This licence agreement (Licence) comprises these terms and any other terms agreed and set out in the Order Form for the Solution (Solution Order Form), and is a legal agreement between the person or entity set out in the Solution Order Form (you and your) and ACRE PLATFORMS LIMITED, a company incorporated in England and Wales with company number 11508306 whose registered office is at Samuel House, 6 St Alban’s Street, 4th Floor, London SW1Y 4SQ (Acre).
Acre allows your Authorised Users to use the Solution on your behalf subject to the terms of this Licence. Acre does not sell the Solution (or any of its Intellectual Property Rights therein) to you. Acre and its licensors remain the owners of the Solution at all times.
USE OF THE SOLUTION IS STRICTLY SUBJECT TO THE TERMS OF THIS LICENCE AND YOU AGREE THAT THE TERMS OF THIS LICENCE WILL BIND YOU AND YOUR AUTHORISED USERS WHEN YOU USE THE SOLUTION. FOR THE AVOIDANCE OF DOUBT, THE TERMS OF THIS LICENCE WILL CONTINUE TO APPLY TO ANY ACRE CONTENT PROCESSED BY YOU OR YOUR AUTHORISED USERS FOLLOWING EXPIRY OR TERMINATION OF THIS LICENCE. THE TERMS OF THIS LICENCE INCLUDE, IN PARTICULAR, LIMITATIONS ON LIABILITY IN CLAUSE 12.
IF YOU DO NOT AGREE TO THE TERMS OF THIS LICENCE, NEITHER YOU NOR YOUR AUTHORISED USERS MAY USE THE SOLUTION.
You should save and print a copy of this Licence for future reference.
DEFINITIONS & INTERPRETATION
1.3 Where Acre allows your Authorised Users to use the Solution on your behalf without, or in advance of, the Solution Order Form being entered into, then all such use shall be deemed to be use on a trial basis for a limited period (as determined by Acre at its sole discretion) only, subject to these terms.
(a) other than as permitted by this Licence, commercialise by way of service offering or otherwise, to or for any third party, the Solution (in whole or part); or
(b) develop, promote or resell any solution that competes with the Solution.
2.3 Acre shall have the right to update and revise the terms of this Licence from time to time by giving you not less than 14 days’ notice.
3.1 In consideration of the Fees, Acre agrees to provide the Support Services in respect of the Solution.
3.2 Acre does not warrant that use of the Solution will be uninterrupted or error-free.
3.3 You will provide Acre with all reasonable assistance required by Acre in the provision of the Support Services and to enable Acre to perform its relevant obligations under this Licence.
3.4 You acknowledge that Acre may utilise non-dedicated infrastructure, virtualised infrastructure and/or private networks when providing the Solution, and that Acre is entitled to reconfigure the set-up of the Production Environment at any time provided that it does not materially reduce the functionality of the Solution or its ability to meet performance requirements.
Third Party Services
3.6 If you are required to enter into a Direct Agreement with a Third Party Service Provider then you:
(a) shall notify Acre immediately if the Direct Agreement expires or is terminated; and
(b) hereby indemnify Acre against any loss or damage that Acre suffers or incurs as a result of you not having a Direct Agreement in place or any breach of such Direct Agreement.
3.7 Acre will notify you as soon as reasonably practicable if Acre is no longer able to provide any of the Third Party Services and Acre shall reflect any revised Third Party Fees in the following invoice.
3.8 You acknowledge that any hypertext links to other websites, extranets or portals provided via the Solution do not constitute an endorsement or warranty in relation to the content therein and that you and your Authorised Users shall access and use the Third Party Services and links at your own risk.
3.9 You undertake that you and your Authorised Users shall comply with all policies and procedures which may be required by Third Party Service Providers, and to enter into all necessary documentation required by Third Party Service Providers in order to receive the Third Party Services.
