Acceptable Use Supplement

This Acceptable Use Supplement is attached to and incorporated into the Proof General Terms (“General Terms”), the Order Form, or both. Capitalized terms not otherwise defined have the meanings given in the General Terms, the Proof Glossary, or the Order Form. This Acceptable Use Supplement replaces the Defend Supplement. Any reference to the Defend Supplement in the Order Form or elsewhere in the Agreement shall be read to refer to this Acceptable Use Supplement.

1. ‍Applicability.  This Acceptable Use Supplement applies to any User who receives Proof Content.‍
   ‍
2. User Responsibilities.  Any risk score and any fraud indicators provided do not definitively indicate that fraud has occurred. User is solely responsible for (i) reviewing the risk score and fraud indicators provided by Proof; (ii) deciding whether action should be taken; and, (iii) if User decides action is appropriate, taking that action. Proof shall have no liability for a failure to detect fraud.
   ‍
3. ‍Acceptable Use.
   3.1 Acceptable and Prohibited Uses.
   
   (a) Purpose. The Services and Proof Content are provided solely for identity verification, authentication, and fraud-prevention purposes.
   (b) No FCRA Use. User shall not use the Services or Proof Content for any “permissible purpose” under the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (“FCRA”)(including, without limitation, employment, credit, insurance underwriting, housing/tenant screening, or any other eligibility determination), and shall not use any output to take an “adverse action” as that term is defined by the FCRA.
   (c) No CRA Status / No Consumer Reports. Proof is not a Consumer Reporting Agency (“CRA”) and does not furnish consumer reports as that term is used under the FCRA (“Consumer Report”). User will not (i) represent any output as a Consumer Report, (ii) combine or use outputs to create or furnish a Consumer Report, or (iii) request, procure, or use outputs for any FCRA-regulated purpose.
   (d) Other Legal Considerations. Where Proof Content includes data governed by the Gramm–Leach–Bliley Act, 15 U.S.C. § 6801 et seq. (“GLBA”), the Driver’s Privacy Protection Act,18 U.S.C. § 2721 et seq. (“DPPA”), or a state biometric-information law such as the Illinois Biometric Information Privacy Act, 740 ILCS 14 et seq. (“BIPA”), such Proof Content is provided solely for identity verification, authentication, and fraud-prevention in connection with User’s legitimate business needs.
   (e) Prohibited Uses (GLBA/ DPPA/BIPA). User shall not use GLBA, DPPA, or BIPA-governed data for marketing, profiling, or any other purpose restricted by those statutes, implementing regulations, or other restrictions communicated by Proof.
   (f) Evolving Legal Requirements. User will comply with any new or amended law or regulation that Proof reasonably determines limits or conditions use of Proof Content, and will promptly implement any restrictions, safeguards, or process changes communicated in writing by Proof.
   (g) Geographic Access Controls. User will not access Proof Content from an IP address outside the United States or its territories.
   (h) Records Retention. User will maintain for five (5) years complete and accurate records of its access to and use of Proof Content sufficient to demonstrate compliance with this Agreement and applicable law.
   (i) Misuse Notification. User will immediately notify Proof in writing if it suspects, has reason to believe, or confirms that any Account ID, Proof Content, or data derived (directly or indirectly) from Proof Content has been lost, stolen, compromised, misused, or accessed by an unauthorized person or for any purpose other than legitimate business reasons.
   (j) Notices, Consents, and Lawful Basis. User shall provide all required notices and obtain all necessary consents and authorizations under applicable law for: (i) the transfer of User Data to Proof and its vendors/subprocessors; (ii) the processing of such User Data by Proof and its vendors under the Agreement; and (iii) access by Proof or its vendors to Customer Proprietary Network Information (as defined in the Telecommunications Act), where applicable.
   (k) Sanctions Compliance Representation. User represents that neither it nor any of its shareholders, directors, officers, or principals is (1) organized in, located in, or a citizen of a country and region subject to comprehensive U.S. embargo or similar sanctions, or (2) listed on the U.S. Department of the Treasury’s Specially Designated Nationals (SDN) or Blocked Persons lists (or any similar restricted-party list).
   (l) Monitoring, Verification, and Audit Cooperation. Proof may monitor usage and review records as reasonably necessary to safeguard data and verify compliance with this Section 3.1. User will cooperate with reasonable compliance inquiries and provide information demonstrating adherence.
   (m) Remedies. Without limiting other remedies, Proof, in its sole and reasonable discretion, may terminate the Agreement with User immediately to prevent additional non-compliance.
   
