TOWN OF WEBSTER
“CREDIT CARD ACCEPTANCE AND PROCESSING POLICY”
Adopted xx/xx/xx
INDEX
DESCRIPTION
PAGE
SECTION 1 - PURPOSE
1
SCOPE OF THE POLICY
1
TOWN JUSTICE COURT GENERAL GUIDELINES
1
TOWN CLERK/ TAX COLLECTOR GENERAL GUIDELINES
2
PARKS & RECREATION DEPT. GENERAL GUIDELINES
3
WEBSTER PUBLIC LIBRARY GENERAL GUIDELINES
4
TOWN CREDIT CARD REFUND POLICY
5
TOWN CREDIT CARD SECURITY POLICY
5
COMPROMISED CREDIT CARDS
6
DATA DISPOSAL TRIGGERS
6
DATA DISPOSAL METHODS
7
VERIFICATION AND RECORDS
7
The purpose of this policy is to define the guidelines for accepting and processing credit and debit cards and storing personal cardholder information. The policy will help to ensure that cardholder information supplied to the Town of Webster is secure and protected. Additionally, it helps the town remain in compliance with credit card company requirements, state and federal regulations, and the Payment Card Industry (PCI) Data Security Standards (DSS). II. SCOPE OF THE POLICY: It is the policy of the Town of Webster to establish standards for the acceptance and processing of credit and debit card payments in various town departments and maintaining the security of confidential payment card data. The only departments authorized to accept payment by card transactions are the Town Justice Court, Town Clerk/Tax Collector, the Parks and Recreation Department and the Webster Public Library. III. TOWN JUSTICE COURT GENERAL GUIDELINES: 1. The Town Justice Court will accept payment cards for the payment of amounts due. There is no minimum. 2. Payment by card may be made to Court Clerk/Deputy Court Clerk or via website (allpaid.com). 3. The town will accept VISA and MasterCard credit cards as payment cards. 4. All online (allpaid.com) card payments will also be charged a convenience fee (a percentage of the payment). All payees will be notified of the convenience fee prior to transaction completion. 5. Card payments will be logged into a case, ticket, or other matter identifying information and reported monthly as payment to New York State Comptroller. 6. In-person payments and electronic online payments are the standard transactions accepted by the Town Justice Court. Over the phone and email transaction will not be accepted. 7. Only card holders can complete transactions. The town will not accept payment on behalf of a representative presenting the card for payment. (For example, the town will not accept payment from a child presenting a parent’s card, a person presenting their spouses card, etc.) 8. The staff may request a form of identification before accepting a payment card, but it is not required. 9. Prior to processing the customer’s payment card, staff must ensure the payment card expiration date has not passed. If the payment card has expired, it will not be accepted for payment. 1
10. Each transaction will have a reference code. If processed through allpaid.com there will be an ADP reference number. In person payments are issued a prenumbered receipt via NYS software system. 11. For in-person transactions, two copies of each payment card transaction are printed. A signature must be obtained on the payment card receipt and compared to the signed payment card. The unsigned copy of the transaction is given to the customer, and the signed copy is retained in the department for reconciliation. Online customers will receive their receipt via email. In lieu of a signature on the office copy, a notation will be made stating “Online Transactions.” 12. If the payment card cannot be read by the terminal, the card number will be manually keyed into the payment card terminal. 13. In all circumstances of declined or unaccepted transactions, the payment card will be returned to the customer and the customer informed that the presented card was not accepted. The employee will offer to accept another payment card or another authorized form of payment. 14. Only authorized and properly trained town staff may accept, process and access payment card data. 15. All town staff who have access to payment card information are responsible for properly safeguarding the payment card information in accordance with this policy and all other applicable town policies. 16. Records retention of card transactions, and all other fiscal records of the Town Justice Court will continue to be retained by the Office of Justice Court Support Fiscal Records Retention and Disposition Schedule. IV. TOWN CLERK/TAX COLLECTOR GENERAL GUIDELINES: 1. The minimum transaction amount allowed on a payment card is $.25. 2. The town will accept VISA, MasterCard, Discover (Capital One), American Express credit cards, and VISA or MasterCard debit cards (with logo) as payment cards. Apple Pay and Google Pay are also accepted. 3. In-person payments and electronic online payments are the standard transactions accepted by the department. Over the phone and email transaction will not be accepted. 4. Only card holders can complete transactions. The town will not accept payment on behalf of a representative presenting the card for payment. (For example, the town will not accept payment from a child presenting a parent’s card, a person presenting their spouses card, etc.) 5. The staff may request a form of identification before accepting a payment card, but it’s not required. 6. All customers will be informed of the convenience fee that will be charged to their payment card. A chart is available that shows the fees based on the amount being charged. 2
