This Acceptable Use Supplement is incorporated into the Proof General Terms (“General Terms”). Capitalized terms not otherwise defined have the meanings given in the General Terms, the Proof Glossary, or the Order Form. This Acceptable Use Supplement replaces the Defend Supplement. Any reference to the Defend Supplement in the Order Form or elsewhere in the Agreement shall be read to refer to this Acceptable Use Supplement.
- Applicability. This Acceptable Use Supplement applies to any User who receives Results Data, including a Verifier that receives Claims.
- User Responsibilities. Any risk score and any fraud indicators provided do not definitively indicate that fraud has occurred. User is solely responsible for (i) reviewing the risk score and fraud indicators provided by Proof; (ii) deciding whether action should be taken; and, (iii) if User decides action is appropriate, taking that action. Proof shall have no liability for a failure to detect fraud. Proof provides Results Data “as is” and does not warrant that it is accurate, complete, or current.
- Acceptable Use.
3.1 Acceptable and Prohibited Uses.
(a) Purpose. The Services and Results Data are provided solely for identity verification, authentication, and fraud-prevention purposes.
(b) No FCRA Use. User shall not use the Services or Results Data as a factor in establishing any individual’s eligibility for credit, insurance, employment, housing, or any other purpose described in § 1681b of the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (“FCRA”), and shall not use any output to take an “adverse action” as that term is defined by the FCRA.
(c) No CRA Status / No Consumer Reports. Proof is not a Consumer Reporting Agency (“CRA”) and does not furnish consumer reports as that term is used under the FCRA (“Consumer Report”). User will not (i) represent any output as a Consumer Report, (ii) combine or use outputs to create or furnish a Consumer Report, or (iii) use Results Data derived from a data provider’s records, databases, or screening services, rather than from a credential the individual presented, in any way that is regulated by the FCRA.
(d) Other Legal Considerations. Where Results Data includes data governed by the Gramm–Leach–Bliley Act, 15 U.S.C. § 6801 et seq. (“GLBA”), the Driver’s Privacy Protection Act, 18 U.S.C. § 2721 et seq. (“DPPA”), or a state biometric-information law such as the Illinois Biometric Information Privacy Act, 740 ILCS 14 et seq. (“BIPA”), such Results Data is provided solely for identity verification, authentication, and fraud-prevention in connection with User’s legitimate business needs.
(e) Prohibited Uses (GLBA/DPPA/BIPA). User shall not use GLBA, DPPA, or BIPA-governed data for marketing, profiling, or any other purpose restricted by those statutes, implementing regulations, or other restrictions communicated by Proof.
(f) Evolving Legal Requirements. User will comply with any new or amended law or regulation that Proof reasonably determines limits or conditions use of Results Data, and will promptly implement any restrictions, safeguards, or process changes communicated in writing by Proof.
(g) Geographic Access Controls. User will not access Results Data from an IP address outside the United States or its territories.
(h) Records Retention. User will maintain for five (5) years complete and accurate records of its access to and use of Results Data sufficient to demonstrate compliance with this Agreement and applicable law.
(i) Misuse Notification. User will immediately notify Proof in writing if it suspects, has reason to believe, or confirms that any Account ID, Results Data, or data derived (directly or indirectly) from Results Data has been lost, stolen, compromised, misused, or accessed by an unauthorized person or for any purpose other than legitimate business reasons.
(j) Notices, Consents, and Lawful Basis. User shall provide all required notices and obtain all necessary consents and authorizations under applicable law for: (i) the transfer of User Data to Proof and its vendors/subprocessors; (ii) the processing of such User Data by Proof and its vendors under the Agreement; and (iii) access by Proof or its vendors to Customer Proprietary Network Information (as defined in the Telecommunications Act), where applicable.
(k) Sanctions Compliance Representation. User represents that neither it nor any of its shareholders, directors, officers, or principals is (1) organized in, located in, or a citizen of a country and region subject to comprehensive U.S. embargo or similar sanctions, or (2) listed on the U.S. Department of the Treasury’s Specially Designated Nationals (SDN) or Blocked Persons lists (or any similar restricted-party list).
