Updated: August 14, 2026
These Additional Terms and Conditions are organized by service provider: (1) Income Verification and Identity Verification Services provided through Plaid, Inc.; (2) Income Verification Services (Consumer Reports) provided through Plaid Consumer Reporting, Inc.; and (3) Income Verification Services (The Work Number®) provided through Equifax Workforce Solutions LLC. Each part applies solely to the services provided through the provider identified in that part, and no part’s terms, restrictions, definitions, or characterizations of services under the Fair Credit Reporting Act apply to services provided under any other part.
I. Additional Terms Governing Income Verification Services and Identity Verification Services (Provided Through Plaid, Inc.)
Through Plaid, Inc. ("Plaid"), Licensee will have access to Income Verification and/or Identity Verification Services (as defined herein). These terms, together with the master agreement between Licensee and the RealPage Party providing the services ("RealPage") (the "Master Agreement"), apply to any Income Verification Services and Identity Verification Services provided to Licensee through Plaid, and do not apply to income verification services provided through any other provider (including The Work Number®, which is governed exclusively by the TWN Terms below). The term "Licensee" as used herein shall mean the entity licensing Product Centers from RealPage under the Master Agreement. Where Licensee is a Site owner, and its third-party manager is a party to the Master Agreement, Income Verification and Identify Verification Product Centers may be accessed and used on behalf of Licensee by such manager.
A. Compliance Review.
Prior to Licensee receiving access to or use of the Income Verification Services or Identity Verification Services, Licensee must successfully complete a qualification process, which will include: (i) supplying RealPage with information reasonably required to identify the property that will access or use the Services and/or Licensee; and (ii) a physical site inspection, conducted by a third party, of the location where the results of the Services will be reviewed. Licensee agrees to cooperate fully with RealPage and Plaid in any periodic reviews, audits, or investigations ("Reviews") of Licensee to verify its ongoing qualification, uses of the Information and compliance with its obligations under these terms and applicable law. Upon request from RealPage or Plaid, Licensee agrees to supply documents to verify ownership of rental units, business and professional licenses, applications and supplementary application materials, and any other documents reasonably requested by RealPage or Plaid to verify the matters in the foregoing sentence. Such Reviews will be performed during Licensee's regular business hours and in a manner that minimizes, to the extent practicable, disruption of its business operations.
B. Income Verification Services.
The following provisions (the "Income Verification Terms") set out terms and conditions in connection with the Income Verification Services.
Restrictions. Unless Plaid specifically agrees in writing, Licensee will not, and will not enable or assist any third-party to: (i) attempt to reverse engineer (except as permitted by law), decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, or algorithms of the Plaid income verification services described at https://www.plaid.com (the "Income Verification Services" or "IV Services"); (ii) modify, translate, or create derivative works based on the IV Services; (iii) make the IV Services or information and data of Licensee's end users (such businesses and consumers, the "End Users") provided to Licensee via the IV Services (such information and data, the "Output") (or any derivative work thereof) available to, or use the IV Services or Output (or any derivative work thereof) for the benefit of, anyone other than Licensee or End Users; (iv) sell, resell, license, sublicense, distribute, rent or lease any IV Services or Output to any third-party, or include any IV Services or Output (or any derivative work thereof) in a service bureau, time-sharing, or equivalent offering; (v) publicly disseminate information from any source regarding the performance of the IV Services or Output; or (vi) attempt to create a substitute or similar service through use of, or access to, the IV Services or Output. Licensee will use the IV Services and Output only in compliance with (a) the Licensee application, use case, and the terms of the Master Agreement and any product-specific exhibit, addendum, or other document governed by these Income Verification Terms, (b) the Plaid developer policies (available at https://www.plaid.com/legal), (c) Plaid's applicable technical user documentation (available at https://www.plaid.com/docs), and (d) any agreements between Licensee and End Users (for clarity, including any privacy policy or statement). Notwithstanding anything to the contrary, the Licensee accepts and assumes all responsibility for complying with all applicable laws and regulations in connection with all of Licensee's activities involving any IV Services, Output, or End User data. Except as set forth in any product-specific exhibit, addendum, or other document attached to these Income Verification Terms, the parties acknowledge that Plaid retrieves End User data for the IV Services (including Output) from End Users' financial accounts on behalf, and with the authorization, of such End Users and transmits such IV Services (including Output) to RealPage and/or Licensee (via RealPage) at End Users' request, and accordingly, Licensee will not (x) make any representation or other statement to any third party, including to End Users, that Plaid is a "consumer reporting agency," issues or creates a "consumer report," or is a "furnisher" of information to "consumer reporting agencies," or that the IV Services (including Output) is a "consumer report," in each case, as such terms are defined in the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., its implementing regulations (12 C.F.R. 1022), or analogous state laws (collectively the "FCRA") or (y) use any IV Services or Output as, or in a manner that would cause them to be deemed, a "consumer report"; provided that, for clarity, this clause (b) does not prohibit Licensee from using solely "Assets" and "Income and Employment" Services and associated Output in connection with verification and decisioning use cases permitted by Plaid in writing such as employment verification, tenant screening, pre-screening or firm offers of credit, eligibility determination, or extension of credit by RealPage or Licensee to End Users. Notwithstanding anything to the contrary, Licensee will be bound by and will only use the IV Services or Output in compliance with the terms and conditions set forth herein.
Privacy and Authorizations. Plaid and Licensee each warrant that it will provide all notices, and obtain all consents, required under applicable law for such party to process End User data in accordance with these Income Verification Terms. Neither party will knowingly (i) make representations or other statements in its privacy policy with respect to End User data that are contrary to or otherwise inconsistent with the other's privacy policy or (ii) interfere with any independent efforts by the other party to provide End User notice or obtain End User consent. Without limiting the generality of the foregoing, Licensee will not prevent Plaid from presenting End Users with Plaid's "Plaid Link" interface or from otherwise presenting a link to Plaid's privacy policy (currently available at http://www.plaid.com/privacy) before End Users engage with the Licensee services in a manner that uses or otherwise implicates the Services.
WARRANTY; DISCLAIMER; ENFORCEMENT. THE IV SERVICES ARE PROVIDED "AS IS." TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PLAID NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, AND DISTRIBUTORS MAKE ANY WARRANTY OF ANY KIND, EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR ANY WARRANTY THAT THE IV SERVICES ARE FREE FROM DEFECTS. PLAID DOES NOT MAKE ANY WARRANTY AS TO THE OUTPUT THAT MAY BE OBTAINED FROM USE OF THE IV SERVICES. PLAID WILL BE AN INTENDED THIRD-PARTY BENEFICIARY OF THE AGREEMENT BETWEEN REALPAGE AND LICENSEE AND MAY DIRECTLY ENFORCE SUCH AGREEMENT AGAINST LICENSEE, WITHOUT REALPAGE'S CONSENT OR PARTICIPATION, BUT SOLELY RELATING TO THE OUTPUT OR IV SERVICES PROVIDED BY PLAID TO REALPAGE OR LICENSEE.
FI Data. Through the RealPage Product Centers or Plaid Services, Licensee may have access to information about or of End Users provided to Plaid by a bank, financial institution, or other financial data source (each, as designated by Plaid, "FI", and such information, the "FI Data").
Licensee Obligations.
