Agility Credit: Master Service Agreement

Master Service Agreement

Pursuant to the Agility Credit Master Service Agreement (“MSA”), Agility Credit, LLC (“Agility Credit”) will provide services to the signatory specifically identified on the Service Order Agreement (“SOA”) which includes but not limited to its affiliates, subsidiaries and other business ventures (“Client”). Agility Credit and Client maybe referred to individually as a “Party” or collectively as the “Parties”.

In a desire for extreme clarity and in abundance of caution, the section of the MSA titled “Specific Compliance and Credit Bureau Terms and Requirements” and the ensuring subsections, are part and parcel, which form the entire MSA.

Agility Credit and Client agree to the following terms and conditions as set forth:

GENERAL CONTRACTUAL TERMS AND CONDITIONS

Service Documents

The Agility Credit MSA governs the services agreement documents (“Service Documents”) included but are not limited to the basic document(s) identified below:

Service Order Agreement (“SOA”)
Client Affiliates

Services

Agility Credit will provide services pursuant to the Agility Credit Service Order Agreement (“SOA”), which may include other specified services and documents that references and incorporates by reference this MSA, that hereafter collectively describe the services provided “(Services”).

Notice

Any and all notices, demands or requests required or permitted to be given under the Service Documents to Agility Credit shall be given in writing and sent, by email only to notices@agilitycredit.com . Any and all notices, demands or requests required or permitted to be given under the Service Documents to Client shall be given in writing and sent, by email or mail, to its designated email address or mailing address set forth in the Service Documents, in particular, the SOA. Each Party may from time-to-time change the email address or mailing address for notice by giving the other party written notice in accordance with the terms of this section.

Notices to Agility Credit shall be sent to billing@agilitycredit.com .
Notice to Client shall be sent to the Clients physical address and/or Billing email address as indicated on the Service Order Agreement

Document Modification

The MSA and Service Documents, except for the Client specific SOA, may be modified in writing by Agility Credit. The most current version of the MSA and Service Documents, except for the Client specific SOA, is available for review at https://www.agilitycredit.com/ master-service-agreement/ and are binding.

Sole and Exclusive Provider

Agility Credit shall be the sole and exclusive provider to the Client of credit reports, and products provided through Experian, TransUnion, and Equifax, except for products Agility Credit does not offer.

Nothing in this Agreement or Service Documents shall be construed as making Agility Credit a consumer reporting agency as defined in the Federal Fair Credit Reporting Act and companion state statutes.

Fees, Payment, Late Payment Resolution Process

Fees

Client agrees to pay for Services pursuant to the SOA. Agility Credit reserves the right to increase rates and fees after at least 30-days written notice before the effective date of the modification. Written notices shall be emailed to the address indicated on the SOA and / or pursuant to §3 above.

Invoice and Payment

For Services rendered, Agility Credit will invoice Client monthly or as specified on the applicable SOA. The client is subject to a monthly minimum the “Minimum Fee” of ($50.00/month for one bureau, $75.00/month for two bureaus, $100.00/month for three bureaus). Should the combined total of all client’s services be less than the Minimum Fee as described above in any given month, the client will still be billed at the monthly Minimum Fee charge. Monthly minimums are for the collective credit report transactional services and do not include the Credit Reporting Agencies Monthly Subscriber Code Service Fees. Upon receipt, Client agrees to immediately pay each invoice in full in U.S. Dollars. Payment shall be authorized via ACH (Automatic Clearing House) or CC (Credit Card), unless otherwise agreed in writing. Client is responsible for any Non-Sufficient Funds charges that may occur when processing ACH payments. Payment shall be without setoff, counterclaim, discount, abatement or demand.

Client’s primary billing address shall be Client’s email address as indicated on the SOA. Invoices sent via email shall be considered validly delivered to the Client. Invoices may also be sent to the Client’s physical address. Valid addresses are indicated on the SOA or other related document that indicates the Client’s billing address.

Late Payment and other charges

Any invoice not properly disputed as provided in Section 6(D) below and not paid in-full by the due date stated on the invoices (“Due Date”), shall be subject to a late payment of $75 dollars if the entire invoice amount inclusive of all charges, fees and any other cost is $375 or more. Invoices under $375 which is inclusive of all charges, fees and any other cost shall be subject to a late payment of $25 dollars.

Payment Disputes Process

The Parties agree to use good faith efforts to resolve any payment dispute. All payment disputes must be claimed within ninety (90) days after the Due Date or the claim is barred unless manifest error.

In good faith, Client may dispute in writing the amount of any invoiced fee or other charge as follows: Client shall provide a written notification to Agility Credit at billing@agilitycredit.com of the fees(s) or other charge(s) being disputed along with substantiating documentation and other information reasonably requested by Agility Credit to resolve the payment dispute (“Payment Dispute Process”).

Client shall remain responsible by the Due Date for the invoiced amount excluding the disputed amount.

Absent manifest error, failure to contest fee(s) or charge(s) pursuant to the Payment Dispute Process shall create an irrefutable presumption of correctness of the fee(s) or charge(s), and Client shall be deemed to have waived its dispute rights for the applicable invoice and agreed to pay such invoice in full.

Standard Service Level, Service Term, Termination of Services and Suspension of Services

Standard Service Level

Definitions

“Scheduled Maintenance Window” means the designated time periods during which Agility Credit may limit or suspend access to the platform so that planned maintenance may be performed. The tentative Scheduled Maintenance Window is Wednesday, between 12:00 a.m. and 3:00 a.m. Pacific Time.

“Scheduled Maintenance” means platform maintenance that is performed by Agility Credit during a Scheduled Maintenance Window, or when Agility Credit has provided Client at least 12 hours advance notice using e-mail specifying the nature and anticipated impact to Services.

“Emergency Maintenance” means maintenance that is performed by Agility Credit due to a major issue impacting the platform outside of the Scheduled Maintenance Window.

Support

E-mail Support is available at support@agilitycredit.com

Phone Support is available at 1 (877) 744-0777

Service Performance

Agility Credit shall provide a 99.95% Platform Uptime, measured each calendar month (Platform Uptime). The following are excluded for purposes of computing Platform Uptime:

Scheduled Maintenance or Emergency Maintenance; unavailability caused by acts or omissions of Client or its agents; unavailability caused by the Credit Bureau Outages, network unavailability, bandwidth outside of the Agility Credit Network, or cloud provider service disruption; an unforeseen event, any Force Majeure Event.

Maintenance

Agility Credit will use commercially reasonable efforts to minimize the impact for Clients using the platform by typically utilizing only one or two Scheduled Maintenance Windows per month and performing operations to minimize Client impact. Agility Credit reserves the right to perform any required Emergency Maintenance work outside of the Scheduled Maintenance Window and will use commercially reasonable efforts to notify Client as soon as reasonable via email to the Client’s primary contact or a notice posted in the Platform before commencing any Emergency Maintenance outside of the Scheduled Maintenance Window.

Service Term and Renewal

An order for Services shall remain in force and effect as designated on the Service Order Agreement for the Initial Service Term and shall automatically renew for the same term as the Initial Service Term referred to as the Renewal Term.

Termination of Services
1. Client may terminate the Renewal Term and related Service Order Agreement after giving Agility Credit written notice of termination no more than ninety (90) days prior and no less than thirty (30) days prior to the Renewal Term for annual or multi-year agreements or thirty (30) days prior to the Renewal Term for month-to-month agreements. Written notices shall be sent to billing@agilitycredit.com or pursuant to §3 above.
2. After giving reasonably written notice to Client and without liability to Agility Credit, Agility Credit may immediately terminate any and all Services to Client for a Default as described below.

Each of the following shall constitute an event of default (“Default”) under this Agreement:

Client’s failure to pay any invoice after the Due Date;
Client’s failure to comply with any Federal or State law;
Client’s failure to comply with any requirement of a credit provider, including but not limited to Equifax Information Services LLC, TransUnion LLC, Experian Information Solutions, Inc or any of their affiliated companies (“Credit Bureau” or collectively the Credit Bureaus”);
If Client is seeking to become or has become a subject to any insolvency, bankruptcy, proceeding, dissolution or cessation of business operations;
A Credit Bureau requests Agility Credit to terminate service to Client;
Client breaches any term or condition of the Service Documents.

Suspension of Services

Agility Credit may immediately terminate or suspend its obligation to provide Consumer Reports and other Services upon written notice to Client when directed to do so by any Credit Bureau or for a Default.

Representations and Warranties
1. Client Represents and Warrants

Client represents and warrants that:

Client represents and warrants that it will not use any Service in a manner that could result in a contravention of Federal or State law and Agility Credit policy and procedures;
Client represents and warrants that it shall comply with all the requirements of the Credit Bureaus as outlined in this Master Service Agreement and the attached exhibits;
Client represents and warrants that it shall comply with all applicable laws, regulations and ordinances and shall maintain in effect all the licenses, permissions, authorizations, consents and permits that it needs to carry out its obligations under the Service Documents;
Client represents and warrants that its employees and agents that use or have access to any Service are duly authorized with the appropriate authority to act and Client will exercise appropriate controls to ensure each employee and agent does not exceed the authority granted and abide by security protocols, procedures and policies consistent with maintaining Confidential Information;
Client represents and warrants that it shall establish and enforce appropriate security protocols, procedures and policies consistent with maintaining Confidential Information and Credit Bureau requirements.
Client represents and warrants that it will use all information received from Agility Credit for a permissible purpose and abide by other obligations as stated and described by U.S.C. §1681et al of the Fair Credit Reporting Act (FCRA) and The Financial Services Modernization Act of 1999 “(GLBA”)
Client represents and warrants that it will not endeavor in a business not served or prohibited by the Credit Bureaus and/or Federal or State law, and will abide by the information security and other requirements of the Credit Bureaus as described in this MSA and attached exhibits.

Agility Credit Representations and Warranties

TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER AGILITY CREDIT NOR THE CREDIT BUREAUS MAKE ANY WARRANTY OR REPRESENTATIONS WITH RESPECT TO THE SERVICE(S) PROVIDED BY AGILITY CREDIT UNDER ANY AND ALL OF THE SERVICE DOCUMENTS AND EXPRESSLY DISCLAIM ANY AND ALL REPRESENTATIONS AND WARRANTIES WRITTEN, ORAL, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THE WARRANTY OF MERCHANT ABILITY, INFRINGEMENT, COMPLETENESS, QUALITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE. NEITHER AGILITY CREDIT NOR THE CREDIT BUREAUS REPRESENT OR WARRANT THAT THE SERVICE(S) PROVIDED WILL BE UNINTERRUPTED, FREE OF VIRUSES, MALWARE, OR OTHER HARMFUL COMPONENTS OR ERROR FREE. ANY REPRESENTATION OR WARRANTY EXPRESSLY SET FORTH IN A SERVICE ORDER CONSTITUTES THE ONLY REPRESENTATION OR WARRANTY OF AGILITY CREDIT AND RELATES SOLELY TO THE SPECIFIC SERVICE ORDER.

NOTWITHSTANDING ANYTHING TO THE CONTRARY CONTAINED HEREIN, UNDER NO CIRCUMSTANCES WILL AGILITY CREDIT OR THE CREDIT BUREAUS HAVE ANY LIABILITY FOR INTERRUPTIONS AFFECTING THE SERVICES FURNISHED UNDER THIS AGREEMENT THAT ARE ATTRIBUTABLE TO CLIENT’S EQUIPMENT FAILURE, OR CLIENT’S BREACH OF THE AGREEMENT, OR FOR ANY ACT OR OMISSION OF A THIRD PARTY PROVIDING ANY SERVICE OR PRODUCT THAT IMPACTS THE SERVICE(S) PROVIDED UNDER THE SERVICE DOCUMENTS. THE PARTIES ARE COMMERCIAL ENTERPRISES, CLIENT HAS THE UNDERSTANDING AND COMPREHENSION OF THIS SECTION AND THE OPPORTUNITY FOR REVIEW BY LEGAL COUNSEL.

Limitation of Liability and Indemnification
1. Limitation of Liability

The liability of Agility Credit arising out of or in connection with the Service Documents and or services provided, shall not exceed the amount of fees actually collected by Agility Credit from Client during the previous twelve (12) months before the incident that gave rise to the claim. In no event shall Agility Credit or the Credit Bureaus be liable for indirect, special, punitive incidental or consequential damages of any kind, including but not limited to proﬁts, actual or projected revenues, business harm, regardless if the action is based on warranty, strict liability, tort, negligence of any kind, nonperformance, termination, action or inaction for any reason even if Client advises of the possibility of such loss or damage. Client acknowledges that Agility Credit does not offer legal advice, as such, any customer facing materials and products provided by Agility Credit will be reviewed and approved by Client’s legal counsel before circulation. Client agrees that this limitation set forth in this section is integral to the charges for Services and if Agility Credit were to assume any further liability than set forth herein, said Services charges would of necessity be substantially higher. The Parties are commercial enterprises, Client has the understanding and comprehension of this section and the opportunity for review by legal counsel.

Indemnification

Client agrees to indemnify and hold Agility Credit and its directors, officers, employees and agents and the Credit Bureaus harmless from all claims, demands, losses, liabilities, judgments and expenses (including their attorney’s fees and legal expenses) arising out of or in any way connected with Agility Credit’s performance, breach or failure of express or implied warranty, gross negligence, even if informed by an authorized agent or negligence of any kind under the Service Documents and or services provided. The Parties are commercial enterprises, Client has the understanding and comprehension of this section and the opportunity for review by legal counsel.

Arbitration and Waiver of Jury Trial
1. Arbitration

The Parties agree in the event a dispute arises concerning the Service Documents, whereby the value of the claim is less than ten-thousand dollars ($10,000), litigation will not afford a practical resolution of the issues within a reasonable period of time and at a reasonable cost. Consequently, any claim less than ten-thousand dollars ($10,000), with the exceptions noted below, each Party agrees that any dispute, controversy or claim arising out of or relating to this contract, including the formation, interpretation, breach or termination thereof, including whether the claims asserted are arbitrable, will be referred to and ﬁnally determined by binding arbitration in accordance with the JAMS International Arbitration Rules. The tribunal will consist of a sole arbitrator. The seat of the arbitration will be located in Las Vegas, Clark County, Nevada. The language to be used in the arbitral proceedings will be American English. The arbitrator shall award the prevailing party fees and costs. Judgment upon the award rendered by the arbitrator may be entered by any court having jurisdiction thereof. The losing party shall pay the ﬁling fees, cost of the representative, attorney fees and arbitrator’s cost, if any, of the successful party. For purposes of this provision, the following matters will not be subject to arbitration, matters relating to the breach of Conﬁdential Information, which Agility Credit may seek to enforce in any court of competent jurisdiction. Either Party may initiate an arbitration proceeding at any time by giving notice to the other Party. The arbitration proceeding and all ﬁling, testimony, documents, and information, relating to or presented during the proceeding, shall be disclosed exclusively for the purpose of facilitating the arbitration process and for no other purpose and shall be deemed to be information subject to section 12, Conﬁdential Information, of this Master Services Agreement. The decision of the arbitrator, absent fraud, duress, incompetence or gross and obvious error of fact, shall be ﬁnal and binding upon the Parties and shall be enforceable in courts of proper jurisdiction. Following written notice pursuant to section 10, of a request for arbitration, each Party shall be entitled to an injunction restraining all further proceedings in any pending or subsequently ﬁled litigation concerning the Service Documents, except as otherwise provided herein.

