Pöördumine

REGISTRATION AND APPLICATION FORM Registration date: 18.05.2022 Organisation Information Organisation number: 74000091 Organisation name: EESTI HAIGEKASSA Address: Lastekodu tn 48 Postal code/area: 10113 Kesklinna linnaosa Telephone number: +372 6208430 The person who will sign the contract (Contract Signer) Full name: Rain Laane Job title: Director General Mobile number: +37 26208430 Email address: [email protected] The person applying for this certificate (Certificate Applicant) Full name: Jaak Vaabel Mobile number: +37 27943900 Email address: [email protected] The person who is authorised to verify the identity of the organisation (Organisation's Authorised Representative) Full name: Rain Laane Mobile number: +37 26208430 Email address: [email protected] Method for personal attendance: Registered mail (REK) Address: Eesti Haigekassa, Tallinn, Lastekodu 48 Country: EE Postal code/area: 10113 TALLINN Registration and application form-74000091-1579651.pdf 1/2  Order information Order number: 1579651 Order date: 18.05.2022 Product: QC eSeal Type: Customer generated key (csr) Validity period: 3 years Price QC eSeal: 500 EUR Price: 500 EUR Information on your certificate Organization (O): EESTI HAIGEKASSA Organisational Unit (OU): EHK Common Name (CN): LVE-RINA01.eessilive.ee INT HK Business By signing this document I confirm: That all information in this document is correct That the Subscriber agreement for Buypass Class 3 Enterprise certificates has been read and accepted The identity of the organisation requires the use of an electronic signature (satisfying the relevant legislation in your country), or that the Organisation's Authorised Representative is authorised to verify the identity of the organisation Place/date Signature Rain Laane (Contract Signer) Send signed form on mail or email to Buypass: Buypass AS - Customer Service, Postboks 639, N-2810 Gjøvik, email: [email protected] Registration and application form-74000091-1579651.pdf 2/2  SUBSCRIBER AGREEMENT - BUYPASS CLASS 3 ENTERPRISE CERTIFICATES MAIN PART OF THE SUBSCRIBER AGREEMENT (PART 1) 1 INTRODUCTION This document (Part 1), along with the Registration Form (Part 2), the Application Form for Buypass Class Enterprise Certificates (Part 3) and the Certification Practice Statement for Buypass Class 3 Enterprise Certificates (Part 4) constitutes the Subscriber Agreement for Buypass Class 3 Enterprise Certificates. The Registration Form and the Application Form can be combined to make a joint Registration and Application Form, which would then constitute both Parts 2 and 3 of the agreement. Buypass Class 3 Enterprise Certificates includes Qualified Certificate for electronic Seal (QC eSeal and QC eSeal for PSD2). For Buypass Qualified Certificates for electronic Seals the PKI Disclosure Statement (Part 5) also constitutes a part of the Subscriber Agreement. Please refer to the other documents for the technical specifications and details of the Enterprise Certificate's features. For further information, please refer to Buypass Web. This document (the main part of the Subscriber Agreement) constitutes Part 1 of the Subscriber Agreement between the Subscriber and Buypass. The Registration Form (Part 2) contains subscriber-specific agreement information and a signature. The Application Form (Part 3) contains certificate-specific agreement information. The Registration and Application Form contain both subscriber-specific and certificate-specific agreement information. The terms and conditions contained in this document (Part 1) shall apply unless exceptions to one or more of the terms and conditions have been made in the Registration Form (Part 2). The Subscriber may enter into more than one agreement with Buypass for Enterprise Certificates. The Subscriber may authorise natural persons and/or Partners to apply for, manage and use Enterprise Certificates on behalf of the Subscriber. The roles which can be assigned to natural persons by the Subscriber are hereafter referred to as Contract Signer, Authorized Officer, Certificate Manager, Certificate Applicant and Subject Sponsor. The Certificate Applicant role may be assigned to a Partner. These authorisations must be stated on the Registration Form (Part 2) and may apply to all future applications until authorisation is withdrawn if this is specified in the Registration Form. Buypass shall deal with the Subscriber as a contractual party, and the Subscriber shall be responsible for any actions carried out by the Subscriber's Certificate Managers, Certificate Applicants and Subject Sponsors. 