End User Consents. Licensee will provide all notices and obtain all express consents from each End User as required under applicable laws in connection with Licensee's use, storage, and other processing of any FI Data (such notices and consents, the "Express Consents"). Express Consents will be clear and conspicuous and will generally specify the categories of FI Data that Licensee will receive and how Licensee will use, store, and otherwise process it, in addition to any other required disclosures under applicable laws. Licensee will maintain records (which may include technical logs, screenshots, and versions of Express Consents obtained) to demonstrate its compliance with this Section 4(i)(a) and will promptly provide such records to Plaid upon request.
Scope of Access. Licensee will only access FI Data for which it has obtained Express Consents from the End User for the use case reviewed and permitted by Plaid in writing that is consented to by the applicable End User (such use case, the "Permitted Use Case"). Key factors Plaid will consider during its review include whether the use case is appropriate and useful to provide the End User with the Licensee application that the End User has enrolled in, whether the Licensee application provides a direct benefit to the End User, and whether the use case directly supports the development of new or improved product features for the benefit of End Users, and the jurisdiction(s) in which the Licensee operates and/or stores FI Data. If Licensee possesses FI Data that exceeds the scope of the End User's Express Consents, Licensee will use industry-standard means to permanently and securely delete ("Delete") such FI Data. Plaid has reviewed and approved RealPage's use case:
RealPage will use Plaid's "Income" endpoint to enable Licensees to verify End Users' income and employment in connection with Licensee's lease or guarantor application decisions. Subject to these Income Verification Terms, RealPage will use and store data from Plaid's income endpoint into RealPage-owned platforms accessed by Licensees to perform these verifications and validations. RealPage will provide Plaid with prior notice of, and Plaid will have the right to reject, any proposed use cases of the Plaid Services and Plaid-Provided Data that fall outside of the scope defined in the foregoing sentence.
Data Use. Licensee will use, store, and otherwise process FI Data solely in accordance with the End User's Express Consents and applicable laws.
Data Disclosure. Licensee will not disclose, transfer, syndicate or distribute FI Data to any third party (including its employees, agents, contractors, and service providers accessing or using the IV Services on Licensee's behalf) ("Data Sharing") except in each case with the End User's Express Consents and in accordance with applicable laws. Notwithstanding anything to the contrary, Licensee will not sell FI Data.
Data Deletion. Licensee will promptly Delete any FI Data upon request by the applicable End User and acknowledges and agrees that RealPage may do the same in response to requests made to RealPage by End Users; provided that each may retain copies of the FI Data solely to the extent required by applicable laws.
No Attribution. Licensee will not charge End Users any fees attributable to an FI for (a) access to its FI Data or (b) use of End User's account with an FI in connection with the Licensee application. In addition, Licensee will not publicize its receipt of FI Data from specific FIs under the Master Agreement or this Section 4 (FI Data).
No Other Access. Licensee will only access FI Data through the IV Services or another manner that uses the FI's authorized APIs. Licensee will not "screen scrape" data from FIs or collect an End User's log-on credentials for FI accounts and will not otherwise knowingly obtain from a third-party FI Data that was originally sourced through screen scraping. Licensee will immediately Delete any such End User log-on credentials in its possession. Licensee will maintain records to demonstrate compliance with this Section 4(i)(g) and will provide them to Plaid upon request.
Compliance with Laws. Licensee will comply with all applicable privacy, security, and other laws, including, as applicable, the Gramm-Leach-Bliley Act, the California Consumer Privacy Act, and all other laws relating to FI Data. Licensee will not use, store, disclose, or otherwise process any FI Data for any purpose not permitted under applicable laws.
Information Security Program. Licensee will maintain a comprehensive written information security program approved by its senior management ("Infosec Program"). The Infosec Program will include administrative, technical, and physical measures designed to: (a) ensure the security of FI Data, (b) protect against unauthorized access to or use of FI Data and anticipated threats and hazards to FI Data and (c) ensure the proper disposal of FI Data. The Infosec Program will be appropriate to Licensee's risk profile and activities, the nature of the Licensee application, and the nature of the FI Data received by Licensee. In any event, the Infosec Program will meet or exceed applicable control objectives captured in industry standards and best practices such as AICPA Trust Service Criteria for Security, NIST 800-53, or ISO 27002 and will comply with applicable laws. Licensee will use up-to-date antivirus software and anti-malware tools designed to prevent viruses, malware, and other malicious code in the Licensee application or on Licensee's systems.
Security Breach Obligations. Licensee will promptly notify Plaid (and in no event after more than 24 hours) upon becoming aware of any Security Breach via an email to security@plaid.com (with a copy to legalnotices@plaid.com), providing a description of all known facts, the types of End Users affected, and any other information that Plaid may reasonably request. Licensee will reasonably cooperate with Plaid in investigating and remediating Security Breaches. Licensee will be responsible for the costs of investigating, mitigating, and remediating the Security Breach, including costs of credit monitoring, call centers, support, and other customary or legally required remediation. "Security Breach" means any event that compromises the Licensee application or Licensee's systems or that does or reasonably could compromise the security, integrity or confidentiality of FI Data or result in its unauthorized use, disclosure, or loss. For clarity, (i) the definition of "Security Breach" is not intended to include inconsequential incidents that occur on a daily basis such as scans, pings, or other unsuccessful attempts to penetrate computer networks or systems; and (ii) Licensee's obligations in this section do not apply to the extent the Plaid Services fail to operate in material compliance with Plaid's technical documentation available on Plaid's website or if the Security Breach is directly caused by a compromise of the Plaid Services or Plaid systems or facilities owned or operated by Plaid in providing such Plaid Services.
FI Confidential Information. If Plaid discloses to Licensee any confidential or proprietary materials of an FI (such materials, "FI Confidential Information"), such materials will be subject to the same obligations that apply to RealPage's Confidential Information under the Master Agreement, which will in no event be less protective of such information than a reasonable standard of care. FI Confidential Information will also be subject to the same obligations as FI Data under this Section (i) (Licensee Obligations) of this Section 4 (FI Data).
Oversight and Cooperation. Towards assessing Licensee's material compliance with this Section 4(i), Licensee will promptly provide all reasonably necessary information and cooperation requested by Plaid, an FI, or any entity with examination, supervision, or other legal or regulatory authority over Plaid or an FI. In the event that Plaid has a good faith reason to believe that Licensee is not in material compliance with this Section 4 (FI Data), Plaid will notify Licensee and, at Plaid's option, Licensee will promptly provide sufficient documentation to demonstrate such material compliance or submit to a third-party audit by a firm selected from a mutually-approved list of audit firms at Plaid's expense (provided that Licensee will reimburse reasonable and actual out-of-pocket costs of such audit incurred by Plaid if the conclusion of such audit confirms Licensee's material non-compliance) to verify such compliance. Plaid and FIs may also conduct operational assessments of Licensee, which will be subject to advance notice and will not occur more than once per year unless legally required and materially different in scope from a preceding audit.
Information Sharing. Where required by an FI and to the extent relevant to an Licensee's access or use of FI Data from that FI, Plaid may share with such FI certain information related to Licensee's compliance with this Section 4 (FI Data), including with respect to Licensee's Infosec Program, provided that such information Plaid shares with FI shall be treated in the same manner it treats Plaid confidential information after Plaid has entered into a written agreement with FI containing terms of confidentiality at least as stringent and protective as those in these Income Verification Terms, but in any event no less than reasonable care.
