• Supplier hosts the Supplier Data
• Supplier is a Sub-processor of Client Information
• Client Information includes Personal Data
• The Sub-processor is located in the United States of America
• The Sub-processor is located outside of the EEA
• The Sub-processor uses further Sub-processors based in the United States of America
• GBG has an arrangement in place with the Sub-processor to maintain appropriate safeguards

The Supplier Data used to provide USA Identity Dataset is supplied by GBG’s Data Supplier, IDology Inc. GBG is obliged under the terms of its agreement with IDology Inc. to ensure that all End Users agree to comply with the following licensing provisions:

1. DEFINITIONS
1.1. In these Additional Terms, the following definitions shall apply, in addition to the definitions set out in the Agreement:
“Applicant” means an individual applying for the purchase of a product or service or for some other benefit from the End User.
“Application” means IDology’s proprietary computer software that comprises the principal application software to be used in providing the Services.
“IDology Confidential Information” means information in the possession of IDology, regardless of the media in which it resides, and whether retained in written or electronic form, or otherwise, which information by its nature is confidential, including, but not limited to, Trade Secrets and Supplier Data.
“IDology” means IDology, Inc.
“IDology IP” means IDology’s intellectual property, including its proprietary technology, which includes, without limitation, the Services, the Application, its hardware designs, algorithms, software (in source code and object code forms), user interface designs, architecture, class libraries, objects and documentation (both printed and electronic), network designs, know-how, trade secrets and any related intellectual property rights throughout the world (whether owned by IDology or licensed to IDology from a third party), IDology’s copyrights, and any derivatives, improvements, enhancements, updates, modifications, or extensions of IDology intellectual property.
“KBAs” means a component of the IDV Services comprising IDology’s (or its data supplier’s) proprietary question and answer sets for use in Applicant Verification. 
“Person” means any corporation, company, partnership, firm, joint venture, association, trust, government agency, political subdivision, other entity, or individual.
“Representatives” means a Person’s affiliates, and its and its Affiliates’ owners, members, directors, officers, employees, agents, independent contractors, investors, attorneys, licensees, and other representatives.
“IDV Services” means IDology’s proprietary identity and age verification services provided as part of this Dataset.
“Trade Secret” means information, without regard to form, including, but not limited to, technical or nontechnical data, a formula, a pattern, a compilation, a program, a device, a method, a technique, a drawing, a process, financial data, financial plans, product plans, or a list of actual or potential customers or suppliers which is not commonly known by or available to the public and which information (i) derives economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use, and (ii) Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.
“Verification” means the process by which the End User, utilizing the IDV Services, seeks to verify the identity or age of its Applicant.

2. USE OF DATASET AND IDV SERVICES

2.1 If the End User processes personal data belonging to data subjects residing in the United States or any of its territories then clauses 2.2-2.5 below shall apply.

2.2. The terms ‘consumer reporting agency’, ‘consumer report,’ ‘permissible purposes’, and ‘adverse action’ utilized in clause 2 shall adhere to the definitions ascribed to them under the Fair Consumer Reporting Act, 15 U.S.C. §1681 et seq. (“FCRA”).

2.3 THE END USER ACKNOWLEDGES AND AGREES THAT (A) GBG AND IDOLOGY DO NOT QUALIFY AS A “CONSUMER REPORTING AGENCY”, (B) THAT THE IDV SERVICES PROVIDED TO END USER HEREUNDER DO NOT CONSTITUTE “CONSUMER REPORTS,” AND (C) THAT THE IDV SERVICES ARE EXCLUSIVELY PROVIDED FOR IDENTITY VERIFICATION AND FRAUD PREVENTION, AND THEREFORE END USER SHALL NOT USE THE IDV SERVICES AS A FACTOR TO DETERMINE ELIGIBILITY FOR CREDIT, INSURANCE, EMPLOYMENT, OR ANY OTHER PERMISSIBLE PURPOSES UNDER THE FCRA OR ANY OTHER SIMILAR APPLICABLE CONSUMER CREDIT LAW IN THE UNITED STATES OR OTHERWISE.