2 DEFINITIONS Term Abbreviation Description Application Form The Application Form contains certificate-specific information and is (Part 3 of the Subscriber conditional on the Registration Form (Part 2). Agreement) Authorization Code Secret code used to ensure physical presence of Authorised Subscriber Representative in case of Subscriber generated Private Key. Authorization Number A unique identifier of a Payment Service Provider acting as the Subscriber for PSD2 Certificates. The Authorization Number is used and recognized by the NCA. Authorized Officer Authorized Subscriber Representative who has authority on behalf of Subscriber to confirm the identity of the Subscriber by physical presence according to article 24 of the Regulation (EU) No 910/2014. The Contract Signer may act as Authorized Officer. Copyright © Buypass AS 2019 Page 1 of 7  Version 8.0 – 03.06.2019 Term Abbreviation Description Authorized Subscriber Natural persons assigned the roles Certificate Manager, Certificate Representatives Applicant and Subject Sponsor and/or Partners assigned the role Certificate Applicant. Buypass Web Websites operated by Buypass, i.e. www.buypass.no and www.buypass.com. Certificate Applicant Authorized Subscriber Representative who has authority to submit a Certificate Application on behalf of the Subscriber. Central Coordinating Norwegian national register containing basic data (e.g. Organization name Register for Legal Entities and Organization Number) about legal persons to coordinate information on business and industry that resides in various public registers (‘Enhetsregisteret’). Certificate Manager Authorized Subscriber Representative who has the authority to (i) act as a Certificate Applicant and (ii) to authorize other employees or third parties to act as a Certificate Applicant. Certificate Policy CP Named set of rules that indicates the applicability of a Certificate to a particular community and/or class of application with common security requirements. Certification Practice CPS Statement of the practices which a Certificate Authority employs in issuing Statement Certificates (Part 4 of the Subscriber Agreement) Certificate Signing CSR An electronic request that contains the Subscriber's Public Key to which Request the Certificate is to be associated. In this document, a Certificate Signing Request denotes a PKCS#10 formatted request that is submitted by a Subscriber as part of a Certificate Application. Contract Signer Authorized Subscriber Representative who has authority on behalf of Subscriber to sign Subscriber Agreements. Distribution Key Secret key that protects access to CA generated Subject Private keys during Soft Token distribution from CA to Subject Sponsor. Enterprise Certificate or Public Key of a user, together with other information, rendered unforgeable Buypass Class 3 by encipherment with the Private Key of the certificate authority which Enterprise Certificate issued it. An Enterprise Certificate may also be issued as a Qualified Certificate for electronic Seal. European Business EBR The European Business Register is a network of National Business Register Registers and Information Providers in European Countries containing basic data (e.g. Organization name and Organization Number) about legal persons operating in these countries. EBR includes the Norwegian Central Coordinating Register for Legal Entities (“Enhetsregisteret”). Hard Token A secure user device protecting the Private Keys. In this document, the Hard Token is a smart card if Buypass generates the Private Key and an HSM if the Subscriber generates the Private Key. National Competent NCA A national authority responsible for payment services. The NCA approves Authority or rejects authorizations for Payment Service Providers in its country. Organization The legal person acting as the Subscriber Organization’s Authorized See Authorized Officer Representative Organization number Unique registration number identifying a legal person. Assigned by a national authority in the jurisdiction where the legal person operates. Partner A legal person given the authority to assign natural persons as Authorized Subscriber Representatives on behalf of one or more Subscribers through the initial Subscriber Registration. The legal person must have signed a Contractual agreement with Buypass before acting as a Partner. The Partner's role is regulated by the Registration Form (Part 2). PKI Disclosure Statement PDS A document that supplements a CPS by disclosing important information about the policies and practices of a CA. A PDS is a vehicle for disclosing Copyright © Buypass AS 2019 Page 2 of 7  Version 8.0 – 03.06.2019 Term Abbreviation Description and emphasizing information normally covered in detail by associated CPS documents. For Qualified Certificate for electronic Seal the PDS constitutes Part 5 of the Subscriber Agreement. Private key The key of a key pair that is kept secret by the holder of the key pair, and that is used to create Digital Signatures and/or to decrypt electronic records or files that were encrypted with the corresponding Public Key. Only authorized users should have access to the Private Key. Public key The key of a key pair that may be publicly disclosed by the holder of the corresponding Private Key and that is used by a Relying Party to verify Digital Signatures created with the holder's corresponding Private Key and/or to encrypt messages so that they can be decrypted only with the holder's corresponding Private Key. PSD2 Certificate PSD2 QC A Qualified Certificate for