EXPLANATORY NOTE ON DECEMBER 15, 2015, SYNCHRONY BANK (F/K/A GE CAPITAL RETAIL BANK) AND SYNCHRONY FINANCIAL (SYNCHRONY ENTITIES) ENTERED INTO THE THIRD AMENDMENT TO THE AMENDED AND RESTATED CONSUMER CREDIT CARD PROGRAM AGREEMENT BY AND AMONG THE GAP, INC. (THE COMPANY), GAP (PUERTO RICO), INC., GPS CONSUMER DIRECT, INC., GAP (APPAREL), LLC, GAP (ITM) INC., AND THE SYNCHRONY ENTITIES, WHICH IS ATTACHED HERETO. THE SYNCHRONY ENTITIES ALSO ENTERED INTO THREE OTHER AGREEMENTS WITH CERTAIN OF THE COMPANYS WHOLLY-OWNED SUBSIDIARIES ON THE SAME DAY:

This Third Amendment to the Amended and Restated Consumer Credit Card Program Agreement, dated as of December 15, 2015 (the “Amendment”), amends that certain Amended and Restated Consumer Credit Card Program Agreement dated as of February 28, 2014 (as amended, modified and supplemented from time to time, the “Agreement”) by and among Synchrony Bank (f/k/a GE Capital Retail Bank), a federal savings bank (“Bank”), Synchrony Financial, a Delaware corporation (“Bank Parent”), The Gap, Inc., a Delaware corporation (“The Gap, Inc.”), Gap (Puerto Rico), Inc., a Puerto Rico corporation, GPS Consumer Direct, Inc., a California corporation, Gap (Apparel), LLC, a California limited liability company, and Gap (ITM) Inc., a California corporation (jointly and severally, the “Retailers”). Capitalized terms used herein and not otherwise defined have the meaning given in the Agreement.

WHEREAS, Bank and Retailers are parties to the Agreement, pursuant to which Bank provides consumer credit to qualified customers of Retailers for the purchase of goods and services from Retailers through the use of a private label credit card and from Retailers and other retailers through the use of a co-branded bankcard;

WHEREAS, the parties hereto desire to amend the Agreement as set forth herein;

NOW, THEREFORE, in consideration of the mutual promises and subject to the terms and conditions hereinafter set forth, the parties hereby agree as follows:

““Absentee Transaction” means an Internet Purchase, a Catalog Purchase, or any Private Label Retailer Purchase or Co-brand Retailer Purchase made at an Approved Alternate Site where the Cardholder is not present.”

““Athleta Retailers” means the “Retailers”, as such term is defined in the Credit Card Program Agreement between Bank and Athleta, Inc. and certain of its Affiliates.”

““Alternate Site” means any form of retail distribution other than a Store, Catalog, (or, with respect to any entity participating in the Program pursuant to Section 13.02, any form of retail distribution operated by such entity), or Internet Site for use in the United States or Puerto Rico (e.g., kiosks, temporary special event promotional booths, short-term seasonal leases of retail or outlet stores).”

““Credit Card Program Agreements” means (i) this Agreement, (ii) that certain “Amended and Restated Consumer Credit Card Program Agreement” entered into by and between the Banana Republic Retailers and Bank, dated as of the date hereof (as may be amended or extended from time to time), (iii) that certain “Amended and Restated Consumer Credit Card Program Agreement” entered into by and between the Old Navy Retailers and Bank, dated as of the date hereof (as may be amended or extended from time to time), (iv) that certain “Consumer Credit Card Program Agreement” entered into by and between the Athleta Retailers and Bank, dated as of September 28, 2015, and (v) any other program agreements executed by and between Bank and any Affiliate of The Gap, Inc., in accordance with Section 13.03.”

