|
Incode Technologies Inc.
|
CLIENT ACKNOWLEDGES AND AGREES THAT THESE LICENSED SERVICES TERMS ARE AN AGREEMENT BETWEEN CLIENT AND INCODE TECHNOLOGIES, INC. (“INCODE”). YOUR USE OF INCODE’S TECHNOLOGY, SOFTWARE, PRODUCTS, AND SERVICES (COLLECTIVELY, THE “SERVICE”) IS SUBJECT TO CLIENT’S AGREED TO ALL OF THE TERMS AND CONDITIONS HEREIN.
THE MSA, TOGETHER WITH THESE LICENSED SERVICE TERMS, CONSTITUTES THE “CLIENT AGREEMENT” FOR PURPOSES HEREOF. IN THE EVENT OF ANY CONFLICTS BETWEEN THE MSA AND THESE LICENSED SERVICE TERMS, THE LICENSED SERVICE TERMS SHALL CONTROL.
1. License Grant. During the Term, Incode hereby grants Client, a nonexclusive, limited, personal, non-sublicensable, nontransferable right and license to use and access the Service, only for the internal business purposes of Client and only in accordance with Incode Documentation (as defined herein below). The Service to be used by Client shall be set up exclusively by Incode and must not be modified by Client unless previously agreed in writing by Incode. No other rights or licenses are granted except as expressly and unambiguously set forth herein. Incode Documentation means Incode’s usage guidelines and standard technical documentation for the Software, the current version of which is available at the following links or upon request to Incode:
2. License Restrictions. Client, shall not (and shall not permit any third party to), directly or indirectly: (a) reverse engineer, decompile, disassemble, or otherwise attempt to discover the underlying structure of the Service (except to the extent applicable laws specifically prohibit such restriction); (b) modify, translate, or create derivative works based on the Service; (c) transfer or encumber rights to the Service; (c) use the Service for the benefit of a third party; (d) remove or otherwise alter any proprietary notices from the Service or any portion thereof; (e) use the Service to build an application or product that is competitive with any Incode product or service; (f) interfere or attempt to interfere with the proper working of the Service or any activities conducted on the Service; (g) bypass any measures Incode may use to prevent or restrict access to the Service (or other accounts, computer systems or networks connected to the Service); (h) use the Service for the design or development of nuclear, chemical or biological weapons or missile technology, or for terrorist activity, without the prior permission of the United States government; or (i) allow any third party to remove or export from the United States or Mexico or allow the export or re-export of any part of the Software or any direct product thereof (i) into (or to a national or resident of) any embargoed or terrorist-supporting country, (ii) to anyone on the U.S. Commerce Department’s Table of Denial Orders or U.S. Treasury Department’s list of Specially Designated Nationals, (iii) to any country to which such export or re-export is restricted or prohibited, or as to which the United States government or any agency thereof requires an export license or other governmental approval at the time of export or re-export without first obtaining such license or approval or (iv) otherwise in violation of any export or import restrictions, laws or regulations of any United States or foreign agency or authority. The Software may incorporate third-party open source software (“OSS”). To the extent required by the OSS license, that license will apply to the OSS on a stand-alone basis. Client, is responsible for all of Client’s activity in connection with the Service, including but not limited to uploading Data onto the Service. Client, shall warrant that it is not located in, under the control of or a national or resident of any such prohibited country or on any such prohibited party list. Client: (A) shall use the Service in compliance with all applicable laws (including but not limited to privacy and consumer protection laws), treaties and regulations in connection with Client’s use of the Service, and (B) shall not use the Service in a manner that violates any third-party rights. This provision shall survive any expiration or termination of the Client Agreement.