electronic Seal meeting regulatory requirements eSeal for PSD2 and the Regulatory Technical Standard. Payment Service Provider PSP An organization authorized to provide payment services to customers. Registration and A form which contains both general information about the Organization Application Form (subscriber-specific information) and application specific information. (Parts 2 and 3 of the Subscriber Agreement) Registration Form A form which contains general information about the Organization, (Part 2 of the Subscriber including authorisations for the Authorised Subscriber Representatives. Agreement) Revocation Revocation of an Enterprise Certificate during its lifetime, i.e. when the Enterprise Certificate is no longer valid for some reason and must no longer be used. Qualified Certificate QC See Qualified Certificate for electronic Seal Qualified Government QGR Any Authoritative Source provided by a Government Entity containing Register basic information about legal persons operating in the Government’s jurisdiction. The basic information includes the full name of the legal person, an Organization Number and a business and/or postal address for the legal person. All registers in EBR are QGRs. QGRs hold information about legal persons as required by national legislation. Qualified Certificate for QC eSeal An Enterprise Certificate that meets the requirements to Qualified electronic Seal Certificates for electronic seals according to the eIDAS regulation (Regulation (EU) no 910/2014). Soft Token If Buypass generates the Private Key, this is an encrypted file protecting the Private Keys during distribution from the CA to the Subject Sponsor. The file is a PKCS#12 file encrypted with a Distribution Key. If the Subscriber generates the Private Key, this represents a key store controlled by the Subscriber. Subject Sponsor Authorized Subscriber Representative who has privileges to undertake the Subject’s obligations under this policy whenever the Subject is a non- human entity. The Subject Sponsor may receive the Distribution Key or Authorization Code. Subscriber An Organization to whom an Enterprise Certificate has been issued by Buypass and who is authorised to use the private key corresponding to the Enterprise Certificate. Suspension Temporarily revocation of an Enterprise Certificate during its lifetime, i.e. when it is unclear whether a valid revocation reason exist or the revocation request can not be processed in due time. 3 AGREEMENT PROCESS Subscribers must apply for Enterprise Certificates online on Buypass web or by alternative means as specified by Buypass. Copyright © Buypass AS 2019 Page 3 of 7  Version 8.0 – 03.06.2019 The Registration Form (Part 2) is generated during the registration process before the Application Form (Part 3) is generated during the application process. The Registration Form must be signed by the Contract Signer. If authority is delegated to a Partner, this must be stated on the Registration Form (Part 2). When the Subscriber has previously filled in and sent the Registration Form (Part 2) to Buypass, a signature from the Certificate Manager or Certificate Applicant on an Application Form (Part 3) is sufficient for applying for Enterprise Certificates. A combined Registration and Application Form is generated when the application is placed, and must be signed by the Contract Signer. All subsequent applications requires a signed Registration and Application Form. Signed forms must be sent to Buypass by post or e-mail to the contact specified on the forms. In order to comply with Buypass' security requirements on issuing Enterprise Certificates, whoever signs the Registration Form on behalf of the Subscriber (Contract Signer) must be authorised to sign agreements/contracts on behalf of the Subscriber. The Contract Signer may authorise a natural person to appoint Certificate Applicants and to apply for Enterprise Certificates (Certificate Manager). Such authorisations shall be given on the Registration Form (Part 2). Authorisation shall apply until it is withdrawn, cf. Item 6. The Contract Signer or the Certificate Manager may authorise a natural person or a Partner to apply for Enterprise Certificates (Certificate Applicant). Such authorisations shall be given on the Registration Form. Authorisation shall apply until it is withdrawn if this is specified in the Registration Form, cf. Item 6. For Qualified Certificates for electronic Seals, the Subscriber authorizes a natural person to confirm the identity of the Subscriber by physical presence through the Subscriber Agreement (Authorized Officer). Buypass will verify the contents upon receipt of the Registration Form, the Application Form and the Registration and Application Form. The verifications are described in Part 4 of the Subscriber Agreement. The Subscriber shall inform the Authorised Subscriber Representatives about obligations incurred by the Subscriber under the Subscriber Agreement. 