Compliance Terms

Creditsafe Compliance Terms

The following additional terms (“Compliance Terms”) apply if the Customer will be accessing Creditsafe’s compliance services (“Compliance Service”). Words defined in the General Terms shall have the same meaning in these Compliance Terms unless expressly stated to the contrary.

1. Definitions:

“Affiliates” means companies in common ownership or control with the Customer with access to the Compliance Service as may be expressly permitted under the Agreement (if any).

“Permitted Purpose” means the Customer’s internal business purposes including the lawful purpose of identity or age verification, fraud prevention and/or compliance with laws implemented to prevent money laundering, as applicable.

“Prohibited Business” means adult entertainment services of any kind; companies that handle physical third party repossession; dating services; massage services; tattoo services; companies that charge advance fees for debt or mortgage assistance relief (excluding refinancing of a dwelling loan or services offered by lawyers); private investigation or detective services (excluding assisting with pre-employment services with written consent); credit repair clinics or any type of company involved in credit repair; bail bondsman (unless licensed by the province in which they are operating); news agency or journalist; asset location service; law enforcement agency; company seeking information in connection with time shares; pawn shops; company that locates missing children; subscriptions (magazines, books, music); genealogical or heir research firm; credit counselling (except for not-for-profit credit counsellors); law firms.

“Security Event” means the actual or reasonably suspected misuse of and/or unauthorised access to the Customer’s Compliance Service, in particular, which results in access to personal data (such as social security or driver’s license numbers or dates of birth) which may be matched to a name of any person.

2. Provision of the Compliance Service

2.1. Access to the Compliance Service may be subject to (i) the Customer or its users’ credentials being verified to the satisfaction of Creditsafe (either for itself of on behalf its third-party service and/or Data Providers) for the purposes of preventing money laundering and the financing of terrorism as required by the Luxembourg law of November 12, 2004 (notably, article 3) and/or (ii) subject to additional terms of third party suppliers. To the extent applicable, Creditsafe shall notify the Customer as soon as reasonably practicable of any additional terms and shall provide the Customer with a copy of such additional terms. The Customer agrees to comply at all times with any additional terms when using the Compliance Services and in particular all provisions relating to the fight against money laundering and the financing of terrorism as required by the Luxembourg law of November 12, 2004.

3. Usage of the Compliance Service

3.1. In addition to compliance with the Customer Obligations and Conduct provisions set in clause 6 of the General Terms, the Customer shall:

3.1.1. only use the Compliance Service and Output Data within the scope of the licence granted to the Customer under the Agreement;

3.1.2. not make any use of the Compliance Service or Output Data for any purpose which is unlawful, harmful, threatening, defamatory, obscene or offensive or discriminatory;

3.1.3. use the Compliance Service and the Output Data for the Permitted Purpose only and for no other purpose (including, but not limited to) for (i) marketing; (ii) employment screening; (iii) credit assessment decision making; or (iv) reselling or otherwise making the Compliance Service and/or the Output Data available to third parties

3.1.4. shall reproduce and include without altering, removing or obscuring any copyright notices and proprietary legends of Creditsafe or its Data Providers as they appear in or on any reports or other output generated by using the Compliance Service;

3.1.5. not name Creditsafe (or any of its Data Providers) or refer to the Compliance Services and/or Output Data in any publication, news release, advertisements, or promotional or marketing materials unless otherwise agreed in advance with Creditsafe;

3.1.6. not cause or permit any third-party to breach any of the foregoing obligations;

3.1.7. use best endeavours to prevent unauthorised access to, or use of, the Compliance Service or any Output Data, whether the same is in electronic form or hard copy, by any person or entity, including implementing and documenting appropriate policies and procedures covering the administrative, physical and technical safeguards which are measured against objective standards and controls (“Customer’s Information Security Program”). Customer’s Information Security Program shall: (1) account for known and reasonably anticipated threats and Customer shall monitor for new threats on an ongoing basis; and (2) meet or exceed industry best practices. Customer will promptly remediate any deficiencies identified in Customer’s Information Security Program;

3.1.8. maintain and enforce data destruction procedures to protect the security and confidentiality of all Output Data obtained through the Compliance Service as it is being disposed as required by the Luxembourg law of August 1st, 2018 on the General Data Protection Regulation;;

3.1.9. be capable of receiving the Compliance Service via mechanical where the same as provided utilising “secure socket layer”, or such other means of secure transmission as is deemed reasonable by Creditsafe;

3.1.10. not access and/or use the Compliance Service via mechanical, programmatic, robotic, scripted or other automated search means, other than through batch or machine-to-machine applications approved by Creditsafe; and

3.1.11. take all steps to protect its network and computer environments, or those used to access the Compliance Service, from compromise.