3. Client Data. Client, is solely responsible for the accuracy, integrity, and legality of Client Data. Client, represents and warrants that it owns all right, title and interest in and to the Client Data or otherwise has sufficient rights to such data to permit its use as contemplated hereunder. Incode is not responsible to Client, for unauthorized access to Client Data, or the unauthorized use of the Service. The parties acknowledge and agree that any data personal and specific to an individual is owned by such individual. Client acknowledges and agrees that Incode may use the Client Data to (i) provide the Service to Client; and (ii) improving or modifying Incode´s technology (including its algorithms) for the purposes included in Incode’s privacy notice, available at https://incode.com/privacy-policy/, provided it has an appropriate legal basis from the Clients end-users’ before any end-user accesses the Service and prior to the collection of the end-users selfie and government issued identification document, (this shall be considered “Incode Data”) and (iii) freely use and make available Aggregated Anonymous Data for Incode’s business purposes (including without limitation, for purposes of improving, testing, operating, promoting and marketing Incode’s products and services) notwithstanding anything herein to the contrary. “Aggregated Anonymous Data” means data submitted to, collected by, or generated by Incode in connection with Client’s (as the case may be), use of the Service in aggregated, anonymized form which cannot be linked to Client, or identifies any individual person. This provision shall survive any expiration or termination of the Client Agreement.
4. End User Consents. Client acknowledges and agrees that the Service requires the collection of End-user consent pursuant to applicable laws, which shall be enabled and collected by Snappt (or its sub-processors) directly via consent module; if an End-user does not provide consent, such End-user shall not be permitted to upload any Data into the Service. Client will not modify or alter any consent language, features, or functionality without the written approval of Snappt and Incode.
Client will indemnify and hold Incode harmless from and against all claims, actions, suits, proceedings, demands, losses, damages, liabilities, fines, penalties, settlements, costs and expenses (including attorneys’ fees) arising from or in connection with (i) Client’s breach of this Section 4, or (ii) Client’s violation of any privacy related laws or regulations. Incode may, at its election, control all defense and settlement activities or require Client to do so. Any settlement is subject to Incode’s prior written approval (including as to the final form and content thereof).
Client will not allow the collection or processing of any data subject to the E.U. General Data Protection Regulation (GDPR) or any foreign laws or regulations without (i) providing Snappt and Incode with prior notice thereof and (ii) at Snappt or Incode’s require, executing an appropriate data protection addendum.
5. Infrastructure / Third Party services. Client, acknowledges and agrees that the Service may use services provided by third parties. Any exchange of data or other interaction between Client and a third-party provider is solely between Client, and such third party provider and is governed by such third party’s terms and conditions.
6. Suspension of Services; Effect of Termination. Incode may suspend or limit Client’s, access to or use of the Service if Client’s use of the Service results in (or is reasonably likely to result in) (i) damage to or material degradation of the Service which interferes with Incode’s ability to provide access to the Service to other Incode customers, or (ii) a breach or violation of any privacy related laws or regulations (foreign or domestic). Upon expiration or earlier termination of the Client Agreement, all license granted to Client, will cease, and Client must immediately cease using the Software and delete (or, upon request, return) all copies of the Software. Client shall delete all of Incode’s Confidential Information upon request unless required to be maintained pursuant to applicable laws, in which case it shall remain subject to this Agreement for so long as it is retained. Confidential Information may be retained in the Incode’s standard backups after deletion but will remain subject to the Agreement This provision shall survive any expiration or termination of the Client Agreement.
7. Disclaimer of Warranties. THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE” AND ARE WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, AND ANY WARRANTIES IMPLIED BY ANY COURSE OF PERFORMANCE, USAGE OF TRADE, OR COURSE OF DEALING, ALL OF WHICH ARE EXPRESSLY DISCLAIMED. INCODE DOES NOT WARRANT ANY THIRD-PARTY SERVICES OR THAT CLIENT’S OR CLIENT’S PARTNER (AS THE CASE MAY BE), USE OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE OR THAT ANY SECURITY MECHANISMS IMPLEMENTED BY THE SERVICE WILL NOT HAVE INHERENT LIMITATIONS. WITHOUT LIMITING THE FOREGOING, INCODE WILL HAVE NO LIABILITY FOR THE CLIENT-‘ DECISIONS BASED ON ANY RESPONSE DATA DERIVED FROM THE SERVICE, OR ANY OTHER INFORMATION PROVIDED TO CLIENT VIA THE SERVICE OR BY INCODE This provision shall survive any expiration or termination of the Client Agreement.
