• Supplier hosts the Supplier Data
• Supplier receives and processes End User Data in its capacity as an independent controller
• End User Data includes personal data
• The Data Supplier is based in the United Kingdom
• The United Kingdom is deemed to offer an adequate level of data protection by the European Commission

The Supplier Data used to provide 0403 UK Consumer Affordability Enhanced Dataset is provided by GBG’s Supplier, Equifax Ltd. GBG is obliged under the terms of its agreement with its Supplier to ensure that all End Users agree to comply with the following licencing provisions:

1. DEFINITIONS
1.1. In these Additional Terms, the following definitions shall apply in addition to the definitions set out in the General Terms and Product Terms:
“Applicable Laws” means all applicable laws, enactments, rules, regulations, orders, regulatory policies, regulatory permits and licences, and any mandatory instructions or requests of a regulator, in each case which are in force from time to time, including:
i. The Consumer Credit Acts 1974 and 2006;
ii. The Data Protection Act 2018;
iii. The Representation of the People (England and Wales) Regulations 2001;
iv. The Financial Services and Markets Act 2000 (Money Laundering Regulations 2001);
v. Rules made by the Steering Committee on Reciprocity; and
vi. The Guide to Credit Scoring 2000

“End User” means an end user which is a gambling operator, as per the applicable gambling regulation, or a car hire and/or lease company.

“End User Data” means any data provided to GBG by the End User for processing in accordance with the terms of the Agreement including where relevant any personal data.
“Permitted Purpose” means the purposes, restrictions and/or conditions for the use of the Dataset outlined by the Supplier as set out in clauses 2.3 to 2.16 below in addition to the Customer Use Case set out in the Agreement and at clause 2.1.

2. USE OF THE DATASET
2.1. This Dataset may only be used for the Customer Use Case detailed in this clause 2.1, provided that such Customer Use Case is selected on the End User’s Order Form and the End User complies with any use case restrictions set out in the Agreement or these Additional Terms:
• ID Verification – Fraud
• ID Verification – Regulatory

• ID Verification – Affordability
2.2. In addition to the Customer Use Case restrictions contained within clause 2.1 (including any conditions that apply to that Customer Use Case) clauses 2.3-2.16 shall also apply.
2.3. Before using this Dataset to obtain information relating to a natural person, notwithstanding the provisions of clause 2.6, the End User shall notify the person that: (a) information which the person gives you may be disclosed to a credit reference agency, which may keep a record of that information. This is known as a search footprint; and (b) the credit reference agency may disclose that information, and the fact that a search was made, to its other customers for the purposes of assessing the risk of giving credit and occasionally to prevent fraud, money laundering and to trace debtors. Upon request the End User shall send GBG a copy, or transcript, of the notification it uses.
2.4. To the extent that the End User is able to so, the End User grants the Supplier a perpetual, royalty free right to record the information referred to in clause 2.3 for the purposes referred to in clause 2.3(b).
2.5. The End User must ensure that prior to any use of the Dataset or Supplier Data, each consumer is provided with:
(a) clear notice, in accordance with Applicable Data Protection Law, that a search of their data undertaken with a Credit Reference Agency which will return as applicable information including public derogatory data, CCJs, bankruptcies, insolvencies, credit searches by debt collection agents, and will be used to assess their affordability (for the avoidance of doubt, such notice to consumers cannot be ‘hidden’ within a privacy policy or terms of use, and must be specifically highlighted as part of the customer onboarding journey (or equivalent process); and
(b) the option for their data, as set out above, to not be searched and collected as set out above.
2.6. To the extent that the Dataset and Supplier Data are used by an End User operating in the gaming sector for the purposes of complying with guidelines published by the Gambling Commission, assessments may be requested and used following the occurrence of the following trigger events to the extent that they are likely to indicate financial vulnerability:
(a) material increases in spending; or
(b) the consumer having suffered a material loss or a series of losses amounting to a material loss over a limited period;
provided that in each case fair notice has been provided to the consumer that such checks may be conducted in such circumstances. The notice required under clause 2.5(a) shall clearly inform consumers of the potential for such processing. The End User shall also ensure the consumer has not ‘opted-out’ under clause 2.5(b) above.
2.7. GBG will notify the End User of the search type or types it is entitled to carry out when using the Dataset. The Supplier may from time to time change the search types which the End User is entitled to carry out. GBG will notify the End User in writing of any such changes in reasonable time before the change becomes effective. The End User shall ensure that it understands which search type code are required to use for each kind of search you carry out using the Dataset and the End User shall ensure that it will use the correct search type code at all times when using Dataset.
2.8. The End User shall comply at all times with the Applicable Laws.
2.9. The Dataset and Supplier Data can only be used on a single enquiry basis at the point at which a consumer opens an account or requests services.
2.10. The Dataset and Supplier Data cannot be used in isolation to make a decision about a consumer, and should be used only as a risk flag forming part of a broader affordability assessment undertaken by the End User.
2.11. The End User acknowledges and accepts that Equifax is a CRA and in utilising the services of a CRA, the End User is required by Equifax to include a link to the Credit Reference Agency Information Notice (commonly known as “CRAIN”) as set out below within their own fair processing notice or provide an off-line route to access information about CRAIN, such as printed copies The CRAIN notice link is as follows https://www.equifax.co.uk/crain.html.
2.12. The End User shall fully indemnify GBG against all liabilities, costs, expenses, damages and losses incurred by GBG as a result of the End User’s failure to incorporate the CRAIN notice within their fair processing policy and notify individuals of such notice in the provision of the End User’s products and services.
2.13. The End User shall procure that Supplier Data is not transferred or processed outside of the EEA.
2.14. Notwithstanding the provisions of clause 2.6, the End User shall use the Dataset and Supplier Data only where the assessment of affordability is necessary and appropriate:
(a) to either protect the consumer from over indebtedness or to assess the risk of providing products or services to a consumer, in each case in relation to the purchase of products or services which involve a financial commitment beyond a single transaction where payment is required at the time of sale; or
(b) due to a regulatory requirement or guidance issued by a relevant regulatory or governing body, requiring the End User to undertake appropriate affordability assessments of consumers.
2.15. The End User shall not use the Dataset or Supplier Data:
(a) in relation to any application for or assessment of risk in relation to regulated credit activities;
(b) to increase account limits or spend velocity; or
(c) for any direct marketing purposes.
2.16. The End User must not retain a copy of the Supplier Data in relation to each Consumer, for any future use save for retaining a copy for auditing or regulatory purposes.
2.17. The End User warrants that it will not use this Dataset for any reason outside of the Customer Use Case and the Permitted Purpose.