““Internet Site” means the internet website with the internet address www.gap.com, and any other internet website maintained, operated or controlled by, or on behalf of, any Retailer and which markets Gap-branded goods or services provided, that “Internet Site” shall not include any internet website or portions thereof maintained by, or on behalf of, any Retailer if (i) such website or portions thereof are specifically designed to target customers who are residents of a country other than the United States or Puerto Rico and (ii) purchases made through such website or portions thereof and shipped to locations in the United States and Puerto Rico constitute less than 5% of the total number of purchases made through such website or portions thereof.”

““Net Credit Card Sales” means, as of any date of determination, the sum of the Gap Net Credit Card Sales and the Other Net Credit Card Sales. As used herein, “Other Net Credit Card Sales” shall mean the sum of the amounts calculated in the same manner as the Gap Net Credit Card Sales but determined for each of the other three Credit Card Programs.”

““Old Navy Canada” means Old Navy (Canada) Inc.”

“(g)    Bank shall manage and administer the Cardholders Rewards Program, which shall include those cardholders identified periodically by Retailers as being participants in the Best Customer Program, and provide reward points tracking and servicing functionality tied to the Accounts to support the Cardholder Rewards Program. Bank shall provide to Retailers not later than the monthly meeting of the Program Execution Committee, a rewards summary in the form set forth in Schedule 2.04(g). Bank shall also, at its own cost and expense, provide Retailers with the ability to include printable redemption certificates as part of the second page of a Cardholder’s monthly billing statement; provided, that Retailers shall, at their own cost and expense, have the option of including redemption certificates as inserts in the Cardholder’s monthly billing statement. If Retailers choose to implement their own Cardholder Rewards platform, then the parties will discuss in good faith a process to transition the Cardholder Rewards Program administration and management to Retailers, and the removal of costs associated with administering and managing the Cardholder Rewards Program from the Program P&L.”

“(k)    Data Security.

(i)    Each party shall implement appropriate administrative, technical, physical and organizational safeguards (including encryption and tokenization, at rest and in transit, as applicable, using current industry standards for approved security functions, such as those listed in the Federal Information Processing Standards (FIPS) 140-2 annex A) to protect the security, confidentiality, availability and integrity of all customer and/or Cardholder information, including but not limited to, [***] contemplated by this Section 3.04 in accordance with all Applicable Laws, including without limitation protecting against any anticipated threats or hazards, improper, unauthorized or unlawful Processing, any loss or any other compromise. Each party shall review such security measures regularly, [***], and update and maintain such security measures to comply with Applicable Laws and regulations. In addition, each Retailer and Bank, respectively, will, as appropriate, use [***] designed to properly dispose of all records containing personally identifiable information relating to Cardholders, whether in paper, electronic, or other form, including adhering to policies and procedures that require the destruction or erasure of electronic media containing such personally identifiable information so that the

information cannot practicably be read or reconstructed. For purposes of Section 3.04(k), “Process” or “Processing” means any operation or set of operations performed upon information from or about an identified or identifiable individual.

(ii)    Each party shall implement and maintain an [***] data security incident management program and disaster recovery plans. Each party will review and amend its disaster recovery plans [***] in accordance with technology advances as needed. In the event there is [***] to a Cardholder or an identified or identifiable person tied to a Cardholder (“Customer Data”), [***] of Customer Data [***] of Customer Data whether [***] (“Security Incident”), each Retailer and Bank, as applicable, shall notify the other party [***] following discovery or notification of any Security Incident. Bank will notify Retailers by telephone [***] and by telephone and email to the general manager of the Program for Retailers, and Retailers will notify the [***] for the Program for Bank by [***]. Both parties agree to [***] cooperate to investigate and resolve the Security Incident, including [***], coordinating on the content of any notifications of the Security Incident. The party that suffers the Security Incident (the “Affected Party”) agrees: (i) to take action [***], to investigate the Security Incident, (ii) to identify [***] the effects of the Security Incident, (iii) properly document [***], if any, [***] to any regulatory and law enforcement agencies, and (iv) to implement [***] measures in response to such breach. The Affected Party also will provide the other party with [***] information regarding such breach to assist that other party in implementing its information security response program and, if applicable, in notifying affected Cardholders. Notwithstanding the foregoing, in the event of a Security Incident the parties shall work [***] in good faith to agree on a plan to use [***] methods to remediate such problems (“Remediation Plan”). Once the parties agree on a Remediation Plan, each party shall execute and complete its responsibilities [***] and notify the other party when such actions are completed.