(a) you assume sole responsibility for advice and/or recommendations provided to your Customers in using the Solution; and
(b) you are responsible for compliance with all laws or regulations concerning your business, including, but not limited to, the rules of the FCA or any other regulations, requirements, stipulations or conditions made by any professional or regulatory organisation to which you or your Authorised Users may be subject from time to time; and
(c) Acre shall have no liability for any loss or damage arising from any processing of the Broker Data or the Customer Data by Acre at the direction of you or your Authorised Users.
and Acre reserves the right, without liability or prejudice to its other rights, to immediately disable access to any material that breaches the provisions of this clause 5.3.
Acre may remove any offending material and/or suspend access to all or part of the Solution as reasonably necessary to effect such removal.
6.2 The Third Party Fees will be payable in accordance with the Solution Order Form only where:
(a) use of the Solution is deemed by Acre to be use outside of Fair Use; and/or
(b) the Solution is not being used, or Acre suspects that the Solution is not being used, in accordance with the terms of this Licence.
6.3 Unless otherwise specified in the Solution Order Form, Acre shall invoice you at the end of each calendar month for the Fees and you will pay the Fees to Acre without deduction or set-off, by bank transfer in GBP, within 30 days of the date of Acre’s invoice.
6.4 If the Licence terminates for any reason at any time prior to expiry of the Minimum Period, then Acre shall be entitled to invoice you for any Fees that would have otherwise been payable by you during the Initial Free Period and you shall pay such invoiced amount to Acre without deduction or set-off, by bank transfer in GBP, within 30 days of the date of Acre’s invoice.
6.5 If you fail to make any payment due to Acre by the due date (other than a payment which is the subject of a bona fide dispute), then, without prejudice to any of its other rights or remedies, Acre may:
(a) charge you interest on the overdue sum from the due date until payment of the overdue sum, whether before or after judgement, interest at a rate of 4% per year above the Bank of England’s base rate from time to time, but at 4% a year for any period when the base rate is below 0%; and/or
(b) suspend access to all or part of the Solution if any undisputed sum is not paid within 30 days of its due date, until such time as the undisputed some has been paid.
except that prior to any disclosure pursuant to this clause 7.4, the Recipient shall notify the Disclosing Party and shall give the Disclosing Party an opportunity to participate in objecting to the production of the Confidential Information (to the extent practicable and permissible).
(i) passes a resolution for winding-up or is subjected to a judgment or order issued by any court of competent jurisdiction ordering the sale, winding-up or other liquidation or dissolution procedure of the other party; or
8.3 Acre may, without prejudice to its other rights or remedies or to the other termination rights identified in this Licence, terminate this Licence with immediate effect at any time during the Term by written notice to you if there is a change of Control within you.
12.1 All warranties, representations, undertakings, conditions or terms which may be implied or incorporated into this Licence by law, custom, trade usage or otherwise are hereby expressly excluded to the maximum extent permitted by law (including any implied warranties, representations, undertakings, conditions or terms of merchantability, satisfactory quality or fitness for a particular purpose).
12.2 Nothing in this Licence shall exclude or limit Acre’s liability for:
12.3 Other than in respect of clauses 12.2, and subject to clauses 12.4 - 12.7 (inclusive), Acre’s maximum aggregate liability to you or any of your Authorised Users, whether in contract, tort (including for negligence or breach of statutory duty howsoever arising), misrepresentation (whether innocent or negligent), restitution or otherwise, arising out of or in connection with the performance or contemplated performance of this Licence or any collateral contract, shall in respect of any and all acts, omissions, defaults or events be limited to £5,000 (or an amount equal to the Solution Fees paid by you to Acre in the immediately preceding period of 12 months, if greater).
12.4 Acre will not in any circumstances be liable to you whether in contract, tort (including for negligence and breach of statutory duty howsoever arising), misrepresentation (whether innocent or negligent), restitution or otherwise, for:
in each case, whether or not Acre has been notified of the possibility or likelihood of such loss or damage occurring.