8. Limitation of Liability. EXCEPT FOR CLIENT’S BREACH OF THE LICENSE RESTRICTIONS OF THE AGREEMENT, IN NO EVENT SHALL EITHER PARTY, NOR ITS DIRECTORS, EMPLOYEES, AGENTS, PARTNERS, SUPPLIERS OR CONTENT PROVIDERS, BE LIABLE UNDER CONTRACT, TORT, STRICT LIABILITY, NEGLIGENCE OR ANY OTHER LEGAL OR EQUITABLE THEORY WITH RESPECT TO THE SUBJECT MATTER OF THE AGREEMENT (A) FOR ANY LOST PROFITS, DATA LOSS, COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR SPECIAL, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES OF ANY KIND WHATSOEVER, SUBSTITUTE GOODS OR SERVICES (HOWEVER ARISING), (B) FOR ANY BUGS, VIRUSES, TROJAN HORSES, OR THE LIKE (REGARDLESS OF THE SOURCE OF ORIGINATION), OR (C) FOR ANY DIRECT DAMAGES IN EXCESS OF (IN THE AGGREGATE) THE FEES PAID (OR PAYABLE) TO INCODE WITH RESPECT TO THE LICENSE GRANTED HEREUNDER IN THE TWELVE (12) MONTHS PRIOR TO THE EVENT GIVING RISE TO A CLAIM HEREUNDER. This provision shall survive any expiration or termination of the Client Agreement.
9. Force Majeure. Incode will not be liable for any delay or failure to perform the Service due to events beyond its reasonable control, such as a strike, blockade, war, act of terrorism, riot, infrastructure services provided by third party providers, Internet or utility failures, refusal of government license or natural disaster.
10. Government End Users. Elements of the Software are commercial computer software. If the user or licensee of the Software is an agency, department, or other entity of the United States Government, the use, duplication, reproduction, release, modification, disclosure, or transfer of the Software or any related documentation of any kind, including technical data and manuals, is restricted by the terms of the Agreement in accordance with Federal Acquisition Regulation 12.212 for civilian purposes and Defense Federal Acquisition Regulation Supplement 227.7202 for military purposes. The Software was developed fully at private expense. All other use is prohibited. This provision shall survive any expiration or termination of the Client Agreement.
11. Notices. To be effective, notices to Incode must be provided via first class or registered mail to: Incode Technologies, Inc.; 221 Main Street, Suite 520, San Francisco, CA 94105; Attn: Legal. A copy must be sent to LegalCompliance@incode.com). Such physical and email addresses may be updated by Incode on notice. Notices from Incode to Client may be provided via email to the email address Incode has on file or is otherwise able to locate.
|
|
Plaid Consumer Reporting Agency, Inc.
(Bank Account Linking -- BETA)
|
Client’s right to access and use bank account-linking functionality provided by Plaid Consumer Reporting Agency, Inc. (“Plaid”) as incorporated into Snappt’s Services (the “Plaid BaL”) is subject to the following terms (the “Plaid Terms”). In the event of any conflict between these Plaid Terms and the MSA, any Order Form, or any other agreement between Snappt and Client, these Plaid Terms shall control solely as to the Plaid BaL and Client’s use of the Plaid Services and Consumer Reports made available thereunder.
Snappt is a party to a reseller agreement with Plaid (the “Plaid Reseller Agreement”) under which Snappt operates as a “Reseller” of Plaid’s Plaid Services. The Plaid Reseller Agreement requires Snappt to obtain from each End Client (as defined below) certain covenants, representations, warranties, acknowledgments, and indemnities. Client acknowledges that it is an End Client for purposes of the Plaid Reseller Agreement and agrees to these Plaid Terms on that basis.
Client’s access to and use of the Plaid BaL is subject to Client’s completion of such compliance and registration process as Snappt reasonably requires from time to time to satisfy Plaid’s onboarding requirements applicable to end clients of Plaid’s resellers.
1. Definitions. As used in these Plaid Terms:
“API Package” means the package of application programming interface materials provided by Plaid to Snappt in connection with the Plaid Services.
