• Supplier hosts the Supplier Data
• The Supplier receives and processes End User Data in its capacity as an independent controller
• End User Data includes personal data
• The Supplier is located in Australia
• The Supplier is based outside of the EEA and United Kingdom
• GBG has an arrangement in place with the Supplier to maintain appropriate safeguards

The Supplier Data used to provide the New Zealand DIA Birth, DIA Citizen and DIA Passport Dataset is provided by GBG’s Supplier. GBG is obliged under the terms of its agreement with its Supplier to ensure that all End Users agree to comply with the following licensing provisions. These Additional Terms apply to all New Zealand DIA Birth, DIA Citizen and DIA Passport Dataset. Individual New Zealand DIA Birth, DIA Citizen and DIA Passport Datasets are identified on the End User’s Order Form or Agreement.

1. DEFINITIONS
1.1. In these Additional Terms, the following definitions shall apply, in addition to the definitions set out in the General Terms and Product Terms:
“Agency Agreement” means the due diligence forms and agreement that must be completed by the End User, returned to and verified by the Supplier, in order for the End User to access this Dataset.
“C2C Model Clauses” means the model clauses for the transfer of personal data to controllers established in third countries approved by the European Commission, the approved version, of which, in force at present is that set out in the European Commission’s Decision 2004/915/EC of 27 December 2004 (available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0915) as such model clauses may be amended or superseded by the European Commission from time to time.
“Department of Internal Affairs (“DIA”)" means that governmental department of New Zealand.
“End User Data” means any data provided to GBG by the End User for processing in accordance with the terms of the Agreement including where relevant any personal data.
“Permitted Purpose” means the purposes, restrictions and or conditions for use of the Dataset outlined by the Supplier in clauses 2.3-2.8 in addition to the Customer User Case set out in the Agreement and clause 2.1.

2. USE OF THE DATASET
2.1 This Dataset may only be used for the Customer Use Cases detailed in this clause 2.1, provided that such Customer Use Case is selected on the End User's Order Form and the End User complies with any use case restrictions set out in the Agreement or these Additional Terms:
• ID Verification – Fraud
• ID Verification – Regulatory
2.2 In addition to the Customer Use Case restrictions contained within clause 2.1 (including any conditions that apply to that Customer Use Case) the following terms set out in clauses 2.3-2.8 also apply.
2.3 The End User must not provide the Supplier Data or Results to any other third party.
2.4 The End User is responsible for the accuracy of the input of the End User Data for this Dataset.
2.5 The End User will ensure that each search conducted in relation to this Dataset relates to the name of a specific individual with whom the End User has an existing or prospective business relationship, and the individual is made aware and agreed (whether implied or not) that an identity verification check will be conducted with third party organisations.
2.6 To access this Dataset, the End User must be registered with RBNZ and are an Australian or New Zealand registered business entity.
2.7 The End User must complete a DIA application form and sign the DIA Agency Agreement.
2.8 If the End User decides to undertake checks on an individual/data subject on an ongoing basis, and an individual/data subject has given consent to the End User to do so, the End User must treat that consent as having expired if:
2.8.1 The data subject/individual ceases to be a customer of the End User; or
2.8.2 12 months has elapsed since the date on which consent was given.
2.9 The End User warrants that it will not use the Dataset for any reason outside of the Customer Use Cases and the Permitted Purpose.

3. DATA PROTECTION
3.1 The Supplier Data used to provide you with this Dataset is hosted by the Supplier in Australia. In order to deliver this Dataset, the Supplier shall receive and process End User Data in its capacity as an independent controller.
3.2 GBG has entered into C2C Model Clauses with the Supplier to ensure safe onward transit of End User Data to the Supplier.

4. TERMINATION
4.1 Notwithstanding the termination provisions between GBG and the End User in the General Terms, under the terms of GBG’s agreement with its Supplier, the supply of this Dataset can be terminated upon GBG providing the End User with 90 days’ notice.