Waiver of Jury Trial

Each Party acknowledges a controversy that may arise under the Service Documents and or services provided are likely to involve complicated and difficult issues, therefore, each Party irrevocably and unconditionally waives any right to a trial by jury in respect of any legal action arising out of or relating to the Service Documents and or services provided.

Governing Law and Venue, No Waiver of Remedy, Attorney Fees

Governing Law and Venue

The Service Documents are governed by and to be construed in accordance with the laws of the State of Nevada, without regard to conﬂict of laws, rules and without regard to provisions related to the choice of law or forum. Unless strictly prohibited by applicable law, any action brought to enforce the terms of the Service Documents shall be brought in the Federal and State Courts of Clark County, Nevada.

No Waiver of Remedy

Except as otherwise set forth in the Service Documents, no failure to exercise, or delay in exercising, any right, remedy, power or privilege arising from any of the Service Documents and or services provided shall operate or be construed as a waiver thereof, nor shall any single or partial exercise of any right, remedy, power or privilege hereunder preclude any other or further exercise thereof or the exercise of any other right, remedy, power or privilege.

Attorney Fees and Representative Fees

In the unlikely event a Party seeks enforcement of or defended against an unsuccessful claim of breach of the Service Documents and or services provided, the unsuccessful party shall be liable for all reasonable attorney fees, representative fees, expenses and costs incurred by the successful party.

Confidentiality of Information
1. The term “Confidential information”, includes but is not limited to, all information, including Credit Bureau Data [below Part II section 1(a)], any proprietary of sensitive information, data, technical documentation, computer programs, pricing information, and intellectual property which is owned or licensed to Client by Agility Credit, documents, agreements, files, whether transferred verbally or electronically or written or any other media format whether observed or stored, all consumer information, marketing plans and strategies, client and customer information, any personally identifiable information, as well as proprietary information such as – source codes, trade secrets, know how, processes, methods, protocols, practices, analyses, compilations, documents that reflect or are generated from such information, documents or any other materials to the extend disclosure concerning the business and affairs of Agility Credit.

Nothing contained in the Service Documents grants or alters any property rights, by license, ownership or otherwise to Client of any Confidential Information of Agility Credit or its service providers.

Client agrees that Confidential Information shall not be reproduced in any form except in conjunction with accomplishing the Services contracted.

Except as provided for in the Service Documents, Client shall not make any disclosure of Confidential information to anyone other than those individuals, agents and employees that need to know (“Authorized Persons”) in order to accomplish the duties and obligations under the Service Documents. Client shall make all Authorized Persons aware and responsible for the terms and conditions of controlling Agility Credit’s Confidential Information.

Client agrees to follow the required security information protocols of the appropriate Credit Bureau as described in the exhibits attached to this Master Services Agreement, which may be updated from time to time and without prior written notice. Further, Client agrees that Conﬁdential Information received in any form or via any medium shall: (a) be stored in a physically and logically secure and controlled environment, only accessible by Authorized Persons; and (b) be downloaded only onto physically and logically secured and controlled systems accessible by Authorized Persons.

Upon written request by Agility Credit, Client shall promptly return to Agility Credit or securely destroy, all Conﬁdential Information and all copies thereof. Conﬁdential Information disposed of in the regular course of business shall be securely destroyed on a regular basis. Notwithstanding, Client may retain copies of any Conﬁdential Information required to comply with applicable law or regulation provided (i) such information shall remain subject to this Master Services Agreement and (ii) shall not be retained beyond the period required by applicable law or regulation.
Client acknowledges and agrees that an actual or threatened breach of any of the terms and or conditions contained in this section will result in irreparable and continuing damage to Agility Credit for which there will be no adequate remedy at law, and Agility Credit shall be entitled without the requirement of posting a bond or other security, to injunctive relief, speciﬁc performance and or other equitable relief as remedies for such breach or threatened breach, and other relief as may be proper (including monetary damages if appropriate), and these remedies shall not be deemed Agility Credit’s exclusive remedies but shall be in addition to all other remedies available at law or in equity to Agility Credit.

Miscellaneous

Independent Entities

The Service Documents shall establish no relationship between the Parties other than that of an independent contractor. Neither Party’s employees or agents shall be construed to be a representative of the other Party. None of the provisions of the Service Documents are intended to create, nor shall they be deemed or construed to create, any partnership, joint venture or other relationship between the Parties other than that of independent contracting parties.

Taxes and other Exemptions
1. Client shall be responsible for all charges, including but not limited to, fees, taxes, regulatory fees, governmental assessments, surcharges, State surcharges, credit bureau surcharges, value added tax, and other charges imposed on Client as a result of Agility Credit’s sale of Services or Client’s use of Services during the course of business. Agility Credit shall not be responsible in any manner, under any conditions or in any terms liable or responsible for the above referenced charges.
2. If Client claims a tax exemption of any kind, Client must provide evidence of such exemption to Agility Credit that is satisfactory to Agility Credit in Agility Credit’s sole and absolute discretion. Agility Credit may invoice Client for all charges Agility Credit deems, in its sole and absolute discretion, not covered by the Client’s exemption and Client shall promptly pay such invoice by the Due Date without setoff, counterclaim, discount, abatement or demand. Any outstanding balance shall remain Client’s sole and absolute responsibility.
Assignment or Delegation

Client may not assign, delegate or transfer its rights or obligations under the Service Documents without Agility Credit’s written consent, which consent may not be unreasonably delayed or withheld, however, no such consent will be required by Agility Credit if such assignment or delegation is to an aﬃliate or successor-in-interest (by merger, acquisition, asset sale, or otherwise). Except as provided herein, any assignment or delegation without prior written consent from the other Party is null and void.

In the event the Client changes its location or ownership, Client will notify Agility Credit in writing within ten (10) calendar days of such change. In Agility Credit’s sole discretion, Agility Credit will determine if this Agreement may remain in force or voided without liability. In addition, Agility Credit will determine if re-credentialing and other requirements are needed to continue Services under this Agreement.

No Third-Party Beneficiaries

Nothing in the Service Documents shall be construed to create any rights or obligations except between the Parties hereto, and no person or entity shall be regarded as a third-party beneﬁciary under the Service Documents. Agility Credit and the Credit Bureaus shall be entitled to inspect and audit records and ﬁles of Client as it relates to the Services provided.

Force Majeure

Agility Credit will not be liable for delays in its performance or failure to perform in whole or in part of the terms of the Service Documents caused by the occurrence of any contingency beyond its control, including but not limited to, labor dispute, strike, labor shortage, shortage of supplies or materials, vendor issues, war or act of war, insurrection, sabotage, riot or civil commotion, act of a public enemy, epidemic, pandemic, lock down, accident, ﬁre, Credit Bureau nonperformance, storm, earthquake, explosion, ﬂood, drought or other act of God, act of any governmental authority, judicial action, equipment failure, outage or technical failure, electrical outage and any such delay or failure will not be considered a breach of the Service Documents.

Severability

The invalidity or unenforceability of any term or provision contained in the Service Documents shall not void or impair the remaining provisions hereof, which shall remain in full force and effect as if such invalid or unenforceable provision had never been contained herein.

Construction and Headings

In the event of an ambiguity or if a question of intent or interpretation arises, the Service Documents shall be construed as if drafted jointly by the Parties and no presumption or burden of proof shall arise favoring or disfavoring any Party by virtue of the authorship of any of the provisions. The section headings contained herein are for reference purposes only and shall not affect in any way the meaning or interpretation of the Service Documents.

Entire Agreement

The Service Documents constitutes and represents the entire agreement between Parties regarding the Services to be provided and supersedes and extinguishes all prior agreements, understandings, representations, warranties and arrangements of any nature, whether oral or written, but excludes any specifically drafted and agreed upon arrangement(s) by the Parties.

Survival

Notwithstanding anything herein to the contrary, sections 8, 9, 10, 11, 12 and shall survive after the termination of all the Service Documents.

EXHIBITS OF SPECIFIC COMPLIANCE AND CREDIT BUREAU TERMS AND REQUIREMENTS
1. Definitions of Key Terms
  1. Credit Bureau and/or Credit Bureaus shall mean, individually or collectively, any of the three national credit reporting agencies (Equifax Information Services LLC, Transunion, Experian Information Solutions, Inc.).

Credit Bureau Data means any Consumer Report and/or any other related consumer information received by Agility Credit and/or Client who has a permissible purpose for receiving such information in accordance with the Fair Credit Reporting Act (15 U.S.C. §1681 et seq.) including, without limitation, all amendments thereto (“FCRA”).

Client shall refer to the signatory speciﬁcally identiﬁed on the Service Order Agreement (SOA), includes but not limited to its aﬃliates, subsidiaries and other business ventures, to receive services.

Consumer Information refers to Consumer Reports and other non-public, personally identiﬁable consumer information obtained from the Credit Bureaus.

Consumer Report shall have the meaning set forth in the Fair Credit Reporting Act (“FCRA”), 15 USC 1681(a)(d), as may be amended from time to time. For purposes of this Exhibit, the term Consumer Reports refers to those consumer reports, or any information derived therefrom including, but not limited to scores, obtained from any of the Credit Bureaus.

Consumer Reporting Agency (“CRA”) shall have the meaning set forth in the FCRA, 15 USC 1681 (a)(f), as may be amended from time to time. As of the date of this Exhibit, the term “Consumer Reporting Agency” is deﬁned in the FCRA as an entity which, for monetary fees, dues, or on a cooperative nonproﬁt basis, regularly engages in whole or in part-in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.

Death Master File (DMF) is made available by the U.S. Department of Commerce National Technical Information Service (NTIS) and subject to regulations found at 15 CFR Part 1110. All users are required to comply with all applicable laws with respect to DMF data.

Federal Fair Credit Reporting Act (FCRA) refers to the Federal Fair Credit Reporting Act, 15 USC 1681 et seq., as amended from time to time.

Fair Isaac Corporation (FICO) formally referred to as Fair Isaac and Company and any of the FICO scoring models.

Financial Modernization Act of 1999 (GLBA) refers to the Financial Modernization Act of 1999, also known as the Gramm-Leach-Bliley Act or GLBA.

Permissible Purpose - Agility Credit and the Client certify that any Consumer Reports or related Credit Bureau Data will only be used for a permissible purpose and used for no other purpose other than prescribed by the Fair Credit Reporting Act (FCRA).

Services refers to, but not limited to, the services speciﬁed on the Agility Credit Service Order signed by the Client.

Service Order Agreement (Service Order) references to, but not limited to, the Services agreed to by Client as indicated on the executed Service Order Agreement and other related documents.

Subscriber Code is the code number (account number) assigned to Agility Credit and Client to access Credit Bureau Data and systems.

General Requirements of Agility Credit and Client

The following representations, certifications and warranties are in addition to and do not void or invalidate any of the representations and warranties of the MSA.

Designate a contact

Agility Credit will designate the primary contact for the Credit Bureaus as [Darrel Schulte at support@agilitycredit.com or +1(877)744-0777].

Agility Credit and Client Certify

1. Credit Bureau Data will be requested and used for a permissible purpose under Section 604 of the FCRA for the Consumer Reports.

2. Agility Credit and Client are permitted to receive and use nonpublic personal information under Section (6802)(e) of the GLBA.

3. Agility Credit and Client are permitted to receive and use nonpublic personal information under Section (6802)(e) of the GLBA for identiﬁcation services that are sourced from Credit Bureaus and databases other than the Credit Bureaus .

4. Client will permit Agility Credit and the Credit Bureaus to inspect and audit its records and ﬁles as it relates to the Services provided by Agility Credit and the Credit Bureaus.

5. Client will not resell Credit Bureau Data.

Unacceptable Business Types

Client Certifies it is not doing business as one of the follow types of unacceptable business, nor will Agility Credit sell credit bureau data to any company in the following types of business:

Bail Bond Enforcement or Bounty Hunters
Internet people locator services
Diet centers
Adoption search firms
Credit Repair companies or credit clinics
Non-Credit Repair Organizations Act (CROA) For profit Credit Counseling
Loan Modification Companies or debt settlement
Investigative companies, including private investigators and detective agencies except those licensed for - and exclusively practicing, investigative work for employment purposes.
Media agencies, news agencies or journalists
Non-governmental agencies or businesses associated with the collection of child support
Companies or individuals identified on Experian Customer Alert List
Businesses operating out of a residence except where provided in policy
Dating Services
Asset Location Services
Condominium/Homeowners Associations (unless acting as a tenant screener with proof of permissible purpose)
Future services (i.e., health clubs, continuity clubs, etc.), except health clubs (spas) human resource departments for employment screening and Fraud Services for fraud detection purposes
Country Clubs (except for employment screening)
Timeshare (unless proof of credit extension is procured or fraud detection purposes)
Companies involved and/or associated with inappropriate adult content web sites and/or adult-type telephone services and or adult entertainment service of any kind
Any company or individual who is known to have been involved in credit fraud or other unethical business practices
Any person or entity which Agility Credit knows, or suspects may be engaged in fraudulent or illegal activity, such as identity theft, harassment or stalking
Any company or individual listed on the Departments of Commerce, State and the Treasury lists Export) website http://export.gov/ecr/eg_main_023148.asp
For the sole purpose of Identifying and locating illegal immigrants or undocumented individuals unless presented with a court order, as permitted by law.
1. Agility Credit shall require Client to maintain and provide documented evidence of such court order(s) for 12 months and provide to Experian upon request.
Pawn shop
Attorney or Law Firm engaged in the practice of law, unless engaged in collection or using the report in connection with a consumer bankruptcy pursuant to the written authorization of the consumer.
Child location service (i.e. company that locates missing children)
Financial counseling, except a registered securities broker dealer or a certified financial planner
Foreign company or agency of a foreign government
Genealogical or heir research firm
Law enforcement agency
Massage service
Private detective, detective agency or investigative company
Repossession company
Subscriptions (magazines, book clubs, record clubs, etc.)
Tattoo service
Weapons dealer, seller or distributor

Permissible Purpose

Client certiﬁes, represents and warrants to Agility Credit that it has a permissible purpose for obtaining Consumer Reports in accordance with the Fair Credit Reporting Act (15 U.S.C. §1681 et seq.) including, without limitation, all amendments thereto:

1. As instructed by the consumer in writing. Pursuant to Fair Credit Reporting Act (15 U.S.C. §1681 et seq.) Section 604(a)(2).