12.5 Acre shall not be liable for any loss or damage if and to the extent resulting from any of the following:
in each case, whether or not Acre has been notified of the possibility or likelihood of such loss or damage occurring.
12.6 You acknowledge that Acre has no direct control over the availability of bandwidth over the entirety of the internet and that Acre shall not be responsible for any delay or failure caused by unavailability of bandwidth over networks not under Acre’s ownership or reasonable control.
12.7 For the avoidance of doubt, if any of the exclusions set out in each of clauses 12.4 – 12.6 (inclusive) is not upheld, the limit on liability at clause 12.3 shall apply.
(a) the data controller of any personal data processed pursuant to any use of the Acre Customer Portal by the Customer; and
(b) the joint controller (with you) of any personal data processed pursuant to any use of the Solution where Acre or its Group Company determines the purposes and means of such processing.
Nothing in this Licence is intended to create a partnership or joint venture or legal relationship of any kind between the parties that would impose liability upon one party for the act or failure to act of the other party, or to authorise either party to act as agent for the other. Save where expressly stated in this Licence, neither party shall have authority to make representations, act in the name or on behalf of, or otherwise to bind, the other.
Except as expressly stated in this Licence, a person who is not a party to this Licence shall have no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Licence.
Any change to this Licence shall only be valid if it is agreed in writing on behalf of Acre by its duly authorised representative.
Acre Content means any proprietary information, including but not limited to data, databases, reports, charts, graphs, tools, software, source code, documentation and other materials that are made available to you or your Authorised Users;
Acre Customer Portal means the web application made available at https://portal.myac.re or any other such location that enables a Customer to access, update and otherwise interact with the information held in the Solution and/or Platform.
Authorised Users means users authorised by you to use the Solution on your behalf (each, an Authorised User);
Broker Data means any information relating to a case or transaction which is not considered Customer Data and any other information provided by you which does not relate to a Customer.
Confidential Information means any information which is disclosed by one party to the other party whether before or after the commencement of the Term, which is designated in writing as confidential or would appear to a reasonable person to be confidential including but not limited to information regarding a party's business, affairs, operations, customers, processes, budgets, pricing policies, products information, strategies, developments, trade secrets, know-how, design rights, market opportunities, personnel, plans or intentions, suppliers, other contracting parties, or other persons in respect of whom a confidentiality obligation may arise of the party disclosing it, and all information derived from any of the above together with the provisions of this Licence, and the negotiations relating to the same;
Control means that a person owns directly or indirectly more than 50% of the shares or securities of the other person representing the right to vote on all or substantially all matters including the election of directors (and Controls and Controlled shall be construed accordingly);
Customers means any of your customers or potential customers who uses the Solution or Acre Customer Portal directly or who receive financial products or advice from you or your Authorised Users using the Solution (each, a Customer);
Customer Data means information relating to an individual, that is held within the Solution for the purpose of advising in connection with and/or providing that individual with financial services and/or any related service;
Fair Use means use of the Solution in the ordinary course to collect Customer information, perform “know your customer” and anti-money laundering checks, pull credit report information, and make product recommendations for products whose sale is recorded in the Solution. For the avoidance of doubt, any use of the Solution to prepare business for submission where the sale is not recorded in the Solution shall be deemed to be use outside of Fair Use;
FCA means the United Kingdom Financial Conduct Authority or its successor;
Fees means the Solution Fees and the Third Party Fees;
Force Majeure Event means an event which is beyond the reasonable control of Acre including an event which falls into one or more of the following categories: strike, lockout, work stoppages, slow-downs or any other labour dispute; act of God, fire, flood and storm; war, military action, riot, civil commotion, terrorism, epidemic or pandemic; explosion or malicious damage; nuclear, chemical or biological contamination or sonic boom; compliance with a law or governmental order, rule, regulation or direction coming into force after the date of this Licence;
Group Company means a subsidiary company or holding company of the party concerned, or a subsidiary company of such holding company, all as defined in section 1159 of the Companies Act 2006, and Group Companies shall be construed accordingly;
