GBG ANZ Pty Ltd (we, us) are a participant in ConnectID, and hold approval to perform transactions and obtain services through ConnectID (ConnectID Transactions) for the benefit of certain ‘sponsored’ third parties (a Beneficiary, and in this Agreement, you, your).
We agree to sponsor your participation in ConnectID and perform ConnectID Transactions through ConnectID for your benefit on the terms of this Agreement. This sponsorship and each ConnectID Transaction we perform for your benefit is referred to as the Identity Service. You cannot assign this benefit to a third party or use the Identity Service for the benefit of any other entity (i.e. as service bureau or similar).
You acknowledge that the ConnectID Operator has various rights to suspend or terminate our or your participation in ConnectID or this Agreement, and we may suspend or terminate this Agreement if the ConnectID Operator exercises those rights, including with immediate effect. We will promptly notify you where the ConnectID Operator exercises such rights.
We will act as the interface between you and ConnectID, including any Data Providers.
You must provide us with information, reports and notices and assistance as required by us to comply with our obligations under ConnectID or as may be requested by the ConnectID Operator. You consent to us disclosing such information, reports and notices on an identified basis and in accordance with section 1.
Notwithstanding paragraph (a):
the ConnectID Operator has monitoring, audit, and investigation rights and powers to require assistance and access to information under the Network Documentation;
you must reasonably co-operate with us and the ConnectID Operator where it exercises any of these rights or powers; and
if you become aware of a matter which you consider may adversely impact the stability, security, reliability, performance or integrity of ConnectID, or otherwise bring ConnectID or the ConnectID Operator into disrepute, and you reasonably believe that such matter will not be adequately brought to the ConnectID Operator’s attention through us (including due to urgency or sensitivity), you may notify the ConnectID Operator of this matter directly.
You agree that you have no rights or powers under the Network Documentation and, to the extent permitted by law, must not bring any claim in connection with the Network Documentation or ConnectID (including any ConnectID Transaction) against the ConnectID Operator or any Participant.
To the extent you suffer loss or damage in connection with the Identity Service, your right of action to recover those losses is through us. As your Representative, we may seek to enforce the provisions of the Network Documentation for your benefit, subject to any limitations and exclusions in the Network Documentation.
The exclusions and limitations in this section, and the other rights and benefits granted to the ConnectID Operator under this Agreement are held on trust by us for the ConnectID Operator. This means that, although the ConnectID Operator is not a party to these terms, it can rely on your acknowledgment of, and agreement to, these exclusions and limitations and any rights and benefits.
3.1 Eligibility Requirements
You must at all times meet the Eligibility Requirements and any conditions imposed by the ConnectID Operator that we advise you of from time to time.
3.2 Approved Use
You may only use the Identity Service in accordance with the following Approved Use(s) and for identified relevant Attributes:
|
# |
Approved Use |
Relevant Attributes |
|
1 |
Customer Onboarding |
given_name, middle_name, family_name, address, birthdate, email, phone_number (fees may differ) |
|
2 |
Existing customer verification |
given_name, middle_name, family_name, address, birthdate, email, phone_number (fees may differ) |
3.3 Onboarding and ConnectID Certification
The Identity Service only starts once all onboarding and certification has been successfully completed. You must participate and assist in certification activities, as reasonably required by us or the ConnectID Operator. The ConnectID Operator has rights to determine whether certification has been successfully completed.