2. For the extension of credit as a result of an application from a consumer, or the review or collection of a consumer’s account. Pursuant to Fair Credit Reporting Act (15 U.S.C. §1681 et seq.) Section 604(a)(3)(A).

3. When there is a legitimate business need, in connection with a business transaction that is initiated by the consumer. Pursuant to Fair Credit Reporting Act (15 U.S.C. §1681 et seq.) Section 604(a)(3)(F)(i).

Client will only use GLBA information for fraud prevention products.

Client shall use the Consumer Reports only for (a) the permissible purpose as indicated on this MSA and as specified on the SOA (b) its exclusive use and (c) solely for its one time use and for the purpose(s) of (1) pre-screening applicants for credit; and/or (2) a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer. Client certiﬁes that it will only request Consumer Reports for the permissible purpose(s) certiﬁed above and for Client’s exclusive authorized use. Client further certiﬁes and agrees that all Consumer Reports requested will be held in strict conﬁdence pursuit to section 12 of this Master Service Agreement, except to the extent that disclosure to others is required or permitted by applicable law. Only designated and authorized representatives of Client will request Consumer Reports on behalf of Client. Client shall prohibit its employees from obtaining Consumer Reports on themselves, associates or any other persons except in the exercise of their oﬃcial duties. Client will not disclose information from Consumer Reports to the subject of the report or any third party except as permitted herein or required by law, but will refer the subject of the Consumer Report to the applicable Credit Bureau. Client agrees to implement appropriate procedures so that only employees with adequate training regarding the requirements of the FCRA and other applicable law have access to Consumer Reports.

Proper Authorization from Consumer for Credit Report

Client certiﬁes, represents and warrants to Agility Credit that it will obtain authorization, written or verbal, from each person on whom a Consumer Report is ordered, prior to ordering a Consumer Report, and will maintain all such written or verbal authorizations on ﬁle, whether physical or electronic, for a period no less than sixty (60) months from the date the authorized credit report inquiry was processed per the terms of the Federal Equal Credit Opportunity Act (“ECOA”). Client shall dispose of such Consumer Reports in accordance with all applicable provisions of the FCRA and all other law and regulations. During the retention period, Client will make available to Agility Credit and/or Credit Bureaus, copies of any and all consumer credit authorizations or related purchase/sales agreements, if applicable, as may be requested from time to time.

Death Master File (DMF)

Death Master File (DMF) is made available by the U.S. Department of Commerce National Technical Information Service (NTIS) and subject to regulations found at 15 CFR Part 1110. All users are required to comply with all applicable laws with respect to DMF data. Client acknowledges that many services containing Credit Bureau information also contain information from the Death Master File as issued by the Social Security Administration (“DMF”); certify pursuant to Section 203 of the Bipartisan Budget Act of 2013 and 15 C.F.R. § 1110.102 that, consistent with its applicable FCRA or GLB use of Credit Bureau information, the Client’s use of deceased ﬂags or other indicia within the Credit Bureau information is restricted to legitimate fraud prevention or business purposes in compliance with applicable laws, rules regulations, or ﬁduciary duty, as such business purposes are interpreted under 15 C.F.R. § 1110.102(a)(1); and certify that the client will not take any adverse action against any consumer without further investigation to verify the information from the deceased ﬂags or other indicia within the Credit Bureau information.

Client Compliance to Audit

Client agrees that Agility Credit or representatives of the Credit Bureaus, upon reasonable notice, may conduct audits of Client’s compliance with the Service Documents, and Client agrees to provide reasonable cooperation in connection with such audits. Client further agrees to provide additional information and documentation as requested for required compliance certiﬁcation. When conducting an investigation, particularly following a consumer complaint that Client impermissibly accessed their credit report, Agility Credit and/or the Credit Bureaus, in their sole discretion, may demand a copy of the original application signed by the consumer or, if applicable, a copy of the sales contract. Client certiﬁes that it will not store, or allow a third-party service provider to store or have access to, Credit Bureau Data without ﬁrst getting Credit Bureau written permission.

Organizational Security and Risk Management

Agility Credit will document and at least annually update its policies and procedures, as well as, security and compliance controls, in the following major categories to ensure the security of the Credit Bureau Data:

Organizational / Corporate charts
Document Employees Security Awareness Training
Incident Responses Log
Incident Response Plan
Risk Management Program
Secure Conﬁguration Management
Asset Management
Access and Remote Access Control
Encryption and Cryptography
Network and Communications Security
Vulnerability Management
Monitoring and Logging
Physical and Environmental Security Controls
Data Classiﬁcation, Handling, and Security
Protection of Privacy Information
Business Continuity and Disaster Recovery
Employee Onboarding
Employee Background Check
Employee Credit Check
Employee Security Awareness
Insider Threat Investigation
Where permitted by applicable law, Agility Credit may require a drug test for illegal substances be performed by a third party for applicants directly working with sensitive Credit Bureau Data and or systems
Where permitted by applicable law, Agility Credit may require a criminal history screening for applicants directly working with sensitive Bureau Data and or systems
Every Employee, Client and Client authorized signer will be Oﬃce of Foreign Assets Control Veriﬁcation (OFAC) screened against the US Treasury Specially Designated Nationals and Blocked Persons list for compliance with all applicable US regulations/requirements. This list can be found at https://sdnsearch.ofac.treas.gov/

Information Security Requirements

The terms and conditions of this exhibit meets and/or exceeds the information security requirements of the three national credit reporting agencies (Equifax Information Services LLC, Transunion LLC, Experian Information Solutions, Inc.), where applicable, complies with the access of information requirements of the Federal Fair Credit Reporting Act and Gramm-Leach-Bliley Act for data privacy (FCRA and GLB 5A Data). In addition, this exhibit complies with the notiﬁcation requirements prescribed by the California Consumer Credit Reporting Agencies Act and the Vermont Fair Credit Reporting Statute, 9 V.S.A. § 2480e (1999) § 2480e, as well as, the requirements of the Fair Isaac Company and aﬃliates (FICO).

Click to open the requirement speciﬁcations for the Experian Security Requirements for FCRA and GLBA 5A Data (ASR). URL

Client certifies that it shall implement and maintain a comprehensive information security program written in one or more readily accessible parts and that contains administrative, technical, and physical safeguards that are appropriate to the Client’s size and complexity, the nature and scope of its activities, and the sensitivity of the information provided to the client by Agility Credit; and that such safeguards shall include the elements set forth in 16 C.F.R. § 314.4 and shall be reasonably designed to (i) insure the security and confidentiality of the information provided by Agility Credit, (ii) protect against any anticipated threats or hazards to the security or integrity fo such information, and (iii) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any consumer.

Specific Access Control Requirements for – Agility Credit, Client and Third-Party

All user credentials such as Subscriber Code number, Subscriber Code passwords, User names/identiﬁers (user IDs) and user passwords must be kept conﬁdential and must not be disclosed to an unauthorized party.
If using third party or proprietary system to access Credit Bureau’s systems, ensure that the access must be preceded by authenticating users to the application and/or system (e.g. application-based authentication, Active Directory, etc.) utilized for accessing Credit Bureau’s data/systems.
If a third party or third-party software or proprietary system or software, used to access Credit Bureau Data or systems, is replaced or no longer in use, the passwords should be changed immediately.
A unique user ID for each user is to be created to enable individual authentication and accountability for access to Credit Bureau infrastructure. Each user of the system access software must also have a unique logon password.
User IDs and passwords shall only be assigned to authorized individuals based on least privilege necessary to perform job responsibilities.
User IDs and passwords must not be shared, posted, or otherwise divulged in any manner.

Develop strong passwords that are:

Not easily guessable (i.e. your name or company name, repeating numbers and letters or consecutive numbers and letters)
Contain a minimum of eight (8) alphabetic and numeric characters for standard user accounts
For interactive sessions (i.e. non system-to-system) ensure that passwords/passwords are changed periodically (every 90 days is recommended)

Passwords (e.g. subscriber code passwords, user password) must be changed immediately when:
1. Any system access software is replaced by another system access software or is no longer used
2. The hardware on which the software resides is upgraded, changed or disposed
3. Any suspicion of password being disclosed to an unauthorized party (see section 4.3 for reporting requirements)
Ensure that passwords are not transmitted, displayed or stored in clear text; protect all Agility Credit, Client and Third-Party (e.g. internal and external) passwords using, for example, encryption or a cryptographic hashing algorithm also known as “one-way” encryption. When using encryption, ensure that strong encryption algorithms are utilized (e.g. AES 256 or above).
Implement password protected screensavers with a maximum ﬁfteen (15) minute timeout to protect unattended workstations. Systems should be manually locked before being left unattended.
Active logins to credit information systems must be conﬁgured with a 30-minute inactive session timeout.
Ensure that personnel who have authorized access to credit information have a business need to access such information and understand these requirements to access such information are only for the permissible purposes listed in the Permissible Purpose Information section of the membership application.
Agility Credit, Client and Third-Party must NOT install Peer-to-Peer ﬁle sharing software on systems used to access, transmit or store Credit Bureau Data.
Ensure that Agility Credit, Client and Third-Party employees do not access their own credit reports or those reports of any family member(s) or friend(s) unless it is in connection with a credit transaction or for another permissible purpose.
Implement and manage a process to terminate access rights immediately for users who access Credit Bureau Data or systems when those users are terminated or when they have a change in their job tasks and no longer require access to that credit information.
Implement and manage a process to perform periodic user account reviews to validate whether access is needed as well as the privileges assigned.
Implement and manage a process to periodically review user activities and account usage, ensure the user activities are consistent with the individual job responsibility, business need, and in line with contractual obligations.
Implement and manage physical security controls to prevent unauthorized entry to Agility Credit, Client and Third-Party facility and access to systems used to obtain credit information. Ensure that access is controlled with badge readers, other systems, or devices including authorized lock and key.
Client and Agility Credit certify that they will access, use and store Credit Bureau Data only within the territorial boundaries of the United States, Canada, and United States territories of Puerto Rico, Guam and the Virgin Islands.

Network Security and Data/Information Security Standards

a. On ﬁle and accessible to the Credit Bureaus upon request, Agility Credit will maintain an updated and comprehensive Information Security Policy and an Acceptable Use Policy. Agility Credit will install the necessary hardware and software to interface with Credit Bureaus. Agility Credit will use the high standards of network and data security which is consistent with regulatory, legal and industry standards and incorporates the standards of:

b. ISO 27001/27002 standards of control

Credit bureau information and data security requirements (Equifax, Experian and Transunion)

Federal Finical Institute Examination Council - Information Technology Examination Handbook (FFIEC Examiners Guidelines)

National Institute of Standards and Technology (NIST)

Payment Card Industry Data Security Standard (PCI DSS)

GLB Safeguard Rules

FACTA Disposal Rules

c. Agility Credit will maintain policies and procedures to address the following requirements:

Wireless Security

Network Security

Firewall Management

Use of Secure Protocols

Prohibition of Split Tunneling

Network Segmentation

d. Agility Credit will keep current and maintain operating systems and infrastructure to industry best practices that include but not limited to: ﬁrewalls, routers, servers, personal computers (laptops and desktops) and all other systems current with appropriate patches that are no more than one version behind; as well as, updates, disabling unnecessary services or features, removing or changing default passwords, IDs and sample ﬁles/programs, while enabling the most secure conﬁguration features to avoid unnecessary risks.

In addition, Agility Credit and Client will follow current best security practices for computer virus detection scanning services and procedures:

Use, implement and maintain a current, commercially available anti-virus software on all systems, if applicable anti-virus technology exists. Anti-virus software deployed must be capable to detect, remove, and protect against all known types malicious software such as viruses, worms, spyware, adware, Trojans, and root-kits.
Ensure that all anti-virus software is current, actively running, and generating audit logs; ensure that anti-virus software is enabled for automatic updates and performs scans on a regular basis.
If Agility Credit or Client suspects an actual or potential virus infecting a system, immediately cease accessing the system and do not resume the inquiry process until the virus has been eliminated.

e. Agility Credit and Client will encrypt Credit Bureau Data above AES 256 when stored electronically on any system including but not limited to laptops, tablets, personal computers, servers and/or databases. When accessing Credit Bureau Data on devices such as smart tablets or smart phones the devices will be protected via a pass-code. Agility Credit and client accessing Credit Bureau Data via smart phones or smart tablets must protect data while in transmission such as SSL protection and/or use of VPN, etc. When no longer in use, electronic media containing Credit Bureau Data is rendered unrecoverable via a secure wipe program in accordance with industry-accepted standards for secure deletion, or otherwise physically destroying the media (for example, degaussing).

f. Agility Credit and Client will build and maintain a Secure Network

1. Administrative access to firewalls and servers must be performed through a secure internal wired connection only.

2. Any stand-alone computers that directly access the Internet must have a desktop firewall deployed that is installed and configured to block unnecessary/unused ports, services, and network traffic.

3. Change vendor defaults including but not limited to passwords, encryption keys, SNMP strings, and any other vendor defaults

4. Fore wireless networks connected to or used for accessing or transmission of Credit Bureau Data, ensure that networks are configured and firmware on wireless deices updated to support strong encryption (for example IEEE 802.11i) for authentication and transmission over wireless networks.

5. When using service providers (e.g software providers) to access Credit Bureau systems, access to third party tools/services must require multi-factor authentication

g. Agility Credit and Client will regularly monitor and test networks

1. Perform regular tests on information systems (port scanning, virus scanning, internal/external vulnerability scanning). Ensures that issues identified via testing are remediated according to the issue severity (e.g. fix critical issues immediately, high severity in 15 days, etc)

2. Ensure that audit trails are enabled and active for systems and applications used to access, store, process, or transmit Credit Bureau Data; establish a process for linking all access to such systems and applications. Ensure that security policies and procedures are in place to review security logs on a daily or weekly basis and that follow-up to exceptions is required.