3. DATA PROTECTION AND COMPLIANCE WITH RELEVANT LAWS
3.1. The Supplier Data used to provide you with this Dataset is hosted by Equifax in the United Kingdom. In order to deliver the Dataset, Equifax shall receive and process End User Data in its capacity as an independent controller. In addition, the Supplier may retain copies of End User Data for audit and compliance purposes.
3.2. The Supplier is based in the United Kingdom. The United Kingdom is deemed to offer an adequate level of data protection for personal data by the European Commission, therefore End User Data can be safely transferred to the Supplier without further data export safeguards.

4. LIABILITY
4.1. In addition to any right that the End User has against GBG, the End User is also entitled make a claim directly against the Supplier under these Additional Terms provided that it give the Supplier written notice of the claim within 6 months of becoming aware of the circumstances giving rise to the claim or, if earlier, 6 months from the time the End User ought reasonably to have become aware of such circumstances.
4.2. The Supplier’s entire liability in respect of any single cause of action arising out of or in connection with the Supplier Data or the Dataset (whether for breach of contract, negligence, under statute or otherwise) shall be limited to £50. The End User shall not be entitled to recover from the Supplier and GBG in respect of the same loss.
4.3. Nothing in these terms shall limit or exclude the Supplier’s liability for death, personal injury or fraud arising from its negligence.
4.4. Except as expressly provided in these terms, all representations, conditions and warranties whether express or implied (by statute or otherwise) are hereby excluded by the Supplier to the fullest extent permitted by law.

5. TERMINATION
5.1. Notwithstanding the termination provisions between GBG and the End User in the General Terms, under the terms of GBG’s agreement with the Data Supplier, the supply of the Supplier Data can be terminated at any time if such supply is no longer possible under the terms of the agreement that the Supplier has in place with its own third party data suppliers.
5.2. The Supplier may cease to make Supplier Data or the Dataset available to the End User if in their sole discretion it is not satisfied that they are being used in accordance with these Additional Terms, and or demonstrates compliance with Applicable Laws.
5.3. GBG may (at the request of the Supplier) from time to time and on reasonable notice to the End User update, modify and change the Supplier Data and or Dataset, the delivery mechanism, and the Permitted Purposes, or end this element of the Agreement:
(a) to comply with Applicable Law.
(b) if the End User or any member of its corporate group applies for or is granted the status of a Credit Reference Agency.
(c) to keep pace with changes to the Supplier’s IT systems and usual means of data supply; and
(d) to accord with the Supplier’s rights under the terms on which it receives any relevant data from third parties.