3.1.12. take all necessary measures in the event of intrusion in the computer network and in particular with regard to the prevention and notification of computer incidents, as required by the Luxembourg law of May 28, 2019 on measures intended to ensure a common high level of network and information system security in the European Union (also known as the "NIS" Law).

3.2. The Customer acknowledges that Creditsafe and its Data Providers are subject to economic sanctions laws, including but not limited to those enforced by the U.S. Department of the Treasury’s Office of Foreign Assets Control ("OFAC"), the European Union, and the United Kingdom. Accordingly, the Customer shall comply with all economic sanctions laws of the United States, the European Union, and the United Kingdom. The Customer shall not provide access to Services to any individuals identified on OFAC’s list of Specially Designated Nationals, the UK’s HM Treasury’s Consolidated List of Sanctions Targets, or the EU’s Consolidated List of Persons, Groups, and Entities Subject to EU Financial Sanctions. The Customer shall not take any action which would place Creditsafe or its Data Providers in a position of non-compliance with any such economic sanctions laws;

3.3. The Customer warrants that it is not engaged in any Prohibited Business and will not use the Information for the benefit of any Prohibited Business;

3.4. The Customer shall defend, indemnify and hold harmless Creditsafe and its Data Providers from and against any and all claims, losses, costs, liabilities and expenses (including reasonable legal fees) arising from or in any way related to the use of the Compliance Services or Documentation by the Customer.

4. Security Events

4.1. The Customer shall report all Security Events to Creditsafe without delay and provide such information and assistance as reasonably required by Creditsafe. Further, the Customer shall comply with and be responsible for the legal obligations which may arise under all applicable law, including as required to notify all affected individuals of the occurrence of the Security Event.

4.2. The Customer agrees to indemnify and hold harmless Creditsafe and its third-party service and/or Data Providers in respect of any Security Event.

4.3. The foregoing provisions apply in addition to the Data Protection obligations as clause 5 of the General Terms.

5. Monitoring Customer Use / Misuse

5.1. The Customer agrees that Creditsafe may conduct periodic audits of Customer activity and use of the Compliance Service and/or Output Data to monitor compliance with applicable law and this Agreement. Creditsafe further investigates reports it may receive of misuse or abuse of the same. The Customer agree to permit Creditsafe to review usage of the Customer’s account for the Compliance Service for these purposes, and, also to co-operate with and provide such information and documents as Creditsafe may reasonably request in the investigation of reported or suspected abuse or misuse of the Compliance Service.

5.2. Violations may lead to suspension of the Customer’s access to the Compliance Service (without prejudice to any other rights remedies available to Creditsafe). Creditsafe may exercise all of the foregoing rights either on its own account or in conjunction with its third-party service and/or Data Providers.

5.3. Creditsafe shall be able to share information relating to any audits carried out on the Customer (including information on the nature and scope of the audit and any audit findings) with its Data Providers.

6. Grant of License by the Customer

6.1. In addition to the monitoring for compliance and to investigate any abuse or misuse of the Compliance Service, the Customer grants to Creditsafe a non-exclusive license to utilise data relating to the Customer’s use of the Compliance Service as follows:

6.1.1. to anonymise and aggregate such use data with similar data collected from other customers;

6.1.2. to analyse the use and performance of the Compliance Service and prepare and use reports relating to the same.

6.2. The Customer grants the foregoing rights to Creditsafe its exercise own account or to sub-license to or to exercise in conjunction with its third-party service and/or Data Providers.

7. Notification of Errors and Feedback

7.1. The Customer should advise Creditsafe if the Output Data gives any unexpected or apparently incorrect results.

7.2. Creditsafe will in its sole discretion and working together with its third-party service and/or Data Providers, examine and make any necessary modifications or corrections.

7.3. Creditsafe invites and welcomes Customer feedback on the Compliance Service which Creditsafe or its third-party service or Data Providers may freely use the same without obligation or liability to the Customer.

8. Data Retention

8.1. The Customer acknowledges and agrees that in order to comply with government regulations on money laundering and other due diligence checks, it shall only retain documents and evidence, that has been uploaded to Creditsafe’s platform as part of a search request (“Input Data”), for a period of 5 years following the termination of the relationship or the last transaction with its own respective client or supplier.

