• Supplier hosts the Supplier Data
• Supplier receives and processes End User Data in its capacity as controller
• End User Data includes personal data
• The Supplier is based in the United Kingdom
• The United Kingdom is deemed to offer an adequate level of data protection by the European Commission
• The Supplier is a Credit Reference Agency (“CRA”) therefore the End User must include a reference to Credit Reference Agency Information Notice (“CRAIN”) in its fair processing notice

The Supplier Data used to provide the UK Credit Header Datasets is provided by GBG’s Supplier, Equifax Ltd. GBG is obliged under the terms of its agreement with its Supplier to ensure that all End Users agree to comply with the following licensing provisions. These Additional Terms apply to all UK Credit Header Datasets. Individual UK Credit Header Datasets can be identified by the ID Number on the End User’s Order Form.

1. DEFINITIONS
1.1. In these Additional Terms the following definitions shall apply, in addition to the definitions set out in the General Terms and Product Terms:
“Applicable Laws” means all applicable laws, enactments, rules, regulations, orders, regulatory policies, regulatory permits and licences, and any mandatory instructions or requests of a regulator, in each case which are in force from time to time, including:
i. The Consumer Credit Acts 1974 and 2006;
ii. The Data Protection Act 2018;
iii. The Representation of the People (England and Wales) Regulations 2001;
iv. The Financial Services and Markets Act 2000 (Money Laundering Regulations 2001);
v. Rules made by the Steering Committee on Reciprocity; and
vi. The Guide to Credit Scoring 2000
“End User Data” means any data provided to GBG by the End User for processing in accordance with the terms of the Agreement including where relevant any personal data.
“Permitted Purpose” means the purposes, restrictions and/or conditions for the use of the Dataset outlined by the Supplier as set out in clauses 2.3 to 2.8 below in addition to the Customer Use Case set out in the Agreement and at clause 2.1.

2. USE OF THE DATASET
2.1. This Dataset may only be used for the Customer Use Case detailed in this clause 2.1, provided that such Customer Use Case is selected on the End User’s Order Form and the End User complies with any use case restrictions set out in the Agreement or these Additional Terms:
• ID Verification – Fraud
• ID Verification - Regulatory
2.2. In addition to the Customer Use Case restrictions contained within clause 2.1 (including any conditions that apply to that Customer Use Case) clauses 2.3 -2.8 shall also apply
2.3. Before using this Dataset to obtain information relating to a natural person, the End User shall notify the person that: (a) information which the person gives you may be disclosed to a credit reference agency, which may keep a record of that information. This is known as a search footprint; and (b) the credit reference agency may disclose that information, and the fact that a search was made, to its other customers for the purposes of assessing the risk of giving credit and occasionally to prevent fraud, money laundering and to trace debtors. Upon request the End User shall send GBG a copy, or transcript, of the notification it uses.
2.4. To the extent that the End User is able to so, the End User grants the Supplier a perpetual, royalty free right to record the information referred to in clause 2.3 for the purposes referred to in clause 2.3(b).
2.5. GBG will notify the End User of the search type or types it is entitled to carry out when using the Dataset. The Supplier may from time to time change the search types which the End User is entitled to carry out. GBG will notify the End User in writing of any such changes in reasonable time before the change becomes effective. The End User shall ensure that it understands which search type code are required to use for each kind of search you carry out using the Dataset and the End User shall ensure that it will use the correct search type code at all times when using Dataset.
2.6. The End User shall comply at all times with the Applicable Laws.
2.7. The End User acknowledges and accepts that Equifax is a CRA and in utilising the services of a CRA, the End User is required by Equifax to include a link to the Credit Reference Agency Information Notice (commonly known as “CRAIN”) as set out below within their own fair processing notice or provide an off-line route to access information about CRAIN, such as printed copies The CRAIN notice link is as follows https://www.equifax.co.uk/crain.html.
2.8. The End User shall fully indemnify GBG against all liabilities, costs, expenses, damages and losses incurred by GBG as a result of the End User’s failure to incorporate the CRAIN notice within their fair processing policy.
2.9. The End User warrants that it will not use this Dataset for any reason outside of the Customer Use Case and the Permitted Purpose.

3. LIABILITY
3.1. In addition to any right that the End User has against GBG, the End User is also entitled make a claim directly against the Supplier under these Additional Terms provided that it give the Supplier written notice of the claim within 6 months of becoming aware of the circumstances giving rise to the claim or, if earlier, 6 months from the time the End User ought reasonably to have become aware of such circumstances.
3.2. The Supplier’s entire liability in respect of any single cause of action arising out of or in connection with the Supplier Data or the Dataset (whether for breach of contract, negligence, under statute or otherwise) shall be limited to £50. The End User shall not be entitled to recover from the Supplier and GBG in respect of the same loss.
3.3. Nothing in these terms shall limit or exclude the Supplier’s liability for death, personal injury or fraud arising from its negligence.
3.4. Except as expressly provided in these terms, all representations, conditions and warranties whether express or implied (by statute or otherwise) are hereby excluded by the Supplier to the fullest extent permitted by law.

4. DATA PROTECTION AND COMPLIANCE WITH RELEVANT LAWS
4.1. The Supplier Data used to provide you with this Dataset is hosted by Equifax in the United Kingdom. In order to deliver the Dataset, Equifax shall receive and process End User Data in its capacity as an independent controller. In addition, the Supplier may retain copies of End User Data for audit and compliance purposes.
4.2. The Supplier is based in the United Kingdom. The United Kingdom is deemed to offer an adequate level of data protection for personal data by the European Commission, therefore End User Data can be safely transferred to the Supplier without further data export safeguards.

5. TERMINATION
5.1. Notwithstanding the termination provisions between GBG and the End User in the General Terms, under the terms of GBG’s agreement with the Supplier, the supply of this Dataset can be terminated at any time if such supply is no longer possible under the terms of the agreement that the Supplier has in place with its own third party data suppliers.
5.2. GBG may (at the request of the Supplier) from time to time and on reasonable notice to the End User update, modify and change the Supplier Data, the delivery mechanism, and the Permitted Purposes, or end this element of the Agreement:
(a) to comply with Applicable Law.
(b) if the End User or any member of its corporate group applies for or is granted the status of a Credit Reference Agency.
(c) to keep pace with changes to the Supplier’s IT systems and usual means of data supply; and
(d) to accord with the Supplier’s rights under the terms on which it receives any relevant data from third parties.