3. Use current best practices to protect telecommunications systems and any computer system or network device(s) used to provide Services hereunder to access Credit Bureau systems and networks. These controls should be selected and implemented to reduce the risk of infiltration, hacking, access penetration or exposure to an unauthorized third party by;

a. protecting against intrusions;

b. securing the computer systems and network devices;

c. and protecting against intrusions of operating systems or software.

h. Agility Credit will maintain policies and procedures to address the following physical and environmental security concerns:

1. Physical Access Restrictions

2. Visitor Access Requirements

3. CCTV Monitoring

4. CCTV Video Retention

5. CCTV logs must be maintained for 90 days online and 1 year archived.

6. Clean Desk / Clear Screen

7. Climate Control System Monitoring

8. Heat, Smoke, Fluid, Water Detection

9. Fire Suppression

Generator and Uninterruptable Power Supplies (UPS) Visitors must be escorted at all times where Information Assets are processed, stored, or transmitted.

Mobile and Cloud Technology

Client and Agility Credit will not store Credit Bureau Data on mobile devices. Any exceptions will be obtained from the speciﬁcally effected Credit Bureau.

When using a mobile application and cloud technology, whether together or separately, to deliver Credit Bureau information directly to the consumer, the following requirements apply:

a. Storing Experian data on mobile devices is prohibited. Any exceptions must be obtained from Experian in writing; additional security requirements will apply.

b. Mobile applications development must follow industry known secure software development standard practices such as OWASP and OWASP Mobile Security Project adhering to common controls and addressing top risks.

c. Mobile applications development processes must follow secure software assessment methodology which includes appropriate application security testing (for example: static, dynamic analysis, penetration testing) and ensuring vulnerabilities are remediated in accordance with Experian’s requirements.

d. Mobility solution server/system should be hardened in accordance with industry and vendor best practices such as Center for Internet Security (CIS) benchmarks, NIS, NSA, DISA and/or other.

e. Mobile applications and data shall be hosted on devices through a secure container separate from any personal applications and data. See details below. Under no circumstances is Experian data to be exchanged between secured and non-secured applications on the mobile device.

f. In case of non-consumer access, that is, commercial/business-to-business (B2B) users accessing Experian data via mobile applications (internally developed or using a third-party application), ensure that multi-factor authentication and/or adaptive/risk-based authentication mechanisms are utilized to authenticate users to application.

g. When using cloud providers to access, transmit, store, or process Experian data ensure that:

1) Appropriate due diligence is conducted to maintain compliance with applicable laws and regulations and contractual obligations

2) Cloud providers must have gone through independent audits and are compliant with one or more of the following standards, or a current equivalent as approved/recognized by Experian:

a) ISO 27001

b) PCI DSS

c) SSAE 16 – SOC 2 Type II or SOC3

d) FISMA

e) CAI / CCM assessment

M. Compliance with Experian’s Reseller Security Policy, Attachment 2 is maintained regarding cloud providers’ user security practices.

N. When using third party service providers to access, transmit, or store Credit Bureau data, additional documentation may be required by the Credit Bureau.

II. Data Breach

If it is believed that Credit Bureau Data is compromised, the specific Credit Bureau will be notified within twenty-four (24) hours or as otherwise required per contractual agreement and the proper notification procedure shall be followed by Agility Credit according the effected Credit Bureau’s reseller guidelines.

III. Regulatory Monitor and Test Networks

Per Agility Credit’s Information Security Policy, Agility Credit will perform regular tests on information systems (port scanning, virus scanning, internal/external vulnerability scanning). Ensure that issues identiﬁed via testing are remediated according to the issue severity (e.g. ﬁx critical issues immediately, high severity in 15 days, etc.). Logs will be maintained for 90 days online and 1 year archived.

Audit trails will be enabled and active for systems and applications used to access, store, process, or transmit Credit Bureau Data establish a process for linking all access to such systems and applications.

Use current best practices to protect telecommunications systems and any computer system or network device(s) used to provide Services hereunder to access Credit Bureau systems and networks. These controls should be selected and implemented to reduce the risk of inﬁltration, hacking, access penetration or exposure to an unauthorized third party by:

Protecting against intrusions

Securing the computer systems and network devices

Protecting against intrusions of operating systems or software.

Regulatory Required Compliance Terms and Conditions
1. FCRA Compliance

As a user of Consumer Reports, Agility Credit and Client will comply with all applicable FCRA regulations currently in effect which can be currently found at the Consumer Financial Protection Bureau’s website https://www.consumerfinance.gov/learnmore .

California Consumer Credit Reporting Agencies Act URL

Client agrees to comply with all applicable the provisions of the California Consumer Credit Reporting Agencies Act as it may be amended.

Client hereby certiﬁes that it will comply with California Consumer Credit Reporting Agencies Act.

Client acknowledges and certiﬁes that it has the understanding and comprehension of this exhibit, as well as, the opportunity for review by legal counsel to fully comply with the California Consumer Credit Reporting Agencies Act, as amended.

California website reference: https://leginfo.legislature.ca.gov/faces/codes_displayexpandedbranch.xhtml? tocCode=CIV&division=3.&title=1.6.&part=4.&chapter=&article

Vermont Fair Credit Reporting 9 V.S.A. 2480 (1999) URL

Client agrees to comply with all applicable the provisions of the Vermont Fair Credit Reporting Statute, 9 V.S.A. § 2480 (1999) as amended

Client acknowledges that it subscribes to receive various consumer report and information services, as deﬁned in 15 USC 1681(a)(d) (“Consumer Reports”), from Agility Credit and the Credit Bureaus, in accordance with the Vermont Fair Credit Reporting 9 V.S.A § 2480e (1999), as amended from time to time, and the Federal Fair Credit Reporting Act, 15, U.S.C. 1681 et. Seq., as amended and its other state law counterparts. In connection with Client’s use of such Consumer Reports and information services in relation to Vermont consumers, Client hereby certiﬁes that it will comply with Vermont law. In particular, Client certiﬁes that it will order information services relating to Vermont residents, that are “credit reports” as deﬁned by 9 V.S.A. § 2480 (1999) only after Client has received prior consumer consent in accordance with 9 V.S.A. § 2480e (1999) and the rules and regulations promulgated thereunder. URL to the Vermont Fair Credit Reporting Statute, 9 V.S.A. § 2480e (1999).

Credit Bureau Specific Requirements
1. FICO® Scoring Certifications URL

The terms set forth hereunder are only applicable to Clients with the subscribed products and or services as agreed to in the SOA.

Agility Credit and Client hereby understands and agrees to the following terms and conditions regarding the use of Consumer Reports and reason codes obtained through Agility Credit and the Credit Bureaus:

Client may disclose the Consumer Reports provided to Client to credit applicants, when accompanied by the corresponding reason codes, in the context of bona ﬁde lending transactions and decisions only.
Client agrees to comply with all applicable law and regulations with respect to use of the Consumer Reports and reason codes purchased from Agility Credit and certiﬁes that it has permissible purpose under the FCRA to obtain said Consumer Reports. Client agrees to limit its use of the Consumer Reports and reason codes to its own business and will not sell, transfer, license or distribute Consumer Reports or reason codes to third parties. Client agrees to maintain security procedures to minimize the risk of disclosure of Consumer Reports to employees without a legitimate need to know.
Client will not permit its employees, agents or subcontractors to use any of the trademarks, service marks, logos, names, or any other proprietary designations, whether registered or unregistered, of Equifax Information Services LLC, Transunion, Experian Information Solutions, Inc., Fair Isaac and Company, or the Aﬃliates of either of them, or of any other party involved in the provision of the Credit Bureau/Fair Isaac Model, without such entity’s prior written consent.
Client will not permit its employees, agents or subcontractors to, in any manner, directly or indirectly, discover or reverse engineer (or attempt to discover or reverse engineer) any conﬁdential and proprietary criteria developed or used by Credit Bureau/Fair Isaac in performing the Credit Bureau/Fair Isaac Model.
End user will indemnify, defend, and hold each of Agility Credit, Experian, and Fair, Isaac harmless from and against any and all liabilities, damages, losses, claims, costs, and expenses (including attorneys’ fees) arising out of or resulting from any nonperformance by Client of any obligations to be performed by Cleint under this Agreement, provided that Experian/Fair, Isaac have given Client prompt notice of, and the opportunity and the authority (but not the duty) to defend or settle any such claim.
NOT WITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, UNDER NO CIRCUMSTANCES WILL AGILITY CREDIT, EXPERIAN OR FAIR, ISAAC HAVE ANY OBLIGATION OR LIABILITY TO END USER FOR ANY INCIDENTAL, INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES INCURRED BY END USER, REGARDLESS OF HOW SUCH DAMAGES ARISE AND OF WHETHER OR NOT END USER WAS ADVISED SUCH DAMAGES MIGHT ARISE. IN NO EVENT SHALL THE AGGREGATE LIABILITY OF AGILITY CREDIT, EXPERIAN OR FAIR, ISAAC TO CLIENT EXCEED THE FEES PAID BY CLIENT PURSUANT TO THIS AGREEMENT DURING THE SIX MONTH PERIOD IMMEDIATELY PRECEDING THE DATE OF CLIENT’S CLAIM.

The Credit Bureau/Fair Isaac has warranted to Agility Credit that the Credit Bureau/Fair, Isaac Model is empirically derived and demonstrably and statistically sound and that to the extent the population to which the Credit Bureau/Fair Isaac Model is applied is similar to the population sample on which the Credit Bureau/Fair Isaac Model was developed. The Credit Bureau/Fair Isaac Model score may be relied upon by Client to rank consumers in the order of the risk of unsatisfactory payment such consumers might present to Client. Credit Bureau/Fair Isaac has further warranted to Agility Credit that so long as it provides the Credit Bureau/Fair Isaac Model, it will comply with regulations promulgated from time to time pursuant to the Equal Credit Opportunity Act, 15 USC Section 1691 et seq. The foregoing warranties are the only warranties Credit Bureau/Fair Isaac have given Agility Credit with respect to the Credit Bureau/Fair Isaac model and such warranties are in lieu of all other warranties, express or implied, Credit Bureau/Fair Isaac might have given Agility Credit with respect thereto, including, for example, warranties of merchantability and ﬁtness for a particular purpose. Agility Credit and each respective Client’s rights under the warranty are expressly conditioned upon each respective Client’s periodic revalidation of the Credit Bureau/Fair Isaac Model in compliance with the requirements of Regulation B as it may be amended from time to time (12 CFR Section 202 et seq.).

Terms Applicable to FICO® Scores Additional URL

In addition to the terms and conditions contained in the Agreement and this Exhibit, the following additional terms also govern the use by Client of credit risk scores of Fair Isaac Corporation (“FICO Scores”):

From time to time, Client may request that Equifax provide FICO Scores, for, in each case, one of the following internal decisioning purposes requested: (a) in connection with the review of a consumer report it is obtaining from Equifax; (b) for the review of the portion of its own open accounts and/or closed accounts with balances owing that it designates; (c) as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation; (d) for use as a selection criteria to deliver a list of names to Client, or Client’s designated third party processor agent; (e) for transactions not initiated by the consumer for the extension of a ﬁrm offer of credit or insurance; or (f) with respect to the insurance risk scores only for use in connection with the underwriting of insurance involving the consumer. Client shall use each such FICO Score only once and, with respect to FICO Scores, only in accordance with the permissible purpose under the FCRA for which Client obtained the FICO Score.

Client acknowledges that the FICO Scores are proprietary and that Fair Isaac retains all its intellectual property rights in the FICO Scores and the Models (deﬁned below) used by Equifax to generate the FICO Scores. Fair Isaac grants to Client, effective during the term of the Client agreement, a personal, non-exclusive, non-transferable, limited license to use, internally, the FICO Scores solely for the particular purpose set forth in Section 1 above for which the FICO Scores were obtained, including, but not limited to the single use restrictions set forth above. Client’s use of the FICO Scores must comply at all times with applicable federal, state and local law and regulations, and Client hereby certiﬁes that it will use each FICO Score only for a permissible purpose under the FCRA. Client shall not attempt to discover or reverse engineer the FICO Scores, Models or other proprietary information of Fair Isaac, or use the FICO Scores in any manner not permitted, including, without limitation, for resale to third parties, model development, model validation (except as expressly set forth above with respect to Archive Scores), model benchmarking, or model calibration. “Model” means Fair Isaac’s proprietary scoring algorithm(s) embodied in its proprietary scoring software delivered to and operated by Equifax.

Client shall not disclose the FICO Scores nor the results of any validations or other reports derived from the FICO Scores to any third party (other than to a consumer as expressly permitted in the Service Order and this Section 3) unless: (a) such disclosure is clearly required by law, (b) Fair Isaac and Equifax provide written consent in advance of such disclosure; and/or (c) such disclosure is to Client’s designated third party processor agent; provided however that in either (i.e., (b) or (c) above) event, Client may make such disclosure (or in the event of (c), direct Equifax to deliver such lists, only after Client has entered into an agreement with the third party that (i) limits use of the FICO Scores to only the use permitted to Client hereunder, (ii) obligates the third party provider to otherwise comply with these terms, and (iii) names Fair Isaac as an intended third party beneﬁciary of such agreement with respect to the Models, FICO Scores, and other Fair Isaac intellectual property and with fully enforceable rights. Client shall not disclose a FICO Score to the consumer to which it pertains unless such disclosure is (i) approved in writing by Fair Isaac or (ii) required by law or is in connection with adverse action (as deﬁned by the FCRA) and then only when accompanied by the corresponding reason codes.

Fair Isaac represents and warrants that the scoring algorithm (s) used in the Models to produce FICO Scores are empirically derived and demonstrably and statistically sound; provided, that, this warranty is conditioned on (i) an Client’s use of each FICO Score for the purposes for which the respective Model was designed , as applied to the United States population used to develop the scoring algorithm, (ii) the Client’ compliance with all applicable laws and regulations pertaining to the use of the FICO Scores, including the Client’s duty (if any) to validate or revalidate the use of credit scoring systems under the ECOA and Regulation B, and (iii) the Client’s use of the FICO Scores otherwise remaining in compliance with the terms of the Service Order and this Exhibit with respect to FICO Scores.

