• The Data Supplier’s supplier hosts the Supplier Data
• The Data Supplier and the Data Supplier’s supplier receive and process the Client Information
• The Client Information includes personal data
• The Data Supplier processes the Client Information in the EEA
• The Data Supplier’s supplier processes the Client Information in the United Kingdom

The Supplier Data that GBG uses to provide UK Mobile Identity is supplied by GBG’s Data Supplier. GBG is obliged under the terms of its agreement with the Data Supplier to ensure that all End Users agree to comply with the following provisions:

1. DEFINITIONS
1.1. In these Additional Terms, the following definitions shall apply, in addition to the definitions set out in the General Terms:
“Permitted Purpose” means the permitted purpose set out in the End User’s individual Use Case.
“Use Case” means the intended use of the Supplier Data within the End User’s products and services, which has been agreed with GBG and the Data Supplier, prior to gaining access to the Supplier Data.

2. USE OF THE SERVICE
2.1. The End User may only access the Supplier Data following the Data Supplier’s approval of its Use Case.
2.2. The End User may only use the Supplier Data for the Permitted Purpose.
2.3. Any changes to the Use Case or Permitted Purpose must be agreed by the Data Supplier, prior to delivery of the Supplier Data.

3. DATA PROTECTION
3.1. The Supplier Data used to provide you with this Dataset is hosted by the Data Supplier’s supplier.
3.2. In order to deliver the Dataset, the Data Supplier shall receive and process the Client Information in its capacity as an independent controller.
3.3. The Data Supplier processes the Client Information in the EEA. The EEA is deemed to offer an adequate level of data protection for personal data by the United Kingdom, therefore the Client Information can be safely transferred to the Data Supplier without further data export safeguards.
3.4. In order to deliver the Dataset, the Data Supplier’s supplier shall receive and process the Client Information as an independent controller appointed by the Data Supplier.
3.5. The Data Supplier’s supplier processes the Client Information in the United Kingdom. The United Kingdom is deemed to offer an adequate level of data protection for personal data by the European Commission, therefore the Client Information can be safely transferred to the Data Supplier’s supplier without further data export safeguards.