2.4. GBG grants the End User a non-exclusive, non-assignable, non-sublicensable license to use the IDV Services in the United States for the purposes of Verification of End User’s Applicants subject to the following limitations: End User will not use the Services (i) for any “permissible purpose” under FCRA (15 U.S.C. Sec. 1681 et seq.) or use any of the information it receives through the IDV Services to take any “adverse action”, as that term is defined in the FCRA; (ii) in violation of the provisions of and regulations pursuant to the Drivers Privacy Protection Act (18 U.S.C. Section 2721 et seq.); (iii) other than pursuant to an exception of the privacy provisions of and regulations issued pursuant to the Gramm-Leach-Bliley Act (15 U.S.C. Sec. 6801 et seq.); or (iv) in violation of such other future legislation that IDology reasonably determines limits the use of the IDV Services and Supplier Data; or (v) for marketing purposes. 
2.5. Verification must be authorized by the consumer for the use in the normal course of business submitted by the individual to the business and, if the submitted information is incorrect, to obtain correct information, but only for the purpose of preventing fraud or ID verification by, or pursuing legal remedies against, or recovering on a debt or security interest against, the individual. 18 U.S.C. § 2721 (b)(3)
2.6. Change to Services: IDology, directly or indirectly through GBG, has the right to implement changes to the IDV Services from time to time.
2.7. IDology Confidential Information: End User acknowledges that in connection with its access and receipt of the IDV Services, it will, either directly or indirectly through GBG, receive IDology Confidential Information from, or have access to IDology Confidential Information in the possession of, IDology, including, but not limited to, KBAs and other Supplier Data, and Trade Secrets. End User will (i) hold any such IDology Confidential Information with at least the same level of care as it uses for its own IDolgoy Confidential Information of the same nature, but not less than a commercially reasonable level of care, (ii) use the IDology Confidential Information only as reasonably necessary or appropriate in connection with its verification of Applicants, and (iii) unless otherwise required by law, not disclose such IDology Confidential Information to any third Person, except to End User’s employees or other representatives, bound by End User to these same confidentiality restrictions, as reasonably necessary in connection with End User’s Verification of Applicants. End User’s confidentiality obligations under this section will continue during the term of the Agreement and for two (2) years following the end of the term, except that those obligations will continue beyond that period to the extent, and so long as, the IDology Confidential Information comprises one or more Trade Secrets.
2.8. Access of IDology Systems: To the extent that GBG has provided the End User certain access to IDology’s systems for purposes of managing its Verification settings or other uses, the End User will take reasonable steps to ensure that such access will be restricted to those of End User’s employees or agents who are engaged in the Verification process and to ensure that its employees and agents will not utilize such access for personal reasons. Those steps will include limiting access to passwords, access codes, or other confidential information necessary for End User to obtain such access to those with a need-to-know in connection with the Verification process, and changing of passwords at least every ninety (90) days or sooner if an employee or agent who has utilized a password is no longer responsible for obtaining such access, or if End User suspects an unauthorized Person has learned of the password. End User immediately will notify GBG if the End User knows of or suspects unauthorized access to IDology’s systems. End User will cooperate with GBG in putting in place other reasonable access security controls recommended by GBG or IDology.
2.9. The End User agrees that by using the IDV Services it grants IDology the right to utilize Client Information in its consortium fraud network (the “Velocity Network”) to help perform real-time fraud prevention and regulatory compliance services for its customers by combining the Client Information with other personal data that it receives from, or on behalf of, other customer/persons by providing matches for velocity or anomalies. All data that is fed into the Velocity Network is pseudonymized, encrypted in transit and at rest, and masked upon receipt and will not itself be appended or provided outright to any other business customer.  