“Consumer Report” means a consumer report as defined in 15 U.S.C. § 1681a(d), including any data relating to an End User included therein, deposit account verification and activity reports, and enhancements to the consumer reports.
“Delete” means to permanently and securely delete using industry-standard means.
“End Client” means Client in its capacity as an “end client” under the Plaid Reseller Agreement.
“End User” means the consumer that a Consumer Report relates to and who has permissioned Plaid’s provision of the Consumer Report.
“End User Data” means information about or of an End User provided to Plaid by an FI or other data source and made available to Client through the Plaid BaL.
“Express Consents” has the meaning set forth in Section 3(a).
“FCRA” means the Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq.
“Plaid Services” means (i) the API Package, and (ii) Consumer Reports.
“FI” means each bank, financial institution, or other data source designated by Plaid that provides End User Data to Plaid.
“FI Confidential Information” has the meaning set forth in Section 11.
“Infosec Program” has the meaning set forth in Section 9.
“Permitted Use Case” means, with respect to any End User Data, the use case for such End User Data that has been reviewed and permitted by Plaid in writing and consented to by the applicable End User.
“Permitted Users” means Client’s employees, Affiliates, agents, contractors, and service providers who are permitted by Client to access the Plaid BaL solely on Client’s behalf and for the sole benefit of Client.
“Plaid Developer Policy” means the Plaid Inc. and its subsidiaries Developer Policy available at www.plaid.com/legal, as updated from time to time.
“Plaid Privacy Policy” means Plaid’s privacy policy available at https://plaid.com/plaid-check-consumer-report/privacy-policy/, as updated from time to time.
“Security Breach” means any event that compromises Client’s systems or applications, or that does or reasonably could compromise the security, integrity, or confidentiality of End User Data, or result in its unauthorized use, disclosure, or loss.
2. Permissible Purpose; Use Limitations. Client certifies and agrees that it will request and use Consumer Reports solely for a certified permissible purpose under the FCRA and, without limiting the foregoing, solely for the tenant-screening use case identified to Snappt (and, through Snappt, to Plaid) at the time of Client’s onboarding. Client shall not request or use Consumer Reports for any other purpose, including any purpose prohibited by law. Client shall retain all Consumer Reports in strict confidence and shall disclose them only to Permitted Users whose duties reasonably relate to the legitimate business purpose for which the information was requested. Client shall not sell or otherwise distribute to any third party or other reseller any Consumer Reports or information received hereunder, except as otherwise expressly provided in these Plaid Terms or required by law. If Client changes or alters the information provided in any Consumer Report in any manner, Client waives any and all rights against Plaid and Snappt arising from or in connection therewith and agrees to indemnify Plaid, Snappt, and their respective affiliates against any and all claims related to Client’s use of that altered information. Client further certifies and agrees that it shall not, and shall not enable or assist any third party to: (a) use the Plaid Services to create, enhance, or structure any database in any form for resale or external distribution; (b) modify, translate, or create derivative works based on the Plaid Services; (c) attempt to reverse engineer (except as permitted by law), decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, or algorithms of the Plaid Services; (d) use the Plaid Services in any way that is defamatory, trade libelous, unlawfully threatening, or unlawfully harassing; (e) make the Plaid Services or any Consumer Report (or any derivative work thereof) available to, or use the Plaid Services or any Consumer Report (or any derivative work thereof) for the benefit of, anyone other than Client, End Users, and Permitted Users; (f) publicly disseminate or disclose information from any source regarding the performance of the Plaid Services; (g) attempt to create a substitute or similar service through use of, or access to, the Plaid Services; (h) use or store the Plaid Services outside of the United States; or (i) request or obtain, or permit any Permitted User to request or obtain, any Consumer Report on such Permitted User, coworkers, employees, family members, or friends, except in connection with a legitimate permissible purpose previously identified to Plaid. Client further certifies and agrees that it shall use the Plaid Services in accordance with the Plaid Developer Policy.
