• Supplier hosts the Supplier Data
• Supplier is a Sub-processor of Client Information
• Client Information includes Personal Data
• The Sub-processor is located in the United States of America
• The Sub-processor is located outside of the EEA
• The Sub-processor uses further Sub-processors based in the United States of America
• GBG has an arrangement in place with the Sub-processor to maintain appropriate safeguards

The Supplier Data that GBG uses to provide USA Identity is supplied by GBG’s Data Supplier, IDology Inc. GBG is obliged under the terms of its agreement with IDology Inc. to ensure that all End Users agree to comply with the following provisions:

1. DEFINITIONS
1.1. In these Additional Terms, the following definitions shall apply, in addition to the definitions set out in the General Terms:
“Applicant” means an individual applying for the purchase of a product or service or for some other benefit from Client.
“Application” means IDology’s proprietary computer software that comprises the principal application software to be used in providing the Services.
“Confidential Information” means information in the possession of IDology, regardless of the media in which it resides, and whether retained in written or electronic form, or otherwise, which information by its nature is confidential, including, but not limited to, Trade Secrets and Consumer Data.
“Consumer Data” means identifying information pertaining to an individual, such as name, address, date of birth, or social security number, and KBAs, provided directly or indirectly by IDology or its data providers and utilized in the Services.
“IDology” means IDology, Inc.
“IDology IP” means IDology’s intellectual property, including its proprietary technology, which includes, without limitation, the Services, the Application, its hardware designs, algorithms, software (in source code and object code forms), user interface designs, architecture, class libraries, objects and documentation (both printed and electronic), network designs, know-how, trade secrets and any related intellectual property rights throughout the world (whether owned by IDology or licensed to IDology from a third party), IDology’s copyrights, and any derivatives, improvements, enhancements, updates, modifications, or extensions of IDology intellectual property.
“KBAs” means a component of the Services comprising IDology’s (or its data supplier’s) proprietary question and answer sets for use in Applicant Verification.
“Person” means any corporation, company, partnership, firm, joint venture, association, trust, government agency, political subdivision, other entity, or individual.
“Representatives” means a Person’s affiliates, and its and its Affiliates’ owners, members, directors, officers, employees, agents, independent contractors, investors, attorneys, licensees, and other representatives.
“Services” means IDology’s proprietary identity and age verification services, and similar IDology services, as further defined or described in this Agreement or other documentation provided by GBG to the End User.
“Trade Secret” means information, without regard to form, including, but not limited to, technical or nontechnical data, a formula, a pattern, a compilation, a program, a device, a method, a technique, a drawing, a process, financial data, financial plans, product plans, or a list of actual or potential customers or suppliers which is not commonly known by or available to the public and which information (i) derives economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use, and (ii) Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.
“Verification” means the process by which Client, utilizing the Services, seeks to verify the identity or age of its Applicant. Verification must be authorized by the consumer for the use in the normal course of business submitted by the individual to the business and, if the submitted information is incorrect, to obtain correct information, but only for the purpose of preventing fraud by, or pursuing legal remedies against, or recovering on a debt or security interest against, the individual. 18 U.S.C. § 2721 (b)(3)

2. USE OF THE SERVICE
2.1. GBG grants the End User a non-exclusive, non-assignable, non-sublicensable license to use the Services in the United States for the purposes of Verification of End User’s Applicants subject to the following limitations: End User will not use the Services (i) for any “permissible purpose” under the Fair Credit Reporting Act (“FCRA”) (15 U.S.C. Sec. 1681 et seq.) or use any of the information it receives through the Services to take any “adverse action”, as that term is defined in the FCRA; (ii) in violation of the provisions of and regulations pursuant to the Drivers Privacy Protection Act (18 U.S.C. Section 2721 et seq.); (iii) other than pursuant to an exception of the privacy provisions of and regulations issued pursuant to the Gramm-Leach-Bliley Act (15 U.S.C. Sec. 6801 et seq.); or (iv) in violation of such other future legislation that IDology reasonably determines limits the use of the Services and Consumer Data.
2.2. Change to Services: IDology, directly or indirectly through GBG, has the right to implement changes to the Services from time to time.
2.3 Third Party Contractual Requirement (Sale of Data): End User agrees that by using the IDology Services it grants IDology the right to utilize End User Data in its consortium fraud network (the “Velocity Network”) to help perform real-time fraud prevention and regulatory compliance services for other third-party customers by detecting repeat transaction attempts across the network or flagging specific attributes associated with known fraud. All data that is fed into the Velocity Network is pseudonymized/hashed.