Initial Free Period means any initial free period set out in the Solution Order Form;
Intellectual Property Rights means: (i) patents, utility models, supplementary protection certificates, petty patents, inventions (whether patentable or not), registered designs, rights in copyright (including authors' and neighbouring or related insert "moral" rights), database rights, design rights, semiconductor topography rights, mask work rights, trade marks and service marks; (ii) all registrations or applications to register any of the items referred to in paragraph (i); and (iii) all rights in the nature of any of the items referred to in paragraphs (i) or (ii) including continuations, continuations in part and divisional applications, reputation, personality or image, trade names, business names, brand names, get-up, logos, domain names and URLs, rights in unfair competition and, without prejudice to anything set out elsewhere in this definition, rights to sue for passing off and all rights having equivalent or similar effect to, and the right to apply for any of, the rights referred to in this definition in any jurisdiction;
Minimum Period means any minimum period set out in the Solution Order Form;
Password means the unique password assigned to each Authorised User that permits access to the Solution;
Platform means the Acre platform, created, hosted and maintained by or on behalf of Acre, and any successor platform thereto, that is used as the underlying infrastructure, data store, processing environment, and shared services for the delivery of multiple solutions, including the Solution;
Production Environment means the combination of hardware, software, telecommunications links, Platform and network connections and other material used by Acre to provide the Solution for access by you;
Reports means individual data analysis reports, including, without limitation, summary of activities performed, charts and graphs generated by the Solution pursuant to data parameters requested by you or an Authorised User;
Solution means Acre’s proprietary customer relationship management solution for mortgage brokers (including all software and services which are made available through, or which form part of, the Solution from time to time), together with any enhancements and modifications thereto, and any accompanying materials;
Solution Fees means the fees payable by you for access to the Solution, as set out in and/or calculated pursuant to the Solution Order Form;
Support Services means any error corrections and/or modifications, documentation, or testing to be provided by Acre with respect to the Solution in accordance with Acre’s standard support policy in force from time to time;
Term means the term of this Licence, as specified under clause 8 hereunder;
Termination Notice Period means the termination notice period set out in the Solution Order Form or, if no such notice period specified in the Solution Order Form, then 30 days’ notice;
Third Party Data means any data (including financial data), information or software sourced from a third party and made available through, or which forms part of, the Solution;
Third Party Fees means the fees payable (if any) by you at Acre’s prevailing re-charge rates from time to time for access to certain Third Party Services (which may include fees for any administration in respect of such access), the current re-charge rates being those set out in and/or calculated pursuant to the Solution Order Form;
Third Party Service Provider means a third party service provider who provides Third Party Services;
Third Party Services means access to Third Party Data and access to any other software or services which are provided by, or on behalf of, a third party and which are made available through, or which form part of, the Solution.
Amazon Web Services (AWS)
The Third Party Terms subject to which the Third Party Services provided by Amazon Web Services (AWS) are provided are available at https://aws.amazon.com/service-terms/ as updated from time to time.
The Third Party Terms subject to which the Third Party Services provided by Equifax are provided are set out below:
Agreement means the agreement between us and the Reseller under which we make available to the Reseller certain data services for resupply to end users;
Applicable Laws means all applicable laws, enactments, rules, regulations, orders, regulatory policies, regulatory permits and licences, and any mandatory instructions or requests of a regulator, in each case which are in force from time to time, including:
Customer means any person to whom the Reseller supplies any of the Information Services … and shall include any Customer Group Participants …;
Customer Group Participants means any members of the Customer’s group who are entitled to benefit from the Services, as approved by Equifax in writing from time to time;
Information Services means the services that you are authorised to receive via the Reseller that are provided to the Reseller under the Agreement;
Output Data means any information or data provided by us as part of the Information Services;
Reseller means the third party through whom you are authorised to access the Information Services;
us and we means Equifax Limited; and
you has the meaning in the application form set out above these terms and shall include and Customer Group Participants where applicable.