FAIR ISAAC AND EQUIFAX HEREBY DISCLAIM ALL OTHER WARRANTIES, WHETHER STATUTORY, EXPRESS OR IMPLIED INCLUDING, WITHOUT LIMITATION, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND OTHER WARRANTIES THAT MIGHT BE IMPLIED FROM A COURSE OF PERFORMANCE OR DEALING OR TRADE USAGE. IN NO EVENT SHALL EQUIFAX OR FAIR ISAAC BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES INCURRED BY ANY PARTY AND ARISING OUT OF THE PERFORMANCE HEREUNDER, EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF SUCH DAMAGES WERE REASONABLY FORESEEABLE. IN NO EVENT SHALL EQUIFAX’S AND FAIR ISAACS’S COMBINED AGGREGATE TOTAL LIABILITY HEREUNDER EXCEED THE AMOUNTS PAID HEREUNDER DURING THE PRECEDING TWELVE (12) MONTHS FOR THE FICO SCORES THAT ARE THE SUBJECT OF THE CLAIM(S) OR TEN THOUSAND DOLLARS ($10,000.00), WHICHEVER AMOUNT IS LESS.

Equifax and Client acknowledge and agree that Fair Isaac is a third party beneﬁciary hereunder with respect to the Model, FICO Scores, and other Fair Isaac intellectual property and with fully enforceable rights. Client further acknowledges and agrees that Fair Isaac’s rights with respect to the Models, FICO Scores, other Fair Isaac intellectual property, and all works derived therefrom are unconditional rights that shall survive the termination for any reason.

FICO® Risk Score, Classic, V8, V8F, Auto Score, v5 F - is a credit scoring service URL

Based on a model developed by Fair Isaac Corporation (“Fair Isaac”) and Equifax that ranks consumers in the Equifax consumer credit database relative to other consumers in the database with respect to the likelihood of those consumers paying their accounts as Agreed.

ACROFILE and ACROFILE Plus – Are the Core Consumer reports from the Equifax URL

consumer credit database, consisting of identiﬁcation information, credit ﬁle inquiries, public record information and credit account trade lines of the subject of the report. Client may access these credit reports on an individual basis or through Joint Files Access SM, which provides simultaneous access to the credit ﬁles of both husband and wife with a single inquiry.

VantageScore Requirements URL

VantageScore - is a tri-bureau credit risk model developed using one algorithm across sample data common to all three credit bureaus. The following additional terms and conditions apply to Client’s receipt and use of VantageScore: Client will request VantageScores only for Client’s exclusive use. Client may store VantageScores solely for Client’s own use in furtherance of Client’s original purpose for obtaining the VantageScores. Client shall not use the VantageScores for model development or model calibration, except in compliance with the following conditions: (1) the VantageScores may only be used as an independent variable in custom models; (2) only the raw archived Score and Score segment identiﬁer will be used in modeling (i.e. no other Score information including, but not limited to, adverse action reasons, documentation, or scorecards will be used); and (3) Client’s depersonalized analytics and/or depersonalized third party modeling analytics performed on behalf of Client, using VantageScores, will be kept conﬁdential and not disclosed to any third party other than as expressly provided for below in subsections (ii), (iii), (iv), (v) and/or (vi) of this paragraph. Client shall not reverse engineer the Score. All VantageScores provided hereunder will be held in strict conﬁdence and may never be sold, licensed, copied, reused, disclosed, reproduced, revealed or made accessible, in whole or in part, to any Person, except (i) to those employees, agents and independent contractors of Client with a need to know and in the course of their employment; (ii) to those third party processing agents and other contractors of Client who have executed an agreement that limits the use of the VantageScores by the third party only to the use permitted to Client and contains the prohibitions at least as restrictive as set forth herein regarding model development, model calibration, reverse engineering and conﬁdentiality; (iii) when accompanied by the corresponding reason codes, to the consumer who is the subject of the VantageScore (provided that, accompanying reason codes are not required to the extent permitted by law); (iv) to government regulatory agencies; (v) to ratings agencies, dealers, investors and other third parties for the purpose of evaluating assets or investments (e.g. securities) containing or based on obligations of the consumers to which the VantageScores apply (e.g. mortgages, student loans, auto loans, credit cards), provided that, as it relates to this subsection (v), (a) Client may disclose VantageScores only in aggregated formats (e.g. averages and comparative groupings) that do not reveal individual VantageScores, (b) Client shall not provide any information that would enable a recipient to identify the individuals to whom the VantageScores apply, and (c) Client shall enter into an agreement with each recipient that limits the use of the Score to evaluation of such assets or investments, or (vi) as required by law. Client agrees that the trademarks, trade names, product names, brands, logos, and service marks (“Vantage Marks”) for VantageScores and VantageScore credit scoring models will remain the sole property of VantageScore Solutions, LLC. Client obtains a limited, non-exclusive, non-transferable, royalty free license to use and display the Vantage Marks in connection with the activities solely permitted by this Agreement. The use of the Vantage Marks under the preceding license is limited to use only in connection with the Services covered by this Agreement, and the Client expressly agrees not to use the Vantage Marks in connection with any products or services not covered by this Agreement. Any use of the Vantage Marks is subject to VantageScore Solutions, LLC’s prior written authorization. Client further agrees it will include the Vantage Marks in all advertising and marketing materials which reference the VantageScores or Vantage models and it will comply with the VantageScore Trademark Policy and Brand Guidelines, which may be changed from time to time upon written notice. All use of the Vantage Marks will accrue solely to the beneﬁt of VantageScore Solutions, LLC.

Product Specific Requirements

The terms set forth hereunder are only applicable to Clients with the subscribed products and or services as agreed to in the SOA.

Equifax MLA Covered Borrower Status URL

Permissible use of the Equifax MLA Covered Borrower Status is limited to completing covered borrower checks pursuant to the Military Lending Act (MLA), as codified in 10 U.S.C. 5987.

Credit Bureau Identity and Fraud Services URL

Client certiﬁes that it will use Credit Bureau identity and fraud services (“IFS Services”) exclusively within Clients own organization for the purpose of verifying the identity of individual persons (ID Subjects) who initiates a business transaction with the Client and not for any other purpose; and that it will use and ensure that its employees access to the IFS Services is in accordance with the terms of the Client Agreement. Client acknowledges and agrees that the IFS Services do not guarantee the identity of the ID Subject, but merely provide a risk assessment regarding the ID Subject’s identity that is derived, in part, from information provided by the ID Subject or otherwise collected from an ID Subjects use of the IFS Services and relayed by Client to Credit Bureau (“ID Subject Content”); and that in connection with certain IFS Services; (i) Client will establish a risk decision threshold above which the ID Subject is veriﬁed or authenticated, depending on the applicable Service, and below which the ID Subject is not veriﬁed or authenticated (“Risk Decision Threshold”) and Credit Bureau may act as a consultant to review Client’s risk strategies, but Client, in its sole discretion, will set its Risk Decision Threshold(s); and (ii) that depending upon Client’s Risk Decision Threshold an ID Subject may be able to successfully pass veriﬁcation and authentication even though the individual submitting the ID Subject Content is not the actual individual to whom the ID Subject Content pertains.

Client shall not maintain, copy, capture, reproduce, re-use or otherwise retain in any manner the interactive questions or multiple choice answers provided as part of the IFS Services (“Queries”), the ID Subject responses to the Queries (“Answers”) or the scores, ﬂags and reason codes generated or other information relating to such Queries and Answers provided by the IFS Services (Scores); provided, however, that Client may capture and retain the unique transaction number generated by the IFS Services with each transaction (each a “Transaction ID” solely for the purpose of (i) audit trail; (ii) calculation of the amount of usage of IFS Services; and (iii) billing. Without limiting the generality of the foregoing, Client shall not retain or make copies of, and must purge from its system, the Queries and Answers prior to Client’s receipt of any Score relating to such Queries and Answers; and in the event Client receives the IFS Services at its call center (or call center maintained by a Service Provider), Client shall ensure that the call center operators are unable to retrieve the Queries and Answers after the delivery of tie Score by, for example, disabling the use the back button key after the delivery of the Score- In the event that the IFS Services do not provide a response, tie Queries must be purged as expeditiously as possible but in no event longer than thirty (30) minutes after receipt of such Queries.

Client has the right to transmit and authorize the use of ID Subject Content and hereby authorizes the use of ID Subject Content as required to perform the IFS Services; analyze, enhance or improve the performance of the IFS Services; and disclose ID Subject Content as required by law or the operation of the IFS Services. Client will timely, reliably and accurately relay the Queries, Answers and other ‘D Subject Content to and from the IFS Services and the applicable ID Subject.

When providing ID Subjects with access to the IFS Services via the Internet, Client will adopt, publish, maintain and adhere to a privacy policy and upon request, provide a copy of Clients privacy policy.

Client’s privacy policies clearly disclose to ID Subject that the ID Subject Content may be shared with third party service providers for the purpose of completing the relevant transaction.

Client acknowledges and agrees that prior to receiving the IFS Services, Client may need to complete an approval process for receipt of the IFS Services by the applicable wireless carriers. Such process shall include, without limitation, review of the proposed consumer consent language or any other consumer terms and conditions, review of any process ﬂows, a description of Client’s intended use, and a copy or summary of Client’s applicable privacy policy. The IFS Service will be provided only with respect to those wireless carriers that have authorized the use of such data in connection with the provision of IFS Services, and then only to the extent and for the period that such data is available or provided by such wireless carriers.

Client will establish and maintain a manual veriﬁcation process in the event that Client determines that an ID Subject does not pass the Risk Decision Threshold or Client receives a nag from tie IFS Services indicating a possible match from a fraud database.

Client will not (i) use or access the IFS Services outside the territorial boundaries of the United States, Canada, and the United States territories of Puerto Rico, Guam, and the Virgin Islands (collectively, the “Permitted Territory”); regardless of whether such use or access is by off-shore Authorized Agents or authorized Service Providers or an off-shore department or division of Client, or (it) export or permit the export of the IFS Services outside of the Permitted Territory.

Client will not share or permit the use of the IFS Services, in whole or in part, with any third party.

Credit Bureau may review Client’s practices and procedures including, without limitation, any relevant documentation, to determine Clients compliance with this Integrator Schedule- Client shall promptly provide Credit Bureau with copies of all requested documents and records- If Credit Bureau reasonably believes a compliance issue exists, Credit Bureau or its designated representative may enter Client’s facilities, upon at least ﬁve (5) business days prior written notice and at a mutually agreed upon time â to an on-site assessment of Clients practices and procedures relating to Client’s request for, and use of, the IFS Services and Client’s security practices with respect thereto.

Client shall employ decision-making processes appropriate to the nature of the transaction and in accordance with industry standards, and Client will use the IFS Services only for the purposes set forth in this Integrator Schedule. Client is solely responsible for all results of its use of the IFS Services. TO THE MAXIMUM EXTENT ALLOWABLE BY LAW, ALL IFS SERVICES ARE PROVIDED BY Credit Bureau ON AN “AS-IS,” AS-AVAILABLE BASIS, AND Credit Bureau (AND ITS DATA PROVIDERS AND SUPPLIERS HEREBY DISCLAIM ANY AND ALL PROMISES, REPRESENTATIONS, GUARANTEES, AND WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WITH RESPECT TO THE ACCURACY, COMPLETENESS, CURRENTNESS, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE, OF THE IFS SERVICES. IN NO EVENT WILL Credit Bureau OR ITS DATA PROVIDERS AND SUPPLIERS BE LIABLE TO CLIENT FOR ANY LOSS OR INJURY RELATING TO, ARISING OUT OF, OR CAUSED IN WHOLE OR IN PART BY, ITS ACTS OR OMISSIONS, EVEN IF NEGLIGENT, RELATING TO THE IFS SERVICES.

If Client receives the one-time passcode (“OTP”), Client must comply with the following acceptable use policy (“AUP”):

Scope. Client must comply with this Acceptable Use Policy (“AUP”) with regard to its use of and access to the one-time passcode (“OTP”). By using the OTP Client acknowledges and agrees to comply with this AUP. This AUP shall only apply to the OTP and not to any IFS Services otherwise described in the Agreement. Further, Client agrees to cooperate with Agility Credit, any third-party service provider involved in providing the OTP, and governmental authorities in investigations of any alleged or perceived violation of any law, rule, regulation or the AUP. Upon the request of any third-party service provider, Agility Credit may modify this AUP at any time in which case it will promptly notify Client and provide Client a copy therewith.

Restrictions on Use. Client agrees that it will not use the OTP in or for any illegal, fraudulent, unauthorized or improper manner or purpose and will only be used in compliance with all applicable laws, rules and regulations, including all applicable state, federal and international internet, data, telecommunications, telemarketing, “spam,” and import/export laws and regulations, including the U.S. Export Administration Regulations. Without limiting the foregoing, Client agrees not to permit the OTP to be used to transmit or disseminate any:

Junk mail, spam, or unsolicited material to persons or entities that have not agreed to receive such material or to whom Client or its customer do not otherwise have a legal right to send such material;
Material that infringes or violates any third party’s intellectual property rights, rights of publicity, privacy, or conﬁdentiality, or the rights or legal obligations of any wireless service provider or any of its customers or subscribers;
Material or data that is illegal, or material or data, as determined by Equifax (in Equifax’s sole discretion) that is harassing, coercive, defamatory, libelous, abusive, threatening, obscene, or otherwise objectionable, materials that are harmful to minors, or materials the transmission of which could diminish or harm the reputation of Equifax or any third party service provider involved in the provision of the OTP;
Material or data that is alcoholic beverage-related (e.g. beer, wine, or liquor), tobacco-related (e.g. cigarettes, cigars, pipes, chewing tobacco), guns or weapons-related (e.g. ﬁrearms, bullets) illegal drugs-related (e.g. marijuana, cocaine), pornographic-related (e.g. adult themes, sexual content), crime-related (e.g. organized crime, notorious characters), violence-related (e.g. violent games), death -related (e.g. funeral homes mortuaries), hate-related (e.g. racist organizations) ,gambling-related (e.g. casinos, lotteries), speciﬁcally mentions any wireless carrier or copies or parodies the products or services of any wireless carrier;
Viruses, Trojan horses, worms, time bombs, cancel-bots, or other computer programming routines that are intended to damage, detrimentally interfere with, surreptitiously intercept or expropriate any system, data, or personal information;
Material or information that is false or misleading;
Material that would expose any third party service provider involved in providing the OTP, or any other third party to liability; and/or

Any signal or impulse that could cause electrical, magnetic, optical, or other technical harm to the equipment or facilities of Agility Credit or any third party.