3. End User Consents; Notices. (a) Express Consents. Client will provide all notices and obtain all express consents from each End User as required under applicable laws in connection with Client’s use, storage, and other processing of any End User Data (such notices and consents, the “Express Consents”). Express Consents shall: (i) be clear and conspicuous; (ii) generally specify the categories of End User Data that Client will receive and how Client will use, store, and otherwise process it; (iii) be valid, enforceable, and expressly accepted by each End User; (iv) identify any and all third parties or categories of third parties to whom Client may provide End User Data for processing; (v) specify how End Users may exercise their right to revoke their Express Consent; and (vi) include any other required disclosures under applicable laws. Client will maintain records (which may include technical logs, screenshots, and versions of Express Consents obtained) to demonstrate its compliance with this Section 3(a) and will promptly provide such records to Snappt or Plaid upon request.
(b) Required Consents. Without limiting Section 3(a), Client represents, warrants, and covenants that, before requesting a Consumer Report, it has provided all notices and obtained all consents required under applicable laws, regulations, and third-party agreements for Plaid and Snappt to provide the Plaid Services and the Plaid BaL and to otherwise collect, use, and process End User data (including any identifying information such as first name, last name, and address provided to Plaid or Snappt in connection with the Plaid Services (“End User Input”)) in accordance with the Plaid Privacy Policy (as to Plaid) and the MSA (as to Snappt).
(c) Consumer Rights Notices. Client acknowledges receipt of, and agrees to be bound by, the following notices: (i) Vermont Fair Credit Reporting Statute, 9 V.S.A. § 2480e, set forth in Appendix 1 to these Plaid Terms; and (ii) each of the following notices, copies of which are available at https://plaid.com/plaid-check-consumer-report/notices-of-consumer-rights/: (A) Notice to Users of Consumer Reports: Obligations of Users Under the FCRA; (B) A Summary of Your Rights Under the Fair Credit Reporting Act; and (C) Remedying the Effects of Identity Theft. Client shall comply with the obligations of a user of consumer reports set forth therein and shall provide such notices to consumers as and to the extent required by applicable law.
4. Scope of Access; Data Use; Deletion. Client will only access End User Data for which it has obtained Express Consents from the End User for the Permitted Use Case. If Client possesses End User Data that exceeds the scope of the End User’s Express Consents, Client will Delete such End User Data. If Client becomes aware that any data it receives from Plaid (whether directly or through Snappt) does not relate to the End User for whom Client originally requested End User Data, Client will promptly notify Snappt (which will notify Plaid) and will Delete such data. Client will use, store, and otherwise process End User Data solely in accordance with the End User’s Express Consents and applicable laws.
5. Data Disclosure; No Sale; End User Deletion Requests. Client will not disclose, transfer, syndicate, or distribute End User Data to any third party (including Permitted Users) (“Data Sharing”) except in each case with the End User’s Express Consents and in accordance with applicable laws. Notwithstanding anything to the contrary, Client will not sell End User Data. Except as explicitly provided in these Plaid Terms, Client shall not disclose, disseminate, share, sublicense, resell, or otherwise redistribute the Plaid Services (or any part thereof) to any parent, subsidiary, affiliate, or other third party, except: (a) in connection with the sale of a loan to which the Plaid Services relate; (b) to the End User to whom a Consumer Report relates if an adverse action (as defined by the FCRA) has been taken based on the Plaid Services; or (c) as otherwise required by law. Client will promptly Delete any End User Data upon request by the applicable End User; provided that Client may retain copies of End User Data solely to the extent required by applicable laws.
6. No FI Attribution; No Other Access. Client will not charge End Users any fees attributable to an FI for (a) access to their End User Data or (b) use of an End User’s account with an FI in connection with the Plaid BaL. Client will not suggest or imply a partnership, sponsorship, or other relationship with an FI based on Client’s receipt of End User Data under the MSA or these Plaid Terms. Client will only access End User Data through the Plaid Services or another manner that uses the FI’s authorized APIs. Client will not “screen scrape” data from FIs or collect an End User’s log-on credentials for FI accounts, and will not otherwise knowingly obtain from a third party End User data that was originally sourced through screen scraping. Client will immediately Delete any such End User log-on credentials in its possession. Client will maintain records to demonstrate compliance with this Section 6 and will provide them to Snappt or Plaid upon request.