1. Confidentiality: use and non-disclosure of Output Data
1.1 You shall use the Output Data only as permitted by paragraph 4 below or as otherwise permitted by the Reseller and shall not engage in any business involving the supply of any Output Data, or any information derived from any Output Data, to any other person.
1.2 Unless expressly permitted by the Reseller, you may not disclose to any other person any of the Output Data, except:
1.2.1 when required to do so by law or any regulatory authority; or
1.2.2 to your personnel whose duties reasonably require such disclosure, on condition that you ensure that each such person to whom such disclosure is made: (a) is informed of your obligation of non-disclosure and (b) complies with that obligations as if they were bound by it.
1.3 You shall maintain adequate security measures to protect the integrity, security and confidentiality of all Output Data (including complying with Equifax’s security requirements and policies).
2. Applicable Laws
2.1 You shall comply at all times with the Applicable Laws.
2.2 You shall provide to us any information we may from time to time reasonably request in order for us to determine whether your use and possession of the Output Data is in compliance with the Applicable Laws.
2.3 We may cease to make the Output Data available to the Reseller for resupply to you if your response to any request we may make as contemplated by paragraph 2.2 above does not satisfy us that your use and possession of the Output Data is in compliance with the Applicable Laws
2.4 The use of some types of the Output Data require you to be a member of the relevant “closed user group” and enter into, and comply with, any applicable closed user group agreements.
2.5 In utilising any Output Data, you are acting as a data controller and, as such must comply with all the obligations on a data controller imposed under the Data Protection Act 2018.
3.1 Before using any Information Services to obtain information relating to a natural person you shall notify the person that: (a) information which the person gives you may be disclosed to a credit reference agency, which may keep a record of that information; and (b) the credit reference agency may disclose that information, and the fact that a search was made, to its other customers for the purposes of assessing the risk of giving credit and occasionally to prevent fraud, money laundering and to trace debtors. You shall give the notification to the person in writing, unless doing so would unreasonably interfere with your activities. On our request you shall send us a copy, or transcript, of the notification you use.
3.2 To the extent that you are able to do so, you grant us a perpetual, royalty free right to record the information referred to in paragraph 3.1(a) for the purposes referred to in paragraph 3.1(b).
3.3 The Reseller will notify you of the search type or types you are entitled to carry out when using the Information Services. We may from time to time change the search types which you are entitled to carry out. The Reseller will notify you in writing of any such changes in reasonable time before the change becomes effective. You shall ensure that you understand which search type code we require you to use for each kind of search you carry out using the Information Services and you shall ensure that you use the correct search type code at all times when using the Information Services.
4. Permitted Use
4.1 You shall not use the Output Data for any purpose other than: (a) prevention of money laundering; or (b) ID verification.
5. Limitation of liability
5.1 You acknowledge: (a) that most of the Output Data is provided to us by third parties which we do not control, in particular in relation to the accuracy or completeness of the Output Data; (b) that the volume and nature of the information on our databases makes it impractical for us to verify it; and (c) that, if we were to attempt to verify the Output Data, we would only be able to offer the Services to you at significantly increased cost. You agree that we shall not in any circumstances be liable for any loss or damage at all arising from any inaccuracies, faults or omissions in, or in the provision of, the Output Data unless caused by our negligence or wilful default.
5.2 You agree that we shall not in any circumstances (including without limitation if we have been negligent) be liable for (a) any indirect or consequential loss or damage at all; or (b) any loss of business, capital, profit, reputation or goodwill, arising out of or in connection with the Information Services or the Output Data.
5.3 Our entire liability in respect of any single cause of action arising out of or in connection with the Output Data or the Services (whether for breach of contract, negligence, under statute or otherwise) shall be limited to £50. You shall not be entitled to recover from us and the Reseller in respect of the same loss.