Client shall not access any carrier services that Client has not ordered or for which Client has not paid applicable fees. Client will not use or attempt to use a third party’s account with Agility Credit or any third party service provider involved in providing the OTP, or interfere with the security of, or otherwise abuse, the OTP or any other third party service provider’s customers. Client shall not interfere in any manner with Equifax’s provision of the OTP.

Client further acknowledges and agrees that all customers of Client and any third parties to whom messages may be transmitted using the OTP have the right to opt-in and opt-out of Short Message

Requirements for Equifax Identity Scan Service URL

Equifax Identity Scan “Identity Scan” is an on-line warning system containing information that can be used to detect possible or known identity theft and application fraud. Some of the information in the Identity Scan database is provided by credit grantors. If Client orders the Identity Scan service, then Client agrees to furnish for potential inclusion in Equifax’s Identify Scan system any data that Client knows to have been used in connection with a fraudulent transaction or attempted fraudulent transaction with Client. That data will include but not be limited to consumer names, aliases, Social Security numbers, addresses (current and former), employment (current and former) and telephone numbers (business and residential). Client grants Equifax permission to evaluate and include such data in Identity Scan and other identity/ fraud products if deemed appropriate by Equifax and permits Equifax to use such information to test effectiveness of fraud and identity products. Subscriber will not use an alert or warning message from the Identity Scan system in its decision-making process for denying credit but will use the message as an indication that the consumer’s application information should be independently veriﬁed prior to a credit decision. Client understands that the information supplied by Identity Scan may or may not apply to the consumer who has applied to Client for credit. Subscriber also understands and agrees that data from the Identity Scan system is proprietary to Equifax and shall not be used as a component of any database or ﬁle built or maintained by Client. The use of such data shall be limited to the speciﬁc transaction for which the Identity Scan alert message is provided.

Requirements for Equifax Synthetic ID Fraud Alert URL

These terms and conditions apply to Client’s receipt of and use of the Synthetic Fraud Alerts, as described below, and Client acknowledges it will request and receive the Synthetic Fraud Alert, subject to the terms of the additional terms and conditions set forth below.

Synthetic ID Alerts provide ﬂags and attributes that can help identify synthetic identity fraud through the use of aggregated and anonymous authorized user transactions from a separate anonymous database of potential synthetic identity fraud transactions that may have association with the subject consumer.

When Synthetic ID Alerts are delivered with a credit report, Synthetic ID Alerts includes authorized user output ﬁelds (Authorized User Velocity & ID Discrepancy ﬂags plus other associated authorized/terminated user counts) and a Final assessment ﬂag. Although Synthetic ID Alert are not consumer reports, this version of the Synthetic ID Alert may only be purchased at the same time that Client purchases a consumer report in connection with the extension of credit or account review.

Synthetic ID Alerts are for identity fraud risk alert purposes only and are not to be used for determining an individual’s eligibility for credit or any other FCRA permissible purpose or in any way for the purpose of taking “adverse action,” in whole or in part, against a consumer, as deﬁned in the ECOA and. Regulation B, or for suspending a consumer’s account. As such Client will not use the Synthetic ID Alert in its decision-making process for denying credit but will use the Synthetic ID Alerts as an indication that the consumer’s identity and personally identiﬁable information should be independently veriﬁed to form a reasonable belief that Client knows the true identity of the consumer. Client certiﬁes that it shall use the Synthetic ID Alerts exclusively within Client’s own organization for the purpose of identity fraud prevention and for no other purpose. Client will not resell or otherwise redistribute the Synthetic ID Alerts.

Client understands that the information supplied by Synthetic ID Alerts may or may not apply to the consumer who has applied to Client for credit, service, dealings, or other ﬁnancial transactions.

Client also understands and agrees that the information contained in the Synthetic ID Alerts is proprietary to Equifax and shall not be used as a component of any database or ﬁle build or maintained by Client. The use of each Synthetic ID Alert shall be limited to one time use in conjunction with the speciﬁc transaction for which the Synthetic ID Alert is requested and provided. Client’s obligations with regard to the use of the Synthetic Fraud Alerts will survive any termination for as long as the Synthetic ID Alerts are in Client’s custody or control. EQUIFAX MAY, BY WRITTEN NOTICE TO CLIENT, IMMEDIATELY TERMINATE OR SUSPEND THE PROVISION OF THE SYNTHETIC ID ALERT SERVICE IF EQUIFAX HAS A REASONABLE BELIEF THAT CLIENT HAS VIOLATED THE TERMS AND CONDITIONS APPLICABLE TO THE SYNTHETIC ID ALERTS.

Equifax, and its data suppliers (including government agencies) (a) makes no warranty, express, implied or statutory, and speciﬁcally disclaims all warranties with respect to the Limited Access Death Master File information incorporated into the Synthetic ID Alerts (the “Death Master Flag”), including but not limited to, implied warranties of merchantability and ﬁtness for any particular use or that use of the Death Master Flag constitutes compliance with any law or regulation; (b) assume no liability for any direct, indirect or consequential damages ﬂowing from any use of any part of the Death Master Flag, including infringement of third party intellectual property or privacy rights; and (c) assume no liability for any errors or omissions in the Death Master Flag. The Death Master Flag contains inaccuracies. As such, neither Equifax, NTIS, nor the Social Security Administration which provides the Death Master Flag to NTIS, guarantees the accuracy of the Death Master Flag. The LADFM does not contain death records for all deceased persons. Therefore, the absence of a particular person in the Death Master Flag is not proof that the individual is alive. Further, it is possible for the records of a person who is not deceased to be included erroneously in the Death Master Flag. Client acknowledges and agrees that the Death Master Flag does not guarantee the identity of or information regarding any individual and that Client has processes in place to independently verify the information provided in the Death Master Flag.

Speciﬁcally with regard to the Death Master Flag included with the Synthetic ID Alerts, Client certiﬁes that:

(i) Its access to the Death Master Flag is appropriate because Client (i) has a legitimate fraud prevention interest, a legitimate business purpose pursuant to a law, governmental rule, regulation, or ﬁduciary duty; (ii) has systems facilities, and procedures in place to safeguard such information, and experience in maintaining the conﬁdentiality, security, and appropriate use of such information, (iii) agrees to satisfy such similar requirements, and (iv) it will provide a renewal certiﬁcation from time to time upon request from Equifax.

It will not share the Death Master Flag with any person or entity unless they ﬁrst meet the requirements of this section. Client understands that any successful attempt by any person to gain unauthorized access to or use of the Death Master Flag that Equifax may immediately terminate Client’s access to the Synthetic ID Alerts. In addition, any successful attempt by any person to gain unauthorized access may under certain circumstances may result in penalties as prescribed in 15 CFR Â§ 1110.200 levied on Client and the person attempting such access.

Client will take appropriate action to ensure that all persons accessing the Death Master Flag through it are aware of their potential liability for misuse and/or penalties for attempting to gain unauthorized access. Any such access or attempted access is a breach, or attempted breach, of security, and Client must immediately report such events to Equifax.

Client will provide, at a minimum, the ﬁelds noted as “Required.” ** If only last 4 digits of SSN are provided on input, the following ﬂags cannot be returned: Shared SSN (Name), SSN Veriﬁed, Invalid SSN and Death Master Hit Flags.

![A table with text and numbers

Description automatically generated with medium confidence]( https://lh7-us.googleusercontent.com/h1XH5al_UZ_-GQmm7_v7aHhECMhafLBtjwc9sQH-ZgvKz71RZiPYYK_pen02r9O09LuFbxoTXwB60BI2GHqLyxrXT1oGpclXowH93msADPlHRhud9nZkgmhYjA0ewmt9Wr6wr8aEZmRWTg-o2x1M5w )

Client, at its own expense, will prepare and deliver to Equifax at mutually agreed to intervals (but no less than every ninety (90) days) and in a mutually agreeable form and medium its most current identity fraud performance feedback data (" Feedback Data"). Feedback Data will be used to conﬁgure and enhance the performance of products and services related to potentially fraudulent activity. For purposes of this Addendum, “performance” means identity fraud outcome of decisions at time of origination or account management. Client will encrypt all Feedback Data as directed by Equifax and comply with such data security policies as Equifax may from time to time make known to Client in writing. Client hereby grants to Equifax a perpetual, irrevocable right and license to use, distribute, modify, create derivative works from, and copy the Feedback Data, combine the Feedback Data with other data, incorporate the Feedback Data into current and future databases, use the Feedback Data to develop and enhance products and services, and share the Feedback Data with third parties in conjunction with the evaluation of products and services. Feedback Data provided to Equifax hereunder shall only be subject to the license provided herein and shall not be deemed Client Data or Client Conﬁdential Information. Client will notify Equifax upon learning that any Feedback Data supplied is inaccurate or incomplete. Client will provide Equifax with any corrections or additional Feedback Data necessary to make the Feedback Data supplied complete and accurate and will implement procedures

Terms Applicable to OFAC Alert URL

Client agrees to hold Agility Credit harmless for any liability or responsibility as to the accuracy and/or subsequent usage of the information returned. OFAC Alert is based on information that was not collected, in whole or in part, for the purpose of serving as a factor in establishing a consumer’s eligibility for credit or insurance to be used primarily for personal, family or household purposes; employment purposes, or any other purpose authorized under the FCRA. Accordingly, Client will not use an OFAC Alert indicator as part of its decision-making process for determining the consumer’s eligibility for any extension of credit or any other FCRA permissible purpose. A match does not necessarily indicate that the consumer about whom Client inquired is the same person referenced by OFAC. Client acknowledges that such an indicator is merely a message that the consumer or business name may match or partially match a name listed on one or more U.S. government-maintained lists of persons subject to economic sanctions, and Client should contact the appropriate government agency for conﬁrmation and instructions. Client agrees that any action taken by Client regarding a consumer must be taken based on Client’s complete investigation of the consumer and not based solely on the OFAC information. The OFAC Alert indicator may or may not pertain to the individual referenced in your inquiry.

Precise ID URL

Client agrees that if it uses Services that includes Experian’s Precise ID for Compliance that they will only be used to protect or prevent actual or potential fraud in accordance with the GLB Act. Client agrees that its use is in compliance with the Driver’s Privacy Protection Act of 1994 (18 U.S.C. Sec. 2721(b)(3)) and that motor vehicle department data and property information will be used solely for Authentication purposes. Client agrees that if it uses Services that include Experian’s Precise ID for Account Opening with or without Synthetic ID add-on Client will certify it’s “permissible purpose(s)” under the GLB AND FCRA and that it will not request or use Services for any other purpose. If client’s “permissible purpose” is based upon written instructions of the consumer or a legitimate business need for the information with a business transaction that is initiated by the consumer, then the Client shall be required to obtain the consumer’s written instructions and consent. Also, Client agrees it will not request, use, or resell any Services for any other purpose, regardless of whether permitted by law.

Prequalification Requirements, Terms and Conditions URL

A. Written Instructions

FCRA Compliance-Written Instructions. Client shall substantially comply with the following website requirements:
1. Client will prominently display a message specifically informing the consumer that his or her credit profile will be consulted for the purpose for which it is to be used and no other purpose, and that clicking on the “I AGREE” button following such notice constitutes written instructions to Client under the Fair Credit Reporting Act (“FCRA”). The notice to be provided by Client to the Consumer will be substantially as follows or in such form as has been previously approved in writing by Experian and shall not deviate therefrom:

“You understand that by clicking on the “I AGREE” button immediately following this notice, you are providing “written instructions” to [name of Client] under the Fair Credit Reporting Act authorizing [name of Client] to obtain information from your personal credit profile or other information from [Credit Reporting Agencies Name]. You authorize [name of Client] to obtain such information solely to conduct a Prequalification for credit.”

The “I AGREE” button must immediately follow the notice provided for above. The notice and “I AGREE” button must be separate from any other notice or message contained on Client’s website.
The terms to which the consumer is agreeing immediately preceding the consensual click must be viewable by the consumer.
The consumer must not be able to proceed in the process without affirmatively agreeing to the terms in the notice.
The consumer must have the ability (should he/she choose) to print out the terms to which he or she is agreeing, including the consumer’s consent.
The consumer must be provided with a statement of hardware and software requirements for access to and retention of the terms to which he or she is agreeing, including their consent in a manner that reasonably demonstrates that the consumer can access information in the electronic form that will be used to provide the information that is the subject of the consent.
The record of the consumer’s “written instructions” by clicking “I AGREE” must be retained by Client in a form that is capable of being accurately reproduced for later reference by the parties.
The consumer must be informed how, after providing consent, he or she may, upon request, obtain a paper copy of any applicable electronic record, and whether any fee will be charged for such copy.
Client must provide the consumer with information on how the consumer can update his or her contact information.

Written Instructions by Telephone. Client shall comply with the following requirements if Client is obtaining written instructions over the telephone. Client shall substantially comply with Article 1 of this Section, as specifically modified below; both Section A and Section B are designed to comply with the Electronic Records and Signatures in Commerce Act:
1. Client will ask each consumer to confirm his or her consent to access such person’s credit report for Prequalification purposes by asking the following: “In order to verify your identity, you need to authorize Client to access your credit report for Prequalification purposes. Please confirm your authorization to access your credit report for Prequalification purposes by pressing the # key now”;
2. The consumer must not be able to proceed in the process without affirmatively agreeing to allow access to his credit report as provided above; and
3. The record of the consumer’s ‘written instruction’ by pressing the # symbol must be retained by Client in a form that is capable of being accurately reproduced for later reference by the parties.

Credit Experian Terms and Conditions

Agility Credit Experian Prequalification Services

Prequalification Services will be performed at the election of Client that request such services through Agility Credit. These Prequalification Terms and Conditions establish the terms and conditions pursuant to which Agility Credit may provide the Prequalification Information to Client as described herein.

Prequalification Services.

For the purposes of this Section, “Prequalification Services” (i) is a consumer consent-based business model; (ii) is a consumer-initiated transaction, in which consumers consent to have their credit report pulled to see what credit options may be available to them from Client (iii) is a solution where the consumer reviews the credit options returned by Client and decides whether or not to apply for such options; (iv) requires that each Client’s permissible purpose is consumer’s written instructions, and a soft consent Prequalification inquiry is posted on all files accessed; and (v) is different from a prescreen process, and, therefore, no firm offer of credit is involved.