7. End User Authentication. Client certifies that, before requesting a Consumer Report, (a) it will verify the consumer’s identity prior to presenting the consumer with Plaid’s channel, (b) it understands that Plaid may rely on this verification, and (c) it understands and agrees that Plaid has no obligation to separately authenticate or confirm the identity of any consumer presented to the Plaid channel by Client.
8. Compliance with Laws. Client will comply with all applicable federal, state, and local statutes, regulations, and rules, including the FCRA, the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801 et seq., the California Consumer Privacy Act, and all other privacy, security, and other laws relating to End User Data. Client will not use, store, disclose, or otherwise process any End User Data for any purpose not permitted under applicable laws. For the avoidance of doubt, Client acknowledges that Section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act may include obligations on Client relating to processing, handling, and protecting End User Data. Client will maintain a program designed to ensure compliance with applicable laws, including appropriately training Client personnel. Client acknowledges that it is solely responsible for its own regulatory compliance and shall obtain any necessary licenses, certificates, permits, approvals, or other authorizations required by federal, state, or local statute, law, or regulation applicable to Client’s use of the Plaid Services. Client certifies that it is in compliance with 9 V.S.A. § 2480e and applicable Vermont Rules.
9. Information Security Program. Client will maintain a comprehensive written information security program approved by its senior management (the “Infosec Program”). The Infosec Program will include administrative, technical, and physical measures designed to: (a) ensure the security of End User Data and the Plaid Services; (b) protect against unauthorized access to or use of End User Data and the Plaid Services and anticipated threats and hazards to End User Data and the Plaid Services; and (c) ensure the proper disposal of End User Data and the Plaid Services. The Infosec Program will be appropriate to Client’s risk profile and activities, the nature of Client’s applications, and the nature of the End User Data received by Client. In any event, the Infosec Program will meet or exceed applicable control objectives captured in industry standards and best practices such as AICPA Trust Service Criteria for Security, NIST 800-53, or ISO 27002, and will comply with applicable laws. Client will use up-to-date antivirus software and anti-malware tools designed to prevent viruses, malware, and other malicious code in Client’s applications or on Client’s systems.
10. Security Breach Obligations. Client will promptly notify both Snappt and Plaid (and in no event later than twelve (12) hours after becoming aware of any Security Breach), providing a description of all known facts, the types of End Users affected, and any other information that Snappt or Plaid may reasonably request. Notice to Snappt shall be given to Snappt at legal@snappt.com (or such other address as Snappt may designate in writing from time to time), and notice to Plaid shall be given to Plaid at legalnotices@plaid.com and Plaid Consumer Reporting Agency, Inc., P.O. Box 7775 #35278, San Francisco, CA 94120, Attn: Legal (or such other address as Snappt or Plaid may designate in writing from time to time). Client will reasonably cooperate with Snappt and Plaid in investigating and remediating Security Breaches. Client will be responsible for the costs of investigating, mitigating, and remediating each Security Breach, including costs of credit monitoring, call centers, support, and other customary or legally required remediation.
11. FI Confidential Information. If Plaid or Snappt discloses to Client any confidential or proprietary materials of an FI (such materials, “FI Confidential Information”), such materials will be subject to the same obligations that apply to Plaid’s Confidential Information under these Plaid Terms and the Plaid Reseller Agreement. FI Confidential Information will also be subject to the same obligations as End User Data under Sections 3 through 6 of these Plaid Terms. Client will promptly Delete FI Confidential Information in its possession upon Snappt’s or Plaid’s request and will provide a written certification regarding such Deletion.