5.4 We shall not be liable for any claim arising under these terms unless you give us written notice of the claim within 3 months of becoming aware of the circumstances giving rise to the claim or, if earlier, 3 months from the time you ought reasonably to have become aware of such circumstances.
5.5 Nothing in these terms shall limit or exclude our liability for death, personal injury or fraud arising from our negligence.
5.6 Except as expressly provided in these terms, all representations, conditions and warranties whether express or implied (by statute or otherwise) are hereby excluded to the fullest extent permitted by law.
6.1 You shall allow Equifax and any advisers to Equifax to access on reasonable notice any of your premises, personnel and relevant records as may be reasonably required in order to undertake verification of your compliance with these terms.
6.2 You shall comply with your obligations as set out in any Applicable Laws, in relation to record keeping.
6.3 Subject to the obligations of confidentiality, you shall provide Equifax (and its advisers) all reasonable co-operation, access and assistance in relation to each audit.
6.4 If the audit identifies a default by you or there are reasonable grounds for Equifax to reasonably suspect a default, then without prejudice to any other rights or remedies available:
7.1 Where Customer Group Participants are entitled to benefit from the Information Services:
7.1.1 … the Customer Group Participants may only use the Information Services and Output Data for the Permitted Purposes, as if they were the Customer;
7.1.2 the Customer Group Participants shall comply with the terms of these terms as if they were the Customer;
7.1.3 the Customer shall be liable for the acts and omissions of the Customer Group Participants in respect of these terms as if they were its own acts and omissions;
7.1.4 any limitations and exclusions of liability in these terms for the benefit of Equifax shall apply to the Customer and the Customer’s Group Participants as if they were a single service recipient, including that any limit on Equifax's liability shall apply in aggregate to the Customer and all Customer Group Participants; and
7.1.5 for clarity, a company shall cease to be entitled to use the Information Services or receive Output Data if it ceases to be a member of the Customer’s Group.
7.2 Equifax may cease to supply those Information Services which relates to the provision of data if the data supply is no longer possible under any agreement Equifax has with third party suppliers. In such cases, the affected element of the Information Services shall terminate from the date on which Equifax can no longer perform the relevant Information Services.
7.2 These terms set out the entire agreement and understanding between you and us in connection with its subject matter. In particular, but without limitation to the generality of the foregoing, you warrant and represent that in entering into these terms you have not relied upon any statement of fact or opinion made by Equifax or our officers, servants or agents which has not been included expressly in these terms.
7.3 If any provision of these terms is or becomes invalid or unenforceable it will be severed from the rest of these terms so that it is ineffective to the extent that it is invalid or unenforceable and no other provision of these terms shall be rendered invalid, unenforceable or be otherwise affected.
7.4 In these terms: (a) the headings are inserted for convenience only and shall not affect their construction or interpretation; (b) unless the context requires otherwise, words importing the singular shall include the plural and vice versa; and (c) unless the context requires otherwise, references to any person include references to any human being, company, body corporate, association, joint venture, partnership, trust and any entity capable of suing and being sued.
7.5 These terms shall be governed by English law. The parties hereby submit to the exclusive jurisdiction of the English Courts.
The Third Party Terms subject to which the Third Party Services provided by Onfido are provided are set out below:
Each of the expressions Authorised User, Customer and you shall have the meaning given to it in Schedule 1 of the Licence (of which these terms form part).
Brand Features means the trade names, trademarks, logos and other distinctive brand features of the applicable party.
Content means any information, text, graphics, or other materials uploaded, downloaded or appearing as part of the Services.
Developments means the improvements to and development of Onfido’s Identity Verification Services.
Information Security Policy has the meaning attributed to it in paragraph 4.2.1.
Personal Data means any information relating to an identified or identifiable User.
