Equifax Subscriber Terms

Last Updated: February 24, 2025

These AVA Credit - Equifax Subscriber Terms (the "Equifax Subscriber Terms") are entered into by and between you ("Subscriber") and FINVIN AI INC. dba Autocorp ("VAB").

SUBSCRIBER ACKNOWLEDGES AND AGREES THAT: (A) BY EXECUTING THE MASTER SERVICES AGREEMENT BETWEEN SUBSCRIBER AND VAB ("MSA"), SUBSCRIBER WILL RECEIVE, THROUGH VAB, THE EQUIFAX INFORMATION SERVICES (AS DEFINED BELOW), (B) SUCH SERVICES WILL BE SUBJECT TO THE VALUE-ADDED BROKER AGREEMENT ("VAB AGREEMENT") BETWEEN VAB AND EQUIFAX INFORMATION SERVICES LLC ("EQUIFAX"), THE MSA, AND THE TERMS DESCRIBED IN THESE EQUIFAX SUBSCRIBER TERMS (COLLECTIVELY, THE "AGREEMENT"), AND (C) IF SUBSCRIBER DOES NOT AGREE TO THESE EQUIFAX SUBSCRIBER TERMS, SUBSCRIBER MAY NOT ACCESS OR USE THE EQUIFAX INFORMATION SERVICES.

1. General Agreement

1. Scope of these Equifax Subscriber Terms.

These Equifax Subscriber Terms consist of the general terms set forth in the body of these Equifax Subscriber Terms, Part 1 (State Compliance Matters), Part 2 (Equifax Information Services Additional Terms and Conditions) and Part 3 (Notice to Users of Consumer Reports: Obligations of Users Under the FCRA).

If there is a conflict between the general terms and conditions and any Part, the provisions of the Part will govern and control. These Equifax Subscriber Terms apply to every kind of information, software or service provided by Equifax to VAB for provision to Subscriber (collectively, the "Equifax Services" or "Equifax Information Services," consisting of "Equifax Information").

2. Users.

Equifax Information Services will be requested only for Subscriber's exclusive use.

3. FCRA Certification.

Subscriber certifies that it will order Equifax Information Services that are consumer reports, as defined by the Federal Fair Credit Reporting Act, 15 U.S.C. 1681 et. seq., as amended (the "FCRA"), only when Subscriber intends to use the consumer report:

in accordance with the FCRA and all state law FCRA counterparts, and
for one of the following FCRA permissible purposes:
- in connection with a credit transaction involving the consumer on whom the consumer report is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer;
- in connection with the underwriting of insurance involving the consumer;
- as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation;
- when Subscriber otherwise has a legitimate business need for the information either in connection with a business transaction that is initiated by the consumer, or to review an account to determine whether the consumer continues to meet the terms of the account;
- for employment purposes.

4. Access.

Subscriber is responsible for providing and installing all hardware and software at its facilities necessary to access the Equifax Information Services through VAB. Subscriber shall request assistance from VAB with defining hardware or software needs or configuring Subscriber's ingestion of the Equifax Information within the Equifax Services. Equifax will provide reasonable consultation as needed.

5. License of Information.

Equifax grants a non-exclusive license to Subscriber to use the Equifax Services and associated Equifax Information only as described in these Equifax Subscriber Terms. Subscriber may reproduce or store the Equifax Information solely for its own uses in accordance with these Equifax Subscriber Terms, and will hold all Equifax Information licensed under these Equifax Subscriber Terms in strict confidence and will not reproduce, reveal or make it accessible in whole or in part, in any manner whatsoever, to each other or any others unless required by law;

provided, however, that Subscriber, as applicable, may discuss information in a consumer report with the subject of that consumer report when Subscriber has taken adverse action against the subject based on the consumer report.

Subscriber will not provide a copy of the consumer report to the consumer, unless required by law or approved in writing by Equifax, except where this contractual prohibition would be invalid.

Subscriber will refer the consumer to Equifax whenever the consumer disputes information in an Equifax consumer report disclosed by Subscriber.

Subscriber will not interpret the failure of Equifax to return information regarding the consumer's eligibility for a credit service as a statement regarding that consumer's credit worthiness, because that failure may result from one or more factors unrelated to credit worthiness.

6. Compliance with Laws.

Subscriber will comply with applicable federal and state laws, rules and regulations relating to such party's performance of its obligations under these Equifax Subscriber Terms including, but not limited to, all applicable state and federal consumer financial protection laws, the FCRA and state law counterparts, and the Gramm-Leach-Bliley Act. In addition, Subscriber shall not engage in any unfair, deceptive, or abusive acts or practices.

7. Audits.

In order to determine Subscriber's compliance with these Equifax Subscriber Terms, VAB, Equifax or its designated representative shall have the right, from time to time, to:

upon reasonable notice to Subscriber, enter into Subscriber's facilities during normal business hours, and conduct on-site audits of Subscriber's practices and procedures relating to Subscriber's request for and use of consumer reports;
conduct audits by mail, email or similar electronic means that may require Subscriber to provide documentation regarding permissible purposes for particular consumer reports ordered by Subscriber.

Subscriber shall promptly provide Equifax with copies of or access to all requested documents and records and use reasonable efforts to otherwise cooperate with Equifax in all such audits.

8. Processing Locations.

For the purposes of this section, "Processing" means accessing (including access to view), transmitting, using or storing the Information Services and all information and data provided or obtained through use of the Information Services (the "Equifax Information").

Subscriber may Process the Equifax Information from the United States, Canada, and the United States territories of American Samoa, Guam, the Northern Mariana Islands, Puerto Rico, and the U. S. Virgin Islands (collectively, the "Permitted Territory").

Subscriber must notify Equifax directly or through VAB at least thirty (30) days prior to Processing the Equifax Information from a location outside of the Permitted Territory, in accordance with the notice requirements described in this Agreement. Equifax reserves the right to deny any such request for reasons including, without limitation, regulatory requirements, security concerns, or existing contractual obligations.

