 Protection of Cardholder Data and Customer Data Chase Paymentech has implemented various measures, including appropriate administrative, technical and physical safeguards, designed to ensure the security and confidentiality of Cardholder Data and Customer Data, protect against anticipated threats or hazards to the security or integrity of such information, and protect against unauthorized access to or use of such information. Such measures may include, among others, encryption, physical access security and other appropriate technologies. Chase Paymentech continually reviews and enhances its security systems, as necessary. Chase Paymentech is subject to the detailed rules and regulations of the various credit and debit card organizations and networks (i.e. VISA, MasterCard, American Express, NYCE, Star, etc.), relating to the security and safeguarding of Cardholder Data, including, but not limited to, the Payment Card Industry Data Security Standards (""PCI""), VISA Inc.'s Cardholder Information Security Program (""CISP"") and MasterCard International's Site Data Protection Program (""SDP""). Chase Paymentech endeavors to comply with all such rules at all times. Pursuant to such rules and regulations, Chase Paymentech is required to undergo periodic third-party assessments and periodic network scans to ensure that, among other things, Chase Paymentech has installed and maintains a firewall configuration to protect data; does not use vendor-supplied defaults for system passwords and other security parameters; protects stored data; encrypts transmission of Cardholder Data and sensitive information across public networks; uses and regularly updates anti-virus software; develops and maintains secure systems and applications; restricts access to data to those with a business need-to-know; tracks and monitors all access to network resources and Cardholder Data; regularly tests security systems and processes; assigns a unique ID to each person with computer access; restricts physical access to Cardholder Data; and maintains a policy that addresses information security. Additional information regarding the requirements of VISA's CISP and Mastercard's Site Data Protection program (SDP) can be found on the VISA, Inc. and MasterCard International Web sites. 