3. END USER OBLIGATIONS
3.1. Confidential Information: End User acknowledges that in connection with its access and receipt of the Services, it will, either directly or indirectly through GBG, receive Confidential Information from, or have access to Confidential Information in the possession of, IDology, including, but not limited to, KBAs and other Consumer Data, and Trade Secrets. End User will (i) hold any such Confidential Information with at least the same level of care as it uses for its own Confidential Information of the same nature, but not less than a commercially reasonable level of care, (ii) use the Confidential Information only as reasonably necessary or appropriate in connection with its verification of Applicants, and (iii) unless otherwise required by law, not disclose such Confidential Information to any third Person, except to End User’s employees or other representatives, bound by End User to these same confidentiality restrictions, as reasonably necessary in connection with End User’s Verification of Applicants. End User’s confidentiality obligations under this section will continue during the term of this Agreement and for two (2) years following the end of the term, except that those obligations will continue beyond that period to the extent, and so long as, the Confidential Information comprises one or more Trade Secrets.
3.2. Access of IDology Systems: To the extent that GBG has provided the End User certain access to IDology’s systems for purposes of managing its Verification settings or other uses, the End User will take reasonable steps to ensure that such access will be restricted to those of End User’s employees or agents who are engaged in the Verification process and to ensure that its employees and agents will not utilize such access for personal reasons. Those steps will include limiting access to passwords, access codes, or other confidential information necessary for End User to obtain such access to those with a need-to-know in connection with the Verification process, and changing of passwords at least every ninety (90) days or sooner if an employee or agent who has utilized a password is no longer responsible for obtaining such access, or if End User suspects an unauthorized Person has learned of the password. End User immediately will notify GBG if the End User knows of or suspects unauthorized access to IDology’s systems. End User will cooperate with GBG in putting in place other reasonable access security controls recommended by GBG or IDology.

4. LIABILITY
4.1. If at any time, IDology determines, in its reasonable discretion, that an End User is in violation of the terms of these Additional Terms or the Agreement, and that violation is materially detrimental or reasonably could be materially detrimental to IDology, or that an End User is using the Services or Consumer Data in a manner inconsistent with Subsection 2.1, IDology, upon written notice to GBG, may require GBG promptly to terminate End User’s use of the Services.
4.2. IN NO EVENT WILL GBG OR END USER, OR THEIR RESPECTIVE REPRESENTATIVES OR SUPPLIERS (INCLUDING IDOLOGY) BE LIABLE FOR (A) SPECIAL, INCIDENTAL, INDIRECT, OR CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR REVENUES), ARISING OUT OF OR IN ANY MANNER IN CONNECTION WITH THE SERVICES, THIS AGREEMENT, THE PERFORMANCE OR BREACH OF THIS AGREEMENT, THE SUBJECT MATTER OF THIS AGREEMENT OR END USER’S USE OF, OR IN INABILITY TO USE, THE SERVICES, ANY INFORMATION OR DATA PRODUCED BY THE SERVICES OR ANY OTHER INFORMATION, DATA OR MATERIALS PROVIDED TO THE OTHER, REGARDLESS OF THE FORM OF ACTION (INCLUDING STRICT LIABILITY OR NEGLIGENCE), WHETHER OR NOT THEY HAVE BEEN ADVISED, OR OTHERWISE MIGHT HAVE ANTICIPATED THE POSSIBILITY, OF SUCH DAMAGES; PROVIDED THAT THE FOREGOING LIMITATION WILL NOT APPLY IN THE CASE OF INTENTIONAL MISUSE BY END USER OF CONSUMER DATA OR MISAPPROPRIATION OR MISUSE OF IDOLOGY IP OR TRADE SECRETS. GBG’S AGGREGATE LIABILITY FOR ANY OR ALL LOSSES OR INJURIES ARISING OUT OF ANY ACTS OR OMISSIONS UNDER THIS AGREEMENT OR RELATING TO ITS SUBJECT MATTER WILL BE LIMITED TO THE FEES PAID BY END USER FOR THE SERVICES UNDER THIS AGREEMENT DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRIOR TO THE OCCURRENCE OF THE FIRST EVENT GIVING RISE TO ALL OR PART OF THE LIABILITY.

5. EXCLUSION OF WARRANTY/IES
5.1. NEITHER GBG NOR IDOLOGY GUARANTEES OR WARRANTS THE CORRECTNESS OR COMPLETENESS OF THE SERVICES OR THEIR DATABASES. THE SERVICES ARE PROVIDED ON AN “AS IS” BASIS, AND END USER USES THE SERVICES AT ITS OWN RISK. NEITHER GBG NOR IDOLOGY MAKES ANY REPRESENTATION OR WARRANTY, EITHER EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, SUITABILITY, FITNESS FOR A PARTICULAR USE OR PURPOSE, NONINFRINGEMENT, TITLE, OR WARRANTIES ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE, AND NEITHER GBG NOR IDOLOGY REPRESENTS OR WARRANTS THAT THE SERVICES WILL BE UNINTERRUPTED, OR ERROR-FREE, AND ALL SUCH REPRESENTATIONS OR WARRANTIES ARE EXPRESSLY DISCLAIMED. END USER ACKNOWLEDGES THAT GBG OR IDOLOGY OBTAIN CONSUMER AND OTHER DATA FROM THIRD PARTY SOURCES, WHOSE DATA IS NOT NECESSARILY COMPLETELY ACCURATE OR COMPLETE, AND THAT THEREFORE NEITHER GBG OR IDOLOGY CAN AND NEITHER DOES WARRANT THE ACCURACY, INTEGRITY OR COMPLETENESS OF CONSUMER OR OTHER DATA UTILIZED, STORED OR TRANSMITTED AS PART OF THE SERVICES.