Notwithstanding the foregoing, Subscriber is prohibited from Processing Equifax Information from an Embargoed Country. "Embargoed Country" means any country or geographic region subject to comprehensive economic sanctions or embargoes administered by OFAC or the European Union.

9. Service Providers.

Except with respect to VAB, Subscriber must notify Equifax directly or through VAB at least thirty (30) days prior to utilizing a third party, including a cloud service provider, to process, transmit, or store the Equifax Information (each, a "Service Provider") in accordance with the notice requirements described in these Equifax Subscriber Terms.

Equifax reserves the right to deny the use of a Service Provider for reasons including, without limitation, regulatory requirements, security concerns, existing contractual obligations or failure of such Service Provider to execute such agreements with Equifax as Equifax may require.

Subscriber will monitor Service Providers to ensure compliance with the security requirements of these Equifax Subscriber Terms.

Notwithstanding anything to the contrary herein, Subscriber will at all times be responsible for and remain liable to Equifax for any and all damages of any kind or nature whatsoever that may arise from or relate to the acts or omissions of Service Provider.

2. Pricing

Subscriber will be charged for the Equifax Information Services by VAB, which is responsible for paying Equifax for the Equifax Information Services, inclusive of product fees, taxes and regulatory recovery fees.

3. Termination of Services

1. Either VAB or Equifax may, in its own discretion, immediately suspend or terminate Subscriber's access to the Equifax Services based on a reasonable belief that Subscriber has:

Either VAB or Equifax may, in its own discretion, immediately suspend or terminate Subscriber's access to the Equifax Services based on a reasonable belief that Subscriber has:

violated applicable law or regulation, including the FCRA,
materially breached the terms of these Equifax Subscriber Terms, or
violated the "Data Security" Section of these Equifax Subscriber Terms.

VAB's or Equifax's reasonable belief for purposes of the foregoing right may be premised upon Subscriber's failure to provide requested or sufficient documentation pursuant to, or otherwise frustrate any audit or review permitted under, the "Audit" Section or otherwise under these Equifax Subscriber Terms.

2. Notwithstanding anything to the contrary in these Equifax Subscriber Terms, if the continued provision of all or any portion of the Equifax Services becomes impossible, impractical, or undesirable due to:

Notwithstanding anything to the contrary in these Equifax Subscriber Terms, if the continued provision of all or any portion of the Equifax Services becomes impossible, impractical, or undesirable due to:

a change in applicable federal, state or local laws or regulations,
maintenance of products and services with current industry standards as determined by Equifax in its reasonable judgment,
circumstances imposed by Equifax's third party vendors or data sources, or
a change in Equifax's policies relating to compliance with law and/or data security,

Equifax may either:

cease to provide the affected services within, or pertaining to persons residing within, the affected jurisdiction, or
establish new prices which will apply to the affected services when provided or delivered within, or pertaining to persons residing within, the affected jurisdiction, which prices will be reasonably calculated to cover the costs incurred by Equifax in complying with the applicable laws or regulations or circumstances imposed by third party vendors and will become effective on the date specified in such notice unless Subscriber objects in writing, in which case Equifax may exercise its rights under clause (a) above.

Equifax will attempt to provide written notice of its actions to VAB as far in advance of the effective date as is reasonably possible under the circumstances.

Termination or suspension of the Equifax Services pursuant to this Section shall not relieve VAB of its obligation to pay all fees that have accrued or are otherwise owed to Equifax for Subscriber's usage of the Equifax Services.

4. Warranty, Indemnification and Limitation of Liability

1. Disclaimer.

Subscriber shall employ decision-making processes appropriate to the nature of the transaction and in accordance with industry standards, and Subscriber will use the Equifax Services only for the purposes set forth in the terms stated in these Equifax Subscriber Terms. Subscriber is solely responsible for all results of its use of the Equifax Services.

TO THE MAXIMUM EXTENT ALLOWABLE BY LAW, ALL EQUIFAX SERVICES AND EQUIFAX INFORMATION ARE PROVIDED BY EQUIFAX THROUGH VAB ON AN "AS-IS," AS-AVAILABLE BASIS, AND EQUIFAX, AND ITS DATA PROVIDERS AND SUPPLIERS HEREBY DISCLAIM ANY AND ALL PROMISES, REPRESENTATIONS, GUARANTEES, AND WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WITH RESPECT TO THE ACCURACY, COMPLETENESS, CURRENTNESS, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE, OF THE EQUIFAX SERVICES AND EQUIFAX INFORMATION.

IN NO EVENT WILL EQUIFAX, OR ITS DATA PROVIDERS AND SUPPLIERS BE LIABLE TO SUBSCRIBER FOR ANY LOSS OR INJURY RELATING TO, ARISING OUT OF, OR CAUSED IN WHOLE OR IN PART BY, ITS ACTS OR OMISSIONS, EVEN IF NEGLIGENT, RELATING TO THE ACCURACY, CORRECTNESS, COMPLETENESS, OR CURRENTNESS OF THE EQUIFAX SERVICES OR EQUIFAX INFORMATION.

Subscriber recognizes that accessing Equifax's consumer credit database with additional information or different identification information on a consumer, or at a different time from a prior request for information, may result in file content different from that on the date of the original access.

2. Indemnification.

Subscriber shall indemnify, defend, and hold harmless Equifax and its affiliates and their respective directors, officers, and employees from, and against, any loss, damage, cost, liability, and expense (including reasonable attorneys' fees) (collectively, "Losses"), arising from or relating to the investigation, defense, settlement, or satisfaction of claims or causes of action alleged, or asserted by, a third party or investigations, allegations or enforcement actions asserted by government regulators to the extent arising out of or relating to:

Subscriber's use of the Equifax Services or associated Equifax Information by Subscriber in any manner other than as expressly permitted by the terms in these Equifax Subscriber Terms or the terms stated in the MSA or otherwise provided specific to one or more Equifax Services;
the use, operation, or combination of the Equifax Services with software, data, equipment, specifications, or materials not provided by Equifax;
any breach by Subscriber of the terms in these Equifax Subscriber Terms relating to confidentiality, data security, or compliance with laws;
any personal injury or death, or damage to, or loss of, tangible property to the extent caused by Subscriber's wrongful acts;
Subscriber's willful misconduct.