3. LIABILITY
3.1. If at any time, IDology determines, in its reasonable discretion, that an End User is in violation of the terms of these Additional Terms or the Agreement, and that violation is materially detrimental or reasonably could be materially detrimental to IDology, or that an End User is using the IDV Services or Supplier Data in a manner inconsistent with inconsistent with the Permitted Purpose, IDology, upon written notice to GBG, may require GBG promptly to terminate the End User’s use of the IDV Services.
3.2. IN NO EVENT WILL GBG OR END USER, OR THEIR RESPECTIVE REPRESENTATIVES OR SUPPLIERS (INCLUDING IDOLOGY) BE LIABLE FOR (A) SPECIAL, INCIDENTAL, INDIRECT, OR CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR REVENUES), ARISING OUT OF OR IN ANY MANNER IN CONNECTION WITH THE IDOLGOY SERVICES, THESE ADDITIONAL TERMS, THE PERFORMANCE OR BREACH OF THESE ADDITIONAL TERMS, THE SUBJECT MATTER OF THESE ADDITIONAL TERMS OR END USER’S USE OF, OR IN INABILITY TO USE, THE SERVICES, ANY INFORMATION OR DATA PRODUCED BY THE IDOLOGY SERVICES OR ANY OTHER INFORMATION, DATA OR MATERIALS PROVIDED TO THE OTHER, REGARDLESS OF THE FORM OF ACTION (INCLUDING STRICT LIABILITY OR NEGLIGENCE), WHETHER OR NOT THEY HAVE BEEN ADVISED, OR OTHERWISE MIGHT HAVE ANTICIPATED THE POSSIBILITY, OF SUCH DAMAGES; PROVIDED THAT THE FOREGOING LIMITATION WILL NOT APPLY IN THE CASE OF INTENTIONAL MISUSE BY END USER OF SUPPLIER DATA OR MISAPPROPRIATION OR MISUSE OF IDOLOGY IP OR TRADE SECRETS. GBG’S AGGREGATE LIABILITY FOR ANY OR ALL LOSSES OR INJURIES ARISING OUT OF ANY ACTS OR OMISSIONS UNDER THESE ADDITIONAL TERMS OR RELATING TO ITS SUBJECT MATTER WILL BE LIMITED TO THE FEES PAID BY END USER FOR THE IDOLOGY SERVICES UNDER THEIR AGREEMENT DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRIOR TO THE OCCURRENCE OF THE FIRST EVENT GIVING RISE TO ALL OR PART OF THE LIABILITY.

4. EXCLUSION OF WARRANTY/IES
4.1. NEITHER GBG NOR IDOLOGY GUARANTEES OR WARRANTS THE CORRECTNESS OR COMPLETENESS OF THE IDV SERVICES OR THEIR DATABASES. THE SERVICES ARE PROVIDED ON AN “AS IS” BASIS, AND END USER USES THE SERVICES AT ITS OWN RISK. NEITHER GBG NOR IDOLOGY MAKES ANY REPRESENTATION OR WARRANTY, EITHER EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, SUITABILITY, FITNESS FOR A PARTICULAR USE OR PURPOSE, NONINFRINGEMENT, TITLE, OR WARRANTIES ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE, AND NEITHER GBG NOR IDOLOGY REPRESENTS OR WARRANTS THAT THE IDV SERVICES WILL BE UNINTERRUPTED, OR ERROR-FREE, AND ALL SUCH REPRESENTATIONS OR WARRANTIES ARE EXPRESSLY DISCLAIMED. END USER ACKNOWLEDGES THAT GBG OR IDOLOGY OBTAIN CONSUMER AND OTHER DATA FROM THIRD PARTY SOURCES, WHOSE DATA IS NOT NECESSARILY COMPLETELY ACCURATE OR COMPLETE, AND THAT THEREFORE NEITHER GBG OR IDOLOGY CAN AND NEITHER DOES WARRANT THE ACCURACY, INTEGRITY OR COMPLETENESS OF CONSUMER OR OTHER DATA UTILIZED, STORED OR TRANSMITTED AS PART OF THE IDOLOGY SERVICES.

