Subscriber Agreement for Buypass Class 3 BCSS Person certificates
Version 1.0 | Published 2023.10.01 | Effective Date 2023.10.01
1. About the Subscriber Agreement
1.1 Parties to the agreement
This is an agreement between you, as the Subscriber and Buypass AS (organization no. 983163327), hereafter referred to as Subscriber and Buypass respectively.
1.2 Scope of agreement
This document (Part 1), the Certification Practice Statement for Buypass Class 3 BCSS Person Certificates (CPS) (Part 2) and the Signature Policy and Practice Statement (SCPS) (Part 3) constitutes the Subscriber Agreement for Buypass Class 3 BCSS Person Certificates as used in Buypass Cloud Signature Services (BCSS) Person Signing.
The Buypass Class 3 BCSS Person Certificates are short-term certificates supplied as Qualified Certificates supporting Qualified Electronic Signature and Non-Qualified Certificates supporting Advanced Electronic Signature in the BCSS Person Signing service.
The BCSS Person Signing service is delivered by a Signature Creation Application Service Provider (SCASP) in cooperation with Buypass as both the Certificate Authority (CA) issuing certificates and Server Signing Application Service Provider (SSASP) managing the private keys. The SCASP manages the documents signed using the service.
The identity of the Subscriber is defined by an Identity Provider (IdP) which is responsible for authenticating the Subscriber using an existing eID means.
1.3 Acceptance of agreement
We consider these terms and conditions as accepted once the Subscriber confirms that the Subscriber Agreement has been read and accepted when using the BCSS Person Signing service.
By accepting the terms and conditions of this agreement, the Subscriber accepts that the Buypass Class 3 BCSS Person Certificate is made available to relaying parties. The Buypass Class 3 BCSS Person Certificate is made available for the Signature Creation Application Service Provider (SCASP) as a part of the BCSS Person Signing service.
By accepting the terms and conditions of this agreement, the Subscriber also consent to Buypass collecting, processing and storing personal information and information relating to the use of the BCSS Person Signing service, ref 4.1 Collecting, processing, and storing information.
The obligations the Subscriber undertakes by applying for the Buypass Class 3 BCSS Person Certificate by using the BCSS Person Signing service are described under the Subscriber's responsibilities and rights within this document.
This Subscriber Agreement, the CPS and SCPS are available from the Buypass website (Legal Documents).
2. Buypass Class 3 BCSS Person Certificates
Buypass Class 3 BCSS Person Certificates are for signing purposes in the BCSS Person Signing service only. Buypass Class 3 BCSS Person Certificates are herein referred to as Certificates.
2.1 About Buypass BCSS Person certificates
Buypass is the CA for the Certificates. The Certificates are certificates for electronic signature according to Regulation (EU) No 910/2014 (eIDAS).
The Certificates are issued to natural persons based on already existing eID means controlled by the Subscriber. The eID means must be issued in conformance with eIDAS LoA High or Substantial according to Regulation (EU) No 910/2014.
In order to issue a Qualified Certificate, the eID means must be compliant with eIDAS art 24.1 (b).
The Certificate is linked to a private key managed by Buypass as SSASP, in a remote secure cryptographic device (HSM). The Subscriber alone has sole control of the private key using the BCSS Person Signing service. The Subscriber authorizes the access to the private key by using a personal, already existing eID.
The private key will be usable in only those cases for which the signer's consent has been obtained. Subscriber's acceptance of this Agreement is considered such consent.
The Certificates are short-term certificates with a validity period of hours and the corresponding private key residing in the remote HSM is only to be used for a single signing operation (which may include several signature transactions).
Certificates may only be used for Advanced Electronic Signatures (using Non-Qualified Certificates) or Qualified Electronic Signatures (using Qualified Certificates) in the BCSS Person Signing service. The quality of the signature is decided by the SCASP and the Level of Assurance (LoA) of the eID means used.
The private key is deleted when the signing operation is completed.
3. The Subscriber's responsibilities and rights
The issuance of Certificates in the BCSS Person Signing service requires that an existing eID means supporting our requirements are used. The eID means used for verifying the identity must comply with eIDAS LoA Substantial or High.
This is a personal eID that you as a Subscriber must manage under sole control. Others must not be given access to your eID. Contact your eID provider if you need information about your eID, or if you suspect fraudulent usage.