7. Prior to processing the customer’s payment card, the software system will ensure the payment card expiration date has not passed. If the payment card has expired, it will be rejected. 8. Each transaction will have a reference code. For example, a permit number, marriage license number, site plan number, etc. 9. For in-person transactions, two copies of each payment card transaction are printed. A signature is not required. A copy of the transaction is given to the customer, and a copy is retained in the department for reconciliation. Online customers will receive their receipt via email. In lieu of a signature on the office copy, a notation will be made stating “Online Transactions.” 10. If the payment card cannot be read by the terminal, the card number is not allowed to be manually keyed into the payment card terminal. 11. In all circumstances of declined or unaccepted transactions, the payment card will be returned to the customer and the customer informed that the presented card was not accepted. The employee will offer to accept another payment card or another authorized form of payment. 12. Only authorized and properly trained town staff may accept, process and access payment card data. All payment card data is encrypted and stored within the third-party payment processor’s software system. 13. All departments sending a resident to the Town Clerk for credit card payments will provide the originating department’s source documents to the Town Clerk. 14. All town staff who have access to payment card information are responsible for properly safeguarding the payment card information in accordance with this policy and all other applicable town policies. However, no credit card data is retained on site. V. PARKS & RECREATION DEPT. GENERAL GUIDELINES: 1. The minimum transaction amount allowed on a payment card is $1.00. 2. The town will accept VISA, MasterCard, Discover (Capital One), American Express credit cards, and VISA or MasterCard debit cards (with logo) as payment cards. 3. In-person payments and electronic online payments are the standard transactions accepted by departments. Over the phone is accepted but email transactions are not accepted. 4. Only card holders can complete transactions. The town will not accept payment on behalf of a representative presenting the card for payment. (For example, the town will not accept payment from a child presenting a parent’s card, a person presenting their spouses card, etc.)
3
5. The staff may request a form of identification before accepting a payment card, but it is not required. 6. The customers are not charged a convenience fee for the transactions, so notification is not necessary. 7. Prior to processing the customer’s payment card, staff must ensure the payment card expiration date has not passed. If the payment card has expired, it will not be accepted for payment. 8. Each transaction will have a reference code generated via the PayTrac credit card processing software system within RecTrac. 9. For in-person transactions, one copy of the payment card transaction is printed and given to the customer. A signature is not required on the payment card receipt. The department administrator prints and reconciles all credit card transactions the following day. Online customers will receive their receipt via email. In lieu of a signature on the office copy, a notation will be made stating “Online Transactions.” 10. If the payment card cannot be read by the terminal, the card number will be manually keyed into the payment card terminal. 11. In all circumstances of declined or unaccepted transactions, the payment card will be returned to the customer and the customer informed that the presented card was not accepted. The employee will offer to accept another payment card or another authorized form of payment. 12. Only authorized and properly trained town staff may accept, process and access payment card data. 13. All town staff who have access to payment card information are responsible for properly safeguarding the payment card information in accordance with this policy and all other applicable town policies. VI. WEBSTER PUBLIC LIBRARY GENERAL GUIDELINES: 1. The Webster Public Library will accept payment cards for the payment of amounts due. There is no minimum. 2. The library will accept VISA, MasterCard, Discover (Capital One), American Express credit cards, and VISA or MasterCard debit cards (with logo) as payment cards. 3. In-person payments and electronic online payments via the Monroe County Library System are the standard transactions accepted by the library. Over the phone and email transaction will not be accepted. 4. Only card holders can complete transactions. The town will not accept payment on behalf of a representative presenting the card for payment. (For example, the town will not accept payment from a child presenting a parent’s card, a person presenting their spouses card, etc.) 4