12. Oversight, Cooperation, and Audit; Recordkeeping. Client will promptly provide all reasonably necessary information and cooperation requested by Snappt, Plaid, any FI, or any entity with examination, supervision, or other legal or regulatory authority over Snappt, Plaid, or any FI. In the event Snappt or Plaid has a good faith reason to believe that Client is not in material compliance with these Plaid Terms, Snappt or Plaid will notify Client and, at Snappt’s or Plaid’s option, Client will promptly provide sufficient documentation to demonstrate such material compliance or submit to a third-party audit by a firm selected from a Plaid-approved list of audit firms to verify such compliance. Plaid and any FI may also conduct technical or operational assessments of Client, which will be subject to advance notice and will not occur more than once per year unless legally required and materially different in scope from a preceding audit. Where required by an FI and to the extent relevant to Client’s access or use of End User Data from that FI, Snappt or Plaid may share with such FI certain information related to Client’s compliance with these Plaid Terms, including with respect to Client’s Infosec Program (Snappt or Plaid, as applicable, will request that such FI treat any such information in a confidential manner). All consumer authorizations required by these Plaid Terms or by applicable law, together with all adverse action letters provided to consumers and consumer applications (including copies of government-issued identification needed to verify the identity of the applicant), shall be retained by Client for a reasonable period of time, but not less than five (5) years, and evidence of such documents shall be made available for inspection by Snappt, Plaid, its third-party data vendors, or its designee upon demand.
13. Insurance. Client will maintain insurance coverage appropriate to Client’s risk profile and activities, the nature of Client’s applications, and the nature of the End User Data received by Client; provided that such coverage will be no less than industry standard and will include cybersecurity liability insurance.
14. Access Frequency. Client will comply with any guidelines provided by Snappt or Plaid regarding Client’s frequency of “batch” pulls of End User Data. Snappt and Plaid may enforce such guidelines in accordance with their standard practices, which may include throttling, suspension, or termination of Client’s access.
15. Marks License. Client hereby grants to Plaid and each FI (and each of their third-party service providers) the non-exclusive and non-transferable right and license to use Client’s trademarks and service marks solely in connection with consent management activities, including use associated with End User-facing consent management portals operated by Plaid or an FI.
16. Disclaimer. THE PLAID BAL, PLAID SERVICES, CONSUMER REPORTS, AND ANY OTHER INFORMATION, SOFTWARE, PRODUCTS, SERVICES, AND MATERIALS PROVIDED BY PLAID CRA IN CONNECTION WITH THE MSA OR THESE PLAID TERMS ARE PROVIDED BY PLAID CRA “AS IS.” TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PLAID CRA NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS MAKE ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WITHOUT LIMITATION ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ANY WARRANTY THAT THE PLAID BAL OR PLAID SERVICES ARE FREE FROM DEFECTS, ANY WARRANTY THAT THE PLAID BAL OR PLAID SERVICES WILL BE UNINTERRUPTED, OR THAT ANY DATA PROVIDED BY OR THROUGH THE PLAID BAL OR PLAID SERVICES WILL BE TIMELY, ACCURATE, OR COMPLETE. THE FOREGOING DISCLAIMER IS IN ADDITION TO, AND NOT IN LIEU OF, ANY DISCLAIMER SET FORTH IN THE MSA.
17. Suspension. Plaid may suspend or terminate Client’s access to the Plaid Services or End User Data, in whole or in part, if it believes Client has breached these Plaid Terms or where Client’s use of the Plaid Services or End User Data could violate or give rise to liability under any Plaid agreement (including Plaid’s agreement with any FI) or pose a risk of harm, including reputational harm, to any End User, FI, the Plaid Services, or Plaid and its affiliates. An FI may separately suspend Client’s access to End User Data with respect to such FI. Snappt may suspend or terminate Client’s access to the Plaid BaL (in whole or in part) at any time upon Snappt’s determination or reasonable belief that Client is not in compliance with these Plaid Terms or that Plaid has directed such suspension or termination.
18. Indemnification. Client will indemnify, defend, and hold harmless each FI, Plaid, Snappt, and the affiliates of each of the foregoing from any and all claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs, and expenses (including reasonable attorneys’ fees) arising from or in connection with: (a) any Security Breach resulting in unauthorized disclosure of End User Data; (b) Client’s unauthorized or improper use of End User Data (including any unauthorized Data Sharing, transmission, access, display, storage, or loss); (c) Client’s breach of these Plaid Terms or of any obligation flowed down to Client from the Plaid Reseller Agreement; and (d) Client’s breach of any laws or regulations, including the FCRA. Client’s obligations under this Section 18 are not subject to any limitation of liability, damages waiver, or subordination of remedies set forth in the MSA or any other agreement between Snappt and Client. Plaid and each FI is an intended third-party beneficiary of this Section 18 and may directly enforce this Section 18 against Client without Snappt’s consent or participation, but solely with respect to Consumer Reports (including FI data) and the Plaid Services made available to Client through the Plaid BaL.