3. Damages Exclusions and Limitation of Liability.

IN NO EVENT WILL EQUIFAX BE LIABLE TO SUBSCRIBER UNDER ANY THEORY OR CIRCUMSTANCE FOR LOST REVENUES OR INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, NOR SHALL EQUIFAX'S LIABILITY UNDER THESE EQUIFAX SUBSCRIBER TERMS OR WITH REGARD TO THE EQUIFAX SERVICES, FOR ANY AND ALL CLAIMS ARISING OUT OF, OR RELATED TO, THESE EQUIFAX SUBSCRIBER TERMS OR THE EQUIFAX SERVICES, EXCEED THE AMOUNT ACTUALLY RECEIVED BY EQUIFAX FROM VAB FOR SUBSCRIBER'S ORDERS OF THE EQUIFAX SERVICE CONNECTED WITH THE EVENT WHICH GAVE RISE TO LIABILITY.

5. Confidentiality

Except as otherwise set forth in the terms and conditions of these Equifax Subscriber Terms, Subscriber and Equifax, through its agreement with VAB, acknowledge that all other materials and information disclosed by a party ("Discloser") to the other party ("Recipient") in connection with the performance of these Equifax Subscriber Terms, including the terms of these Equifax Subscriber Terms and any pricing terms, consist of confidential and proprietary data (collectively, the "Confidential Information").

Each Recipient will hold the Confidential Information in strict confidence, and will restrict its use of Confidential Information to the purposes anticipated in these Equifax Subscriber Terms.

If the law or legal process requires Recipient to disclose Confidential Information, Recipient will notify the Discloser of the request unless legally prohibited from providing such notification to afford Discloser the opportunity to seek, at Discloser's sole cost and expense, a protective order or other remedy. Thereafter, the Discloser may seek a protective order or waive the confidentiality requirements of these Equifax Subscriber Terms, provided that Recipient may only disclose the minimum amount of information necessary to comply with the requirement.

Recipient will not be obligated to hold confidential any information from the Discloser which:

is or becomes publicly known through no breach of the Recipient,
is received from any person or entity who, to the best of Recipient's knowledge, has no duty of confidentiality to the Discloser,
was already known to Recipient prior to the disclosure, and that knowledge was evidenced in writing prior to the date of the other party's disclosure, or
is independently developed by the Recipient without using any of the Disclosers Confidential Information.

The rights and obligations of this Section V:

with respect to confidential and proprietary data that constitutes a "trade secret" (as defined by applicable law), which includes without limitation all consumer report information received through the Equifax Information Services, will survive the termination of these Equifax Subscriber Terms for so long as such Confidential Information remains a trade secret under applicable law; and
with respect to all other Confidential Information, will survive the termination of these Equifax Subscriber Terms for the longer of two (2) years from termination, or the confidentiality period required by applicable law.

Each party acknowledges that unauthorized disclosure or use of the Confidential Information by a party may irreparably damage the other party in such a way that adequate compensation could not be obtained from damages in an action at law. Accordingly, the actual or threatened unauthorized disclosure or use of any Confidential Information shall give the Discloser the right to seek injunctive relief restraining such unauthorized disclosure or use, in addition to any other remedy otherwise available (including reasonable attorneys' fees).

Each party hereby waives the posting of a bond with respect to any action for injunctive relief.

6. Data Security

This Section applies to any means through which Subscriber orders or accesses the Equifax Services. For the purposes of this Section, "Authorized User" means a Subscriber employee, contractor or agent that Subscriber has authorized to order or access the Equifax Services and who is trained on Subscriber's obligations under the terms of these Equifax Subscriber Terms with respect to the ordering and use of the Equifax Services and all Equifax Information, including Subscriber's FCRA and other obligations with respect to the access and use of consumer reports.

Subscriber shall maintain an information security program ("Program") that includes appropriate administrative, technical and physical safeguards (collectively, "Controls") reasonably designed to:

ensure the security and confidentiality of the Equifax Services and associated Equifax Information;
protect against any anticipated threats or hazards to the security or integrity of such information;
protect against unauthorized access to or use of such information; and
dispose of the Equifax Information from the Services in a secure manner.

Subscriber agrees that its Program has been developed in alignment with commercially recognized frameworks. Subscriber agrees that it will maintain the Program throughout the term of the agreement under which it accesses and uses Equifax Services, and that the Program includes written documentation of the Controls. Subscriber will monitor compliance with the obligations of this Section, and will immediately notify VAB and Equifax if Subscriber suspects or knows of any unauthorized access or attempt to access the Equifax Services.

Subscriber will, with respect to handling the Equifax Information:

ensure that only Authorized Users can order or have access to the Equifax Services and take all necessary measures to prevent unauthorized ordering of or access to the Equifax Services or Equifax Information by any person other than an Authorized User for permissible purposes, including, without limitation, limiting the knowledge of the Subscriber security codes, member numbers, User IDs, and any passwords Subscriber may use to those individuals with a need to know. In addition, the User IDs must be unique to each person, and the sharing of User IDs or passwords is prohibited,
ensure that Authorized Users are trained not to order consumer reports for personal reasons or provide consumer reports to third parties except as permitted by these Equifax Subscriber Terms and that any unauthorized access or use of consumer reports may subject them to civil and criminal liability under the FCRA, punishable by fines and imprisonment,
ensure that secure authentication practices are utilized when accessing the Equifax Information Services, including but not limited to restricting access based on Authorized User location and only permitting access to the Equifax Information Services through Subscriber approved devices,
ensure that Equifax Information is encrypted in transit with Advanced Encryption Standard (AES)-256 or an equivalent or better National Institute of Standards and Technology (NIST) approved cypher,
use commercially reasonable efforts to secure Equifax Information at rest, including:
- encrypting all Equifax Information at rest in accordance with industry accepted encryption standards;
- separating Equifax Information from the Internet or other public networks by firewalls configured to meet industry accepted best practices;
- protecting Equifax Information through multiple layers of network security, including but not limited to, industry-recognized firewalls, routers, and intrusion detection/prevention devices (IDS/IPS);
- securing access (both physical and network) to systems storing Equifax Information;
- patching servers on a timely basis with appropriate security-specific system patches, as they are available,
ensure that:
- all hard copy Equifax Information is stored in a secure manner;
- Equifax Information, including electronic and hard copy information, is securely destroyed when no longer needed for the Equifax Information Services;
- maintain documented policies to ensure compliance with the foregoing,
not allow Equifax Information to be displayed via the Internet unless utilizing, at a minimum, a three-tier architecture configured in accordance with industry best practices,
use commercially reasonable efforts to establish procedures and logging mechanisms for systems and networks that will allow tracking and analysis in the event there is a compromise, and maintain an audit trail history,
provide prompt notification to Equifax of any change in address or office location where Equifax Information Services are or will be accessible, which location is subject to an onsite visit of the new location by Equifax or its designated representative, and
in the event Subscriber has a Security Incident involving Equifax Information, Subscriber will notify Equifax as soon as possible, but in no event more than twenty-four (24) hours following the Security Incident, and:
- fully cooperate with Equifax in a security assessment process;
- promptly remediate any finding; and
- take all necessary actions to prevent a recurrence.
For purposes of this Section "Security Incident" means any suspected or actual breach, theft or unauthorized access, use, misuse, theft, vandalism, modification or transfer of or to Equifax Information Services or Equifax Information.

If Equifax reasonably believes Subscriber has violated this Section, Equifax may, in addition to any other remedy authorized by these terms, with reasonable advance written notice to Subscriber and at Equifax's sole expense, conduct, or have a third party conduct on its behalf, an audit of Subscriber's facilities, security practices and procedures to the extent Equifax reasonably deems necessary, including an on-site inspection, to evaluate Subscriber's compliance with the data security requirements of this Section.

7. Miscellaneous

1. Assignment.: Equifax may assign its benefits under the terms of this Part or any rights or obligations under these Equifax Subscriber Terms to an entity that is controlled by, controls or is under common control with Equifax. Otherwise, neither these Equifax Subscriber Terms, nor any rights or obligations under it may be assigned or transferred, by operation of law or otherwise, by Subscriber or Equifax without the written consent of the other, which consent shall not be unreasonably withheld.
2. Waiver of Jury Trial.: Equifax and Subscriber hereby waive the right to trial by jury of any action, suit, proceeding, dispute, claim or controversy arising out of or relating to these Equifax Subscriber Terms or Equifax Services.
3. Notices.: Notices must be in writing, must be delivered according to clause (a) or (b) below, and must be delivered to Equifax, Attn: Contract Administration, 1550 Peachtree Street, NW, Atlanta, GA 30309 and to Subscriber through VAB or at the address set forth on the Equifax application for service provided by VAB, or to such other address as either party may designate by notice in accordance with this provision. All notices under these Equifax Subscriber Terms will be deemed given on the date of delivery:

by a nationally recognized overnight courier, or

by certified mail, return receipt requested.
4. Force Majeure.: Neither Subscriber nor Equifax will be liable to the other by reason of any failure or delay of performance, whether foreseen or unforeseen, hereunder (except failure to pay any amount when due) if such failure arises out of causes beyond the non-performing party's reasonable control, including, but not limited to, governmental action, emergency regulations, sabotage, riots, vandalism, labor strikes or disputes, acts of God (e.g., fire, flood inclement weather, epidemic, or earthquake), war or act of terrorism, electrical failure, mechanical failure, major computer hardware or software failures, equipment delivery delays, or acts of third parties.
5. Applicable Law.: These Equifax Subscriber Terms will be governed and interpreted by the laws of the State of Delaware, without regard to principles of conflicts of law.
6. Third Party Beneficiary.: Subscriber and VAB acknowledge and agree that Equifax is a third party beneficiary with rights to fully enforce the terms set forth in these Equifax Subscriber Terms. Subscriber and VAB further acknowledge and agree that Equifax's rights with respect to these Equifax Subscriber Terms unconditional rights that shall survive the termination for any reason.

Part 1 - State Compliance Matters

California Retail Seller Compliance

Provisions of the California Consumer Credit Reporting Agencies Act specifically, as amended effective July 1, 1998, will impact the provision of consumer reports to Subscriber if Subscriber is a "retail seller" under California law and Subscriber intends to request consumer reports from Equifax about consumers applying in person for credit.

California Civil Code § 1802.3 defines a "retail seller" as "a person engaged in the business of selling goods or services to retail buyers," defined in §1802.4 as "a person who buys goods or obtains services from a retail seller in a retail installment sale and not principally for the purpose of resale".

Under the foregoing circumstances, before delivering a consumer report to Subscriber, Equifax must match at least three items of a consumer's identification within the file maintained by Equifax with the information provided to Equifax by Subscriber in connection with the in-person credit transaction. Compliance with this law further includes Subscriber's inspection of the photo identification of each consumer who applies for in-person credit, mailing extensions of credit to consumers responding to a mail solicitation at specified addresses, taking special actions regarding a consumer's presentment of a police report regarding fraud, and acknowledging consumer demands for reinvestigations within certain time frames.

If Subscriber is a "retail seller" and intends to request consumer reports from Equifax about consumers applying in person for credit, Subscriber certifies that it will instruct its employees and agents to inspect a photo identification of the consumer at the time an application is submitted in person. If Subscriber is not currently, but subsequently becomes a "retail seller," Subscriber agrees to provide written notice to Equifax prior to ordering credit reports in connection with an in-person credit transaction, and agrees to comply with the requirements of the California law as outlined in this Section, and with the specific certifications set forth herein.