5. The staff may request a form of identification before accepting a payment card, but it’s not required. 6. The customers are not charged a convenience fee for the transactions, so notification is not necessary. 7. Prior to processing the customer’s payment card, the Monroe County Library software system will ensure the payment card expiration date has not passed. If the payment card has expired, it will be rejected. 8. Each transaction will generate a transaction number within the Monroe County Library software system. 9. For in-person transactions, two copies of each payment card transaction are printed. A signature is not required on the payment card receipt. A copy of the transaction is given to the customer, and one copy is retained in the department for reconciliation. Online customers will receive their receipt via email. In lieu of a signature on the office copy, a notation will be made stating “Online Transactions.” 10. If the payment card cannot be read by the terminal, the card number will be manually keyed into the payment card terminal. 11. In all circumstances of declined or unaccepted transactions, the payment card will be returned to the customer and the customer informed that the presented card was not accepted. The employee will offer to accept another payment card or another authorized form of payment. 12. Only authorized and properly trained library staff (front desk clerks) may accept, process and access payment card data. 13. All library staff who have access to payment card information are responsible for properly safeguarding the payment card information in accordance with this policy and all other applicable town policies. VII. TOWN CREDIT CARD REFUND POLICY: Refund requests are reviewed individually by the town staff to determine refund eligibility. Valid refunds will be either credited to the customer’s payment card account, or a check will be issued to the customer within two weeks of validation. VIII. TOWN CREDIT CARD SECURITY POLICY: 1. Electronic payment card numbers are not to be transmitted or stored on a personal computer or e-mail account. Electronic lists of customer’s payment card numbers are not to be retained. Payment card information via fax and e-mail will not be accepted. The Town will not email payment card information. If credit card information is taken over the phone the information will not be retained beyond the period necessary to enter it into the credit card processing software system.
5
2. Physical cardholder data will be locked in a secure area with limited access only to individuals that require and are allowed the use of the data. 3. Only essential information will be stored. Card Validation Code (also known as the Security Digits, V Code, or CID) is not stored. User PIN’s or the full data from a cards magnetic stripe will not be retained. 4. Payment card information will be retained for only the time needed to process and reconcile. 5. Payment card information, if it does not need to be retained, will be destroyed. Information will be destroyed by shredding (crosscut) immediately after processing, or immediately after the information is no longer needed to be retained. 6. All departments must comply with the Payment Card Industry Data Security Standard which has been summarized in this policy. IX. COMPROMISED CREDIT CARDS: If town officials become aware that a customer payment card number or card processing device has been compromised with a security breach, the town will immediately notify the individuals involved. The town officials will contact the Town of Webster’s Finance Department, merchant bank, the Town of Webster Police Department, Information Technology Department and any other involved associations as necessary to remediate the loss of important information. Notifications of a security breach will comply with all state and federal regulations that protect the confidentiality, security, or integrity of private information. X. DATA DISPOSAL TRIGGERS: Data must be destroyed when: 1.
The business purpose for which it was collected is fulfilled (e.g., transaction cleared).
2.
The legal/regulatory retention period has expired (typically 5 years for audit trails, unless otherwise required).
3.
A customer formally requests data deletion (where applicable under privacy laws).
6
Based on the type of media, the Town will follow the following disposal methods:
Media Type
Disposal Method
Requirement
Cross-Cut Shredding
Must be shredded to a size that prevents reconstruction. Use of secure, locked shredding bins is mandatory until pickup.
Digital (OnSite)
Secure Wiping
Use industry-standard software (e.g., NIST SP 800-88 compliant) to overwrite data multiple times so it cannot be recovered by forensic tools.
Digital (Cloud)
Cryptographic Erasure
If data was encrypted (as required), the unique encryption keys must be destroyed, rendering the data unreadable.
Hard Drives/Media
Physical Destruction
Defunct hard drives or USBs containing credit card data must be degaussed or physically crushed/shredded by a certified vendor.
Physical (Paper)
XII. VERIFICATION AND RECORDS The following records must be maintained to document destruction: 1. Logs: A "Certificate of Destruction" or a disposal log must be maintained, noting the date, method, and person/vendor responsible for the disposal. 2. Third Parties: Vendors must provide written proof of secure disposal for any data handled on behalf of the company."
7