19. Modifications. Client acknowledges that continued access to End User Data provided by certain FIs may require modifications to these Plaid Terms, and Client will accept such modifications to continue accessing or using the Plaid BaL with respect to such FIs. Snappt will use commercially reasonable efforts to notify Client of the modifications and the effective date thereof through posting herein, communications via Client’s account, email, or other means. If Client objects to any such modifications, its exclusive remedy is to cease any and all access to and use of the Plaid BaL as they relate to the affected FI(s). Continued access to or use of the Plaid BaL with respect to the affected FI(s) after the effective date of such modifications will constitute Client’s acceptance of such modifications.
20. Miscellaneous. Plaid is an intended third-party beneficiary of these Plaid Terms and may directly enforce these Plaid Terms against Client without Snappt’s consent or participation, but solely relating to Consumer Reports (including FI data) and the Plaid Services made available to Client through the Plaid BaL. Each FI is an intended third-party beneficiary of Sections 3 through 18 of these Plaid Terms with respect to End User Data made available by such FI. Except as expressly set forth in the preceding two sentences, these Plaid Terms do not confer any rights on any third party. All provisions of these Plaid Terms will remain in force in the event of the expiration or termination of the MSA or Client’s access to the Plaid BaL to the extent necessary to give effect to the intent of Snappt and Client.
APPENDIX 1 — VERMONT FAIR CREDIT REPORTING STATUTE, 9 V.S.A. § 2480e (2016)
§ 2480e. Consumer consent.
(a) A person shall not obtain the credit report of a consumer unless:
(1) the report is obtained in response to the order of a court having jurisdiction to issue such an order; or
(2) the person has secured the consent of the consumer, and the report is used for the purpose consented to by the consumer.
(b) Credit reporting agencies shall adopt reasonable procedures to ensure maximum possible compliance with subsection (a) of this section.
(c) Nothing in this section shall be construed to affect:
(1) the ability of a person who has secured the consent of the consumer pursuant to subdivision (a)(2) of this section to include in his or her request to the consumer permission to also obtain credit reports, in connection with the same transaction or extension of credit, for the purpose of reviewing the account, increasing the credit line on the account, for the purpose of taking collection action on the account, or for other legitimate purposes associated with the account; and
(2) the use of credit information for the purpose of prescreening, as defined and permitted from time to time by the Federal Trade Commission.
Vermont Rules — current through December 16, 2016.
Agency 06. Office of the Attorney General. Sub-Agency 031. Consumer Protection Division. Chapter 012. Consumer Fraud — Fair Credit Reporting. Rule CF 112 Fair Credit Reporting. CVR 06-031-012, CF 112.03 (2016).
CF 112.03 Consumer Consent.
(a) A person required to obtain consumer consent pursuant to 9 V.S.A. §§ 2480e and 2480g shall obtain said consent in writing if the consumer has made a written application or written request for credit, insurance, employment, housing or governmental benefit. If the consumer has applied for or requested credit, insurance, employment, housing or governmental benefit in a manner other than in writing, then the person required to obtain consumer consent pursuant to 9 V.S.A. §§ 2480e and 2480g shall obtain said consent in writing or in the same manner in which the consumer made the application or request. The terms of this rule apply whether the consumer or the person required to obtain consumer consent initiates the transaction.
(b) Consumer consent required pursuant to 9 V.S.A. §§ 2480e and 2480g shall be deemed to have been obtained in writing if, after a clear and adequate written disclosure of the circumstances under which a credit report or credit reports may be obtained and the purposes for which the credit report or credit reports may be obtained, the consumer indicates his or her consent by providing his or her signature.
(c) The fact that a clear and adequate written consent form is signed by the consumer after the consumer’s credit report has been obtained pursuant to some other form of consent shall not affect the validity of the earlier consent.
|