Subscriber certifies and agrees that, as a "retail seller" who intends to request consumer reports from Equifax about consumers applying in person for credit, it will either:

acquire a new customer number for use in processing consumer report inquiries that result from in-person credit applications covered by California law, with the understanding that all inquiries using this new customer number will require that Subscriber supply at least three items of identifying information from the applicant; or
contact Subscriber's Equifax sales representative to ensure that Subscriber's existing number is properly coded for these transactions.

Vermont Fair Credit Reporting Compliance

Provisions of the Vermont Fair Credit Reporting Statute, 9 V.S.A. § 2480e, as amended (the "VFCRA") and applicable Vermont Rules (specifically, CVR 06-031-012 Rule CF 112 - Fair Credit Reporting, CF 112.03 Consumer Consent ("Applicable Vermont Rules")), prohibit Subscriber from obtaining credit reports, as defined by the VFCRA, without prior consumer consent specific to the purpose for which such credit report is being ordered as specified in VFCRA § 2480e and Applicable Vermont Rules.

If Subscriber designated above that Subscriber does not comply with these provisions of the VFCRA and Applicable Vermont Rules by obtaining the requisite consumer consent from Vermont consumers, then provision of credit reports, as defined by the VFCRA, to Subscriber will be impacted.

If Subscriber designated above that Subscriber is in compliance with VFCRA § 2480e and Applicable Vermont Rules, Subscriber shall provide notice to Equifax should its ability to certify compliance with VFCRA § 2480e and Applicable Vermont Rules has changed.

Reviews by Equifax pursuant to the section of these Equifax Subscriber Terms authorizing reviews or audits of Subscriber's permissible purpose to obtain consumer reports shall require, as applicable, evidence of specific consumer consent obtained from Vermont consumers as required by the VFCRA and Applicable Vermont Rules.

PART 2 – Equifax Information Services Additional Terms and Conditions

This Part 2 contains additional terms and conditions that apply to the Equifax Information Services that may be provided under the MSA and other special terms and conditions that may affect the provision of Equifax Information Services to Subscriber. Subscriber agrees to abide by these additional terms and conditions and special terms and conditions that apply to those Equifax Information Services.

1. Terms and Conditions for Credit Score Information Services other than FICO® Risk Score, Classic.

a. Disclosure of Scores.

Subscriber will hold all information received from Equifax in connection with any Credit Score Information Services received from Equifax under this Agreement in strict confidence and will not disclose that information ("Scores") to the consumer or to others except as required by law or as explicitly permitted in these Equifax Subscriber Terms. Subscriber may provide the principal factors contributing to the Scores to the subject of the report when those principal factors are the basis of Subscriber's adverse action against the subject consumer. Subscriber must describe the principal factors in a manner which complies with Regulation B of the ECOA.

b. ECOA Statements.

Subject to the terms below, Equifax reasonably believes that, (1) the scoring algorithms used in the computation of the Scores are empirically derived from consumer credit information from Equifax's consumer credit reporting database, and are demonstrably and statistically sound methods of rank ordering candidate records from the Equifax consumer credit database for the purposes for which the Credit Score Information Services were designed particularly (as stated in these Equifax Subscriber Terms for each particular Credit Score Information Service), and each is intended to be an "empirically derived, demonstrably and statistically sound credit scoring system" as defined in Regulation B; and (2) the scoring algorithms comprising the Credit Score Information Services, except as permitted, do not use a "prohibited basis," as such phrase is defined in Regulation B. This section and Equifax's statements herein are contingent on Subscriber's use of the Score for the purpose for which it was designed, in compliance with the Agreement. Subscriber must validate the Credit Score Information Services on its own records. Subscriber will be responsible for meeting its requirements under the ECOA and Regulation B and will not use any Score in any manner that violates any fair lending laws.

c. Release.

Equifax does not guarantee the predictive value of the Scores with respect to any individual, and does not intend to characterize any individual as to credit capability. Neither Equifax nor its directors, officers, employees, agents, subsidiary and affiliated companies, or any third-party contractors, licensors or suppliers of Equifax will be liable to Subscriber for any damages, losses, costs or expenses incurred by Subscriber resulting from any failure of a Score to accurately predict the credit worthiness of Subscriber's applicants or customers. In the event the Credit Score Information Services were not correctly applied by Equifax to any credit file, Equifax's sole responsibility will be to reprocess the credit file through the Credit Score Information Services at no additional charge.

2. Additional Terms and Conditions Applicable to Fair Isaac Scores.

In addition to the terms and conditions contained in the Agreement, the following additional terms also govern the use by Subscriber of credit risk Scores or insurance risk Scores of Fair Isaac Corporation ("FICO Scores"):

a.

From time to time, Subscriber may request that Equifax provide FICO Scores, for, in each case, one of the following internal decisioning purposes requested:

in connection with the review of a consumer report it is obtaining from Equifax;
for the review of the portion of its own open accounts and/or closed accounts with balances owing that it designates;
as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation;
for use as a selection criteria to deliver a list of names to Subscriber, or Subscriber's designated third party processor agent;
for transactions not initiated by the consumer for the extension of a firm offer of credit or insurance;
with respect to the insurance risk scores only for use in connection with the underwriting of insurance involving the consumer.

Subscriber shall use each such FICO Score only once and, with respect to FICO Scores, only in accordance with the permissible purpose under the FCRA for which Subscriber obtained the FICO Score.

b.