4 THE SUBSCRIBER'S RESPONSIBILITIES AND RIGHTS 4.1 Introduction Enterprise Certificates are inseparably linked to the Organization (Subscriber). The Subscriber is responsible for ensuring that Enterprise Certificates are not misused by the Subscriber's representatives. The Subscriber is also responsible for ensuring that Enterprise Certificates are used in accordance with current legislation and the terms and conditions contained in this document. The Subscriber is responsible for using the Enterprise Certificate only for the purposes stated in this agreement. 4.2 Registration of the Subscriber The Subscriber shall undertake to provide complete and correct information upon registration. This shall also apply when Buypass requests additional information or documentation during validation of the registered information. For QC eSeals, the Subscriber designates the Authorized Officer to confirm the identity of the Subscriber by physical presence or by using methods which provide equivalent assurance in terms of reliability to physical presence. The Subscriber must ensure that the Authorised Officer is authorised according to the requirements in the eIDAS regulation (Regulation (EU) no 910/2014). For PSD2 QC eSeals, the Subscriber must have been granted the authorization to act as a PSP in the ‘applied for’ PSP roles by a National Competent Authority (NCA) in the country the Subscriber operates as a PSP according to the PSD2 legislations. If the Subscriber is assigned a specific Authorization Number by the NCA, this must be specified at time of registration and application. The Subscriber shall undertake to inform Buypass immediately if the information provided is no longer correct. 4.3 Applying for Enterprise Certificates When the Subscriber generates the key the Subscriber will need to have the private and public key generated prior to applying. The public key is included in the application. The Subscriber shall undertake to keep and protect the private key in a suitable manner at all times. The Subscriber shall undertake to provide complete and correct information in the application. This shall also apply when Buypass requests additional information or documentation during validation of the application. The Subscriber shall undertake to inform Buypass immediately if the information provided is no longer correct. Copyright © Buypass AS 2019 Page 4 of 7  Version 8.0 – 03.06.2019 4.4 Installation and use of Enterprise Certificates by the Subscriber The Subscriber shall verify that the contents in the Enterprise Certificate are correct prior to installation and use. The Subscriber must notify Buypass immediately if there are any errors in the contents. The contents in the Enterprise Certificate are accepted upon installation. Regardless of this, the Subscriber must notify Buypass if any errors in the contents are detected after installation. Unless the Subscriber has reported errors in the contents, Buypass consider the Enterprise Certificate to be accepted 14 days after the issuance date. Enterprise Certificates issued under this agreement may only be installed on servers that the Subscriber is entitled to use. The Enterprise Certificate should not be installed on equipment that is not under the control of the Subscriber. The Subscriber shall be fully liable for ensuring that the Enterprise Certificate is installed and protected so that only the Subscriber’s authorized representatives and/or authorized systems and/or processes can manage and use the Private Key and the Enterprise Certificate. The Subscriber is liable for recording which natural persons, systems and processes that are authorized to manage and use the Private Key and the Enterprise Certificate. 4.4.1 For Enterprise Certificates where Buypass generates the key Enterprise Certificates delivered as Soft Tokens may only be installed by use of a secret Distribution Key. The Distribution Key is sent to Authorized representative (Subject Sponsor or Certificate Applicant) by means of a proper authentication of the individual (in person or electronically) either at time of application or at time of delivery. Enterprise Certificates delivered as Hard Tokens (i.e. smart cards) requires use of a smart card reader and Buypass Access middleware. Access to the private keys are protected by a PIN. The smart card is distributed securely to the Subject Sponsor while the PIN is distributed in a separate delivery. 4.4.2 For Enterprise Certificates where the Subscriber generates the key If Subscriber generates the private key, the corresponding public key must be provided as a CSR at time of application. The Subscriber must ensure that the private key is generated securely and such that access to the private key is available only for authorized representatives according to this agreement. The key generation process must be according to best practice and satisfy requirements for cryptographic algorithms and key lengths. If the private key is generated and stored within an HSM, the Enterprise certificate may get a higher assurance level and extended usage. If the Subscriber want such higher assurance level, the Subscriber is responsible for making sure that the private key is only used within the HSM and according to the HSMs security requirements. When the Subscriber generates the private key, the physical presence requirements is based on sending an Authorization Code to an Authorized representative (Subject Sponsor or Certificate Applicant) by means of a proper authentication of the individual (in person or electronically) either at time of application or at time of delivery. 