• Supplier hosts the Supplier Data
• The Supplier receives and processes End User Data
• End User Data includes personal data
• The Supplier is located in the Hong Kong Special Administrative Region of the People’s Republic of China
• The Supplier is located outside of the EEA and the United Kingdom
• GBG relies on a derogation to transfer End User Data to the Supplier based outside of the EEA and the United Kingdom in accordance with Article 49 (1)(c) UK GDPR
• This Dataset is only recommended for ID verification of Hong Kong nationals

The Supplier Data used to provide the Hong Kong Population Dataset is supplied by Trans Union Limited (“TransUnion”) and includes consumer credit information about Hong Kong nationals. GBG is obliged under the terms of its agreement with TransUnion to ensure that all End Users agree to comply with the following licensing provisions:

1. DEFINITIONS
1.1. In these Additional Terms, the following definitions shall apply, in addition to the definitions set out in the General Terms and Product Terms:
“Database” means the database owned and maintained by TransUnion which contains the consumer credit data and other items of data including consumer address and certain identifier information that it is allowed to collect and retain under the Code of Practice on Consumer Credit Data issued by the Privacy Commissioner.
“End User Data” means any data provided to GBG by the End User for processing in accordance with the terms of the Agreement including where relevant any personal data.
“Hong Kong” means the Hong Kong Special Administrative Region of the People’s Republic of China.
“Ordinance” means the Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong) in force from time to time.
“Personal Data” means the personal data as defined under the Ordinance.
“Privacy Commissioner” means the Privacy Commissioner for Personal Data, Hong Kong.
“Permitted Purpose” means the purposes, restrictions and or conditions for use of the Dataset outlined by the Supplier in clauses 2.3-2.7 in addition to the Customer User Case set out in the Agreement and clause 2.1.

2. USE OF THE DATASET
2.1. This Dataset may only be used for the Customer Use Cases detailed below, provided that such Customer Use Case is selected on the End User's Order Form and the End User complies with any use case restrictions set out in the Agreement:
• ID Verification – Fraud
• ID Verification – Regulatory
2.2. In addition to the Customer Use Case restrictions contained within clause 2.1 (including any conditions that apply to that Customer Use Case) the following terms set out in clauses 2.3-2.7 also apply.
2.3. Before accessing the Hong Kong Population Dataset, the End User must confirm and verify to GBG that its organisation:
a) is a legitimate existing business;
b) does not carry out business activities which are illegal, illicit, immoral or offensive to a reasonable person, or likely to have negative impact on TransUnion's reputation in its reasonable opinion;
c) has the appropriate consent required under the Ordinance in order to access and use the personal data of the data subjects and the Deliverables as more particularly detailed in clause 5.2;
d) is using the Hong Kong Population Dataset for its own benefit and that it does not intend to resell or otherwise release the information to another third-party business, entity or person, except with the prior written consent of GBG and TransUnion.
2.4 The End User must not use the Hong Kong Population Dataset for any of the following prohibited purposes:
a) Adult entertainment service of any kind (but not including legal online gaming);
b) Attorney or Law Firm engaged in the practice of law, unless engaged in collection or using the Service or Deliverable in connection with a consumer bankruptcy pursuant to the written authorization of the consumer;
c) Bail Bondsman, unless licensed by the state or region in which they are operating;
d) Credit counselling, except not-for-profit credit counsellors;
e) Credit repair clinic;
f) Dating service;
g) Financial counselling, except a registered securities broker dealer;
h) Genealogical or heir research firm;
i) Massage service;
j) Company that locates missing children;
k) Pawn shop;
l) Private detective, detective agency or investigate company;
m) Company that handles third party repossession;
n) Subscriptions (magazines, book clubs, record clubs, etc.);
o) Tattoo service;
p) Company seeking information in connection with time shares (exception: financers of time shares);
q) Law enforcement agency;
r) Asset location service; or
s) News agency or journalist.
2.5 The End User shall not maintain, copy, capture or otherwise retain in any manner the Supplier Data or Results or any information contained therein except for accounting, customer service, regulatory and/or compliance purposes. The End User shall purge any such information from its systems and destroy all hard copies on a daily basis, except for the information retained solely for the purposes of customer service, regulatory and compliance purposes for a reasonable period that is not longer than necessary.
2.6 The End User must track and maintain records of each inquiry carried out using the Hong Kong Population Dataset. Such records must include a copy of the authorisation from each individual consumer in accordance clause 5.2. All records must be retained for the term of the Agreement and for a period of at least three (3) years thereafter.
2.7 Copies of records kept in accordance with clause 2.6 must be provided to TransUnion within fourteen (14) Business Days of a request to do so.
2.8. The End User warrants that it will not use this Dataset for any reason outside of the Customer Use Case and the Permitted Purpose.

