• The Data Supplier hosts the Supplier Data
• The Data Supplier receives and processes End User Data in its capacity as an independent controller
• The End User Data includes Personal Data
• The Data Supplier is located in Ontario in Canada
• The Data Supplier is located outside of the EEA and the UK
• Commercial organisations in Canada which are subject to the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”) are deemed to offer an adequate level of data protection by the European Commission and UK Government.
• Ontario as a province of Canada is subject to PIPEDA and therefore businesses within Ontario are deemed to be adequate by the European Commission.

The Supplier Data used to provide the Canada Credit Bureau Dataset is supplied by Equifax Canada (“Equifax”). GBG is obliged under the terms of its agreement with Equifax to ensure that all End Users agree to comply with the following licensing provisions:

1. DEFINITIONS
1.1. In these Additional Terms, the following definitions shall apply, in addition to the definitions set out in the General Terms:
“Consumer Information” means any Personal Data about an individual that is provided to GBG and Equifax for the performance of the Services in relation to this Dataset.
“End User Data” means any data provided to GBG by the End User for processing in accordance with the terms of the Agreement including where relevant any Consumer Information.
“End User Information Form” means the information form containing details of the End User’s business, including, but not limited to, contact information and nature of the End User’s business.
“Permitted Purpose” means the purposes, restrictions and or conditions for the End User’s use of the Dataset outlined by Equifax in these Additional Terms.

2. USE OF THE DATASET
2.1. The End User agrees to only use this Dataset for the purpose of identity verification for its direct business and in a manner that complies with applicable laws, including Canadian federal and provincial laws.
2.2. The End User agrees that it will not:
(a) Resell, transfer, distribute or otherwise give any third-party access to the Dataset;
(b) Assert any intellectual property right claim or other interest in the Dataset and its Output Materials; and
(c) Assign or otherwise transfer any of its rights to use this Dataset.
2.3. The End User agrees that it will:
(a) obtain an individual's consent to disclose the Consumer Information to GBG and Equifax to use it to deliver this Dataset, including keeping a record, before the End User sends the Consumer Information to GBG and Equifax;
(b) keep all information, data and documentation relating to this Dataset, including any account codes and passwords used to access this Dataset secure and confidential;
(c) securely destroy or delete information received as a result of this Dataset when it no longer has a need to keep it;
(d) allow GBG to conduct an audit to confirm that the End User is in compliance in accordance with the Agreement and these Additional Terms;
(e) provide GBG with any relevant information and documents that GBG requests to respond to any question, investigation or audit by Equifax under GBG’s agreement with Equifax;
(f) give GBG prompt notice of any change that occurs from time to time in the information it provided on its End User Information Form;
(g) comply with any changes to these Additional Terms made by Equifax and notified to the End User by GBG, as a condition of its continued use of this Dataset; and
(h) consent to Equifax and/or GBG sharing any non-personal information (as defined under Applicable Law) about the End User's use of the Services with the other.
2.4. The End User represents and warrants that:
(a) the Dataset will not be used, in whole or in part, as a basis for determining the eligibility of an individual for credit;
(b) the End User Data transferred to GBG and Equifax for the provision of the Services in relation to this Dataset has been collected lawfully and in compliance with all applicable laws and in using the Dataset, the End User will not be in breach of any third-party rights or applicable laws; and
(c) except as expressly permitted, it will not use or make available the Dataset for or in support of, directly or indirectly, any third party.
2.5. The End User acknowledges and agrees that:
(a) the receipt of the Services is dependent in part, upon the Supplier Data in Equifax’s databases, which cannot be controlled;
(b) Equifax makes no representation, warranty or guarantee regarding the accuracy, completeness, or reliability of the Dataset. For clarity, the Dataset is intended to streamline and increase the security of the End User’s authentication processes and in any case, should not solely be relied upon to approve or decline an individual for receipt of products or services;
(c) acknowledge that this Dataset is not guaranteed to be error-free or uninterrupted; and
(d) acknowledge that these Additional Terms may change from time to time to comply with the applicable law.
2.6. The End User warrants that it will not use this Dataset for any reason outside of the Permitted Purpose, which is limited to End User’s own internal purposes only.

3. DUE DILLIGENCE
3.1. Prior to granting the End User access to this Dataset, GBG must carry out a comprehensive membership review of the End User to determine whether the End Users are appropriately verified and credentialed.
3.2. The End User acknowledges and agrees that access to this Dataset is dependent on the completion of a satisfactory security audit and questionnaire that demonstrates compliance with these terms in accordance with clause 3.1.

4. SERVICE LEVELS
4.1. Notwithstanding the Service Levels in the Agreement, the End User acknowledges and accepts that:
(a) Equifax performs regular maintenance on their systems and may utilise all their published maintenance windows during which the use of the Dataset may be unavailable. The maintenance windows are as set out below in Eastern Time (ET):
• Monday: 12:30 am to 4:30 am ET
• Tuesday to Saturday: 3.30am to 4.00am ET
• Sunday 2.30am to 6.30 am ET
(b) Equifax provides no specific resolution times for incidents that affects their services therefore the service resolution times as part of GBG’s Standard Support Services do not apply for this Dataset.

5. DATA PROTECTION AND COMPLIANCE WITH RELEVANT LAWS
5.1. The End User warrants that it shall comply with all applicable laws, including but not limited to Canadian privacy laws, consumer reporting legislation and any other applicable acts, regulations, judicial actions and/or orders of an administrative tribunal, as now or as become effective throughout the term of the Agreement.
5.2. The End User shall have a lawfully compliant privacy notice at the point at which it collects personal data from the data subject/individual. The End User’s privacy notice shall provide the necessary information that a reasonable data subject/individual would require to understand the nature, purpose, and consequence of the collection, use and disclosure of their personal data. The End User warrants and represents that its privacy notice includes all of the required information it is obligated to incorporate under PIPEDA and other applicable laws, including but not limited to the following:
(a) The personal data it is collecting;
(b) How it will use the personal data that it is collecting;
(c) Who it will transfer the personal data to;
(d) Why it is transferring the personal data to other parties; and
(e) The risks of harm or other consequences.
5.3. In respect of the collection, use and disclosure of Consumer Information under these Additional Terms, the End User covenants and agrees: (a) to comply with any applicable laws, including without limitation, all applicable privacy legislation; and (b) to obtain the appropriate consent from individuals.
5.4. The End User shall fully indemnify GBG against all liabilities, costs, expenses, damages and losses incurred by GBG as a result of the End User’s failure to comply with clauses 5.2 and 5.3 of these Additional Terms. Liability in relation to this indemnity shall be uncapped.
5.5. The Supplier Data used to provide this Dataset is hosted by Equifax in Canada. In order to deliver this Dataset Equifax shall receive and process End User Data in its capacity as a controller.
5.6. Equifax is business located in Ontario and governed by PIPEDA.