ConnectID

1. Identity Data

1.1 The Identity Service and Digital Identity Transactions

1. The Organisation works with GBG to participate in a digital identity network, ConnectID. ConnectID enables you to request various organisations with whom you have a relationship (Identity Providers) to provide identity and attribute information or a verification or assertion of your identity (together Identity Data) about you to GBG, who then provides this Identity Data to the Organisation. This can help streamline Organisation’s interactions with you. Identity Data may include identity and attribute information such as your name, telephone number, email, date of birth or address. These terms are the terms that the Organisation and GBG enter into with you, in relation to this “Identity Service”.

2. This “Identity Service” is only available where the eligibility criteria set out in section 2 have been met, where the “Identity Service” is enabled for the relevant product or service you wish to use and where the Identity Provider holds valid accreditation as part of ConnectID.

3. The “ConnectID Network” facilitates the transfer of Identity Data on a bilateral basis between GBG and the Identity Provider (each a Digital Identity Transaction). However, the ConnectID Operator does not access or hold your Identity Data and the transfer of Identity Data occurs directly from the relevant Identity Provider to GBG. GBG will then transfer the Identity Data to the Organisation or otherwise use it to confirm your information with the Organisation.

4. Any Digital Identity Transaction is at your request and option, and any Identity Data will only be provided by the Identity Provider selected by you and with your express consent. If you do not provide your consent, the Digital Identity Transaction will not be performed and the Organisation will provide you with an alternative option to provide your Identity Data or have your identity verified, other than through ConnectID.

5. Further, each Digital Identity Transaction is a one-off transfer of Identity Data, and any further transfers of Identity Data, including any transactions where you ask the same Identity Provider to provide your Identity Data, will require further consent from you and a new Digital Identity Transaction.

1.2 Eligibility

You will only be able to perform a Digital Identity Transaction if:

1. you have a digital account enabled with the relevant Identity Provider and have verified your identity and certain core Identity Data (such as your name, telephone number, email and date of birth) with the Identity Provider within the prior 5 years; and

2. you meet the minimum age requirements set out in the relevant Identity Provider’s terms of service for ConnectID.

2. Customer acknowledgments

2.1 You acknowledge and agree that:

1. any Digital Identity Transaction requested by you using the “Identity Service” is governed by these terms;

2. you will be asked by the Identity Provider to review the Identity Data to be transferred to GBG to verify its accuracy and to expressly consent to such transfer;

3. where you consent to the transfer of Identity Data to GBG from an Identity Provider:

   1. you consent to GBG providing this Identity Data to the Organisation as contemplated by these terms;

   2. Organisation may collect, use and disclose the Identity Data as consented to by you as part of the “Identity Service” as described in section 1(a), and for secondary purposes where you have further consented to such secondary purposes or where the secondary purposes are otherwise permitted by applicable privacy law, [Beneficiary’s] terms with you and [Beneficiary’s] Privacy Policy;

   3. GBG may collect, use and disclose the Identity Data as consented to by you as part of the Digital Identity Transaction and the “Identity Service” as described in section 1(a), for the purposes of providing the service to Organisation, for audit or compliance purposes, and for any secondary purposes where you have further consented to such secondary purposes or where the secondary purposes are otherwise permitted by applicable privacy law, [Representative’s] terms with you and [Representative’s] Privacy Policy;

   4. the Identity Provider will no longer control and will not be responsible for the security or handling of any Identity Data that has been transferred by the relevant Identity Provider to GBG and Organisation, and these terms with you and the Privacy Policy of each of GBG and Organisation will govern handling of Identity Data by the relevant party, not the terms you have with the Identity Provider nor the Identity Provider’s privacy policy; and

   5. if GBG or the Organisation suffer a security or data incident that impacts your Identity Data, you consent to GBG collecting information about the incident from Organisation (as applicable), and in all cases providing to the Identity Provider information about such incident, including your Personal Information and the Identity Data impacted by the incident, which the Identity Provider may use to seek to prevent or respond to cyber security incidents, fraud, scam activity or identify theft;

4. neither GBG, the Organisation nor the ConnectID Operator endorse or make any representations or recommendations in respect of any Identity Providers, including in respect of the suitability of their security or privacy practices; and

5. both the Organisation, GBG and the ConnectID Operator exclude all liability to you to the maximum extent permitted by law in connection with any acts or omissions of the Identity Provider.

   1. The exclusions in this section that relate to the ConnectID Operator are held on trust by GBG for the ConnectID Operator. This means that, although the ConnectID Operator is not a party to these terms, it can rely on your acknowledgment of and agreement to these exclusions.

   2. Please note that Digital Identity Transactions are intended to operate separately to requests made pursuant to the Consumer Data Right scheme.

3. Withholding service

GBG and/or the Organisation may withdraw or suspend the Identity Service at any time. GBG and/or the Organisation may also, or the relevant Identity Provider may, be unable to make available the “Identity Service” or process Digital Identity Transactions relating to you for a number of reasons, including if:

1. the underlying transaction that you are conducting is not a transaction for which GBG or Organisation are able to utilise the “Identity Service”;

2. you do not meet the eligibility requirements set out in section 2 or the relevant Identity Provider is not otherwise able to supply the requested Identity Data;

3. there are suspicions on reasonable grounds that any fraud (including identity fraud) or security incident has or may be occurring in connection with you, the Digital Identity Transaction or the relevant Identity Provider;

4. GBG’s or the Organisation’s participation in the “ConnectID Network” has been suspended or terminated; or

5. there are grounds to believe that the Digital Identity Transaction requires intervention, for example because it relates to you as a vulnerable person.

4. Fees

GBG and the Organisation will not charge you any fees for any Digital Identity Transaction that is performed in relation to you.

6. Complaints

If you have any complaints or disputes relating to GBG’s or the Organisation’s participation in a Digital Identity Transaction or “Identity Service” relating to you, please contact GBG at compliance@gbgplc.com or the Organisation at [insert relevant details]. However, please note that if your complaint or dispute relates to activities of an Identity Provider that you asked to disclose Identity Data to GBG and the Organisation, GBG and the Organisation may direct you to contact that Identity