4.5 Revoking Enterprise Certificates If the Subscriber knows, has reason to believe, or should have understood that any unauthorised persons have acquired knowledge about the private key, the Subscriber shall immediately take steps to revoke the Enterprise Certificate. The Enterprise Certificate shall be revoked in the event of loss, misuse or suspected misuse. Failure to do so shall be regarded as coarse negligence. The Enterprise Certificate shall also be revoked if the information in the certificate is incorrect or inaccurate. For PSD2 QC eSeals, the certificate shall be revoked if the authorization to act as a PSP has been withdrawn, or any of the PSP roles included in the certificate has been withdrawn. Subscribers can submit revocation requests to Buypass’ revocation service by phone or by contacting the revocation service on Buypass Web. The Contract Signer and Authorised Subscriber Representatives may request certificate revocation on behalf of the Subscriber. If the Enterprise Certificate has been suspended the Subscriber may contact Buypass to have it unsuspended or revoked. Suspended Enterprise Certificates will be revoked 30 days after revocation. The Subscriber shall stop using the private key immediately when:  the information in the Enterprise Certificate is incorrect or invalid  it is suspected or demonstrated that the private key has been subject to misuse or has been compromised  the Enterprise Certificate has expired  the Enterprise Certificate has been revoked or suspended If it is suspected or demonstrated that the private key has been subject to misuse or has been compromised, the Subscriber shall immediately comply with Buypass' instructions on the use of private keys and Enterprise Certificates. Copyright © Buypass AS 2019 Page 5 of 7  Version 8.0 – 03.06.2019 The loss of a private key implies that the Subscriber must apply for a new Enterprise Certificate. 5 BUYPASS' RESPONSIBILITIES AND RIGHTS 5.1 Processing of Subscriber information and personal data 5.1.1 Collection and storage As part of the Subscriber registration, Buypass will collect and store personal data about Subscriber Representatives. If Buypass at some point chooses to terminate the service covered by this agreement, the personal data for Subscribers with active certificates may be transferred to a third party who assumes responsibility for the continuation of the service until the certificates expire. In this case, Buypass will notify the Subscriber and retrieve the Subscriber’s consent to this transferal of data. 5.1.2 Purpose This information will not be used without the Subscriber's consent for any other than necessary communication or production of services under this Subscriber Agreement. The information will be deleted as soon as the agreement is no longer applicable unless continued retention is required by law. 5.1.3 Consent By accepting the Subscriber Agreement, the Subscriber agrees that Buypass may process Subscriber’s information and Subscriber Representatives’ personal data as described in this Agreement. 5.1.4 Right to access, change and delete Buypass is responsible for the handling of this data and the Subscriber may ask questions relating to the processing of personal data to Buypass Customer Support. The Subscriber and the Subscriber Representatives also have the right to require access to and possible correction of personal data that is registered in connection with the Subscriber. The Subscriber also has the right to require that personal data about certain Subscriber Representatives be deleted, unless continued retention is required by law. 5.1.5 Information security Buypass is responsible for the protection of personal data and shall, through planned and systematic measures, ensure that adequate information security is in accordance with the laws in force at any time. Buypass has confidentiality in relation to the registered personal data and will not disclose it to third parties, unless such disclosure is required by lawful judgment, applicable law, or according to the Subscriber’s written request or requirement. 5.2 Buypass' liability Buypass' entire liability for damages relating to the use of Enterprise Certificates issued by Buypass is set out in the CPS in force from time to time for Buypass Class 3 Enterprise Certificates (Part 4 of the Subscriber Agreement). Buypass shall have no additional liability under this Subscriber Agreement. 