3. DUE DILLIGENCE AND AUDIT
3.1 Prior to granting the End User access to the Hong Kong Population Dataset, the End User acknowledges that GBG must use reasonable endeavours to ensure that the End User has a legitimate reason to access the Service and that the End User’s intended use or the Service complies with relevant laws and meets the minimum standards specified by TransUnion.
3.2 The End User acknowledges and agrees that access to the Hong Kong Population Dataset is dependent on it passing GBG’s review carried out in accordance with clause 3.1 and that it shall cooperate with GBG and provide all necessary information to enable GBG to comply with its obligations.
3.3 The End User shall cooperate with GBG and TransUnion in relation to any audit or review carried out in accordance with this clause 3 and/or any audit right contained within the General Terms, including any requests to correct any deficiencies discovered during such audits within a period of time mutually agreed upon. In such circumstances, GBG reserves the right to suspend delivery of the Dataset until such deficiencies are corrected.

4. LIABILITY
TransUnion is not a party to any contractual arrangement entered into between GBG and the End User, and is not liable for any dispute that arises between GBG and the End User. Furthermore, the End User acknowledges and accepts that it shall not be entitled as a third party beneficiary or otherwise, to take any action or have any recourse against TransUnion in respect of any claim based upon any actual or alleged failure to perform under these Additional Terms.

5. DATA PROTECTION AND COMPLIANCE WITH RELEVANT LAWS
5.1 The End User warrants that it will not use the Hong Kong Population Dataset, which involves the processing of personal data, unless:
a) a clear and conspicuous disclosure is first made in writing to the data subject;
b) the End User has obtained the authorisation and such other documents from each data subject in accordance with the Ordinance and any other applicable privacy laws in Hong Kong; and
c) the Service, the Deliverables and any information contained or derived therefrom are not to be used in violation of any applicable Hong Kong law or regulations.
5.2 The End User warrants that, before using this Dataset it has obtained the authorisation from each data subject in accordance with the Ordinance and any other applicable privacy laws in Hong Kong by inserting clauses which are similar to or give the same effect as those set out below:

“For verifying my identity for the purposes of anti-money laundering, identification and risk mitigation, I, [Name], voluntarily provide [You] (“Service Provider”) and/or GB Group PLC (“GBG”) with my Personal Data (as defined below) and hereby expressly consent to and authorise the following:

“Personal Data” refers to such data only consist of the following (and shall include any updated data of the following items from time to time):
(a) my full name, including surname, given name and other name;
(b) my Hong Kong Identity Card Number;
(c) my date of birth;
(d) my correspondence address; and
(e) my telephone number.

This consent and authorization is given by me to the Service Provider on its own behalf, and on behalf of, and as agent for, GBG and TransUnion Limited (“TransUnion”) for the following uses of my Personal Data:

(i) the transfer to TransUnion by the Service Provider, through GBG, of my Personal Data for verification of my Personal Data;
(ii) TransUnion checking if my Personal Data is on the database of TransUnion;
(iii) TransUnion providing the matching result to GBG and Service Provider, which may or may not be located inside Hong Kong, without having sent me any copy of the result for my review; and
(iv) Retention of the Personal Data for the period necessary.

By submitting this data, I understand the above and I give consent to and authorize the Service Provider, GBG and TransUnion to act in accordance with (i) to (iii) above. Further, I agree and acknowledge that the use of my Personal Data for the above by the Service Provider, GBG and TransUnion shall not be made the basis for any complaint, claim, suit, demand or cause of action or other proceeding against the Service Provider, GBG, or TransUnion Limited by me or any third party.

__________________
[Name of Data Subject]
[Date]”

6.4 The Supplier Data used to provide you with this Dataset is hosted by the Supplier in Hong Kong. In order to deliver this Dataset the Supplier shall receive and process End User Data.
6.5 The Supplier is based in Hong Kong, which is located outside of the EEA and the UK. The End User acknowledges that GBG relies on a derogation to transfer End User Data to the Supplier for processing in accordance with Article 49 (1)(c) of UK GDPR.
6.6 The End User acknowledges that this Dataset is only recommended for ID verification of Hong Kong nationals. Whilst GBG confirms that the Supplier has passed privacy due diligence and that the Supplier Data used to provide this Dataset has been gathered lawfully by the Supplier in accordance with privacy laws in Hong Kong, the Supplier may not adhere other privacy laws.

6. TERMINATION
Notwithstanding the other termination provisions contained within the Agreement, under the terms of GBG’s agreement with TransUnion the supply of this Dataset may be terminated immediately upon notice if required to ensure compliance with any applicable law, or in the event that there is a material change in existing legal requirements which adversely affects GBG’s agreement with TransUnion.