Subscriber acknowledges that the FICO Scores are proprietary and that Fair Isaac retains all its intellectual property rights in the FICO Scores and the Models (defined below) used by Equifax to generate the FICO Scores. Fair Isaac grants to Subscriber, effective during the term of the MSA, a personal, non-exclusive, non-transferable, limited license to use, internally, the FICO Scores solely for the particular purpose set forth in Section 1 above for which the FICO Scores were obtained, including, but not limited to the single use restrictions set forth above. Subscriber's use of the FICO Scores must comply at all times with applicable federal, state and local law and regulations, and Subscriber hereby certifies that it will use each FICO Score only for a permissible purpose under the FCRA. Subscriber shall not attempt to discover or reverse engineer the FICO Scores, Models or other proprietary information of Fair Isaac, or use the FICO Scores in any manner not permitted, including, without limitation, for resale to third parties, model development, model validation (except as expressly set forth above with respect to Archive Scores), model benchmarking, or model calibration. "Model" means Fair Isaac's proprietary scoring algorithm(s) embodied in its proprietary scoring software delivered to and operated by Equifax.

3. Additional Terms and Conditions Applicable to VantageScore.

Subscriber will request VantageScores only for Subscriber's exclusive use. Subscriber may store VantageScores solely for Subscriber's own use in furtherance of Subscriber's original purpose for obtaining the VantageScores. Subscriber shall not use the VantageScores for model development or model calibration, except in compliance with the following conditions:

the VantageScores may only be used as an independent variable in custom models;
only the raw archived Score and Score segment identifier will be used in modeling (i.e. no other Score information including, but not limited to, adverse action reasons, documentation, or scorecards will be used);
Subscriber's depersonalized analytics and/or depersonalized third party modeling analytics performed on behalf of Subscriber, using VantageScores, will be kept confidential and not disclosed to any third party other than as expressly provided for below in subsections (ii), (iii), (iv), (v) and/or (vi) of this paragraph.

Subscriber shall not reverse engineer the Score. All VantageScores provided hereunder will be held in strict confidence and may never be sold, licensed, copied, reused, disclosed, reproduced, revealed or made accessible, in whole or in part, to any Person, except:

to those employees, agents and independent contractors of Subscriber with a need to know and in the course of their employment;
to those third party processing agents and other contractors of Subscriber who have executed an agreement that limits the use of the VantageScores by the third party only to the use permitted to Subscriber and contains the prohibitions at least as restrictive as set forth herein regarding model development, model calibration, reverse engineering and confidentiality;
when accompanied by the corresponding reason codes, to the consumer who is the subject of the VantageScore (provided that, accompanying reason codes are not required to the extent permitted by law);
to government regulatory agencies;
to ratings agencies, dealers, investors and other third parties for the purpose of evaluating assets or investments (e.g. securities) containing or based on obligations of the consumers to which the VantageScores apply (e.g. mortgages, student loans, auto loans, credit cards), provided that, as it relates to this subsection (v), (a) Subscriber may disclose VantageScores only in aggregated formats (e.g. averages and comparative groupings) that do not reveal individual VantageScores, (b) Subscriber shall not provide any information that would enable a recipient to identify the individuals to whom the VantageScores apply, and (c) Subscriber shall enter into an agreement with each recipient that limits the use of the Score to evaluation of such assets or investments;
as required by law.

Subscriber agrees that the trademarks, trade names, product names, brands, logos, and service marks ("Vantage Marks") for VantageScores and VantageScore credit scoring models will remain the sole property of VantageScore Solutions, LLC. Subscriber obtains a limited, non-exclusive, nontransferable, royalty free license to use and display the Vantage Marks in connection with the activities solely permitted by these Equifax Subscriber Terms. The use of the Vantage Marks under the preceding license is limited to use only in connection with the Services covered by these Equifax Subscriber Terms, and the Subscriber expressly agrees not to use the Vantage Marks in connection with any products or services not covered by these Equifax Subscriber Terms. Any use of the Vantage Marks is subject to VantageScore Solutions, LLC's prior written authorization. Subscriber further agrees it will include the Vantage Marks in all advertising and marketing materials which reference the VantageScores or Vantage models and it will comply with the VantageScore Trademark Policy and Brand Guidelines, which may be changed from time to time upon written notice. All use of the Vantage Marks will accrue solely to the benefit of VantageScore Solutions, LLC.

4. Prequalification Services Terms and Conditions.

Subscriber agrees the following terms and conditions for Prequalification Services:

a. Permissible Purpose and Subscriber FCRA Certification.

Subscriber acknowledges that the Prequalification Information constitutes consumer reports as defined by the FCRA. Subscriber certifies that it will request the Prequalification Information only when it has a permissible purpose, as specified in the FCRA, which permissible purpose for the Prequalification Information is the express written instructions of the Consumer to obtain the Prequalification Information for the sole purpose of the Prequalification Program. Subscriber certifies that it will use the Prequalification Information only in accordance with (i) all applicable law, including the FCRA and all state law FCRA counterparts, (ii) the written instructions of the Consumer, (iii) the Agreement, including applicable Schedule or URL (such as these Equifax Subscriber Terms), and the restrictions and conditions contained herein.

b. Limitations on Access and Use.

Subscriber will use the Prequalification Information solely to determine whether the Consumer satisfies the credit and/or insurance underwriting criteria of certain policies and programs requested by the Consumer in the Prequalification Program and for no other purpose. Subscriber shall not reuse the Prequalification Information in any manner, including with respect to any additional transactions for the Consumer, including, without limitation, marketing, credit or insurance underwriting, or any use that results, in whole or in part, in the issuance of credit or a binding insurance policy or other coverage, or any other secondary use, regardless of whether Subscriber has obtained consumer authorization for such use. In the event that Subscriber discloses one or more preapproved offers to the Consumer via its Prequalification Program and the Consumer opts to apply for such offer(s), Subscriber (i) shall not use the Prequalification Information to complete the application, and (ii) will obtain a new credit report from Equifax in connection with the application.

c. Targeting Prohibited.