Insurance. Licensee will maintain insurance coverage appropriate to Licensee's risk profile and activities, the nature of the Licensee application, and the nature of the FI Data received by Licensee; provided that such coverage will be no less than industry standard and will include cybersecurity liability insurance.
Access Frequency. The parties acknowledge that as of the Effective Date, no guidelines regarding Licensee's frequency of "batch" pulls of End User Data (such guidelines, the "Guidelines") apply to Plaid Licensees. Notwithstanding the foregoing, (i) Licensee will comply with any Guidelines provided in writing by Plaid; and (ii) Plaid may enforce such guidelines in accordance with its standard practices, which may include throttling, suspension, or termination of Licensee's access.
Additional FCRA Requirements. The FCRA and analogous state laws regulate the operations of consumer credit reporting agencies and apply to customers receiving Income Verification Services, such as Licensee and its third party property manager ("Manager") (if any), as users of FI Data about consumers. The FCRA may be found at https://www.ftc.gov/system/files/documents/statutes/fair-credit-reporting-act/545a_fair-credit-reporting-act-0918.pdf. Licensee and Manager (if any) shall review and become familiar with FCRA, paying particular attention to at least the following (non-exhaustive list of) sections, which apply to Licensee and Manager (if any) as users of FI Data:
604. Permissible Purposes of Reports; 607. Compliance Procedures; 615. Requirement on Users of Consumer Reports 616. Civil Liability for Willful Noncompliance; 617. Civil Liability for Negligent Noncompliance; 619. Obtaining Information under False Pretenses; 621. Administrative Enforcement; 623. Responsibilities of Furnishers of Information to Consumer Reporting Agencies
In addition, a copy of the Notice to Users of Consumer Reports: Obligations of Users Under the FCRA ("Notice to Users") is available at https://link.realpage.com/screening. Licensee hereby acknowledges that it has received, reviewed, and will comply with the obligations set forth in the Notice to Users.
By law, FI Data may be issued only if used for certain specific purposes. Under these Income Verification Terms, the only Permissible Purposes for ordering and using FI Data are stated in Section 4(i)(b) above. FCRA PROVIDES THAT ANY PERSON WHO KNOWINGLY AND WILLFULLY OBTAINS INFORMATION ON A CONSUMER FROM A CONSUMER REPORTING AGENCY UNDER FALSE PRETENSES SHALL BE FINED UNDER TITLE 18 OF THE UNITED STATES CODE OR IMPRISONED NOT MORE THAN TWO YEARS, OR BOTH. In addition to FCRA, other federal and state laws addressing such topics as computer crime, unauthorized access to protected databases, and use of personally identifiable information of individuals may also be applicable. Licensee agrees to comply with all relevant federal, state, and local laws, regulations, and ordinances in its use of any FI Data.
Suspension. Plaid may suspend or terminate Licensee's access to the IV Services or FI Data, in whole or in part, if it reasonably believes (a) Licensee has materially breached this Section 4 (FI Data) or (b) Licensee's use of the IV Services or FI Data could violate or give rise to liability under any Plaid agreement (including Plaid's agreement with any FI) or pose a risk of harm, including reputational harm, to any End User, FI, the Plaid Services, or Plaid and its affiliates. Plaid will (i) provide Licensee with at least thirty (30) days' written advance notice of any such suspension and (ii) narrowly tailor any such suspension to mitigate Plaid's risk. Notwithstanding the foregoing, Plaid may immediately suspend Licensee's access to any Plaid Services or FI Data without written advance notice if either of the foregoing (a)—(b) is, in Plaid's reasonable belief, likely to result in irreparable harm to any End User, FI, the Plaid Services, or Plaid. Plaid will then provide written notice to RealPage (and RealPage will convey such notice to Licensee) as soon as practicable under the circumstances. In addition, an FI may immediately suspend Licensee's access to FI Data with respect to such FI.
Indemnity. Licensee will indemnify, defend, and hold harmless each FI, Plaid, and the affiliates of each of the foregoing from any claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs and expenses arising from: (a) any Security Breach resulting in unauthorized disclosure of FI Data or (b) Licensee's unauthorized or improper use of FI Data (including any unauthorized Data Sharing, transmission, access, display, storage or loss). This Section (iii) is not subject to any limitation of liabilities set forth in the Master Agreement. Each FI is a third-party beneficiary of this Section 4(iii).
Modifications. Licensee acknowledges that continued access to FI Data provided by certain FIs may require modifications to this Section 4 (FI Data). In such event, Plaid will notify RealPage (and RealPage will convey such notice to Licensee) in writing in a manner consistent with notice to other Plaid partner/end clients for the same, including a description of the modifications and the effective date of such modifications. If Licensee objects to the modifications, its exclusive remedy is to cease any and all access and use of the IV Services as it relates to such FI(s). Continued access or use of such the Services after the effective date of such modifications to this Section 4 (FI Data) will constitute Licensee's acceptance of such modifications
Miscellaneous. In the event of a conflict with any other agreement (including the Master Agreement), the terms and conditions of this Section 4 (FI Data) will govern and prevail. All provisions of this Section 4 (FI Data) will remain in force in the event of this Section 4's (FI Data) or the Master Agreement's termination or expiration.
C. Identity Verification Services.
The following provisions (the "IDV Terms") set out terms and conditions in connection with the Identity Verification Services.
DEFINITIONS
"End User" means an individual providing data to Licensee via the IDV Services.
"Licensee Data" means data in electronic form that is transmitted through the IDV Services by, on behalf of, from or to Licensee or End Users. For the avoidance of doubt: (i) Licensee Data (including Licensee Data returned to Licensee) is not Output; and (ii) Licensee Data is not the Confidential Information of either party.
"Identity Verification" means the IDV Services to which Licensee may submit Licensee Data provided by Licensee or End Users, as determined by Licensee via the Dashboard.
"Monitor" means the IDV Services that provide anti-money laundering screening.
"Identity Verification Services" or "IDV Services" means the Services comprised of the Identity Verification and Monitor, as applicable, and the Dashboard. For the avoidance of doubt, the IDV Services are Services.
"Dashboard" means the Licensee facing dashboard functionality and dashboard display services within the IDV Services.
"DPPA" means the Drivers Privacy Protection Act, 18 U.S.C. § 2721, et. seq.
"GLBA" means the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801, et seq.
"Output" means the information and data of End Users provided to Licensee via the IDV Services (or any derivative work thereof).
"PII" means Licensee Data that relates to an End User and is deemed "personal data" or "personal information" (or analogous variations of such terms) under applicable privacy or data protection laws.
"Permitted Service Provider" means Licensee's employees, agents, contractors, and service providers accessing or using the IDV Services on Licensee's behalf.
"Process" means collect, disclose, use, store, or otherwise process.
"IDV Use Case" means RealPage will use Plaid's "Identity Verification" endpoint to enable Licensees to verify the identity of applicants, guarantors, and third party invitees or visitors to the property.
For the purposes of these IDV Terms, the terms "controller," "processor," and "subprocessor" have the meanings ascribed to them and are hereby deemed references to the relevant defined terms with analogous meanings, under applicable law. For example, these terms will be deemed references, as applicable, to the terms "business" and "service provider" as such terms are used in the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020.