Without limiting any of your other obligations, you must:
not adversely impact the stability, security, reliability, performance or integrity of ConnectID or otherwise bring ConnectID or the ConnectID Operator into disrepute;
have effective measures in place to identify, mitigate and protect against operational risks (including fraud) in respect of the Identity Service;
except to the extent prohibited by Law, immediately alert us if you become aware of any Fraud Incident and provide any further information reasonably requested by us. You must take reasonable actions to minimise any further fraudulent activity occurring in relation to the Identity Service, monitor use of any account impacted by such fraud, and delete Identity Data obtained in connection with a Fraud Incident;
implement appropriate security and data protection processes, policies and controls to secure Identity Data and Transaction Metadata from any Security Incident;
comply with all Laws applicable to the performance of your obligations or exercise of rights under this Agreement;
comply with any direction, determination, request, condition or requirement made or imposed by the ConnectID Operator in accordance with the Network Documentation, that is notified to you by us or directly by the ConnectID Operator;
promptly notify and consult with us if you are contacted, audited or investigated by any regulatory authority in connection with your participation in the Identity Service;
comply with your obligations under the IP Schedule and the Privacy and Data Schedule;
enter into terms with your Customers that include the minimum required terms we provide you which are based on those required by ConnectID (including as they may be updated from time to time) and take reasonable steps to ensure that your Customers comply with those terms;
promptly respond to, and use reasonable efforts to investigate and resolve, any complaints, disputes, enquiry or support request initiated by a Customer in connection with the Identity Service;
not charge a Customer any fees or charges in respect of your use of the Identity Service; and
not make any warranty or representation in respect of ConnectID, the ConnectID Operator or any Participant in connection with the goods and services you supply or the Identity Service.
5.1 Data and information generally
You acknowledge and agree that we may provide information, including Personal Information, confidential information, and other information about you, your Customers and this Agreement to the ConnectID Operator and other Participants in accordance with the Network Documentation, including in the context of a Security Incident, Fraud Incident or similar. You consent to the disclosure of such information to such persons, and will make all necessary disclosures and obtain all relevant consents and approvals to enable:
us to disclose such information to such person; and
them to Process, publish and hold such information in connection with their business and ConnectID, and as otherwise permitted by Law or the Network Documentation. This includes use by the ConnectID Operator to conduct data analytics and further develop, improve and support ConnectID and the products and services of its Related Bodies Corporate, including for the purposes of fraud prevention, risk management and to respond to security incidents and scams in connection with their respective products, networks or services.
5.2 Treatment and use of Confidential Information
We may provide you with Confidential Information of the ConnectID Operator (including the Network Documentation), another Participant or other person in relation to ConnectID (each a Disclosing Party).
You:
acknowledge the Confidential Information is valuable to the Disclosing Party;
undertake to keep all Confidential Information of the Disclosing Party confidential, except as otherwise permitted under this section 5;
may only use the Confidential Information of the Disclosing Party for the purposes of performing your obligations or exercising your rights under this Agreement. However, this section 5 does not restrict your use or disclosure of Identity Data disclosed to you by us; and
without limiting any restrictions in respect of the use or disclosure of the Identity Data or Personal Information, may only disclose Confidential Information of a Disclosing Party in accordance with this Agreement.
Approved Use in means the approved uses set out in section 3.2.
Beneficiary has the meaning given in section 1(a).
Beneficiary Marks has the meaning given in section 2(b) of the IP Schedule.
CID Documentation means the Network Documentation, any other documentation, data or information provided by the ConnectID Operator, and any modifications, improvements or derivative works of the foregoing.
Confidential Information means (whether or not in material form, or disclosed before or after the commencement of this Agreement) any information of whatever kind disclosed or revealed by the Disclosing Party to you in connection with this Agreement (whether directly or via another person) that:
is by its nature confidential;
is designated by the Disclosing Party as confidential; or
you know or reasonably ought to know is confidential,
but does not include information that:
is published or has otherwise entered the public domain without a breach of this Agreement;
is obtained from a third party who has no obligation of confidentiality to the Disclosing Party; or
is independently developed or obtained without breach of this Agreement.
ConnectID means the ConnectID network operated by the ConnectID Operator and governed by the Network Documentation.
ConnectID Operator means ConnectID Pty Ltd trading as “ConnectID”, as the operator of ConnectID.
ConnectID Operator Mark has the meaning given in section 2(a)(i) of the IP Schedule.
ConnectID Transaction has the meaning given in section 1(a).
Customer means your customers, members, clients, service recipients or other persons who are the individual or identity owner for the purposes of a ConnectID Transaction performed for your benefit.
Data Provider means any provider of Identity Data through ConnectID, which may include an “Identity Provider”, “Attribute Provider” or other service provider.
Disclosing Party has the meaning given in section 5.2(a).