5.3 Revoking Enterprise Certificates Buypass may decide to revoke an Enterprise Certificate if the Subscriber fails to comply with the terms and conditions contained in this agreement or if the certificate is used for illegal activities such as phishing or fraud, or is otherwise misused. If Buypass is made aware that important information in the certificate is incorrect or inaccurate or the Subscriber no longer exists, the Subscriber will be notified and the Enterprise Certificate will be revoked. Buypass may revoke PSD2 QC eSeals based on revocation requests from an NCA identified in the certificate in case the Subscriber (PSP) has lost its authorization to act as a PSP or any PSP role in the certificate has been withdrawn. 5.4 Notification to other entities When a PSD2 QC eSeal is issued, Buypass will send an issuance notification email to the NCA identified in the Certificate using pre-registered NCA contact information if such contact information has been provided by the NCA. When a PSD2 QC eSeal is revoked, Buypass will send a revocation notification email to the NCA identified in the Certificate using pre-registered NCA contact information if such contact information has been provided by the NCA. 5.5 Publication of Enterprise Certificates Buypass publishes all certificates in a public directory accessible by directory services on Buypass Web. Copyright © Buypass AS 2019 Page 6 of 7  Version 8.0 – 03.06.2019 6 AMENDMENTS TO THE SUBSCRIBER AGREEMENT If the Subscriber needs to change any Subscriber-specific information in Part 2 of the Subscriber Agreement, the Subscriber shall update the information registered online at Buypass Web or by alternative means as specified by Buypass. The updated Registration Form (Part 2) shall be signed by the Contract Signer and sent to Buypass. The Registration Form (Part 2) shall be sent as specified on the form. The requirements which applied to signature of the original Registration Form shall also apply to signing the updated Registration Form, cf. Item 3. If the Subscriber wants to assign new natural persons to the role of Certificate Manager, the Subscriber shall update the information registered as specified above. The updated Registration Form shall be signed by the Contract Signer. If the Subscriber wants to assign new natural persons and/or Partners to the role of Certificate Applicant, the Subscriber shall update the information registered as specified above. The updated Registration Form shall be signed by the Contract Signer or the Certificate Manager. The Subscriber shall undertake to notify Buypass when any natural person and/or Partners is no longer authorised to have the roles of Contract Signer, Certificate Manager or Certificate Applicant. Notification shall be given by updating the information registered as specified above. 7 DURATION OF THE SUBSCRIBER AGREEMENT The Subscriber Agreement shall be valid for as long as the Enterprise Certificates subject to this agreement are valid or until they are revoked. The Subscriber shall be responsible for applying for new Enterprise Certificates before his active Enterprise Certificates expire. If the Subscriber defaults on his commitments under the Subscriber Agreement and fails to rectify the situation within a reasonable deadline determined by Buypass, Buypass may cancel the Subscriber Agreement with immediate effect. If default is such that it cannot be rectified, Buypass may cancel the Subscriber Agreement with immediate effect. In the event of such cancellation of the agreement, the Enterprise Certificates subject to this agreement will be revoked. Buypass may amend the contents of Part 4 (CPS) or the Part 5 (PDS) of the Subscriber Agreement by publishing an updated CPS or PDS on Buypass Web. The new CPS or PDS shall then apply whenever the Enterprise Certificates are used after publication of the new CPS or PDS. 8 LEGAL VENUE AND GOVERNING LAW If any disagreements arise between the parties about the interpretation or legal effects of this agreement, the parties shall initially try to reach agreement amicably through negotiations and/or mediation. If a dispute cannot be resolved through negotiations or mediation, either of the parties may submit the dispute for final resolution by the ordinary courts of Norway. Both parties submit to the exclusive jurisdiction and venue of the courts of Oslo, Norway. This agreement, as well as the relationship between the Subscriber and Buypass, is regulated by Norwegian law, without regard to its choice of law principles. 9 FORCE MAJEURE Should any extraordinary situation arise which is beyond the control of the parties and which makes it impossible to comply with this agreement and which under Norwegian law is regarded as being force majeure, the other contracting party shall be notified without undue delay. The obligations of the affected party shall be suspended for the duration of the extraordinary situation concerned. The other party's corresponding services shall be suspended during the same period. 10 CONTACT DETAILS FOR BUYPASS Buypass AS Buypass Certificate Revocation Service: Post-box 4364 Nydalen see Buypass Web Nydalsveien 30 A N-0402 Oslo Customer Support: see Buypass Web, email: [email protected] see Buypass Web, email: [email protected] Copyright © Buypass AS 2019 Page 7 of 7