Privacy Laws means any applicable rules, laws, regulations, directives and governmental requirements currently in effect and as they become effective relating to privacy or data protection.
Processing means any operation or set of operations which is performed on personal data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Reports means a summary at a user level containing one or more of the checks provided as part of the Services.
Security Breach has the meaning attributed to it in paragraph 4.4.
Software means any software provided by Onfido, including the software development kit (or SDK) and any maintenance release which is being made available as part of the Services.
Site means www.onfido.com and its subdomains.
2. DESCRIPTION OF PROCESSING
Subject Matter, Nature, and Purpose of Processing
Subject Matter, Nature, and Purpose of Processing
Duration of Processing
Duration of this contract
Categories of Personal Data
Images/video and information describing the images/video (as specified in the relevant check/process)
Telephone number (web SDK only and optional)
Content of SMS (web SDK only and optional)
IP address and associated city/country level location information
Image of the User’s face
Image of the face in the identity document
Biometric dataImage of the identity document and information describing the identity document
Video of the User
Transcribed text data from the video clip (if applicable)
Categories of Data Subjects
3. YOUR OBLIGATIONS
3.1. You agree to provide or make available to Acre or assist Acre with the collection of Personal Data. Such information includes but is not limited to the information described in paragraph 2. You consent to Acre’s Processing to provide the Services, and you represent and warrant that you have taken all required steps to ensure that Acre may lawfully obtain the Personal Data for the purpose of providing the Services in accordance with Privacy Laws (including by having obtained all necessary consents and provided all necessary notices, where required).
3.2. You are solely and fully responsible for ensuring that all Customer’s data is accurate, complete and captured in a form that Acre can process to maximise the quality of Service.
3.3. Subject to the Acre’s obligations to provide the Services with reasonable care and skill, you assume sole responsibility for conclusions drawn from use of the Services (including the Reports, the Content and the Site).
3.4. You will comply with all applicable laws and regulations (including any obligation to seek prior regulatory review, approval, or similar) with respect to its use of the Services and will not: (a) use the Services to discriminate against the Customer or in a manner that causes damage or injury to any person or property; (b) use the Services in a manner that could be reasonably expected to bring Onfido into disrepute or otherwise harm its reputation; (c) act or omit to act in a way which interferes with or compromises the integrity or security of the Services; (d) access all or any part of the Services in order to build a product or service which competes with the Services; (e) amend or remove Onfido Brand Features or “powered by Onfido” language from the Services, Site, or Software; (g) except as may be allowed by any applicable law which is incapable of exclusion by agreement between the parties: (i) attempt to copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, display, transmit, or distribute all or any portion of the Services (as applicable) in any form or media or by any means to any individual or entity, including without limitation, Customers; or (ii) attempt to reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Services; or (h) attempt to access the Services other than through the means made available to you by Onfido. Any breach of this paragraph will be deemed to be a material breach.
3.5. You acknowledge and agree the services are based on information that was not collected, in whole or in part, for the purpose of serving as a factor in establishing a consumer’s eligibility for credit or insurance to be used primarily for personal, family or household purposes, employment, or any other similar purpose. Accordingly you shall not use any services as part of its decision-making process for determining a consumer’s eligibility for credit, insurance or any other similar purpose. For the avoidance of doubt, this paragraph is not intended to prohibit you from using the Services for the purpose of verifying a Customer’s identity.
3.6. You are responsible for maintaining the confidentiality of any password(s) or security routines you are given or sets to access and use the Services, and are fully responsible for all activities that occur under the Authorised Users’ password(s) or security routines. You agree to notify Acre immediately of any accidental or unauthorised access to or use of the Services, whether suspected or confirmed. In the event of a suspected or confirmed security incident impacting Authorised User‘s use of the Services or other exigent circumstances, Acre reserves the right to immediately withdraw or suspend access to the Services and to alter the Authorised User’s password(s).