8.2. Creditsafe will only retain Input Data for up to 5 years following the termination of the Agreement, after which all Input Data will be permanently deleted.

Annex 1

The following notice and disclaimer applies where the Customer uses the Compliance Services to conduct ID verification checks generating Output Data (also known for the purposes of this Annex as the “Information Product”) provided by Refinitiv

The "Information Product" is any data or service provided by Refinitiv. Refinitiv or its third party providers own and retain all rights, title and interest, including but not limited to copyright, trademarks, patents, database rights, trade secrets, know-how, and all other intellectual property rights or forms of protection of similar nature or having equivalent effect, anywhere in the world, in the Information Product and user is not granted any proprietary interest therein or thereto. The Information Product constitutes confidential and trade secrets of Refinitiv or its third party providers. Display, performance, reproduction, distribution of, or creation of derivative works or improvements from Information Product in any form or manner is expressly prohibited, except to the extent expressly permitted hereunder, or otherwise, with the prior written permission of Refinitiv.

User may use the Information Product for internal purposes only. User may copy, paste and distribute internally only an insubstantial amount of the data contained in the Information Product provided that: (a) the distribution is incidental to or supports user's business purpose; (b) the data is not distributed by user in connection with information vending or commercial publishing (in any manner or format whatsoever), not reproduced through the press or mass media or on the Internet; and (c) where practicable, clearly identifies Refinitiv or its third party providers as the source of the data. Data will be considered in "insubstantial amount" if such amount (a) has no independent commercial value; or (b) could not be used by the recipient as a substitute for any product or service (including any download service) provided by Refinitiv or a substantial part of it.

To the extent that the Information Product contains any third party data referred to in the General Restrictions/Notices page set forth on https:// www.refinitiv.com/en/policies/third-party-provider-terms, the terms set forth on such General Restrictions/Notices page shall apply to user.

User acknowledges that access to certain elements of the Information Product may cease or may be made subject to certain conditions by Refinitiv or upon the instructions of the third party provider of those elements. Upon termination or expiration of this user license, all rights granted hereunder shall immediately terminate and user shall cease to use the Information Product and delete or destroy all copies thereof in its possession or control.

NEITHER REFINITIV NOR ITS THIRD PARTY PROVIDERS WARRANT THAT THE PROVISION OF THE INFORMATION PRODUCT WILL BE UNINTERRUPTED, ERROR FREE, TIMELY, COMPLETE OR ACCURATE, NOR DO THEY MAKE ANY WARRANTIES AS TO THE RESULTS TO BE OBTAINED FROM USE OF THE SAME. USE OF THE INFORMATION PRODUCT AND RELIANCE THEREON IS AT USER'S SOLE RISK. NEITHER REFINITIV OR ITS THIRD PARTY PROVIDERS WILL IN ANY WAY BE LIABLE TO USER OR ANY OTHER ENTITY OR PERSON FOR THEIR INABILITY TO USE THE INFORMATION PRODUCT, OR FOR ANY INACCURACIES, ERRORS, OMISSIONS, DELAYS, COMPUTER VIRUS OR OTHER INFIRMITY OR CORRUPTION, DAMAGES, CLAIMS, LIABILITIES OR LOSSES, REGARDLESS OF CAUSE, IN OR ARISING FROM THE USE OF THE INFORMATION PRODUCT. THE INFORMATION PRODUCT IS PROVIDED ON AN "AS IS" BASIS AND WITHOUT WARRANTY OF ANY KIND. NO WARRANTIES EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, INFRINGEMENT OR OTHERWISE IS PROVIDED HEREUNDER.

IN NO EVENT WILL REFINITIV OR ITS THIRD PARTY PROVIDERS BE LIABLE FOR ANY DAMAGES, INCLUDING WITHOUT LIMITATION DIRECT OR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, LOSSES OR EXPENSES ARISING IN CONNECTION WITH INFORMATION PRODUCT EVEN IF REFINITIV OR ITS THIRD PARTY PROVIDERS OR THEIR REPRESENTATIVES ARE ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, LOSSES OR EXPENSES. FURTHER, REFINITIV OR ITS PARTY PROVIDERS SHALL NOT BE LIABLE IN ANY MANNER FOR REDISTRIBUTOR'S PRODUCTS OR SERVICES.