We will keep all registered user information confidential.

                     Information saved or not submitted to us and the Card
                     Member by the registered user will be stored securely for 30
                     days prior to being destroyed. Access to such data will be
                     granted only to the registered user. Saved responses and
                     unsubmitted results will be confidentially maintained by Card Co.
                     only. However, Card Co. may collect statistical summaries that do
                     not identify individual responses for general management
                     information purposes (such as performance monitoring and
                     capacity planning).

                     Upon the registered user's election to submit the results of its
                     self-assessment to Card Co. and its identified Card Member the data
                     will be considered confidential. Card Co. or the Card Member may
                     take the necessary steps needed to enforce compliance with
                     the Account and Transaction Information Security Standards
                     Manual.

                     It is the responsibility of each registered user who identifies
                     itself as a merchant to identify its Card Co. and other Card Member
                     accurately. Only the Card Member identified by the registered
                     user may receive submitted information. Card Co. is not
                     responsible for the accuracy of the information submitted by the
                     registered user or liable for reputation or financial losses resulting
                     from information delivered to a Card Member as provided by the
                     registered user if inaccurate.

                     For non merchant businesses that provide services to more
                     than one Member, upon election to submit results, those
                     results may be provided to all Members identified by the
                     Net Processor Registration and Designation form or the
                     nonmember Agent Registration Form, as defined by the id
                     provided by the user in the Self Assessment ID number
                     provided in the Self Assessment ID Registration Form.

                     It is the responsibility of the non merchant business to ensure
                     the information submitted annually on the Net Processor
                     Registration and Designation form or the nonmember Agent
                     Registration Form is updated and accurate.