6. INTELLECTUAL PROPERTY RIGHTS
6.1. IDology retains all right, title, and interest in and to the Services, IDology’s databases, including all physical copies of them, and all IDology IP rights related to the Services. End User acquires no IDology IP pursuant to this Agreement. End User will not, directly or indirectly, reproduce, retransmit, republish, reverse engineer, decompile, disassemble, or otherwise attempt to derive source code or other trade secrets from any of the IDology IP.

7. DATA PROTECTION AND COMPLIANCE WITH RELEVANT LAWS
7.1. The Supplier Data used to provide you with this element of the Service is hosted by the Data Supplier. In order to perform the Services, the Data Supplier shall act as Sub-processor of your Client Information (including any Personal Data supplied) for the sole purpose of delivering this element of the Service. The End User authorises GBG to appoint the Data Supplier as Sub-Processor for the purposes specified in this clause 7.1.
7.2. The Data Supplier is based in United States of America which is located outside of the EEA. To ensure that GBG is able to lawfully transfer Personal Data to the Data Supplier (acting as Sub-processor of the Client Information) and to enable GBG to provide and maintain appropriate safeguards with the Data Supplier, the Client hereby grants GBG a mandate to conclude EU Model Clauses with the Sub-processor on behalf of the Client. GBG shall be entitled to sign the EU Model Clauses as Data Processor on behalf of its Clients generally and shall not be required to name the Client in such document.
7.3. The Data Supplier uses further Sub-processors based in the United States of America which is located outside of the EEA.

8. INDEMNIFICATION
8.1. To the extent that any End User agrees in this Agreement to indemnify Reseller under this Agreement, such indemnification will extend to IDology and its Representatives. Further, End User will indemnify, defend, and hold harmless IDology and its Representatives from and against any and all costs, liabilities, losses, and expenses (including, but not limited to, reasonable attorneys’ fees) resulting from or arising out of any action brought by any third Person against IDology resulting from or arising out of End User’s performance or failure to perform its obligations under this Agreement.

9. AUDITS.
9.1. For so long as End User is receiving the Services, and for one (1) year after that, End User or IDology will have the right at their expense to audit, directly and through independent auditors, End User’s records to ensure compliance with the license granted for the Services and compliance with this Agreement as it relates to the Services. Such audits may be conducted during normal business hours upon seventy-two (72) hours written notice of intent to audit by the auditing party.  The auditing party will have the right to make and retain copies of those of End User's records as it reasonably deems necessary or appropriate in order to complete its audit, and will have the right to retain one copy of those records for its archival purposes.  Except as required by law, the auditing party will treat as confidential all of End User’s records, procedures and processes disclosed during the audit, provided that the auditing party will have the right to disclose those records as it deems reasonably necessary in order to enforce its rights under this Agreement.

10.THIRD PARTY BENEFICIARY; NO CONTRACT LIABILITY. 
10.1 IDology (and as applicable, its Representatives) will be a third party beneficiary of this Agreement, including, but not limited to, with respect to IDology’s right to change the Services (Section 2), its right to enforce protection of its Confidential Information (Section 3.1) and the IDology IP (Section 6), compliance with the access security controls (Section 3.2), the disclaimers and liability limitations (Sections 4, 5, and 8), its audit rights (Section 9), and its (and its Representatives’) rights to indemnification (Section 8). IDology is not a party to this Agreement, and will have no liability to End User under this Agreement or in connection with the Services.  Should any arbitrator or judge determine that, notwithstanding the foregoing sentence, IDology has liability to End User relating to the Services or the subject matter of this Agreement, whether in contract or tort, or under any other theory, IDOLOGY’S AGGREGATE LIABILITY FOR ANY OR ALL LOSSES OR INJURIES WILL BE LIMITED TO THE FEES PAID BY END USER FOR THE SERVICES UNDER THIS AGREEMENT DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRIOR TO THE OCCURRENCE OF THE FIRST EVENT GIVING RISE TO ALL OR PART OF THE LIABILITY.

11.TERMINATION OF THE SERVICES. 
11.1 IDology will have the right to require GBG to terminate the Services with respect to any End User if that End User is in material breach of any of the provisions of these Additional Terms, that are for the benefit of IDology, or if the End User’s acts or omissions with respect to its use of the Services are wrongful, or for other good reason.