The Prequalification Services credit data pulled shall be used by Client on a per session basis and shall not be used by such Client after such session ends, provided, however, that Client shall have the right, for a period of up to thirty (30) days after a Prequalification Services credit data pull, to remind a consumer via email that credit options continue to be available for such consumer, provided that the content of such email specifically excludes any details on the credit options and any Experian information.

Agility Credit Responsibilities

Agility Credit shall sell to Client Prequalification Services to determine whether a consumer meets Client’s minimum credit criteria, as communicated to Agility Credit by Client.

Client Duties

Client certifies that, with respect to Prequalification Services:

Client has a “permissible purpose” under the FCRA;
Client shall be required to obtain the consumer’s written instructions in a manner substantially similar to that provided in the attached Exhibit A. By utilizing Agility Credit’s FastApp application, this requirement shall automatically be satisfied.
A record of a consumer’s ‘written instruction’ shall be retained by Client in a form that is capable of being accurately reproduced for later reference by Client and Agility Credit. By Client utilizing Agility Credit’s FastApp application, Agility Credit captures and retains this information on behalf of Client.
Client shall not operate as the agent of any third party;
Client shall not (a) operate as a reseller of Prequalification Services or (b) directly or indirectly charge a consumer any costs or fees, or accept any other payment or valuable consideration from a consumer, for Prequalification or any information derived therefrom (“Consumer Credit Information”), including, without limitation, by offering the Prequalification Services or Consumer Credit Information as the sole additional feature of a higher-priced service offering or as an incentive to or bundled with a fee-based offering.
Client shall only direct consumers to third party lenders that have their own permissible purpose;
Client shall not use, or permit any Client’s respective employees, agents and subcontractors to use, the trademarks, service marks, logos, names or any other proprietary designations of Experian, whether registered or unregistered, without prior written consent from Experian;
Client shall not offer depersonalized credit profiles for bid by third parties;
Client shall not utilize Prequalification Services to replace a hard inquiry for the purpose of offering credit
Client shall allow only consumer-supplied contact data and other consumer-supplied data to be passed on to third party lenders, and only after (i) consumer has provided Client with consumer’s specific affirmative written authorization (in a manner acceptable to Experian), authorizing Client to forward such consumer-supplied data, together with information identifying whether such consumer passed Client’s credit criteria, which may include certain screening criteria provided by the third party lenders to Client, to the third party lenders (which record of such written authorization must be retained by Client in a form that is capable of being accurately reproduced for later reference by the parties) (“Consumer Authorization”); and (ii) applicable credit options available in the marketplace have been presented to the consumer for consumer’s review;
Client shall not provide the credit report (in whole or in part) obtained through Prequalification Services to a consumer or to any third party, and shall not provide a score, decision or any other information or indicator of the consumer’s credit worthiness, derived in whole or in part from such credit report, to the consumer or to any third party;
Client shall not make any credit decision, nor provide FCRA-regulated pre-qualify services on behalf of a third party

Equifax Terms and Conditions

1. Agility Credit Equifax Prequalification Services

Prequalification Services will be performed at the electronic of Client by request through Agility Credit

2. Definitions

In addition to the definitions set forth elsewhere in this Section, the following terms have the meanings set forth below:

“Consumer” means an individual who resides in the United States and requests Consumer Qualification from Client.
“Consumer Qualification Information” means Score Range and Identifying Information related to a Consumer Subject that has met the consumer credit criteria provided to Client in connection with the Prequalification Service, for purposes set forth herein.
“Consumer Qualification Evaluation” means Client’s or Agility Credit’s review of the Equifax Qualification Information of a Consumer Subject seeking qualification, and screening such Consumer Subject and related Equifax Qualification Information against Client’s selected criteria for purposes of qualifying the Consumer Subject for a relationship involving: (i) the extension of credit to, or review or collection of an account of, the Consumer Subject; or (ii) the underwriting of insurance involving the Consumer Subject.
“Consumer Subject” means the Consumer who is the subject of the Equifax Qualification Information.
“Equifax Qualification Information” means the Equifax Information provided to Client pursuant to this Addendum for use solely in connection with the Prequalification Service, and for no other purpose.
“Identifying Information” means any unique consumer-identifying information, including account numbers, name, address, social security number and any other information considered “non-public personal information” pursuant to the GLB.
“Person” means any individual, corporation (including any non-profit corporation), general or limited partnership, limited liability company, joint venture, estate, trust, association, organization, labor union, or other entity or governmental authority.
“Pre-Qualification Evaluation” means Client’s review of the Pre-Qualification Information related to a Consumer Subject seeking pre-qualification, and screening such Consumer Subject and related Pre-Qualification Information against Client’s selected criteria for purposes of pre-qualifying the Consumer Subject for a potential relationship involving the extension of credit to the Consumer Subject in the form of a loan. For the avoidance of doubt, a Pre-Qualification Evaluation shall not include an evaluation in connection with a pre-approval or an application or origination.
“Pre-Qualification Information” means the limited Equifax Information provided to Client by Agility Credit and includes any Scores.
“Scores” means the credit risk scores provided to Client from the Pre-Qualification Information.
“Score Range” means credit score band information derived from Equifax Qualification Information, which is only to be displayed in pre-determined ranges of scores of no less than 50 points (e.g. a score of 710 will be displayed at 700-749).

Information

For purposes of this Addendum, all references in the Credit Report Services Agreement to “Information” shall include Consumer Qualification Information, the Equifax Qualification Information, and Consumer Qualification Evaluation, and any of Client’s obligations in the Credit Report Services Agreement vis-à-vis Information shall be expanded to cover Consumer Qualification Information, the Equifax Qualification Information, and Consumer Qualification Evaluation.

Third Party Beneficiary

Client and Agility Credit acknowledge and agree that Equifax is a third-party beneficiary hereunder with respect to these Addendum Terms and any Consumer Qualification Information, with fully enforceable rights. Client and Agility Credit further acknowledge and agree that Equifax’s rights with respect to these Addendum Terms and any Consumer Qualification Information are unconditional rights that shall survive the termination for any reason.

Use of Information

Client acknowledges that the consumer credit and consumer report information, including Score Range, personally identifiable information and Qualified Offer (as defined below) (collectively, “Consumer Qualification Information”) was provided to Client based on the applicable consumer (the “Consumer”) being screened and qualified against Client’s selected criteria with respect to: (i) the extension of credit to the Consumer; or (ii) the underwriting of insurance involving the Consumer (“Consumer Qualification”). Client will only use the Consumer Qualification Information solely to contact the Consumer in connection with the Client’s offer for which the Consumer was qualified (based on the Consumer Qualification) (the “Qualified Offer”) and for no other purpose (the “Contact Services”). Without limiting the foregoing, Client will not use the Consumer Qualification Information for consumer or commercial credit-granting purposes or use the Consumer Qualification Information for any purpose other than Contact Services, and in all cases accordance with all applicable laws and regulations. For any for consumer credit-granting where a consumer report is reviewed, Client will not use any Consumer Qualification Information for such purposes.

Client will not share, use or otherwise permit access in any manner the Consumer Qualification Information with any other individual, corporation (including any non-profit corporation), general or limited partnership, limited liability company, joint venture, estate, trust, association, organization, labor union, or other entity or governmental authority. The Consumer Qualification Information will only be used by those employees or business people of Client responsible for managing the Client’s information and data related to consumer credit information.

Compliance with Laws

Client will comply with all applicable federal and state laws and all applicable regulations promulgated under any of them, including, without limitation, the provisions of the federal Fair Credit Reporting Act, 15 U.S.C. 1681 et. seq., as amended (the “FCRA”), the federal Equal Credit Opportunity Act, as amended (the “ECOA”), all consumer protection laws, all state law counterparts of them, and all applicable regulations promulgated under any of them.

Agility Credit Duties

Agility Credit shall sell to Client Prequalification Services to determine whether a consumer meets Client’s minimum credit criteria, as communicated to Agility Credit by Client, for the purposes of qualifying the consumer for a relationship involving the extension of credit to the consumer.

Disclaimer

Equifax makes no representations, warranties or guarantees, express or implied. TO THE MAXIMUM EXTENT ALLOWABLE BY APPLICABLE LAW, THE CONSUMER QUALIFICATION INFORMATION PROVIDED HEREUNDER ARE PROVIDED ON AN “AS IS” BASIS AND EACH PARTY HEREBY DISCLAIMS ANY AND ALL OTHER PROMISES, REPRESENTATIONS, GUARANTEES AND WARRANTIES WHETHER EXPRESS OR IMPLIED OR STATUTORY REGARDING THE ACCURACY, CORRECTNESS, COMPLETENESS, CURRENTNESS, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OF THE CONSUMER QUALIFICATION INFORMATION. NEITHER EQUIFAX, NOR ANY OF ITS DIRECTORS, OFFICERS, PROVIDERS, EMPLOYEES, CONTRACTORS, LICENSORS, AFFILIATED COMPANIES (“AFFILIATED PERSONS AND ENTITIES”) WILL BE LIABLE TO PROVIDER FOR ANY LOSS OR INJURY RELATING TO, ARISING OUT OF, OR CAUSED IN WHOLE OR IN PART BY, THEIR ACTS OR OMISSIONS, EVEN IF NEGLIGENT, RELATING TO THE ACCURACY, CORRECTNESS, COMPLETENESS OR CURRENTNESS OF THE CONSUMER QUALIFICATION INFORMATION.

Storage

Client may maintain, copy, capture or otherwise retain the Consumer Qualification Information provided hereunder for thirty (30) days only (“Storage Period”); provided that (i) Client will only use the Consumer Qualification Information for the purposes expressly permitted in these Addendum Terms; (ii) Client must physically and logically segregate Consumer Qualification Information from other consumer reporting agency (“CRA”) information; and (iii) Client must have a formal process for expunging Consumer Qualification Information after 30 days. After the expiration of the Storage Period, Client will not maintain, copy, capture or otherwise retain in any manner any Consumer Qualification Information.

Confidentiality

Client acknowledges that Consumer Qualification Information is a confidential and proprietary trade secret of Equifax. Client agrees to hold in confidence all Consumer Qualification Information and will restrict its use of Consumer Qualification Information to the purposes expressly permitted in these Addendum Terms. If the law or legal process requires Client to disclose Consumer Qualification Information, Client will notify the Equifax of the request. Thereafter Equifax may seek a protective order or waive the confidentiality requirements of these Addendum Terms, provided that Client may only disclose the minimum amount of information necessary to comply with the requirement. The rights and obligations of this Section will survive the termination of this Addendum for so long as such Consumer Qualification Information remains a trade secret under applicable law; and with respect to all other confidential information, will survive the termination of these Addendum Terms for the longer of two (2) years from termination, or the confidentiality period required by applicable law. Client acknowledges that unauthorized disclosure or use of the Consumer Qualification Information may irreparably damage Equifax in such a way that adequate compensation could not be obtained from damages in an action at law. Accordingly, the actual or threatened unauthorized disclosure or use of any Consumer Qualification Information shall give Equifax the right to seek injunctive relief restraining such unauthorized disclosure or use, in addition to any other remedy otherwise available (including reasonable attorneys’ fees). Client hereby waives the posting of a bond with respect to any action for injunctive relief.

D. Equifax Terms and Conditions for Synthetic ID

1. The terms and conditions of this Exhibit apply to Client’s receipt of and use of the Synthetic Fraud Alerts, as described below, and Client acknowledges it will request and receive the Synthetic Fraud Alert, subject to the terms of the additional terms and conditions set forth in this Exhibit. This Exhibit also establish the terms and conditions pursuant to which Agility Credit may provide the Pre-Qualification Information to Client as described herein.

For Synthetic Fraud Alert Services, the following terms and conditions apply:

2. Synthetic ID Alerts provide flags and attributes that can help identify synthetic identity fraud through the use of aggregated and anonymous authorized user transactions from a separate anonymous database of potential synthetic identity fraud transactions that may have association with the subject consumer.

3. When Synthetic ID Alerts are delivered with a credit report, Synthetic ID Alerts includes authorized user output fields (Authorized User Velocity & ID Discrepancy flags plus other associated authorized/terminated user counts) and a Final assessment flag. Although Synthetic ID Alert are not consumer reports, this version of the Synthetic ID Alert may only be purchased at the same time that Client purchases a consumer report in connection with the extension of credit or account review.

4. Synthetic ID Alerts are for identity fraud risk alert purposes only and are not to be used for determining an individual’s eligibility for credit or any other FCRA permissible purpose or in any way for the purpose of taking “adverse action,” in whole or in part, against a consumer, as defined in the ECOA and Regulation B, or for suspending a consumer’s account. As such Client will not use the Synthetic ID Alert in its decision-making process for denying credit, but will use the Synthetic ID Alerts as an indication that the consumer’s identity and personally identifiable information should be independently verified to form a reasonable belief that Client knows the true identity of the consumer. Client certifies that it shall use the Synthetic ID Alerts exclusively within Client’s own organization for the purpose of identity fraud prevention and for no other purpose. Client will not resell or otherwise redistribute the Synthetic ID Alerts.

5. Client understands that the information supplied by Synthetic ID Alerts may or may not apply to the consumer who has applied to Client for credit, service, dealings, or other financial transactions.

6. Client also understands and agrees that the information contained in the Synthetic ID Alerts is proprietary to Equifax and shall not be used as a component of any database or file build or maintained by Client. The use of each Synthetic ID Alert shall be limited to one time use in conjunction with the specific transaction for which the Synthetic ID Alert is requested and provided. Client’s obligations with regard to the use of the Synthetic Fraud Alerts will survive any termination for as long as the Synthetic ID Alerts are in Client’s custody or control. EQUIFAX MAY, BY WRITTEN NOTICE TO CLIENT, IMMEDIATELY TERMINATE OR SUSPEND THE PROVISION OF THE SYNTHETIC ID ALERT SERVICE IF EQUIFAX HAS A REASONABLE BELIEF THAT CLIENT HAS VIOLATED THE TERMS AND CONDITIONS APPLICABLE TO THE SYNTHETIC ID ALERTS.

7. Equifax, and its data suppliers (including government agencies) (a) makes no warranty, express, implied or statutory, and specifically disclaims all warranties with respect to the Limited Access Death Master File information incorporated into the Synthetic ID Alerts (the “Death Master Flag”), including but not limited to, implied warranties of merchantability and fitness for any particular use or that use of the Death Master Flag constitutes compliance with any law or regulation; (b) assume no liability for any direct, indirect or consequential damages flowing from any use of any part of the Death Master Flag, including infringement of third party intellectual property or privacy rights; and (c) assume no liability for any errors or omissions in the Death Master Flag. The Death Master Flag contains inaccuracies. As such, neither Equifax, NTIS, nor the Social Security Administration which provides the Death Master Flag to NTIS, guarantees the accuracy of the Death Master Flag. The LADFM does not contain death records for all deceased persons. Therefore, the absence of a particular person in the Death Master Flag is not proof that the individual is alive. Further, it is possible for the records of a person who is not deceased to be included erroneously in the Death Master Flag. Client acknowledges and agrees that the Death Master Flag does not guarantee the identity of or information regarding any individual and that Client has processes in place to independently verify the information provided in the Death Master Flag.