IDV SERVICES
Access. Licensee may use the IDV Services subject to, and only in accordance with, applicable law, these IDV Terms, the Master Agreement, the IDV Use Case, and any agreements between Licensee and End Users (for clarity, including any privacy policy or terms of service) to: (i) verify, via Identity Verification's matching of Licensee Data provided by End Users, applicable End User identities in the normal course of Licensee's business; and (ii) assess, via Monitor, the Licensee Data for certain screening purposes (e.g., to confirm that End Users do not appear on any watchlist, to provide antifraud or anti-money laundering screening services, etc.). Without limiting the generality of the foregoing, Licensee agrees that: (a) Licensee will not enable or use the "autofill" functionality of the IDV Services if Licensee is located outside of the United States; and (b) any violation of this sentence will be deemed a material breach of these IDV Terms.
Instructions. To enable RealPage to provide the IDV Services to Licensee, RealPage will submit Licensee's instructions to Plaid via the Dashboard (the "Instructions"). The Instructions, based on the RealPage services ordered by Licensee, the applicable Product Specifications, and any settings selected by Licensee, will include direction regarding: (i) the applicable categories or types of Licensee Data that will be processed by the IDV Services on behalf of Licensee and its End Users; (ii) when such processing will occur; and (iii) the categories or types of End Users who will provide Licensee Data through the IDV Services.
Consent. Licensee represents and warrants that Licensee will provide all notices and obtain all consents and/or require that RealPage will provide all notices and obtain all consents on behalf of Licensee as required under applicable law, regulations, and third-party agreements for: (i) Licensee to Process Licensee Data; and (ii) RealPage (and its affiliates, subcontractors, subprocessors, service providers, and data sources) to provide the IDV Services by Processing such Licensee Data, and to otherwise exercise the rights described in these IDV Terms. Licensee will maintain records sufficient to demonstrate its compliance with this Section 2(iii) and will promptly provide such records to RealPage upon request.
Licensee Data. Licensee grants to RealPage's IDV Services subprocessor and its affiliates and subcontractors a limited and non-exclusive license to copy, store, configure, display, back test, transmit, and otherwise Process Licensee Data as necessary to provide the IDV Services and to develop enhancements for the IDV Services in accordance with the end user privacy statement available at https://cognitohq.com/privacy-statement. Without limiting the generality of the foregoing, subprocessor may disclose Licensee Data to subcontractors subject to restrictions similar to those in these IDV Terms. Notwithstanding anything to the contrary, subprocessor may disclose Licensee Data as required by law or court order. Subject to the foregoing in this paragraph, Licensee will retain its existing rights (if any, including any ownership rights) in and to Licensee Data. For the avoidance of doubt and notwithstanding any other provisions of these IDV Terms, the parties hereto acknowledge and agree that subprocessor, subject to its compliance with applicable laws and regulations: (i) may use, reproduce, disclose, or otherwise exploit de-identified or anonymized Licensee Data (i.e., Licensee Data from which PII has been removed, de-identified, or anonymized) in any way in subprocessor's sole discretion; and (ii) reserves the right to provide the IDV Services through use of subcontractors, affiliates, and otherwise, worldwide.
COMPLIANCE
GLBA; DPPA. Licensee certifies that all Licensee's and Permitted Service Providers' uses of, and purposes pertaining to, the IDV Services are and will be in accordance with and solely comprised of uses and purposes: (i) described in Section 6802(e) of GLBA and the United States Federal Trade Commission rules promulgated thereunder, as may be interpreted from time to time by a competent regulatory authority; or (ii) permitted under DPPA.
Processing on Licensee's Behalf. Licensee acknowledges and agrees that, solely with regard to the Licensee Data: (i) Licensee will determine, via the Instructions, the purpose and means by which subprocessor will process Licensee Data; (ii) RealPage will require subprocessor to act on Licensee's Instructions with respect to the details of subprocessor's processing of Licensee Data (i.e., how, what, when, and why such Licensee Data is processed by subprocessor); and that therefore (a) Licensee will be deemed a controller with regard to such Licensee Data; (b) RealPage will be deemed a data processor with regard to Licensee Data; and (c) RealPage's subcontractors will be deemed subprocessors with regard to Licensee Data where such subprocessors facilitate, via the IDV Services, the Licensee activities described in Section 2(i). Licensee will direct End Users to Licensee's privacy policy for any queries or requests regarding End User rights with respect to, and the processing of, PII applicable to the IDV Services. For the avoidance of doubt, Licensee acknowledges and agrees that: (I) Licensee's privacy policy will control and apply with respect to the processing of all PII applicable to the IDV Services; and (II) Licensee will make available and maintain all data retention policies and provisions as required under applicable law pertaining to subprocessor storage of PII on Licensees' behalf in relation to the IDV Services provided under these IDV Terms. RealPage agrees that its IDV Services subprocessor will not, other than as expressly permitted for processors or subprocessors under applicable law: (A) process PII for any purpose (including any commercial purpose) other than as necessary to perform the IDV Services for the Licensee (which performance includes the activities described in Section 2(iv); (B) sell or, where applicable, share (as that term is defined in the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 and any subsequent amendments) any PII; (C) process PII outside of the business relationship described in these IDV Terms; or (D) combine PII with any other personal information that subprocessor collects (directly from end users or via any third party).
Details of Processing. The parties acknowledge and agree that Licensee will control, via the Instructions, the types and categories of PII that may be Processed in connection with the IDV Services. For clarity, such types and categories may include names, addresses, dates of birth, phone numbers, identification documents, and images/videos (e.g., photos or selfies). RealPage agrees that such Processing will continue, as applicable, in accordance with these IDV Terms.
FCRA. Licensee acknowledges and agrees that: (i) neither RealPage nor its IDV Services subprocessor are a "consumer reporting agency" or a "furnisher" of information to consumer reporting agencies under the FCRA; and (ii) the Licensee Data is not a "consumer report" under the FCRA. Licensee represents and warrants that it will not, and will not permit or enable any third party to, use the IDV Services or any Licensee Data: (a) as a, or as part of a, "consumer report" as that term is defined in the FCRA; or (b) such that the IDV Services or any Licensee Data would be deemed "consumer reports" under the FCRA.
Licensee Responsibilities. Notwithstanding the applicability or details of Licensee's integration involving the IDV Services, and notwithstanding anything to the contrary in these IDV Terms or any other terms of the Master Agreement, Licensee is solely responsible for its relationships with End Users, including any related billing matters, technical support, and disputes. Without limiting anything in this these IDV Terms, Licensee will publish and maintain an easily accessible and legally sufficient: (i) terms of service regarding all applicable End User use of Licensee's services; and (ii) privacy policy. Licensee is, and will remain, solely responsible and liable for each End User's and each Permitted Service Provider's use of and access to the IDV Services. Licensee shall have sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of all Licensee Data, and for verifying the same.
Unauthorized Use. In connection with its processing of any Licensee Data, RealPage will comply with all obligations (including privacy protection obligations) applicable to it as a processor under applicable law. Licensee reserves the right to take reasonable and appropriate steps towards stopping and remediating any unauthorized use of PII. RealPage will reasonably cooperate with Licensee to facilitate such steps, including by making available to Licensee all information reasonably necessary to demonstrate RealPage's compliance with its obligations under these IDV Terms and applicable law.
DISCLAIMER
Subprocessor makes no warranty with respect to, and disclaims all liability pertaining to: (i) the Instructions and any acts or omissions in accordance therewith; and (ii) the accuracy of any Licensee Data and all other data (a) uploaded or otherwise provided to or for the IDV Services by or on behalf of Licensee or End Users, and (b) Processed or provided by, or otherwise originating from, subprocessor or its data sources in relation to the IDV Services. With respect to the IDV Services, subprocessor disclaims all liability for the errors and omissions of it and its data sources.
