• GBG's wholly owned subsidiary ("GBG's Subsidiary") Supplier (“Supplier”) hosts the Supplier Data
• GBG's Subsidiary and the Supplier receive and process the End User Data
• The End User Data includes personal data
• GBG's Subsidiary processes the End User Data in the EEA
• The Supplier processes the End User Data in the United States
• The Supplier is based outside of the EEA and the United Kingdom
• The Supplier has an arrangement in place with GBG's Subsidiary to maintain appropriate safeguards

The Supplier Data used to provide Compliance Platform - Adverse Media Diligent Dataset is supplied by the Supplier, Diligent Corporation. GBG is obliged to ensure that all End Users agree to comply with the following licencing provisions.

1. 
   DEFINITIONS
   1.1. In these Additional Terms, the following definitions shall apply, in addition to the definitions set out in the General Terms and Product Terms:

“End User Data” means any data provided to GBG by the End User for processing in accordance with the terms of the Agreement including where relevant any personal data.

"Standard Contractual Clauses" means: (i) where the EU GDPR applies, the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council ("EU SCCs"); and (ii) where the UK GDPR applies, standard data protection clauses in the form of the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses adopted pursuant to or permitted under Article 46 of the UK GDPR ("UK SCCs").

2. USE OF THE DATASET

2.1. This Dataset may only be used for the Customer Use Cases detailed below, provided that such Customer Use Case is selected on the End User's Order Form and the End User complies with any use case restrictions set out in the Agreement:

• ID Verification – Fraud
• ID Verification – Regulatory

2.2. The End User warrants that it will not use this Dataset for any reason outside of the Customer Use Case.

3. SERVICE LEVELS

3.1. Notwithstanding the Service Levels in the Agreement, the End User acknowledges and accepts that the Supplier performs regular maintenance operations on their systems during which the use of the Dataset may be unavailable.

4. DATA PROTECTION AND COMPLIANCE WITH RELEVANT LAWS

4.1. The Supplier Data used to provide you with this Dataset is hosted by the Supplier.

4.2. Notwithstanding the standard data protection provisions between GBG and the End User in the General Terms, the End User acknowledges and accepts that GBG shall act as a data processor in relation to the End User Data provided to GBG for this element of the Service, and the processing provisions set out in the relevant clauses of the Agreement shall apply.

4.3. The End User appoints GBG as a processor to process the End User Data for the purposes of delivering the Dataset to the End User.

4.4. In order to deliver the Dataset, GBG's Subsidiary shall receive and process the End User Data as an independent controller appointed by GBG. GBG’s Subsidiary processes the End User Data in the EEA.

4.5. In order to deliver the Dataset, the Supplier shall receive and process the End User Data as an independent controller appointed by GBG's Subsidiary. The Supplier processes the End User Data in the United States.

4.6. GBG’s Subsidiary has entered into Standard Contractual Clauses with the Supplier to ensure safe onward transit of the End User Data.