• Data Supplier hosts the Supplier Data
• Data Supplier receives and processes Client Information in its capacity as Controller
• Client Information includes Personal Data
• The Data Supplier is based in the UK
• The Data Supplier is located within the EEA
• The Data Supplier is a Credit Reference Agency (“CRA”) therefore the End User must include a reference to Credit Reference Agency Information Notice (“CRAIN”) in its fair processing notice

The Supplier Data that GBG uses to provide this Service is supplied by GBG’s Data Supplier, Equifax Ltd. GBG is obliged under the terms of its agreement with its Data Supplier to ensure that all End Users agree to comply with the provisions set out below.

1. DEFINITIONS
1.1. In these Additional Terms, the following definitions shall apply in addition to the definitions set out in the General Terms:
“Applicable Laws” means all applicable laws, enactments, rules, regulations, orders, regulatory policies, regulatory permits and licences, and any mandatory instructions or requests of a regulator, in each case which are in force from time to time, including:
i. The Consumer Credit Acts 1974 and 2006;
ii. The Data Protection Act 2018;
iii. The Representation of the People (England and Wales) Regulations 2001;
iv. The Financial Services and Markets Act 2000 (Money Laundering Regulations 2001);
v. Rules made by the Steering Committee on Reciprocity; and
vi. The Guide to Credit Scoring 2000

2. USE OF THE SUPPLIER DATA
2.1. The End User acknowledges and accepts that Equifax is a CRA and in utilising the services of a CRA, the End User is required by Equifax to include a link to the Credit Reference Agency Information Notice (commonly known as “CRAIN”) as set out below within their own fair processing notice or provide an off-line route to access information about CRAIN, such as printed copies The CRAIN notice link is as follows https://www.equifax.co.uk/crain.html.
2.2. The End User shall fully indemnify GBG against all liabilities, costs, expenses, damages and losses incurred by GBG as a result of the End User’s failure to incorporate the CRAIN notice within their fair processing policy and notify individuals of such notice in the provision of the End User’s products and services.
2.3. The End User must ensure that prior to any use of the Supplier Data, each consumer is provided with:
a) A clear notice, in accordance with Data Protection Laws, that a search of their data undertaken with a Credit Reference Agency which will return as applicable information including your public derogatory data, CCJs, bankruptcies, insolvencies, credit searches by debt collection agents, and will be used to assess their affordability (for the avoidance of doubt, such notice to consumers cannot be ‘hidden’ within a privacy policy or terms of use, and must be specifically highlighted as part of the customer onboarding journey (or equivalent process); and
b) the option for their data, as set out above, to not be searched and collected as set out above.
2.4. The Supplier Data may only be used on a single enquiry basis at the point at which a consumer opens an account or requests services.
2.5. The End User shall procure that Supplier Data is not transferred or Processed outside of the EEA.
2.6. The End User must not retain a copy of the Supplier Data in relation to each Consumer, for any future use save for retaining a copy for auditing or regulatory purposes
2.7. The End User’s use of the Supplier Data shall:
a) not be in relation to any application for or assessment of risk in relation to regulated credit activities;
b) only be where the assessment of affordability is necessary and appropriate:
• to either protect the consumer from over indebtedness or to assess the risk of providing products or services to a consumer, in each case in relation to the purchase of products or services which involve a financial commitment beyond a single transaction where payment is required at the time of sale; or
• due to a regulatory requirement or guidance issued by a relevant regulatory or governing body, requiring the Customer to undertake appropriate affordability assessments of consumers.
2.8. The End User shall not use the Supplier Data: (i) to increase account limits or spend velocity; or (ii) for any direct marketing purposes.
2.9. The Supplier Data cannot be used in isolation to decide about a consumer and should be used only for analysis of a risk flag forming part of a broader affordability assessment undertaken by the End User.
2.10. GBG may (at the request of the Data Supplier) from time to time and on reasonable notice to the End User update, modify and change the Supplier Data, the delivery mechanism, and the Permitted Purposes, or end this Agreement:
a) to comply with Applicable Law.
b) if the End User or any member of its corporate group applies for or is granted the status of a Credit Reference Agency.
c) to keep pace with changes to the Data Supplier’s IT systems and usual means of data supply; and
d) to accord with the Data Supplier’s rights under the terms on which it receives any relevant data from third parties.

3. DATA PROTECTION AND COMPLIANCE WITH RELEVANT LAWS
3.1. The End User acknowledges and accepts that the nature of this Service requires disclosure of Client Information to the Data Supplier who processes Client Information in its capacity as Controller and not Sub-processor. The End User’s request for this Service will be deemed to be the End User’s instruction to GBG to disclose Client Information to the Data Supplier as necessary to perform this Service.
3.2. The Data Supplier is based in the United Kingdom.

4. LIABILITY
4.1. The End User acknowledges: (a) that most of the Supplier Data is provided to the Data Supplier by third parties which it does not control, in particular in relation to the accuracy or completeness of the Supplier Data; (b) that the volume and nature of the information on our databases makes it impractical for the Data Supplier to verify it; and (c) that, if it were to attempt to verify the Supplier Data, it would only be able to offer the Supplier Data to the End User at significantly increased cost. The End User agrees that the Data Supplier shall not in any circumstances be liable for any loss or damage at all arising from any inaccuracies, faults or omissions in, or in the provision of, the Supplier Data unless caused by its negligence or wilful default.
4.2. The End User agrees that the Data Supplier shall not in any circumstances (including without limitation if it has been negligent) be liable for (a) any indirect or consequential loss or damage at all; or (b) any loss of business, capital, profit, reputation or goodwill, arising out of or in connection with the Supplier Data.
4.3. In addition to any right that the End User has against GBG, the Customer is also entitled make a claim directly against the Data Supplier under these Additional Terms provided that the End User gives the Data Supplier written notice of the claim within 6 months of becoming aware of the circumstances giving rise to the claim or, if earlier, 6 months from the time the End User ought reasonably to have become aware of such circumstances.
4.4. The Data Supplier’s entire liability in respect of any single cause of action arising out of or in connection with the Supplier Data (whether for breach of contract, negligence, under statute or otherwise) shall be limited to £50. The End User shall not be entitled to recover from the Data Supplier and GBG in respect of the same loss.
4.5. Nothing in these terms shall limit or exclude the Data Supplier’s liability for death, personal injury or fraud arising from its negligence.
4.6. Except as expressly provided in these terms, all representations, conditions and warranties whether express or implied (by statute or otherwise) are hereby excluded to the fullest extent permitted by law.

5. TERMINATION
5.1. Notwithstanding the termination provisions between GBG and the End User in the Terms and Conditions, under the terms of GBG’s agreement with the Data Supplier, the supply of the Supplier Data can be terminated at any time if such supply is no longer possible under the terms of the agreement that the Data Supplier has in place with its own third party data suppliers.
5.2. The Data Supplier may cease to make Supplier Data available to the End User if in their sole discretion it is not satisfied that the Supplier Data is being used in accordance with these Additional Terms, and or demonstrates compliance with Applicable Laws.