EFFECT OF TERMINATION
Upon termination or expiration of an Order relating to the IDV Services: (i) Licensee will destroy or return to RealPage all IDV Services documentation provided to Licensee relating to such Order; and (ii) following RealPage's receipt of Licensee's request in writing, RealPage will facilitate the deletion (or return, per such request) of all Licensee Data stored on RealPage's and its subprocessor's servers relating to such Order, unless retention of the Licensee Data is required under applicable law. Without limiting the foregoing, RealPage and Licensee may mutually agree upon the retention periods for various types or categories of Licensee Data. Notwithstanding anything to the contrary, subprocessor disclaims all liability pertaining to: (a) deletion of Licensee Data after the termination or expiration of an Order; and (b) Licensee's use of the IDV Services and Licensee Data after any Order termination or expiration.
INDEMNITY
Licensee will indemnify, defend, and hold harmless RealPage's IDV Services subprocessor and its affiliates from any claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs and expenses arising from or in connection with: (i) breaches by Licensee of these IDV Terms; (ii) acts or omissions of Licensee or its employees, affiliates, or contractors relating to the IDV Services; and (iii) the Processing of Licensee Data by Licensee or its Permitted Service Providers; and (iv) the Instructions and any acts or omissions in accordance therewith.
MISCELLANEOUS
In the event of a conflict between these IDV Terms and any other terms and conditions of the Master Agreement or any agreements between Licensee and End Users (for clarity, including any privacy policy or terms of service), the terms and conditions of these IDV Terms will govern and prevail with respect to the IDV Services. RealPage may update the IDV Services and these IDV Terms from time to time.
II. Additional Terms Governing Income Verification Services (Consumer Reports) (Provided Through Plaid Consumer Reporting, Inc.)
Through Plaid Consumer Reporting, Inc. ("Plaid CRA"), Licensee will have access to Consumer Reports (as defined herein) which are derived from FCRA Services (as defined herein). These terms, together with the master agreement between Licensee and the RealPage Party providing the services ("RealPage") (the "Master Agreement"), apply to any FCRA Services provided to Licensee through Plaid CRA, and do not apply to consumer reports or income verification services provided through any other provider (including The Work Number®, which is governed exclusively by the TWN Terms below). The term "Licensee" as used herein shall mean the entity licensing the Income Verification Product Center from RealPage under the Master Agreement. Where Licensee is a Site owner, and its third-party manager is a party to the Master Agreement, the Income Verification Product Center may be accessed and used on behalf of Licensee by such manager.
Compliance Review. Prior to Licensee receiving access to or use of the FCRA Services, Licensee must successfully complete a qualification process, which will include: (i) supplying RealPage with information reasonably required to identify the property that will access or use the FCRA Services and/or Licensee; and (ii) a physical site inspection, conducted by a third party, of the location where the results of the FCRA Services will be reviewed. Licensee agrees to cooperate fully with RealPage and Plaid CRA in any periodic reviews, audits, or investigations ("Reviews") of Licensee to verify its ongoing qualification, uses of the FCRA Services and compliance with its obligations under these terms and applicable law. Upon request from RealPage or Plaid CRA, Licensee agrees to supply documents to verify ownership of rental units, business and professional licenses, applications and supplementary application materials, and any other documents reasonably requested by RealPage or Plaid CRA to verify the matters in the foregoing sentence. Such Reviews will be performed during Licensee's regular business hours and in a manner that minimizes, to the extent practicable, disruption of its business operations.
Restrictions. Before Licensee receives Consumer Reports (as defined below), as authorized by each applicable consumer (each an "End User"), and accesses the RealPage products or services which include, are derived from, or incorporate the FCRA Services (as defined below) or Consumer Reports, Licensee represents and warrants that it: (i) understands the nature of the information provided in the Consumer Report can change daily and agrees that each Consumer Report is provided for a one-time use; (ii) has certified that it understands and agrees that Plaid Consumer Reporting Agency, Inc.'s ("Plaid CRA's") provision of the FCRA Services do not indicate ownership or authorization to transact on a bank account and are not to be used by the Licensee to confirm ownership or authorization to transact on a bank account; (iii) certified that it shall ensure that its employees, agents or contractors working on its behalf do not request and/or obtain Consumer Reports on themselves, coworkers, employees, family members or friends unless it is in connection with a legitimate permissible purpose previously identified; (iv) has certified that it shall not use or store the FCRA Services outside of the United States; and (v) has certified that it shall not, and shall not enable or assist any third party to: (1) use the FCRA Services to create, enhance or structure any database in any form for resale or external distribution; (2) modify, translate, or create derivative works based on the FCRA Services; (3) attempt to reverse engineer (except as permitted by law), decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, or algorithms of the FCRA Services; (4) use the FCRA Services in any way that is defamatory, trade libelous, unlawfully threatening or unlawfully harassing; (5) make the FCRA Services or Consumer Report (or any derivative work thereof) available to, or use the FCRA Services or Consumer Report (or any derivative work thereof) for the benefit of anyone other than RealPage, End Users, or Licensee; (6) publicly disseminate or disclose information from any source regarding the performance of the FCRA Services; or (7) attempt to create a substitute or similar service through use of, or access to, the FCRA Services. Licensee represents and warrants that it will use the FCRA Service in accordance with (a) the rights granted under this Agreement, and (b) Plaid Inc. and its subsidiaries Developer Policy (available at www.plaid.com/legal). As used in the Agreement, "FCRA Services" means together (I) the API Package, and (II) a consumer report, as is defined in 15 U.S.C. § 1681a(d), including any data relating to an End User included therein, deposit account verification and activity reports, and enhancements to the consumer reports (collectively "Consumer Reports"). Except as explicitly provided in the Agreement, the Licensee agrees that it shall not disclose, disseminate, share, sublicense, resell or otherwise redistribute the FCRA Services (or any part thereof) to any parent, subsidiary, affiliate or other third party, except: (x) in connection with the sale of a loan to which the FCRA Services relate; (y) to the End User to whom the Consumer Report relates if an adverse action (as defined by the FCRA) has been taken based on the FCRA Services; or (z) as otherwise required by law.
Required Consents. Licensee warrants and ensures that it will, before requesting a Consumer Report, provide all notices and obtain all consents required under applicable laws, regulations, and third-party agreements for Plaid CRA to provide the FCRA Services and to otherwise collect, use, and process End User data (including End User Input (as defined below)) in accordance with Plaid CRA's privacy policy (https://plaid.com/plaid-check-consumer-report/privacy-policy/). Licensee may provide Plaid CRA, directly or indirectly via RealPage, certain identifying information regarding an End User, such as first name, last name, and address, to use the FCRA Services (all such information, the "End User Input")
Retention of Documents. All consumer authorizations required by the Agreement or by applicable law, along with all adverse action letters provided to consumers and consumer applications, including copies of government-issued identification needed to verify the identity of the applicant, shall be retained by Licensee for a reasonable period of time, but not less than five (5) years, and evidence of such documents shall be made available for inspection by Plaid CRA, its third-party data vendors, or its designee upon demand.