(l) Monitoring, Verification, and Audit Cooperation. Proof, or a data provider acting through Proof, may monitor usage and review records as reasonably necessary to safeguard data and verify compliance with this Section 3.1. User will cooperate with reasonable compliance inquiries from Proof or its data providers and provide information demonstrating adherence.
(m) Remedies. Without limiting other remedies and in addition to the termination rights in the General Terms, Proof, in its reasonable discretion, may terminate the Agreement with User immediately to prevent additional non-compliance.
(n) Data Providers. Proof’s data providers are intended third-party beneficiaries of this Section 3.1 and may enforce it directly against User.
3.2 Gramm-Leach-Bliley Act. Results Data may contain consumer identification information governed by GLBA. In accordance with the GLBA, User certifies that such information will only be used for the following purposes:
(a) Fraud detection and prevention purposes including use to protect against or prevent actual or potential fraud, unauthorized transactions, claims or other liability;
(b) Completion of a transaction authorized by User including but not limited to the collection of delinquent accounts;
(c) Application Verification including but not limited to (i) employment application verification (however, Results Data cannot be used to make an employment decision as outlined in the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.)), (ii) property leasing application information verification (however, Results Data cannot be used for making a leasing decision as outlined in the FCRA (15 U.S.C. § 1681 et seq.)), and (iii) insurance application information verification (however, Results Data cannot be used for making a decision to insure an individual or business as outlined in the FCRA (15 U.S.C. § 1681 et seq.)). User represents and warrants that Results Data will not be used for purposes governed by the FCRA;
(d) Law firm and attorney functions including use by persons, or their representatives, holding a legal or beneficial interest relating to User;
(e) Insurance purposes including (i) account administration, (ii) reporting, (iii) fraud prevention, (iv) premium payment processing, (v) claim processing and investigation, (vi) benefit administration, or (vii) research projects;
(f) Required institutional risk control programs including complying with federal, state, or local laws, rules, and other applicable legal requirements; and
(g) Dispute resolution for resolving customer disputes or inquiries.
3.3 Driver’s Privacy Protection Act. Results Data may contain driver’s license and motor vehicle registration information subject to the protections of the DPPA. In accordance with DPPA, User certifies that such information will only be used for the following purposes:
(a) Use in the normal course of business, to verify the accuracy of personal information submitted by User and, if the submitted information is incorrect, to obtain correct information, but only for the purpose of preventing fraud by, or pursuing legal remedies against, or recovering on a debt or security interest against, User (18 U.S.C. § 2721 (b)(3));
(b) Use by court or other government agency or entity, acting directly on behalf of a government agency (18 U.S.C. § 2721 (b)(1));
(c) Use for any matter regarding motor vehicle or driver safety or theft; to inform an owner of a towed or impounded vehicle (18 U.S.C. § 2721 (b)(2));
(d) Use in connection with a civil, criminal, administrative, or arbitral proceeding (18 U.S.C. § 2721 (b)(4));
(e) Use by an employer or its agents or insurer to obtain or verify information relating to a holder of a commercial driver’s license that is required under the Commercial Motor Vehicle Safety Act of 1986 (18 U.S.C. § 2721 (b)(9));
(f) Use by an insurer or insurance support organization, in connection with claims investigation activities, antifraud activities, rating or underwriting (18 U.S.C. § 2721 (b)(6));
(g) Use by a licensed private investigative agency, or licensed security service, for a purpose permitted in items (a) through (f) above (18 U.S.C. § 2721 (b)(8)); and
(h) For use in connection with the operation of private toll transportation facilities (18 U.S.C. § 2721(b)(10)).
- Indemnification. User will indemnify, defend, and hold Proof, its affiliates and their officers, directors, employees, agents and representatives harmless from and against any and all costs, damages, liabilities or expenses (including reasonable attorneys’ fees) arising from any third-party claims resulting from (a) use of Results Data received by User (or any third party receiving such information from or through User) furnished by or through Proof; and (b) any unauthorized third-party access to or processing of any Results Data received by User (or any third party receiving such information from or through User) furnished by or through Proof.