8. Specifically with regard to the Death Master Flag included with the Synthetic ID Alerts, Client certifies that:

a. Its access to the Death Master Flag is appropriate because Client (i) has a legitimate fraud prevention interest, a legitimate business purpose pursuant to a law, governmental rule, regulation, or fiduciary duty; (ii) has systems facilities, and procedures in place to safeguard such information, and experience in maintaining the confidentiality, security, and appropriate use of such information, (iii) agrees to satisfy such similar requirements, and (iv) it will provide a renewal certification from time to time upon request from Equifax.

b. It will not share the Death Master Flag with any person or entity unless they first meet the requirements of the Section and this Article b. Client understands that any successful attempt by any person to gain unauthorized access to or use of the Death Master Flag that Equifax may immediately terminate Client’s access to the Synthetic ID Alerts. In addition, any successful attempt by any person to gain unauthorized access may under certain circumstances may result in penalties as prescribed in 15 CFR § 1110.200 levied on Client and the person attempting such access. Client will take appropriate action to ensure that all persons accessing the Death Master Flag through it are aware of their potential liability for misuse and/or penalties for attempting to gain unauthorized access. Any such access or attempted access is a breach, or attempted breach, of security, and Client must immediately report such events to Equifax.

9. Client will provide, at a minimum, the fields noted as “Required.” ** If only last 4 digits of SSN are provided on input, the following flags cannot be returned: Shared SSN (Name), SSN Verified, Invalid SSN and Death Master Hit Flags.

![A table with text and numbers

10. Client, at its own expense, will prepare and deliver to Equifax at mutually agreed to intervals (but no less than every ninety (90)days) and in a mutually agreeable form and medium its most current identity fraud performance feedback data (“Feedback Data”).Feedback Data will be used to configure and enhance the performance of products and services related to potentially fraudulent activity. For purposes of this Addendum, “performance” means identity fraud outcome of decisions at time of origination or account management. Client will encrypt all Feedback Data as directed by Equifax and comply with such data security policies as Equifax may from time to time make known to Client in writing. Client hereby grants to Equifax a perpetual, irrevocable right and license to use, distribute, modify, create derivative works from, and copy the Feedback Data, combine the Feedback Data with other data, incorporate the Feedback Data into current and future databases, use the Feedback Data to develop and enhance products and services, and share the Feedback Data with third parties in conjunction with the evaluation of products and services. Feedback Data provided to Equifax hereunder shall only be subject to the license provided herein and shall not be deemed Client Data or Client Confidential Information. Client will notify Equifax upon learning that any Feedback Data supplied is inaccurate or incomplete. Client will provide Equifax with any corrections or additional Feedback Data necessary to make the Feedback Data supplied complete and accurate and will implement procedures to avoid re-reporting Feedback Data that is inaccurate.

For Pre-Qualification Information services, the following terms and conditions apply:

Definitions. All capitalized terms used but not defined herein shall have the meanings given them in the Agreement. In addition to the definitions set forth elsewhere in these Pre-Qualification Terms and Conditions, the following terms have the meanings set forth below:
1. “Consumer” means an individual who resides in the United States and requests a pre-qualification from Client.
2. “Pre-Qualification Evaluation” means Client’s review of the Pre-Qualification Information related to a Consumer Subject seeking pre-qualification, and screening such Consumer Subject and related Pre-Qualification Information against Client’s selected criteria for purposes of pre-qualifying the Consumer Subject for a potential relationship involving the extension of credit to the Consumer Subject in the form of a loan. For the avoidance of doubt, a Pre-Qualification Evaluation shall not include an evaluation in connection with a pre-approval or an application or origination.
3. “Consumer Subject” means the Consumer who is the subject of the Pre-Qualification Information.
4. “Pre-Qualification Information” means the limited Equifax Information provided to Client by Agility Credit and includes any Scores.
5. “Scores” means the credit risk scores provided to Client from the Pre-Qualification Information.
License. Subject to Client’s compliance with the terms of the Agreement (including these additional Pre-Qualification Terms and Conditions), and solely during the license term set forth in the Agreement or the applicable ordering document, Agility Credit grants to Client and Client receives a non-transferrable, non-exclusive, revocable license to use the Pre-Qualification Information within the Permitted Territory solely for the Permitted Use set forth below and not for any other purpose.
Permitted Use. Client will only use the Pre-Qualification Information in accordance with the Agreement (including these additional Pre-Qualification Terms and Conditions) and for the following use and no other use (the “Permitted Use”):

Client acknowledges that Pre-Qualification Information consists of consumer reports as defined by the FCRA. Client certifies that it will use the Pre-Qualification Information only (a) in connection with a Pre-Qualification Evaluation, (b) in accordance with the FCRA and all state law FCRA counterparts, (c) in accordance with the written instructions of the Consumer Subject, and (d) solely for a single use and for no other purpose.

Client Representations. Client covenants, represents and warrants that:
1. Client shall (i) use the Pre-Qualification Information exclusively within Client’s own organization for the Permitted Use and for no other purpose, including credit decisioning purposes, and (ii) use and ensure that any permitted agents of Client access and use Pre-Qualification Information in accordance with the terms of the Agreement (including these additional Pre-Qualification Terms and Conditions).
2. Client shall use the Pre-Qualification Information in a manner that (i) complies with all applicable federal, state and local laws, rules, regulations and ordinances, including those governing privacy, data protection, fair information practices, public records, marketing to consumers and consumers’ rights to privacy; (ii) does not, in any way or for any purpose, infringe any third party’s intellectual or proprietary rights, including but not limited to, copyright, patent, trademark, or trade secret; and (iii) is not defamatory, libelous, harmful to minors, obscene, pornographic, unlawfully threatening or unlawfully harassing. Client is solely responsible for all results of its or its employees and permitted agents use of the Pre-Qualification Information.
3. Client shall establish strict procedures so that Client’s employees and permitted agents do not access Pre-Qualification Information except as set forth in the Agreement (including these additional Pre-Qualification Terms and Conditions) and shall comply with all Agility Credit and/or Equifax policies and procedures Agility Credit or Equifax makes known to Client from time to time regarding the Pre-Qualification Services.
4. Client shall not (i) merge or combine the Pre-Qualification Information with information or data from any other source or (ii) use the Pre-Qualification Information in combination with any other Equifax Information Services.
5. Client shall hold all Pre-Qualification Information licensed under these Pre-Qualification Terms and Conditions in strict confidence and will not reproduce, reveal or make it accessible in whole or in part, in any manner whatsoever to others except Consumer Subjects to the extent expressly permitted under Section 8 of these Pre-Qualification Terms and Conditions or as otherwise expressly required by law.
6. Client shall not reuse Pre-Qualification Information in any manner, including with respect to any additional transactions or additional Pre-Qualification Evaluations or other evaluations for the Consumer Subject. Consistent with the preceding sentence, Client shall not use the Pre-Qualification Information in connection with any pre-approval or application or origination, or any credit decisioning related thereto.
7. If Client provides Consumer Subjects with access to its pre-qualifications via the Internet, Client shall adopt, publish, maintain and adhere to a privacy policy and upon request, provide Agility Credit and/or Equifax with a copy of Client’s privacy policy.
8. Except as expressly permitted in these Pre-Qualification Terms and Conditions, Client shall not: (i) sell, convey, license, sublicense, copy, commingle, archive, reproduce, display, publish, disclose, distribute, disseminate, transfer, use or otherwise make available the Pre-Qualification Information, or any portion thereof, to another in any manner or by any means; (ii) reverse engineer, decompile, modify in any manner or create derivative works from the Pre-Qualification Information; (iii) interface or connect to the Pre-Qualification Services with any other computer software or system; or (iv) export nor permit the export of the Pre-Qualification Information outside of the Permitted Territory.
Storage. Client may maintain, copy, capture or otherwise retain the Pre-Qualification Information for thirty (30) days only (“Storage Period”); provided that (a) Client will only use the Pre-Qualification Information for the Permitted Use expressly permitted in these Pre-Qualification Terms and Conditions; (b) Client must physically and logically segregate Pre-Qualification Information from other consumer reporting agency information; and (c) Client must have a formal process for expunging Pre-Qualification Information after 30 days. Agility Credit and/or Equifax, reserves the right to review and approve the technical implementation for Client’s access to the Pre-Qualification Information. After the expiration of the Storage Period, Client will not maintain, copy, capture or otherwise retain in any manner any Pre-Qualification Information.
Disclosing Pre-Qualification Information to Consumer Subjects. Client will not provide the Pre-Qualification Information to the Consumer Subject unless expressly required by law or approved in writing by Equifax. In the event that Client discloses the Pre-Qualification Information to the Consumer Subject, Client shall transmit such information only to the Consumer Subject for which the information pertains, accurately and in its entirety, and include the date the information was last checked or revised by Equifax and the full name and mailing address of the Equifax office identified by Equifax as providing the information. In the event that the Consumer Subject does not qualify for the pre-qualification for which such Consumer Subject applies or otherwise requests the Pre-Qualification Evaluation, Client will comply with all applicable laws and regulations requiring adverse action notification to the Consumer Subject (including the provisions of the FCRA, ECOA, all state law counterparts of them, and all applicable regulations promulgated under any of them). In no event shall Client charge the Consumer Subject a fee or other charges for the Pre-Qualification Information or the Pre-Qualification Evaluation.
No Unauthorized Representations. Client will make no representations or warranties on behalf of Equifax or relating to the Pre-Qualification Information except as authorized in writing by Equifax.
Consumer Handling. Client will refer all Consumers who have questions or dispute Pre-Qualification Information to Equifax. In no case will Client attempt to, or hold itself out to the Consumer or to the public as being able to handle disputes on behalf of Equifax or to reinvestigate Equifax Information.
Promotion and Training. Prior to its publication and release, Equifax must review and approve all Client-created advertising, marketing and promotional material that describes the Pre-Qualification Information or which refers to the nature or capabilities of Equifax or otherwise mentions or refers to Equifax by name. Equifax will be provided a minimum of twenty (20) business days in which to review such material including any changes thereto.
Audit. In addition to any audit or review rights set forth in the Agreement, Equifax may review and audit Client’s access to and use of the Pre-Qualification Services. Such audit rights include, without limitation, the right to review and audit Client’s terms and conditions of use applicable to pre-qualifications, as well as all Consumer consents. In connection with any audits hereunder, Equifax shall have the right, from time to time, to: (1) upon reasonable notice to Client, enter into Client’s facilities during normal business hours and conduct on-site audits of Client’s compliance with the terms hereunder; and (2) conduct audits by mail, email or similar electronic means that may require Client to provide documentation regarding compliance with the terms hereunder. Client gives its consent to Equifax to conduct such audits and agrees that any failure to cooperate fully and promptly in the conduct of any audit, or Client’s material breach of these Pre-Qualification Terms and Conditions, constitute grounds for immediate suspension of service or termination of these Pre-Qualification Terms and Conditions.

E. TransUnion Terms and Conditions

1. Agility Credit TransUnion Prequalification Services

Prequalification Services will be performed at the election of Client that request such services through Agility Credit.

Agility Credit Responsibilities

Agility Credit shall sell to Client Prequalification Services to determine whether a consumer meets Client’s minimum credit criteria, as communicated to Agility Credit by Client.

Client Duties

Client agrees to the following requires with respect to Prequalification Services:

Client shall inform a consumer whether or not the consumer has pre-qualified for a lending offer(s) and if so, the lending offer(s) for which the consumer has pre-qualified.
Upon each request for Pre-Qualification Services, Client shall provide a permissible purpose certification to the Agility Credit that Client has obtained the written authorization of the consumer to access such consumer’s credit information, as defined by Section 604(a)(2) of the FCRA, and shall agree to use Pre-Qualification Services for the sole purpose of determining the lending offer(s) for which such consumer might be qualified, and for no other purpose, including underwriting the loan. For avoidance of doubt, being presented with lending offers may result in the consumer’s application for credit, and the underwriting of a loan upon a consumer’s application for credit requires Client to obtain additional access to a consumer report upon an appropriate permissible purpose certification. Client shall be prohibited from using information obtained from the Pre-Qualification Services, or information derived therefrom, for underwriting the loan or for any other purpose. Any violation of this use restriction shall be deemed a material breach by Client of the Credit Report Services Agreement.
Client represents and warrants that Client shall not share, distribute or otherwise provide to a consumer any of the consumer’s credit information that Client has obtained from the consumer’s credit report, including, but not limited to, information derived therefrom, credit attributes, or credit scores, in its communications with the consumer whose report was obtained, whether such communications are verbal, written or otherwise. Any violation of this restriction shall be deemed a material breach by Client of the Master Service Agreement.
Client shall at all times maintain complete and accurate records sufficient to substantiate its use of Pre-Qualification Services, including its compliance with all restrictions, and shall make these and all related records available to Agility Credit and/or TransUnion upon Agility Credit’s and/or TransUnion’s request, which may include providing these records to Agility Credit and/or TransUnion for an off-site review or making these records available for Agility Credit’s and/or TransUnion’s examination during an on-site review. In the event the review of Client’s records shows that Client violated any restriction, Client, without limitation of any other remedies available to Agility Credit and/or TransUnion under law or equity, shall compensate Agility Credit and/or TransUnion for any subsequent use the Credit Information or any intelligence or information derived therefrom at Agility Credit’s and/or TransUnion’s then current rates. In addition, Client shall pay all reasonable costs associated with Agility Credit’s and/or TransUnion’s review.
TransUnion will post “soft” inquiries for credit transactions requesting a Pre-Qualification Service. Client acknowledges that TransUnion’s agreement to post “soft” inquiries for Pre-Qualification Services is expressly conditioned on Client’s compliance to all restrictions, and that any violation of such restrictions will devalue TransUnion’s Consumer Credit Database. As such, any limitation of liability provisions in the Credit Report Services Agreement shall not apply to limit Client’s liability associated with violations of such restrictions.

Updated: 02-09-2024