End User Authentication. Licensee certifies that, before requesting a Consumer Report, (i) it will verify the consumer's identity prior to presenting the consumer with Plaid CRA's channel, (ii) it understands that Plaid CRA may rely on this verification, and (iii) it understands and agrees that Plaid CRA has no obligation to separately authenticate or confirm the identity of any consumer presented to the Plaid CRA channel by the End User.
DISCLAIMER; ENFORCEMENT. THE FCRA SERVICES, CONSUMER REPORTS, AND ANY OTHER INFORMATION, SOFTWARE, PRODUCTS, SERVICES, AND MATERIALS PROVIDED BY PLAID CRA IN CONNECTION WITH THE AGREEMENT ARE PROVIDED "AS IS." TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PLAID CRA NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS MAKE ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ANY WARRANTY THAT THE FCRA SERVICES ARE FREE FROM DEFECTS, ANY WARRANTY THAT ANY FCRA SERVICES WILL BE UNINTERRUPTED, OR THAT ANY DATA PROVIDED BY OR THROUGH ANY FCRA SERVICES WILL BE TIMELY, ACCURATE, OR COMPLETE. PLAID CRA WILL BE AN INTENDED THIRD-PARTY BENEFICIARY OF THE AGREEMENT BETWEEN REALPAGE AND LICENSEE AND MAY DIRECTLY ENFORCE SUCH AGREEMENT AGAINST LICENSEE, WITHOUT REALPAGE'S CONSENT OR PARTICIPATION, BUT SOLELY RELATING TO THE CONSUMER REPORTS (INCLUDING FI DATA) AND FCRA SERVICES THAT ARE PROVIDED BY PLAID CRA TO REALPAGE OR LICENSEE.
FI Data. Through the RealPage Income Verification Product Center or FCRA Services, Licensee may have access to information about or of End Users provided to Plaid CRA by a bank, financial institution, or other financial data source (each, as designated by Plaid CRA, "FI", and such information, the "FI Data").
Licensee Obligations.
End User Consents. Licensee will provide all notices to, and obtain all express consents from, each End User as required under applicable laws in connection with Licensee's use, storage, and other processing of any FI Data (such notices and consents, the "Express Consents"). Express Consents will (A) be clear and conspicuous; (B) generally specify the categories of FI Data that Licensee will receive and how Licensee will use, store, and otherwise process FI Data; (C) be valid, enforceable, and expressly accepted by each End User; (D) identify any and all third parties or categories of third parties to whom Licensee may provide FI Data for processing; (E) specify how End Users may exercise their right to revoke their Express Consent; and (F) include any other required disclosures under applicable laws. Licensee will maintain records (which may include technical logs, screenshots, versions of Express Consents obtained) sufficient to demonstrate Licensee's compliance with this Section 7(a)(i) (End User Consents) and will promptly provide such records to Plaid CRA upon request.
Scope of Access. Licensee will only access FI Data for which it has obtained Express Consents from the End User for the use case reviewed and permitted by Plaid CRA in writing and consented to by the applicable End User (such use case, the "Permitted Use Case"). For clarity, key factors Plaid CRA will consider during its review of a potential Permitted Use Case include whether the use case is appropriate and useful to provide the End User with the Licensee application that the End User has enrolled in, whether the Licensee application provides a direct benefit to the End User, whether the use case directly supports the development of new or improved product features for the benefit of End Users, and the jurisdiction(s) in which the Licensee operates and/or stores FI Data. If Licensee possesses FI Data that exceeds the scope of the End User's Express Consents, Licensee will use industry-standard means to permanently and securely delete ("Delete") such FI Data; provided that Licensee may retain such FI Data to the extent required by applicable laws. If Licensee becomes aware that any data it receives from Plaid CRA does not relate to the End User that Licensee originally requested FI Data for, Licensee will promptly notify Plaid CRA and will Delete such data.
Data Use. Licensee will use, store and otherwise process FI Data solely in accordance with the End User's Express Consents and applicable laws.
Data Disclosure. Licensee will not disclose, transfer, syndicate or distribute FI Data to any third party (including its Permitted Service Providers) ("Data Sharing") except in each case with the End User's Express Consent and in accordance with applicable laws. Notwithstanding anything to the contrary, Licensee will not sell FI Data.
Data Deletion. Licensee will promptly Delete any FI Data upon request by the applicable End User; provided that Licensee may retain copies of FI Data solely to the extent required by applicable laws.
No Attribution. Licensee will not charge End Users any fees attributable to an FI for (a) access to its FI Data or (b) use of End User's account with an FI in connection with the Licensee application. In addition, Licensee will not suggest or imply a partnership, sponsorship, or other relationship with an FI based on Licensee's receipt of FI Data under the Master Agreement or this Section 7 (FI Data).
No Other Access. During the term of the Agreement, Licensee will only access FI Data through the FCRA Services or another manner that uses the FI's authorized APIs. Licensee will not "screen scrape" data from FIs or collect an End User's log-on credentials for FI accounts, and will not otherwise knowingly obtain from a third party FI Data that was originally sourced through screen scraping an FI. Licensee will immediately Delete any such End User log-on credentials in its possession. Licensee will maintain records to demonstrate compliance with this Section 7(a)(vii) (No Other Access). For the avoidance of doubt, nothing in this Section 7(a)(vii) (No Other Access) will prohibit Licensee from engaging any third party to obtain services similar to the FCRA Services, provided that such third-party services enable Licensee's access to FI Data solely via the FI's authorized APIs.
Compliance with Laws. Licensee will comply with all applicable federal, state and local statutes, regulations, rules, privacy, security, and other laws pertaining to FI Data, FCRA Services, including but not limited to Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq., as amended ("FCRA") and the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801 et seq., as amended, in requesting and using the FCRA Services. Licensee will not use, store, disclose, or otherwise process any FI Data for any purpose not permitted under applicable laws. For the avoidance of doubt, Licensee acknowledges that Section 1033 of the Dodd-Frank Act may include obligations on Licensee relating to processing, handling, and protecting FI Data. Licensee will maintain a program designed to ensure compliance with applicable laws, including appropriately training Licensee personnel.
Information Security Program. Licensee will maintain a comprehensive written information security program approved by its senior management ("Infosec Program"). The Infosec Program will be designed to: (a) ensure the security of FI Data and FCRA Services, (b) protect against unauthorized access to or use of FI Data and FCRA Services and anticipated threats and hazards to FI Data and FCRA Services and (c) ensure the proper disposal of FI Data and the FCRA Services. The Infosec Program will be appropriate to Licensee's risk profile and activities, the nature of the Licensee application, and the nature of the FI Data and FCRA Services received by Licensee. In any event, the Infosec Program will meet or exceed applicable control objectives captured in industry standards and best practices, such as AICPA Trust Service Criteria for Security, NIST 800-53, or ISO 27002, and will comply with applicable laws. The safeguards contained within the Infosec Program shall include the elements set forth in 16 C.F.R. § 314.4. Licensee will use up-to-date antivirus software and anti-malware tools designed to prevent viruses, malware, and other malicious code in the Licensee application or on Licensee's systems. Licensee shall limit use of the FI Data and FCRA Services to its employees who have been appropriately trained.