Eligibility Requirements means that you must:
be incorporated (if you are a company) or formed or created in or under Australian Law (if you are any other type of entity) and hold a current Australian Business Number, Australian Company Number or Australian Registered Body Number;
pass probity checks conducted by us; and
have a need to collect Identity Data, and have ConnectID Transactions performed for a purpose that is reasonably necessary for one or more of your functions or activities.
Fraud Incident means: (a) any event or circumstance where fraud has been reasonably suspected on an account and Identity Data has been supplied by a Data Provider that assisted in enabling the fraud, or (b) any fraudulent activity occurring in relation to the Identity Service.
High Risk Attributes means “government related identifiers” as that term is used in the Privacy Act, and includes passport, driver licence and Medicare details and any other Attribute identified as a “High Risk Attribute” in the Network Documentation.
Identity Data means any identity data, identity verification or attributes associated with an individual.
Identity Service has the meaning given in section 1(b).
Intellectual Property includes all industrial and intellectual property rights of any kind including copyright (including rights in computer software), trade mark, service mark, design, patent, trade secret, semi-conductor or circuit layout rights, trade, business, domain or company names, moral rights, rights in Confidential Information, know how or other proprietary rights (whether or not any of these are registered and including any application for registration) and all rights or forms of protection of a similar nature or having equivalent or similar effect to any of these which may subsist anywhere in the world.
IP Schedule means Schedule 1 to this Agreement.
Laws means common law and equity; any legislation, statute, law, by-law, ordinance, rules, or subordinate legislation; mandatory or statutory codes of practice, standards, guidelines, principles and requirements, licences, permit, authorisation, accreditation or associated conditions; and writs, orders, injunctions and judgments.
Marks includes ConnectID Operator Marks, Participant Marks and Our Marks.
Metadata about Identity Data means underlying data about Identity Data, such as but not limited to the level of validation or date of the last update of an Attribute.
Network Documentation means the rules, procedures, specifications and other agreements between us and the ConnectID Operator and/or other Participants that govern our participation in ConnectID.
Our Marks has the meaning given in section 2(a)(iii) of the IP Schedule.
Participant means any other person who participates in ConnectID.
Participant Marks means the relevant Data Provider’s name and main trading logos.
Personal Information means any “Personal Information” or “Sensitive Information” (as such terms are defined in the Privacy Act) or similar terms under any privacy or data protection Law which is received from any source in relation to or as a result of the performance of rights or obligations under this Agreement or a ConnectID Transaction, and in all cases is deemed to include all Identity Data transferred in connection with the Identity Service.
Privacy Act means the Privacy Act 1988 (Cth).
Privacy and Data Schedule means Schedule 2 to this Agreement.
Privacy Law means all legislation, principles, industry codes, guidelines and policies relating to the collection, use, disclosure, storage, protection or granting of access rights to Personal Information, including the Privacy Act and any applicable state or territory privacy laws.
Processing means accessing, collecting, using, disclosing, processing, transferring and/or otherwise handling. Process has an equivalent meaning.
Sanctioned Jurisdiction means any jurisdiction that from time to time is the subject of sanctions or restricted export Laws (as applicable) or identified by the Financial Action Task Force (FATF) or AUSTRAC as a jurisdiction that is: (a) “high risk”, under “increased monitoring” or subject to a “call for action” (or substantially similar or replacement concepts); or (b) a “prescribed foreign country” (or substantially similar or replacement concepts).
Security Incident means any actual or suspected:
breach of confidentiality, privacy or security requirements under this Agreement; or
unauthorised, accidental or unlawful access to, use, disclosure or modification of, or loss of or damage to, any Personal Information or Identity Data transferred in connection with the Identity Service,
and includes an ‘eligible data breach’ (as that term is defined in the Privacy Act) or any other actual or suspected data or security incident that is notified or required to be notified (by any person) to any regulatory authority in connection with the Identity Service or that may compromise the stability, security, reliability, performance or integrity of the Identity Service or ConnectID.
Transaction Metadata means:
data automatically generated in respect of a ConnectID Transaction; and
any metadata associated with a ConnectID Transaction, and including time stamps, identity of us and the relevant Data Provider for a ConnectID Transaction, proofing level and types of Identity Data provided in respect of a ConnectID Transaction,
but does not include Identity Data or Metadata about Identity Data.