(iii)    Each party shall properly implement, maintain and enforce its own internal privacy and data security policies (and as applicable, the parties’ joint policies), and if requested by either party, the parties shall review all such policies relevant to the Processing of Customer Data. Each party agrees to implement and maintain the requirements set forth by [***] for the Processing, storage and/or transmission of credit card information and shall [***] its compliance with the [***]. Each party shall provide, at the other party’s request, [***]. If any point during the term of this Agreement or for as long as either party Processes Customer Data, if it is determined that such party is not in compliance with [***], such party shall work [***] to remedy such defect in order to achieve [***] compliance.

(iv)    In addition to Section 9.02(g), upon reasonable advance notice and during normal business hours, either party may conduct a site visit of the other party’s facilities by representatives of the requesting party (including without limitation its independent third party auditor), provided that: (a) the

scope of the audit and Records Requests (defined below) are relevant and applicable to the terms of Section 3.04; (b) such site visit shall occur at a mutually agreeable time, [***]; (c) such site visit shall not unreasonably interfere with either party’s business operations; (d) any third party representatives acting on behalf of either party shall execute nondisclosure agreement with the party whose site is being audited in a form reasonably acceptable to such party with respect to the confidential treatment and restricted use of such party’s confidential information. Access at the party’s facilities shall be subject to reasonable access requirements and security policies. [***] days prior to a scheduled visit, the auditing party shall provide a list of the records it seeks to inspect (“Records Request”). If there are objections to the auditing party reviewing particular records, the auditing party shall be notified [***], and the parties will discuss the matter [***] to arrive at a mutually agreed Records Request in [***] time possible. If either party, [***], is not able to have Records Requests available at the time of the on-site audit, such party shall notify the auditing party in advance, [***] to the site visit date and the parties will decide whether to proceed with the visit. If either party chooses not to exercise its right to an [***] onsite audit, the party may request a Records Request or may request additional written information from the other party as necessary to satisfy its own compliance obligations and ensure that the other party is operating in compliance with its privacy and security obligations outlined in this Section 3.04.

(v)    Notwithstanding the foregoing, in the event of a determination by either party that a problem exists with the details disclosed during an onsite audit or during a Records Request, the parties shall work [***] to agree on a plan to use [***] methods to remediate such problems in a Remediation Plan. Once the parties agree on a Remediation Plan, each party shall execute and complete its responsibilities [***] and notify the other party when such actions are completed.

(vi)    Each party shall ensure that it will have written agreements in place [***], and that such agreements shall contain terms that enable such party to comply with the data security and privacy obligations under this Agreement. If either party is aware that either party’s [***] has experienced a Security Incident with respect to the Customer Data, such party will comply with the notification process in section 3.04(k)(ii) above.

(viii)    Each party’s obligations under this Section shall continue so long as it has access to or retain Customer Data.”

Amendments to Section 3.08.

“Bank shall schedule each meeting of the Strategic Operating Council after consultation with Retailers as to the time and place for such meeting, and the parties will jointly develop an agenda in advance.”

“(b)    The Strategic Operating Council shall consist of a minimum of ten (10) members. The general manager for the Program for Bank, on the one hand, and Retailers, on the other hand, shall each have the right to designate one-half of the members of the Strategic Operating Council. Any member of the Strategic Operating Council may be removed, with or without cause, by the party designating such member. Any vacancy on the Strategic Operating Council shall be filled by the party who designated the vacating member. All meetings of the Strategic Operating Council shall require a quorum consisting of not less than six members, at least three of whom shall be designees of Bank and at least three of whom shall be designees of Retailers. The Strategic Operating Council shall not approve any matter before it unless and until a majority of the Bank’s members of the Strategic Operating Council and a majority of the Retailers’ members of the Strategic Operating Council both approve such matter.”

