• Supplier hosts the Supplier Data
• Supplier is a Sub-processor of Client Information
• Client Information includes Personal Data
• The Sub-processor is located in Brazil
• The Sub-processor is located outside of the EEA
• The Supplier has not agreed to be subject to GDPR and has not agreed to equivalent data protection provisions
• The Supplier did not pass GBG’s full GDPR due diligence assessment and information security review.
• Where GDPR applies to the End User, the End User must rely on a derogation to transfer Client Information to the Sub-processor based outside of the EEA in accordance with Article 49 GDPR
• The End User must not provide Personal Data belonging to EEA Data Subjects for sub-processing by this Supplier

The Supplier Data that GBG uses to provide Brazil Population Check is supplied by GBG’s Data Supplier. GBG is obliged under the terms of its agreement with its Data Supplier to ensure that all End Users agree to comply with the following provisions:

1. DEFINITIONS
1.1. In these Additional Terms, the following definitions shall apply, in addition to the definitions set out in the General Terms:
“Permitted Purpose” means use of the Supplier Data solely for the purpose of identity verification.

2. USE OF THE SUPPLIER DATA
2.1. The Supplier Data may only be used for the Permitted Purpose in accordance with these terms.
2.2. The End User warrants that it will not:
(a) use the Supplier Data for any reason outside of the Permitted Purpose;
(b) copy or modify the Supplier Data to create a derivative work based on the search results;
(c) make the Supplier Data or information available to any third party, including a parent, subsidiary or associated company.
2.3. The Supplier Data is supplied on an “as is” basis, for which no warranties of any kind can be given.

3. DATA PROTECTION AND COMPLIANCE WITH RELEVANT LAWS
3.1. The Supplier Data used to provide this element of the Service is hosted by the Data Supplier. In order to perform the Services, the Data Supplier shall act as Sub-processor of Client Information (including any Personal Data supplied) for the sole purpose of delivering this element of the Service. The End User authorises GBG to appoint the Data Supplier as Sub-Processor for the purposes specified in this clause 3.1 on basis of the conditions set out in these Additional Terms.
3.2. The Data Supplier is based in Brazil which is located outside of the EEA. Where GDPR applies to the End User, the End User acknowledges that prior to submitting Client Information to GBG for processing it shall determine, and is solely liable for ensuring that it can rely on a derogation to transfer Client Information to the Sub-processor based outside of the EEA in accordance with Article 49 GDPR.
3.3. The Data Supplier has not agreed to be subject to GDPR and has not agreed to equivalent data protection provisions. However, the Data Supplier has confirmed that the Supplier Data has been acquired legally and that they have all licences consents and authorisations to provide this element of the Service in accordance with local law.
3.4. The Supplier did not fully meet the requirements GBG’s GDPR due diligence assessment and information security review. However, the only Client Information shared with this Data Supplier is the Brazilian Natural Persons Register ID Number - the Cadastro de Pessoas Fisicas (CPF).
3.5. The End User warrants that it shall not provide Personal Data belonging to EEA Data Subjects for sub-processing by this Data Supplier.
3.6. The End User acknowledges and accepts that it has read and understood these Additional Terms and that it is solely liable for any decision to use this element of the Service and any risk or liability associated with its use.