• GBG's wholly owned subsidiary ("GBG's Subsidiary") Supplier (“Supplier”) hosts the Supplier Data
• GBG's Subsidiary and the Supplier receive and process the End User Data
• The End User Data includes personal data
• GBG's Subsidiary processes the End User Data in the EEA
• The Supplier processes the End User Data in the United States
• The Supplier is based outside of the EEA and the United Kingdom
• The Supplier has an arrangement in place with GBG's Subsidiary to maintain appropriate safeguards

The Supplier Data used to provide Compliance Platform - Device Fingerprint Dataset is supplied by the Supplier, TransUnion. GBG is obliged to ensure that all End Users agree to comply with the following licencing provisions.

1. DEFINITIONS
   1.1. In these Additional Terms, the following definitions shall apply, in addition to the definitions set out in the General Terms and Product Terms:
   “End User Data” means any data provided to GBG by the End User for processing in accordance with the terms of the Agreement including where relevant any personal data.

“Permitted Purpose” means the purposes, restrictions and or conditions for use of the Dataset outlined by the Supplier in clauses 2.2-2.3 in addition to the Customer User Case set out in the Agreement and clause 2.1.

"Standard Contractual Clauses" means: (i) where the EU GDPR applies, the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council ("EU SCCs"); and (ii) where the UK GDPR applies, standard data protection clauses in the form of the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses adopted pursuant to or permitted under Article 46 of the UK GDPR ("UK SCCs").

2. USE OF THE DATASET

2.1. This Dataset may only be used for the Customer Use Cases detailed below, provided that such Customer Use Case is selected on the End User's Order Form and the End User complies with any use case restrictions set out in the Agreement:

• ID Verification – Fraud
• ID Verification – Regulatory

2.2. The End User shall use the Service and the Dataset for the sole purpose of attempting to identify suspicious and/or high-risk devices used by individual users to access the End User’s website.

2.3. The End User warrants that it has the right to enter into the Agreement and that it will not use, or make available the Supplier Data, Dataset or Service for or in support of, directly or indirectly, any other person or enterprise.

2.4. The End User warrants that it will not use this Dataset for any reason outside of the Customer Use Case and the Permitted Purpose.

3. INTELLECTUAL PROPERTY RIGHTS

3.1. The End User acknowledges and agrees that: (a) TransUnion has and will retain all ownership rights (including but not limited to any copyright, patent, trade secret, trademark or other proprietary and/or Intellectual Property Rights) in and to its Intellectual Property Rights (including but not limited to any components thereof, any information contributed to the Dataset and Supplier Data); (b) TransUnion reserves all rights not expressly granted to the End User; and (c) TransUnion reserves the right to make changes in the Service and the Dataset, including operating procedures and type of equipment.

4. WARRANTY AND LIABILITY

4.1. The Service and the Dataset are provided “AS IS”. TransUnion does not warrant that the Service and the Dataset will be uninterrupted or error-free and makes no warranty regarding results that may be obtained. TRANSUNION MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. TransUnion shall not be held liable for any disturbances that the Service and the Datasets may cause to any hardware or software when used together or otherwise.

4.2. TRANSUNION’S TOTAL CUMULATIVE LIABILITY TO THE END USER UNDER THIS AGREEMENT OR ARISING FROM THE SERVICE AND THE DATASET SHALL BE LIMITED TO AN AMOUNT EQUAL TO ALL FEES PAID BY THE END USER DURING THE PRIOR THREE (3) MONTHS. The End User releases TransUnion from all obligations, liability, claims or demands in excess of the limitation. TRANSUNION, GBG AND THE END USER SHALL NOT BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL, INDIRECT, ECONOMIC OR PUNITIVE DAMAGES, OR LOSS OF PROFIT EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

4.3. The End User shall indemnify and hold TransUnion harmless from any claims arising out of the End User’s failure to obtain the data subject’s consent (if required).

5. DATA PROTECTION AND COMPLIANCE WITH RELEVANT LAWS

5.1. The Supplier Data used to provide you with this Dataset is hosted by the Supplier.

5.2. Notwithstanding the standard data protection provisions between GBG and the End User in the General Terms, the End User acknowledges and accepts that GBG shall act as a data processor in relation to the End User Data provided to GBG for this element of the Service, and the processing provisions set out in the relevant clauses of the Agreement shall apply.

5.3. The End User appoints GBG as a processor to process the End User Data for the purposes of delivering the Dataset to the End User.

5.4. In order to deliver the Dataset, GBG's Subsidiary shall receive and process the End User Data as an independent controller appointed by GBG. GBG’s Subsidiary processes the End User Data in the EEA.

5.5. In order to deliver the Dataset, the Supplier shall receive and process the End User Data as an independent controller appointed by GBG's Subsidiary. The Supplier processes the End User Data in the United States.

5.6. GBG’s Subsidiary has entered into Standard Contractual Clauses with the Supplier to ensure safe onward transit of the End User Data.