3.1 Applying for certificates
The Subscriber applies for Certificates by using the BCSS Person Signing service as provided by the SCASP, authenticating with an existing eID means at an IdP.
3.2 Use of certificates
Certificates are only to be used in the BCSS Person Signing service for generating an Advanced Electronic Signatures (Non-Qualified Certificates) or Qualified Electronic Signatures (Qualified Certificate).
3.3 Acceptance of certificates
By using the BCSS Person Signing service and accepting Certificate contents based on attributes from your eID, Buypass considers that the Certificate has been accepted.
4. Buypass' responsibilities and rights
4.1 Collecting, processing, and storing information
Whenever you sign up for using the BCSS Person Signing service, your identity is verified using your eID for authentication.
The authentication may be performed by the eID provider, or some other IdP allowed to represent the eID provider.
Information about your identity retrieved from the use of the eID means are collected and stored together with the consent to the terms and conditions in the Subscriber Agreement.
4.1.1 The purpose of collecting information
To be able to issue a Certificate we retrieve identity attributes like given name and surname from the authentication.
Buypass will store a unique reference to the eID used as evidence for the authentication and authorization to generate a signature on behalf of the Subscriber.
4.1.2 Processing and storing of information
Buypass is responsible for the security of your personal information. We shall provide satisfactory information security (integrity, confidentiality, and availability) through planned and systematic work and that this is in accordance with applicable legislation.
Buypass is responsible for the confidentiality of the information obtained in the use of the BCSS Person Signing service.
Collecting of information is subject to the Personal Data Act (Personopplysningsloven). In accordance with applicable regulations relating to the use of the BCSS Person Signing service, all information about the application for and use of the Certificate will be retained for 7 years after the certificate expires.
Whenever you use your existing eID in the BCSS Person Signing service regulated by this agreement at one of our SCASPs, Buypass is not responsible for information collected, stored or processed beyond the provisions stated in this document. This is regulated by our SCASPs own terms and conditions in accordance with applicable privacy regulations.
4.1.3 Right of access, correction and deletion of information
4.2 Sharing of information
Buypass will not disclose personal information to third parties beyond those stated in this document, unless such information is required according to the authority's request for extradition, the principle of Lex superior or by your own written consent.
4.3 Revocation of certificates
The Certificates are short-term certificates with no support for revocation. The certificate expires after a few hours and the corresponding private key are deleted before expiry.
The use of the BCSS Person Signing service regulated by this agreement is your own responsibility. If you suspect unwanted activities as possible fraudulent use of your eID you are obliged to notify the eID provider.
4.4.1 Limitation of liability
Buypass cannot be held liable for losses because of the relevant services cannot be used, either, due to technical faults, lost profits or damages resulting from business interruption.
Buypass disclaims its liability in the case of any losses you may incur as a Subscriber if you use your eID in the BCSS Person signing service contrary to the terms of this agreement.
Should an extraordinary situation arise, which is outside of the parties’ control and which, according to normal purchase law, is regarded as Force Majeure, and which makes it impossible for one or both parties to satisfy one or more obligations of this agreement, the affected obligations will be suspended for the duration of the extraordinary situation.
5. Changing the terms and conditions of this agreement
Current terms and conditions will be communicated to the Subscriber for each certificate issued.
New versions of this agreement will be published and announced on Buypass website at least fifteen (15) days before the amendment(s) take(s) effect.
If you do not wish to accept changes in conditions, you must not use the BCSS Person Signing service.
6. Complaints and dispute settlement
Complaints may be notified to Buypass on the Buypass website (Complaints procedure).
Should disagreement arise between the parties regarding the interpretation or legal effect of this agreement or concerning services, the parties may seek to resolve the dispute between themselves.
If agreement cannot be reached, the parties may seek a settlement in the courts. Oslo District Court will be the legal venue.
7. Duration and termination
Current terms and conditions as described in this agreement will be communicated to the Subscriber and must be accepted for each Certificate. This agreement will only be valid during the period of validity of the Certificate and the signing operation.
Termination of the agreement is not supported.
8. Buypass contact information
If you have questions concerning this agreement or require information in other matter, please contact us using one of the following methods:
Buypass customer support, Email: firstname.lastname@example.org
Buypass customer support, Phone: +47 22 70 13 00
Buypass customer support, Buypass website: https://www.buypass.com/the-company/contact-customersupport