The Supplier Data used to provide South Africa Identity is provided by GBG’s Supplier. GBG is obliged under the terms of its agreement with the Supplier that all Intermediaries comply with the following licensing provisions:

1.1 DEFINITIONS
“Consumer Credit Information” shall bear the meaning set out in Section 70 (1) of the NCA
“NCA” means the National Credit Act, 34 of 2005 together with the Regulations as well as the National Credit Act 19 of 2014 and the accompanying amended Regulations
“Regulations” means the National Credit Regulations, published in Government Gazette No. 8477. Notice 28864 and such other Regulations promulgated in terms of the NCA from time to time;
“Report” means a credit report and / or consumer enquiry generated response to a Request;
“Request” means a request for a Report
“The FIC Act” means the Financial Intelligence Centre Act, 2001 as amended.

1.2 In order to access this Dataset by the Intermediary on behalf of its End Users, it shall:
(a) Provide GBG and the Supplier with a list of all End Users who have requested Reports on request as well as any such other information as may be requested by the Supplier;
(b) Comply with all relevant laws, including the NCA and the Regulations and the FIC Act;
(c) implement an effective audit trail for each and every transaction in respect of the request and receipt of Report (which audit trail shall be retained for three (3) years from the date of the customer request) including the dates and times when Reports were requested and dates and times when Reports were sent to such End Users
(d) make such audit trail available to the Supplier within fourteen (14) days of its request. Without limiting the generality of that aforegoing, the Intermediary shall for the purposes of Regulation 17(1), retain for a period of two years from date of request, the number of enquires made on a consumer record, including the name of the person who made the request and a contact person if available;
(e) maintain records of Consumer Credit Information in accordance with Regulation 18(1) and the following standards (i) identified by the consumer's identity number or passport number, or where no identity number or passport number is available for a particular person, any other reasonable method to identify the record; (ii) collected, processed and distributed In a manner that ensures that the records remain confidential and secure; (iii) protected against accidental, unlawful destruction and unlawful intrusion; (iv) protected against loss or wrongful alteration; and (v) protected against unauthorised disclosure or access
(f) be responsible for the verification of End Users in accordance with the due diligence process at clause 1.3 below; and

1.3 The Intermediary acknowledges that prior to granting each End user access to this Dataset, it must carry out a due diligence check on the End User in accordance the Customer Due Diligence requirements and Risk Management and Compliance Programme as contained in the FIC Act.