Security Breach Obligations. Licensee will notify Plaid CRA promptly (and in any event within twenty-four (24) hours) via an email to security@plaid.com, following Licensee becoming aware of any Security Breach, providing a description of all known facts, the types of End Users affected, and any other information that Plaid CRA may reasonably request. Licensee will reasonably cooperate with Plaid CRA in investigating and remediating Security Breaches. Licensee will be responsible for the costs of investigating, mitigating, and remediating the Security Breach, including costs of credit monitoring, call centers, support, and other customary or legally required remediation. "Security Breach" means any event that compromises the Licensee application or Licensee's systems or that does or reasonably could compromise the security, integrity or confidentiality of FI Data or results in such FI Data's unauthorized use, disclosure, or loss. For clarity, (i) the definition of "Security Breach" is not intended to include inconsequential incidents that occur on a daily basis such as scans, pings, or other unsuccessful attempts to penetrate computer networks or systems; and (ii) Licensee's obligations in this section do not apply to the extent the FCRA Services fail to operate in material compliance with Plaid CRA's technical documentation available on Plaid CRA's website or if the Security Breach is directly caused by a compromise of the FCRA Services or Plaid CRA systems or facilities owned or operated by Plaid CRA in providing such FCRA Services.
FI Confidential Information. If Plaid CRA discloses to Licensee any confidential or proprietary materials of an FI pertaining to the provision of FI Data hereunder (such materials, "FI Confidential Information"), such materials will be subject to the same obligations that apply to RealPage's Confidential Information under the Master Agreement, which will in no event be less protective of such information than a reasonable standard of care. FI Confidential Information will also be subject to the same obligations as FI Data under this Section 7(a) (Licensee Obligations). Licensee will promptly Delete FI Confidential Information in its possession upon Plaid CRA's request and will provide a written certification regarding such Deletion.
Oversight and Cooperation. Toward assessing Licensee's material compliance with this Section 7 (FI Data), Licensee will promptly provide all reasonably necessary information and cooperation requested by Plaid CRA, an FI, or any entity with examination, supervision, or other legal or regulatory authority over Plaid CRA or an FI. In the event that Plaid CRA has a good faith reason to believe that Licensee is not in material compliance with this Section 7 (FI Data), Plaid CRA will notify Licensee and, upon Plaid CRA's request, Licensee will promptly provide sufficient documentation to demonstrate such material compliance. If the documentation provided by Licensee in accordance with the immediately prior sentence is insufficient (in Plaid CRA's reasonable discretion) to demonstrate such material compliance, Licensee will submit to a third-party audit by a firm selected by Licensee from a list of audit firms reasonably approved by Plaid CRA to verify such compliance. Plaid CRA and FIs may also conduct operational assessments of Licensee, which will be subject to advance notice and will not occur more than once per year unless legally required and materially different in scope from a preceding audit.
Information Sharing. Where required by an FI or relevant to an Licensee's access or use of FI Data from that FI, Plaid CRA may share with such FI certain information related to Licensee's compliance with this Section 7 (FI Data), including with respect to Licensee's Infosec Program, provided that such information Plaid CRA shares with FI shall be treated in the same manner it treats Plaid CRA confidential information after Plaid CRA (or a Plaid CRA affiliate) has entered into a written agreement with FI containing terms of confidentiality at least as stringent and protective as those in this Agreement, but in any event no less than reasonable care.
Insurance. Licensee will maintain insurance coverage appropriate to Licensee's risk profile and activities, the nature of the Licensee application, and the nature of the FI Data received by Licensee; provided that such coverage will be no less than industry standard and will include cybersecurity liability insurance.
Access Frequency. The parties acknowledge that as of the effective date of the Master Agreement, no guidelines regarding Licensee's frequency of "batch" pulls of FI Data (such guidelines, the "Guidelines") apply to Plaid CRA Licensees. Notwithstanding the foregoing in this paragraph: (1) Licensee will comply with any Guidelines provided in writing by Plaid CRA (including via RealPage); and (2) Plaid CRA and RealPage may enforce such Guidelines to the extent necessary in accordance with Plaid CRA's standard practices, which may include throttling, suspension or termination of Licensee's access.
Licensee Marks License. Licensee hereby grants to Plaid CRA and each FI (and each of their third-party service providers) the non-exclusive and non-transferable right and license to use Licensee's trademarks and service marks solely in connection with consent management activities, including use associated with End User facing consent management portals operated by Plaid CRA or an FI.
Suspension. Plaid CRA may suspend Licensee's access to the FCRA Services or FI Data, in whole or in part, if Plaid CRA determines or reasonably believes that: (a) Licensee has materially breached this Section 7 (FI Data); (b) Licensee's use of the FCRA Services or FI Data will or has materially violated an agreement between Plaid CRA and an applicable FI; (c) Licensee's use of the FCRA Services or FI Data will or does pose a risk of material harm, including material reputational harm, to End Users, an FI, or the FCRA Services. In addition, an FI may suspend Licensee's access to FI Data with respect to such FI. For Plaid CRA-required suspensions, Plaid CRA will (i) provide Licensee with at least thirty (30) days' written advance notice of any such suspension; and (ii) narrowly tailor any such suspension to mitigate Plaid CRA's risk. Notwithstanding the foregoing, Plaid CRA may immediately suspend Licensee's access to any FCRA Services or FI Data without written advance notice if the foregoing (a) – (c) is, in Plaid CRA's reasonable belief, likely to result in irreparable harm to any End User, FI, the FCRA Services, or Plaid CRA. Plaid CRA will then provide written notice to RealPage (and RealPage will convey such notice to Licensee) as soon as practicable under the circumstances. In addition, an FI may immediately suspend Licensee's access to FI Data with respect to such FI.
Indemnity. Licensee will indemnify, defend and hold harmless each FI, Plaid CRA, and the affiliates of each of the foregoing from any claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs, and expenses arising from or in connection with: (a) any Security Breach resulting in unauthorized disclosure of FI Data provided to Licensee hereunder; or (b) Licensee's unauthorized or improper use of FI Data provided to Licensee hereunder (including any unauthorized Data Sharing, transmission, access, display, storage, or loss). This Section 7(c) (Indemnity) is not subject to any limitation of liabilities set forth in the Master Agreement. Each FI is a third-party beneficiary of this Section 7(c) (Indemnity).
Modifications. Licensee acknowledges that continued access to FI Data provided by certain FIs may necessitate modifications to this Section 7 (FI Data) pertaining to all applicable Plaid CRA Licensees. In such event, Plaid CRA will notify RealPage (and RealPage will convey such notice to Licensee) in writing in a manner consistent with notice to other Plaid CRA resellers/Licensees for the same, including a description of the modifications and the effective date of such modifications. If Licensee objects to the modifications, its exclusive remedy is to cease any and all access and use of the FCRA Services as it relates to the applicable FI(s). Continued access to or use of such FCRA Services after the effective date of such modifications to this Section 6 (FI Data) will constitute Licensee's acceptance of such modifications.
Miscellaneous. In the event of a conflict with any other agreement or provision (including other provisions within the Master Agreement), the terms and conditions of this Section 7 (FI Data) will govern and prevail. Capitalized terms used in this Section 7 (FI Data) and not otherwise defined will have the meanings ascribed to them in the Agreement. All provisions of this Section 7 (FI Data) will remain in force in the event of the termination or expiration of this Section 7 (FI Data), the Agreement, or the Master Agreement.