Subscriber shall not use of any of the Prequalification Information to specifically target Consumers of any other creditors or insurers or tailor any offers to Consumers based on the presence of any particular creditor(s) or insurers in the Prequalification Information. Additionally, Subscriber shall not store any Prequalification Information that specifically identifies a Consumer in the prequalification process as having or potentially having one or more open accounts with any specific creditors or insurers. A violation of this Section is a material breach of the Agreement and Equifax may immediately terminate or suspend the provision of Prequalification Information based on a reasonable belief that Subscriber has violated this Section.

d. Consumer Authorization, Disclosures, Privacy Policy.

Prior to requesting any Prequalification Information, Subscriber shall first obtain, capture, and archive the properly authenticated Consumer's express authorization (i.e., written instructions) to obtain the Prequalification Information from Equifax for purpose of the Prequalification Program. Subscriber shall also provide appropriate disclosures to Consumers on the scope of their authorization. In no event will Subscriber seek consent of the Consumer to utilize the Prequalification Information for any purpose not permitted or prohibited in these terms and conditions for Prequalification Services pursuant to this Section 4 of these Equifax Subscriber Terms. Subscriber agrees that it will not pursue any steps to determine eligibility after the consumer withdraws consent. Subscriber shall adopt, publish, maintain and adhere to a privacy policy that clearly discloses to Consumers that information may be shared with third party service providers for completing the relevant Prequalification Program transaction and upon request from Equifax, provide Equifax with a copy of Subscriber's privacy policy.

e. Consumer Authentication Required.

Subscriber must use commercially reasonable methods for authenticating the Consumer and verifying identity as well as for identifying fraudulent Prequalification Program requests consistent with industry standards for consumer authentication and fraud detection and prevention before requesting Prequalification Information, and shall reject any requests for the Prequalification Program that do not pass such authentication and fraud detection measures.

f. Adverse Action.

In the event that the Consumer does not qualify for the credit or insurance programs of the Prequalification Program, Subscriber will comply with all applicable laws and regulations requiring adverse action notification to the Consumer (including the provisions of the FCRA, ECOA, all state law counterparts of each, and all applicable regulations promulgated under any of them). In no event will Subscriber seek or attempt to charge the Consumer any fees or other charges for accessing any Equifax Information that the consumer is entitled to receive under applicable law or regulation.

g. Program Review.

Subscriber agrees that prior to Equifax providing Prequalification Information to Subscriber, Subscriber will cooperate with and complete Equifax's review process, if requested by Equifax (in its sole discretion) ("Program Review"), which may include review of Subscriber's proposed consumer authorization and disclosures and any other applicable consumer terms and conditions, review of Subscriber's process I data flow and a description of Subscriber's intended use ("Program Documentation"). Subscriber further agrees that following the Program Review, if Equifax requires notice and approval of certain Prequalification Program changes, Subscriber will not change or update such aspects of its Prequalification Program (including consumer consents and disclosures) or Program Documentation without first reviewing such changes with Equifax. Notwithstanding, Subscriber acknowledges that it is solely responsible for determining the legality of its Prequalification Program, including any component of the Program Documentation, and that Equifax's review does not constitute Equifax's agreement that Subscriber's Prequalification Program or Program Documentation complies with applicable law, nor does it relieve Subscriber of its obligation to perform its own independent review to ensure that its Prequalification Program and Program Documentation fully complies with any applicable contractual, legal or regulatory requirements.

h. No Unauthorized Representations.

Subscriber will make no representations or warranties on behalf of Equifax or relating to the Prequalification Information except as authorized in writing by Equifax. Upon request, Subscriber will provide its terms and conditions of use applicable to a prequalification or any Prequalification Program to Equifax for review.

i. Additional Terms and Conditions for Internet-Based Prequalification Programs.

In the event Subscriber receives one or more FICO Scores as part of the Prequalification Information and the Pricing Terms and Conditions set forth in the ordering document or other pricing agreement between Equifax and Subscriber include pricing for "Internet-Based Prequalification", Subscriber agrees that such pricing is only applicable in connection with (i) a Prequalification Program for a Consumer engaged in an online Internet-based user experience (and no other channels), (ii) in accordance with the Consumer's written consent or instructions as set forth in Section 5 (above), and (iii) for Subscriber's internal use solely for Prequalification Program of a potential consumer customer for the Subscriber's own internal lending offering.

3. Additional Terms and Conditions Applicable to VantageScore.

the VantageScores may only be used as an independent variable in custom models;
only the raw archived Score and Score segment identifier will be used in modeling (i.e. no other Score information including, but not limited to, adverse action reasons, documentation, or scorecards will be used);
Subscriber's depersonalized analytics and/or depersonalized third party modeling analytics performed on behalf of Subscriber, using VantageScores, will be kept confidential and not disclosed to any third party other than as expressly provided for below in subsections (ii), (iii), (iv), (v) and/or (vi) of this paragraph.

to those employees, agents and independent contractors of Subscriber with a need to know and in the course of their employment;
to those third party processing agents and other contractors of Subscriber who have executed an agreement that limits the use of the VantageScores by the third party only to the use permitted to Subscriber and contains the prohibitions at least as restrictive as set forth herein regarding model development, model calibration, reverse engineering and confidentiality;
when accompanied by the corresponding reason codes, to the consumer who is the subject of the VantageScore (provided that, accompanying reason codes are not required to the extent permitted by law);
to government regulatory agencies;
to ratings agencies, dealers, investors and other third parties for the purpose of evaluating assets or investments (e.g. securities) containing or based on obligations of the consumers to which the VantageScores apply (e.g. mortgages, student loans, auto loans, credit cards), provided that, as it relates to this subsection (v), (a) Subscriber may disclose VantageScores only in aggregated formats (e.g. averages and comparative groupings) that do not reveal individual VantageScores, (b) Subscriber shall not provide any information that would enable a recipient to identify the individuals to whom the VantageScores apply, and (c) Subscriber shall enter into an agreement with each recipient that limits the use of the Score to evaluation of such assets or investments;
as required by law.