   3.2 Gramm-Leach-Bliley Act.  Proof Content may contain consumer identification information governed by GLBA. In accordance with the GLBA, User certifies that such information will only be used for the following purposes:
   
   (a) Fraud detection and prevention purposes including use to protect against or prevent actual or potential fraud, unauthorized transactions, claims or other liability;
   (b) Completion of a transaction authorized by User including but not limited to the collection of delinquent accounts;
   (c) Application Verification including but not limited to (i) employment application verification (however, Proof Content cannot be used to make an employment decision as outlined in the Fair Credit Reporting Act (15 U.S.C. §1681 et seq.)), (ii) property leasing application information verification (however, Proof Content cannot be used for making a leasing decision as outlined in the FCRA (15 U.S.C. §1681 et seq.)), and (iii) insurance application information verification (however, Proof Content cannot be used for making a decision to insure an individual or business as outlined in the FCRA (15 U.S.C.§ 1681 et seq.)). User represents and warrants that Proof Content will not be used for purposes governed by the FCRA;
   (d) Law firm and attorney functions including use by persons, or their representatives, holding a legal or beneficial interest relating to User;
   (e) Insurance purposes including (a) account administration, (b) reporting, (c) fraud prevention, (d) premium payment processing, (e) claim processing and investigation, (f) benefit administration, or (g) research projects;
   (f) Required institutional risk control programs including complying with federal, state, or local laws, rules, and other applicable legal requirements; and
   (g) Dispute resolution for resolving customer disputes or inquiries.
   
   3.3 Driver's Privacy ProtectionAct.  Proof Content may contain driver's license and motor vehicle registration information subject to the protections of the DPPA. In accordance with DPPA, User certifies that such information will only be used for the following purposes:
   
   (a) Use in the normal course of business, to verify the accuracy of personal information submitted by User and, if the submitted information is incorrect, to obtain correct information, but only for the purpose of preventing fraud by, or pursuing legal remedies against, or recovering on a debt or security interest against, User (18 U.S.C. § 2721(b)(3));
   (b) Use by court or other government agency or entity, acting directly on behalf of a government agency (18 U.S.C. § 2721 (b)(1));
   (c) Use for any matter regarding motor vehicle or driver safety or theft; to inform an owner of a towed or impounded vehicle (18 U.S.C.§ 2721 (b)(2));
   (d) Use in connection with a civil, criminal, administrative, or arbitral proceeding (18 U.S.C. § 2721 (b)(4));
   (e) Use by an employer or its agents or insurer to obtain or verify information relating to a holder of a commercial driver's license thatis required under the Commercial Motor Vehicle Safety Act of 1986 (18 U.S.C. §2721 (b)(9));
   (f) Use by an insurer or insurance support organization, in connection with claims investigation activities, antifraud activities, rating or underwriting (18 U.S.C. § 2721 (b)(6));
   (g) Use by a licensed private investigative agency, or licensed security service, for a purpose permitted in items (a) through (f)above (18 U.S.C. § 2721 (b)(8)); and
   (h) For use in connection with the operation of private toll transportation facilities.
   ‍
4. Indemnification.  User will indemnify, defend, and hold Proof, its affiliates and their officers, directors, employees, agents and representatives harmless from and against any and all costs, damages, liabilities or expenses (including reasonable attorneys’ fees) arising from any third-party claims resulting from (a) use of Proof Content received by User (or any third party receiving such information from or through User) furnished by or through Proof; and (b) any Security Incident.

‍