4. ACRE OBLIGATIONS
4.1. Data Processing. Acre will:
4.1.1. Process Personal Data only in accordance with this Agreement;
4.1.2. inform you if, in its opinion, an instruction from you or an Authorised User infringes any Privacy Laws;
4.1.3. not disclose or otherwise make available any Personal Data to any third party service provider acting on Acre’s behalf without first (i) imposing contractual obligations on the third party recipient that are substantially similar to those imposed on Acre under this Agreement; and (ii) including the third party service provider in Acre’s list of third party service providers before sharing any Personal Data with that third party service provider. Acre shall make the list of third party service providers available to you, and if you object to any third party service provider, you may terminate this Agreement. Acre agrees to remain liable to you for the aforementioned third party service provider’s Processing of Personal Data;
4.1.4. cooperate and assist you in responding to any Customer’s request to exercise their rights of access, rectification, erasure, restriction of Processing, data portability, objection to Processing, or any other rights available to the Customer under Privacy Laws;
4.1.5. enable you to amend, correct, or delete Personal Data;
4.1.6. where requested by you and required under Privacy Laws, provide such assistance as you reasonably require (taking into account the nature of the Processing and the information available to Onfido) for you to (i) conduct data protection impact assessments; and (ii) consult with data protection supervisory authorities;
4.1.7. take measures designed to ensure the reliability of all personnel who Process Personal Data by (i) performing background checks upon such personnel (where permissible under applicable law); (ii) assigning specific and necessity-based access privileges to such personnel; (iii) ensuring that such personnel have undergone training in data protection and privacy; and (iv) ensuring that such personnel are bound by obligations of confidentiality;
4.1.8. ensure that all Personal Data residing in the European Economic Area is not transferred out of the European Economic Area to data recipients in third countries which do not ensure an adequate level of data protection as determined by the European Commission or the Information Commissioner’s Office, unless the parties have entered into European Commission approved Standard Contractual Clauses or other data protection safeguards in compliance with Privacy Laws; and
4.1.9. provide other reasonably necessary assistance for you to meet your compliance obligations under Privacy Laws with respect to the Service.
4.2. Security Safeguards.
4.2.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons and in accordance with a comprehensive information security policy (Information Security Policy), Acre will establish, maintain and comply with administrative, physical, technical and organizational safeguards designed to ensure the security and confidentiality of Personal Data and to prevent the unauthorised disclosure of, or access to, Personal Data.
4.2.2. Acre’s Information Security Policy will: (i) implement back-up and disaster recovery systems; (ii) continuously assess risks to the security of Personal Data by (1) assessing the likelihood and potential damage of such risks, taking into account the sensitivity and risk of the Personal Data, (2) identifying internal and external threats that could result in a Security Breach, and (3) conducting penetration testing; and (iii) take appropriate steps to protect against such risks.
4.3.1. Acre will, keep at its normal place of business detailed, accurate and up-to-date records relating to the Processing of Personal Data by you.
4.3.2. Acre shall, subject to confidentiality obligations, make available to you all information … required and reasonably necessary to demonstrate Onfido’s compliance with its obligations under Privacy Laws.
4.3.3. Acre shall promptly resolve all data protection and security issues discovered by you and reported to you that reveal a breach or potential breach by Acre of any of its obligations under this Agreement or Privacy Laws.
4.4. Security Breach. In the event Acre confirms any breach of security involving its facilities, networks or systems and any unauthorised disclosure of, or access to, Personal Data (each, a Security Breach), Acre will (i) promptly notify you of the Security Breach; and (ii) provide all reasonable help for you to investigate and remedy the Security Breach.
4.5. Return or Destruction of Personal Data. When Acre no longer needs to Process Personal Data to fulfill the purposes for processing identified in this Agreement, Acre will (a) cease all use of Personal Data; and (b) destroy all Personal Data (unless storage of any Personal Data is required by applicable law, including Privacy Laws).