4. Prequalification Services Terms and Conditions.

Subscriber agrees the following terms and conditions for Prequalification Services:

a. Permissible Purpose and Subscriber FCRA Certification.

b. Limitations on Access and Use.

c. Targeting Prohibited.

d. Consumer Authorization, Disclosures, Privacy Policy.

e. Consumer Authentication Required.

f. Adverse Action.

g. Program Review.

h. No Unauthorized Representations.

i. Additional Terms and Conditions for Internet-Based Prequalification Programs.

5. Special Procedures for Employee Investigations

Section 603(x) provides special procedures for investigations of suspected misconduct by an employee or for compliance with Federal, state or local laws and regulations or the rules of a self-regulatory organization, and compliance with written policies of the employer. These investigations are not treated as consumer reports so long as the employer or its agent complies with the procedures set forth in Section 603(x), and a summary describing the nature and scope of the inquiry is made to the employee if an adverse action is taken based on the investigation.

6. Obligations of Users of Medical Information

Section 604(g) limits the use of medical information obtained from consumer reporting agencies (other than payment information that appears in a coded form that does not identify the medical provider). If the information is to be used for an insurance transaction, the consumer must give consent to the user of the report or the information must be coded. If the report is to be used for employment purposes - or in connection with a credit transaction (except as provided in federal regulations) - the consumer must provide specific written consent and the medical information must be relevant. Any user who receives medical information shall not disclose the information to any other person (except where necessary to carry out the purpose for which the information was disclosed, or as permitted by statute, regulation, or order).

7. Obligations of Users of "Prescreened" Lists

The FCRA permits creditors and insurers to obtain limited consumer report information for use in connection with unsolicited offers of credit or insurance under certain circumstances. Sections 603(1), 604(c), 604(e), and 615(d). This practice is known as "prescreening" and typically involves obtaining from a CRA a list of consumers who meet certain preestablished criteria. If any person intends to use prescreened lists, that person must (1) before the offer is made, establish the criteria that will be relied upon to make the offer and to grant credit or insurance, and (2) maintain such criteria on file for a three-year period beginning on the date on which the offer is made to each consumer. In addition, any user must provide with each written solicitation a clear and conspicuous statement that:

Information contained in a consumer's CRA file was used in connection with the transaction.
The consumer received the offer because he or she satisfied the criteria for credit worthiness or insurability used to screen for the offer.
Credit or insurance may not be extended if, after the consumer responds, it is determined that the consumer does not meet the criteria used for screening or any applicable criteria bearing on credit worthiness or insurability, or the consumer does not furnish required collateral.
The consumer may prohibit the use of information in his or her file in connection with future prescreened offers of credit or insurance by contacting the notification system established by the CRA that provided the report. The statement must include the address and toll-free telephone number of the appropriate notification system.

In addition, the CFPB has established the format, type size, and manner of the disclosure required by Section 615(d), with which users must comply. The relevant regulation is 12 CFR 1022.54.

8. Obligations of Resellers

1. Disclosure and Certification Requirements

Section 607(e) requires any person who obtains a consumer report for resale to take the following steps:

Disclose the identity of the end-user to the source CRA.
Identify to the source CRA each permissible purpose for which the report will be furnished to the end-user.
Establish and follow reasonable procedures to ensure that reports are resold only for permissible purposes, including procedures to obtain:
1. the identity of all end-users;
2. certifications from all users of each purpose for which reports will be used; and
3. certifications that reports will not be used for any purpose other than the purpose(s) specified to the reseller. Resellers must make reasonable efforts to verify this information before selling the report.

2. Reinvestigations by Resellers

Under Section 611(f), if a consumer disputes the accuracy or completeness of information in a report prepared by a reseller, the reseller must determine whether this is a result of an action or omission on its part and, if so, correct or delete the information. If not, the reseller must send the dispute to the source CRA for reinvestigation. When any CRA notifies the reseller of the results of an investigation, the reseller must immediately convey the information to the consumer.

3. Fraud Alerts and Resellers

Section 605A(f) requires resellers who receive fraud alerts or active duty alerts from another consumer reporting agency to include these in their reports.

9. Liability for Violations of the FCRA

Failure to comply with the FCRA can result in state government or federal government enforcement actions, as well as private lawsuits. Sections 616, 617, and 621. In addition, any person who knowingly and willfully obtains a consumer report under false pretenses may face criminal prosecution. Section 619.

The CFPB's website, www.consumerfinance.gov/learnmore, has more information about the FCRA, including publications for businesses and the full text of the FCRA.

Citations for FCRA sections in the U.S. Code, 15 U.S.C. § 1681 et seq.:

Section 602 15 U.S.C. 1681

Section 603 15 U.S.C. 1681a

Section 604 15 U.S.C. 1681b

Section 605 15 U.S.C. 1681c

Section 605A 15 U.S.C. 1681cA

Section 605B 15 U.S.C. 1681cB

Section 606 15 U.S.C. 1681d

Section 607 15 U.S.C. 1681e

Section 608 15 U.S.C. 1681f

Section 609 15 U.S.C. 1681g

Section 610 15 U.S.C. 1681h

Section 611 15 U.S.C. 1681i

Section 612 15 U.S.C. 1681j

Section 613 15 U.S.C. 1681k

Section 614 15 U.S.C. 1681l

Section 615 15 U.S.C. 1681m

Section 616 15 U.S.C. 1681n

Section 617 15 U.S.C. 1681o

Section 618 15 U.S.C. 1681p

Section 619 15 U.S.C. 1681q

Section 620 15 U.S.C. 1681r

Section 621 15 U.S.C. 1681s

Section 622 15 U.S.C. 1681s-1

Section 623 15 U.S.C. 1681s-2

Section 624 15 U.S.C. 1681t

Section 625 15 U.S.C. 1681u

Section 626 15 U.S.C. 1681v

Section 627 15 U.S.C. 1681w

Section 628 15 U.S.C. 1681x

Section 629 15 U.S.C. 1681y