforceable, that provision will be enforced to the maximum extent permitted and the remaining provisions will remain in full force and effect. No failure or delay by either party in exercising any right under these Terms constitutes a waiver of that right. You may not assign or transfer these Terms without our prior written consent; we may assign these Terms to an affiliate or in connection with a merger, acquisition, or sale of all or substantially all of our assets. No person who is not a party to these Terms has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of these Terms.

24. Contact

If you have any questions about these Terms, or if you need to send any legal notice, please contact us at sales@girotap.com.