Documents & Biometrics:
This Service Schedule supplements the GBG Terms and apply to the Documents and Biometrics Services. Additional Terms applies where the relevant Datasets are selected on the Order Form.
1.1 In this Service Schedule the following definitions shall apply:
“Docs & Bio Additional Terms” means the supplementary terms and conditions relating to particular Datasets and/or aspects of the Docs & Bio Services as updated from time to time which are available at https://www.gbgplc.com/legal-and-regulatory/additional-terms-v6/docs-bio-us/;
“Documents & Biometrics Services” or “Docs & Bio Services” means the following services – Acufill, AssureID, Face-Standard, Government, Face Government, MedicScan, Ozone, KYC: Identify-Risk Assessment, KYB, Transaction Monitoring, Sanctions Screening, S4 and User Interface, and AAMVA which each comprises of the Datasets selected on the Order Form, any Batches processed pursuant to a Batch Request (if applicable) together with any applicable Standard Support Services and Professional Services as described on the Service Page and any other ancillary services provided by GBG to the Customer pursuant to this Agreement;
“Initial Price” means the Charges for the use of the Datasets provided as part of the Service during the fixed Initial Term of this Agreement, as agreed between the Parties and set out within the Order Form. Where the Initial Price listed on the Order Form is lower than the Standard Price listed, the Initial Price will be considered to be Preferential Pricing;
“Service Page” is available at https://www.gbgplc.com/legal-and-regulatory/products-v6/docs-bio-us/; and
“Standard Price” means GBG’s standard Charges for the use of Datasets provided as part of the Service as set out in the Order Form and updated by GBG from time to time.
2.1 Except where an Order is for: (i) an Evaluation or (ii) a one-off Batch Request, this Agreement will start on the Contract Start Date and will continue for the Initial Term and thereafter on a rolling basis unless terminated earlier in accordance with the Agreement.
3.1 Notwithstanding any Preferential Pricing in the Initial Term, GBG’s Standard Pricing and payment terms will prevail in respect of the Customer’s continued use of the Service after the Initial Term.
3.2 If Customer who received Preferential Pricing materially breaches the Agreement, GBG may terminate the Agreement or revoke the Preferential Pricing upon 30 days’ notice. Following revocation, GBG’s standard pricing and payment terms (as notified to the Customer) will apply from the date of the breach for the remainder of the Initial Term and any continued use thereafter.
3.3 Notwithstanding anything else in this clause 3, after the expiry of the Initial Term GBG shall be entitled to increase the Charges by providing at least 30 days’ notice of the change.
3.4 Except as set out in this clause 3 and any other provisions in the Agreement related to price increases (including the Order Form), on Renewal, Prepayments shall renew automatically.
4.1 The provisions in this section apply to the following services: Acufill/idscan, Medicscan, Assureid, Face, Liveness and Ozone:
4.1.1 From time to time, Customer may provide or GBG may request samples of identification documents in order to improve the accuracy of GBG’s libraries for such documents. In such event, Customer shall be solely responsible for obtaining from the owner of the identification document his/her unambiguous and explicit Consent (as defined in the DPA) for the collection, export and processing of his/her Personal Data for such purpose, as well as providing any notice or rights and meeting other obligations set forth in applicable Data Privacy Laws, and Customer shall indemnify GBG for any liability arising out of failure to obtain the owner’s unambiguous and explicit Consent to use of his/her Personal Data in such manner or to comply with such other applicable Data Privacy Law obligations.
4.1.2 If Customer intends to conduct any load testing for any of the Services, then Customer shall provide GBG with a minimum of three business days advance written notice. The parties will then agree on when the load testing will be conducted. All load testing must be conducted between the hours of 8:00 AM through 8:00 PM ET.
4.2 The provisions in this section apply to the following services: KYC: Identity Risk Assessment, KYB, Transaction Monitoring, Sanctions Screening, and S4:
4.2.1 Customer shall modify its software so that it runs on its end user’s browsers to perform device fingerprinting. Device fingerprinting technology may place a cookie or a flash shared object (“FSO”) in the client’s browser or device.
4.2.2 Within thirty days of entering into this Agreement, the Customer shall certify to GBG that the Customer has integrated with GBG’s API correctly and is providing transaction feedback. Prior to GBG providing production credentials to Customer, GBG shall verify the Customer’s certification by having GBG’s implementation team (i) do an API integration validation on API request and response (additional details will be provided after issuing the API keys) and (ii) validate that transaction monitoring feedback is occurring.
4.2.3 Customer must implement a one-way cryptographic hash function and data mask as directed by GBG on payment method data prior to Customer sending the information to GBG. Customer acknowledges that as a result of the foregoing, GBG will never obtain from Customer the actual details within the payment method and will not be able to reconstruct the actual payment details.
