2008 – Clover Flex Lending Policy

Purpose:

This policy governs the lending of Clover Flex credit card terminals to authorized personnel for official transactions at the University of Pennsylvania. It ensures compliance with Payment Card Industry Data Security Standards (PCI DSS) and protects sensitive cardholder data.

Eligibility:

Devices may only be borrowed by UPenn staff and faculty for approved institutional activities. Students, contractors, or external parties are not permitted to borrow terminals.

Reservation & Request:

A Ben Helps request form must be submitted prior to borrowing. Reservations are not guaranteed; they are accepted on a first-come, first-served basis and dependent upon available inventory. Submit your request at: https://benhelps.upenn.edu/support/catalog/items/88

Use Restrictions:

Terminals must only be used for authorized payment processing related to official events or departmental needs. Prohibited uses include personal transactions, storage or transmission of cardholder data outside the PCI-compliant system, and connecting terminals to unsecured networks or personal devices.

PCI Compliance Requirements:

Users must never write down, store, or transmit cardholder data in any form. Ensure terminals remain in a secure location when not in use. Report any suspected security incident immediately to the IT Security Office. Terminals must only be connected to approved, encrypted networks.

Loan Duration:

Standard lending period: up to 5 business days. Extensions require prior approval from UPenn Merchant Services and are not guaranteed.

Charges:

Late Return Fee: $25 per day beyond the agreed return date. This fee exists to ensure courtesy to other borrowers who may need the device for scheduled events.

Replacement Fee: Full replacement cost (up to $1,000) if the device is lost, stolen, or damaged beyond repair.

Device Care (Specific to Clover Flex):

• Keep the device in a secure, dry, and temperature-controlled environment.
• Do not expose the terminal to liquids, extreme heat, or physical impact.
• Use only the official Clover Flex charger and accessories.
• Avoid leaving the device in direct sunlight or in vehicles.
• Do not attempt to open, modify, or repair the device.
• Ensure the screen and card reader remain clean and free of debris.
• Immediately report any damage or malfunction to UPenn Merchant Services.

Borrower Responsibilities:

• Inspect the device upon checkout and report any issues immediately.
• Return the device in the same condition, including all accessories.
• Sign the Clover Flex Sign Out/Sign In Log acknowledging responsibility for compliance and charges.

Terms of Use:

• The only people who may use the Clover Flex are those listed as users on this form.
• The Clover Flex must only be used for card-present transactions and may not be used to collect payments via phone, email, fax, or any other medium.
• Credit card information must not be saved or stored in any way.
• All users must have passed the ‘Payment Card Industry – Data Security Standards (PCI-DSS) Workforce Education – For Merchant Staff & Managers’ training in Workday.

Consequences of Non-Compliance:

• Termination of Access: Any user found not complying with the listed conditions may have their access to the Clover Flex terminal immediately revoked.
• Financial Penalties: Non-compliance with PCI-DSS requirements may result in fines imposed by the payment processor, which borrower will be responsible for.
• Increased Risk of Fraud: Non-compliance increases the likelihood of fraud or unauthorized transactions, which may lead to financial losses.

Contact Information:

For assistance, contact UPenn Merchant Services at dofcashmgmt@pobox.upenn.edu