5. INTELLECTUAL PROPERTY RIGHTS
5.1. IDology retains all right, title, and interest in and to the IDV Services, IDology’s databases, including all physical copies of them, and all IDology IP rights related to the IDV Services. End User acquires no IDology IP pursuant to the Agreement. End User will not, directly or indirectly, reproduce, retransmit, republish, reverse engineer, decompile, disassemble, or otherwise attempt to derive source code or other trade secrets from any of the IDology IP.

6. INDEMNIFICATION
6.1. Indemnification. To the extent that any End User agrees to indemnify GBG in accordance with the General Terms and/or Product Terms, such indemnification will extend to IDology and its Representatives. Further, End User will indemnify, defend, and hold harmless IDology and its Representatives from and against any and all costs, liabilities, losses, and expenses (including, but not limited to, reasonable attorneys’ fees) resulting from or arising out of any action brought by any third Person against IDology resulting from or arising out of End User’s performance or failure to perform its obligations under these Additional Terms.

7. THIRD PARTY BENEFICIARY; NO CONTRACT LIABILITY
7.1. IDology (and as applicable, its Representatives) will be a third party beneficiary in relation to these Additional Terms, including, but not limited to, with respect to IDology’s right to change the IDV Services (clause 2.6), its right to enforce protection of its IDology Confidential Information (clause 2.7) and the IDology IP (clause 5), compliance with the access security controls (clause 2.8), the disclaimers and liability limitations (clause 3, 4, and 6), and its (and its Representatives’) rights to indemnification (clause 6). IDology is not a party to the Additional Terms, and will have no liability to End User under these Additional Terms or the Agreement or in connection with the IDV Services. Should any arbitrator or judge determine that, notwithstanding the foregoing sentence, IDology has liability to End User relating to the Services or the subject matter of these Additional Terms, whether in contract or tort, or under any other theory, IDOLOGY’S AGGREGATE LIABILITY FOR ANY OR ALL LOSSES OR INJURIES WILL BE LIMITED TO THE FEES PAID BY END USER FOR THE IDV SERVICES UNDER THESE ADDITIONAL TERMS DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRIOR TO THE OCCURRENCE OF THE FIRST EVENT GIVING RISE TO ALL OR PART OF THE LIABILITY.

8. TERMINATION OF THE IDV SERVICES
8.1. IDology will have the right to require GBG to terminate the IDV Services with respect to any End User if that End User is in material breach of any of the provisions of these Additional Terms, that are for the benefit of IDology, or if the End User’s acts or omissions with respect to its use of the IDV Services are wrongful, or for other good reason.

9. DATA PROTECTION AND COMPLIANCE WITH RELEVANT LAWS
9.1. The Supplier Data used to provide you with this element of the Service is hosted by the Data Supplier. In order to perform the Services, the Data Supplier shall act as Sub-processor of your Client Information (including any Personal Data supplied) for the sole purpose of delivering this element of the Service. The End User authorises GBG to appoint the Data Supplier as Sub-Processor for the purposes specified in this clause 
9.2. The Data Supplier is based in United States of America which is located outside of the EEA. To ensure that GBG is able to lawfully transfer Personal Data to the Data Supplier (acting as Sub-processor of the Client Information) and to enable GBG to provide and maintain appropriate safeguards with the Data Supplier, the Client hereby grants GBG a mandate to conclude EU Model Clauses with the Sub-processor on behalf of the Client. GBG shall be entitled to sign the EU Model Clauses as Data Processor on behalf of its Clients generally and shall not be required to name the Client in such document.
9.3. The Data Supplier uses further Sub-processors based in the United States of America which is located outside of the EEA