4.2.4 Customer must utilize SSL/TLS encryption as directed by GBG in order to send transaction data to GBG.
4.2.5 In the event that Customer uses GBG’s KYC plugin, all information from the plugin to GBG’s system shall conform to the foregoing.
4.3 Customer shall be responsible for notifying its end users that Personal Data is being provided to GBG for processing on its behalf and GBG may use the Personal Data as otherwise provided for in the Agreement.
4.4 The parties agree that any output of the Services do not constitute a “consumer report” for purposes of the Fair Credit Reporting Act (“FCRA”). Customer may not use any output of the Services, in whole or in part, as a factor in determining consumer eligibility for credit, insurance, employment, tenancy, or for any other purpose under FCRA.
4.5 GBG receives no payment card information but instead receives a one-way salted cryptographic hash of the account number. All transaction data from the GBG is sent securely using HTTPS using the API. All data is stored in a secure, monitored hosting center under PCI Level 1 standards. Access to transaction data is restricted to authorized parties and GBG’s personnel.
4.6 In the event that GBG terminates this Agreement for Customer’s breach, GBG shall have no obligation to retain the Customer Data or provide Customer with access to the Customer Data. Upon a termination of this Agreement by GBG for reasons other than Customer’s breach, at the option of Customer, GBG shall either provide a CSV export of all of the Customer Data or GBG shall continue to retain such Customer Data for the period of time designated by Customer so long as Customer pays the then current post termination data storage fee (“Post Termination Data Storage Fee”). If Customer fails to pay the Post Termination Data Storage Fee within 30 days of its due date, GBG shall be entitled to delete the Customer Data. Should Customer request either i) the export of Customer Data in a format other than CSV, or ii) the export of data other than Customer Data, the parties shall discuss such request and agree on a fee for the additional professional services.
4.7 Customer shall select the rules/data elements of the Services that Customer desires to utilize through GBG’s Platform User Interface (“PUI”). For the avoidance of doubt, all of the Services set out in this Order Form will be taken via the GBG compliance platform (“Platform”).
4.8 Customer acknowledges that GBG offers certain additional Third-Party Services which are complimentary to the Services as identified in PUI (“Third Party Service Solutions”). Certain Third-Party Service Solutions include additional terms and conditions of service (“Third Party Terms”) which supplement this Agreement and are set forth in the PUI and are incorporated herein by reference. In the event of a conflict between the terms of this Agreement and the Third-Party Terms, the Third-Party Terms shall control with respect to the Third-Party Service Solutions.
4.9 GBG reserves the right to make changes in any of the foregoing Third Party Service Solutions from time to time provided, however, that no change will reduce the features or functionality in any material respect. Except for urgent maintenance and support changes that are critical patches or required to improve the availability or robustness of the Available Services, GBG will provide fourteen days’ prior written notice for changes that could negatively impact Customer’s operation.
4.10 The provisions in this section apply to the Automatic Sample Collection Service:
4.10.1 Limited License Grant. When Customer enables Automatic Sample Collection, Customer grants GBG a limited, non-exclusive, revocable, worldwide, royalty-free license to use, reproduce, and process identification documents images, any related personal data, and other materials transmitted through Automatic Sample Collection (collectively, “Collected Data”) for the purposes contemplated in the Agreement and the DPA, and to create De-identified Data as defined below. This license is terminable by Customer upon written notice and revocation shall not affect GBG’s rights in any De-identified Data or Derived Data created prior to such revocation.
4.10.2 De-identified and Derived Data. GBG may de-identify or otherwise transform Collected Data in accordance with applicable Data Protection Laws. De-identification allows GBG to preserve only the structural elements, formatting, and physical security features of the Samples designed to prevent tampering, counterfeiting, or duplication of the document for fraudulent purposes, which are necessary for the provision of the Services. Upon de-identification, such De-identified Data shall no longer be considered Personal Data. GBG shall own all right, title, and interest in and to the De-identified Data and any data, works, models, or libraries derived therefrom (“Derived Data”). GBG may retain and use De-identified Data and Derived Data indefinitely for lawful purposes, including developing, testing, and enhancement of GBG’s AssureID Library and other document-verification technologies.
4.10.3 No Sale or Ownership Transfer of Personal Data. As between the parties—and without prejudice to any rights of individual consumers or data subjects under applicable Data Protection Laws, nothing in this Agreement shall be construed as a sale, or transfer of ownership of Personal Data to GBG. The parties acknowledge that GBG’s collection and processing of Personal Data in connection with Automatic Sample Collection are governed exclusively by the DPA.
Last updated: 29.07.2026