“Bank shall schedule each meeting of the Program Execution Committee after consultation with Retailers as to the time and place for such meeting, and the parties will jointly develop an agenda in advance.”

“(b)    The Program Execution Committee shall consist of a minimum of six members, with at least one member of Bank and at least one member of Retailers also a member of the Strategic Operating Council. The general manager for the Program for Bank, on the one hand, and Retailers, on the other hand, shall each have the right to designate one-half of the members of the Program Execution Committee; provided, however, that Bank’s senior technology advisor for the Program shall be one of Bank’s members of the Program Execution Committee. Any member of the Program Execution Committee may be removed, with or

without cause, by the party designating such member. Any vacancy on the Program Execution Committee shall be filled by the party who designated the vacating member. All meetings of the Program Execution Committee shall require a quorum consisting of not less than four members, at least two of whom shall be designees of Bank and at least two of whom shall be designees of Retailers. The Program Execution Committee shall not approve any matter before it unless and until a majority of the Bank’s members of the Program Execution Committee and a majority of the Retailers’ members of the Program Execution Committee both approve such matter.”

“As of the Effective Date, the foregoing authorization structure shall be applied to the entities participating in the Program pursuant to Section 13.02, other than Gap Canada and Old Navy Canada (the transaction data for which, until subsequently agreed to by the parties, shall be processed through the Network).”

“(a)    Bank will provide all customer service from servicing sites in the United States (including Puerto Rico), Canada, Mexico, India and the Philippines; provided that, until Retailers shall otherwise agree in writing, no more than [***] of customer service volume shall be provided from outside of the United States (including Puerto Rico), Canada and Mexico; and provided, further, that customer service volume shall be provided from Canada, Mexico and Puerto Rico only as required to provide customer service in French or Spanish, respectively, or as required in accordance with Bank’s disaster recovery and call volume overflow practices. Notwithstanding the above, Bank shall be able to provide customer service from outside of the United States (including Puerto Rico), Canada and Mexico in excess of [***] in limited and extraneous circumstances to respond to unusual call volume without being in breach of this Section 4.05. At such time, Bank will notify Retailers of such unusual call volume and its response.”

“(d)    During the Operation Period, (i) maintain a direct link from the Internet Site(s) to an on-line credit center webpage hosted and maintained by Bank (“Credit Center Site”), (ii) permit Cardholders to

make Private Label Retailer Purchases, Co-brand Retailer Purchases and Cross-Shopping Purchases on-line and to charge such purchases to their Accounts on the Internet Site(s); (iii) maintain and operate the Internet Site(s) so that all Absentee Transactions processed through such site(s) will be accepted on a secure basis; and (iv) promote the Program on the Internet Site(s). Retailers will cooperate with Bank in operating and maintaining the Credit Center Site, such that, as systems permit, the Credit Center Site will permit Retailers’ customers to view their bills and to submit customer service inquiries directly to Bank, each online, and to permit Retailers’ customers to apply for Credit Cards. Retailers shall not honor Credit Cards or submit Charge Transaction Data to Bank for the purchase of any Goods and/or Services from a Retailer where the Account information necessary to effect the purchase is provided through an Internet Site unless and until such Internet Site is maintained and operated as provided in the first sentence of this Section 8.04(d). All authorizations for on-line Private Label Retailer Purchases, Co-brand Retailer Purchases and Cross-Shopping Purchases will be separately tagged with a unique store-of-sale number.”

“(g)    Cooperate with Bank to evaluate, and to the extent technically feasible, to implement mutually agreeable online fraud prevention procedures for Cardholders making Private Label Retailer Purchases, Co-brand Retailer Purchases and Cross-Shopping Purchases through an Internet Site.”

“(i)    Bank will provide [***] account managers for the Credit Card Programs, [***], with competencies and required skills to be mutually agreed upon by Bank and Retailers;

(ii)    Bank will provide no less than [***] personnel dedicated to the Credit Card Programs, with at least [***]; provided, that Retailers shall have the right to propose to Bank (x) certain efficiency changes in the use and number of such personnel, and (y) such additional staffing as needed to appropriately support the Program, which proposals Bank shall consider in good faith; provided, that if Bank chooses not to implement Retailers’ proposed changes, Bank will provide Retailers with a detailed explanation of Bank’s reasons therefor;”

“(n)    Bank will cooperate with Retailers to evaluate, and to the extent technically feasible, to implement mutually agreeable online fraud prevention procedures for Cardholders making Purchases through an Internet Site.”

“As of the Effective Date, Bank acknowledges and agrees that Gap Canada and Old Navy Canada shall be deemed to have satisfied the conditions set forth in clauses (i) through (iii) above and shall be permitted to accept Private Label Credit Cards and Co-brand Credit Cards as contemplated by this Section.”

“1)    [***].”

2.1    Authority for Amendment. The execution, delivery and performance of this Amendment has been duly authorized by all requisite corporate action on the part of Retailers and Bank and upon execution by all parties, will constitute a legal, binding obligation thereof.

2.2    Effect of Amendment. Except as specifically amended hereby, the Agreement, and all terms contained therein, remains in full force and effect. The Agreement, as amended by this Amendment, constitutes the entire understanding of the parties with respect to the subject matter hereof.

2.3    Binding Effect; Severability. Each reference herein to a party hereto shall be deemed to include its successors and assigns, all of whom shall be bound by this Amendment and in whose favor the provisions of this Amendment shall inure. In case any one or more of the provisions contained in this Amendment shall be invalid, illegal or unenforceable in any respect, the validity, legality and enforceability of the remaining provisions contained herein shall not in any way be affected or impaired thereby.

2.4    Further Assurances. The parties hereto agree to execute such other documents and instruments and to do such other and further things as may be necessary or desirable for the execution and implementation of this Amendment and the consummation of the transactions contemplated hereby and thereby.

2.5    Governing Law. This Amendment shall be governed by and construed in accordance with the laws of the State of Utah.

2.6    Counterparts. This Amendment may be executed in counterparts, each of which shall constitute an original, but all of which, when taken together, shall constitute but one agreement.

Abercrombie & Fitch

Aeropostale

American Eagle

Ann Taylor

Ann Taylor Loft

Babies R Us

Bloomingdale’s

Brooks Brothers (card competitor)

Belks

Chico’s

Children’s Place

Eddie Bauer

Express

Gymboree & affiliate brands – Janie & Jack, Crazy 8

H&M

J Crew

JCPenney

J. Jill

Justice

Kohl’s

Levi’s

The Limited

Lord & Taylor

Lululemon

Macy’s

Neiman Marcus

Nike

Nordstrom

Polo/Ralph Lauren

Reebok

Saks Fifth Avenue

Sears

Target

title nine

Under Armour

Victoria’s Secret

Wal-Mart

Zara

Period reported: From ___________________        To __________________    (the “Reporting Period”)

During the Reporting Period, the only general-purpose card brand(s) included on co-branded credit cards issued under Program was (were) the following: ________________________

Dollar amount of total Sales on the Program co-branded Visa card issued by Issuer: __________________

Dollar Amount of total in-store sales on the Program co-branded Visa card issued by Issuer: ____________________

Total number of accounts in the Program:    

Total number of cards in the Program:    

Total number of active accounts (defined as having activity in the last 12 months) in the Program: _______________

Sales per active Program account:     

I certify that I am responsible for preparing this document on behalf of Issuer or Merchant and that I used commercially reasonable diligence gathering the foregoing information in accordance with Issuer's (or its affiliate's or contractor's) records and that to the best of my knowledge, the information contained in this document is accurate and complete.

By: ________________________________

Name: ______________________________

Title: _______________________________

(Must be an officer of Issuer or Merchant)