III. Additional Terms Governing Income Verification Services (The Work Number® — Provided Through Equifax Workforce Solutions LLC)
The Work Number®, a solution offered through Equifax Workforce Solutions, is the industry’s largest commercial source of payroll records contributed directly from employers and payroll providers. Through Equifax Workforce Solutions LLC ("EVS"), a provider of Equifax Verification Services and the operator of The Work Number® ("TWN"), a service used to verify certain employment and income related information about an individual (each such individual, a "Consumer"), Licensee may have access to income and employment verification services (the "TWN Services"). These terms (the "TWN Terms"), together with the master agreement between Licensee and the RealPage Party providing the services ("RealPage") (the "Master Agreement"), apply solely to TWN Services provided to Licensee through EVS. For clarity, the Plaid, Inc. Income Verification Terms, the IDV Terms, and the Plaid Consumer Reporting, Inc. terms set out elsewhere on this page do not apply to the TWN Services, and these TWN Terms do not apply to any services provided through Plaid, Inc. or Plaid Consumer Reporting, Inc. The term "Licensee" as used herein shall mean the entity licensing Product Centers from RealPage under the Master Agreement. As used in these TWN Terms, "Data" means employment and/or income data furnished to EVS by employers or other data furnishers and provided by The Work Number; "Information" means certain other information provided by other EVS verification services; and Data and Information are collectively referred to as "EVS Information." RealPage is a consumer reporting agency ("CRA") and a certified reseller of The Work Number® product. Licensee is a "Qualified Subscriber" as that term is used in RealPage's reseller agreement with EVS, and EVS requires, as a condition of Licensee's access to the TWN Services, that Licensee receive EVS Information subject to the following terms and conditions.
Service Description.
Tenant Income Check. The TWN Services consist of Tenant Income Check, which includes, where available: (i) Social Security Number, (ii) employee name, (iii) employee position title, (iv) employment status, (v) record as of date, (vi) employer name, (vii) most recent hire date, (viii) total length of time with employer, (ix) rate of pay, (x) pay frequency, (xi) average hours per pay period, (xii) year to date total compensation, (xiii) previous year total compensation, and (xiv) annualized income calculation. Tenant Income Check will return only available records from current employers having an Active employment status during the past three hundred sixty-five (365) days from the date of the request. Licensee may request the TWN Services only in accordance with these TWN Terms and only when intended to be used for tenant screening purposes.
Audit-by-Reference Number ("ABRN"). Each time EVS performs a verification, EVS assigns such verification a unique reference number. Using the reference number and the last four digits of an individual's Social Security number, an ABRN copy may be obtained as available by Service. The ABRN copy is an exact duplicate of the previous, original verification performed on such individual. Applicable charges apply when an ABRN Transaction is completed.
Qualification; Eligibility; Execution; Ongoing Monitoring.
Qualification Process. Prior to Licensee receiving access to or use of the TWN Services, Licensee must successfully complete a qualification process, which will include an on-site or virtual visual inspection of Licensee's premises verifying that Licensee (i) is a valid business, (ii) has a true business identity, (iii) has placed the computer or other equipment or hardware that will be used to receive the TWN Services, and any files or storage media containing EVS Information, in a secure location, and (iv) will use the EVS Information only in accordance with its obligations set forth in these TWN Terms.
Eligible Subscribers. Licensee certifies that it is not, and will immediately notify RealPage if it becomes, any of the following: (i) an adult entertainment service of any kind (including online gambling, where legal); (ii) a company that handles physical third party repossession; (iii) a dating service; (iv) a company that charges advance fees for debt or mortgage assistance relief (excluding refinancing of a dwelling loan or services offered by attorneys); (v) a debt settlement company; or (vi) a private investigation or detective service (excluding assisting with pre-employment services with written consent). RealPage will not provide, and will immediately cease providing, the TWN Services to any entity within the foregoing categories.
Electronic Acceptance; FCRA Certification; Records. These TWN Terms constitute Licensee's subscriber agreement for the TWN Services and must be accepted by an authorized representative of Licensee before Licensee receives any EVS Information. Acceptance is captured electronically within the RealPage ordering process by the authorized representative affirmatively checking the acceptance box presented with a link to these TWN Terms (including the Exhibits), which action constitutes Licensee's electronic signature and execution of these TWN Terms in accordance with the federal E-SIGN Act and applicable state electronic transactions laws. In addition, and as a separate certification, the same acceptance constitutes Licensee's execution and delivery of the Subscriber FCRA Certification set forth in Exhibit 3, by which Licensee certifies that it has read and understands its obligations under the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. ("FCRA") and the penalties for requesting Data under false pretenses. RealPage will retain a record of each acceptance, including the version of these TWN Terms and each Exhibit accepted and the date, time, and identity of the accepting individual, and will make such records available to EVS upon request.
No Modification; EVS Discretion. Licensee acknowledges that these TWN Terms are required by EVS and may not be modified without the prior written approval of EVS. EVS may, in its sole discretion, deny Licensee access to the TWN Services even where Licensee otherwise meets the criteria for qualification, and Licensee releases EVS from any and all claims, demands, actions, causes of action, suits, costs, damages, expenses, compensation, penalties, liabilities and obligations of any kind or nature whatsoever arising out of or relating to such denial of access, and covenants not to sue or maintain any claim against EVS arising out of or relating to such denial.
Ongoing Monitoring. RealPage will monitor Licensee's ongoing compliance with these TWN Terms and will immediately cease providing the TWN Services to Licensee if Licensee no longer meets the requirements for qualification.
Property Owners and Managers. Where Licensee is a Site owner and a third-party property manager ("Manager") will access or use the TWN Services or EVS Information on Licensee's behalf, such access is permitted only if the Manager either (i) has itself completed the qualification process described in this Section 2 and accepted these TWN Terms and the Subscriber FCRA Certification (Exhibit 3) as a party in the manner described in Section 2.3, or (ii) has been approved in writing by EVS as a service provider of Licensee and has entered into such written agreements as EVS may require, in each case in accordance with Section 10 (Service Providers). No owner, Manager, or other recipient may access or receive EVS Information unless it satisfies clause (i) or clause (ii) of the foregoing sentence.
Permitted Use; Confidentiality.
Exclusive Use for Tenant Screening. Any EVS Information requested by Licensee will be only for Licensee's exclusive use for tenant screening purposes and will be held in strict confidence, except to the extent that disclosure to others is required or permitted by law. Only designated representatives of Licensee will request EVS Information, and Licensee's employees will be forbidden from obtaining EVS Information on themselves, associates, or any other persons except in the exercise of their official duties.
Single Use. Data provided from the TWN Services is limited to a single use for the permissible purpose for which it was obtained. Information provided from other EVS services is limited to a single use for the purpose for which it was obtained.
No Disclosure to Consumers; Referral to EVS. Licensee will not disclose EVS Information to the Consumer who is the subject of the EVS Information except as permitted or required by law, but will refer the Consumer to EVS. Consumer requests for disclosure of, and Consumer disputes regarding, EVS Information will be referred to EVS using the contact information in Section 14 (EVS Contact Information) below.
No Redistribution. Licensee shall not resell, sublicense, distribute, or otherwise make EVS Information available to any third party.
Consumer Authorization. Licensee represents that, before requesting income Data through the TWN Services, it has obtained authorization from the Consumer authorizing Licensee to verify the Consumer's income data. Licensee need not use any particular form of authorization, provided the authorization is auditable and demonstrates to a reasonable degree of certainty that the Consumer has authorized Licensee to receive the income Data. Upon request by EVS or RealPage at any time, Licensee shall promptly provide such Consumer authorizations. Licensee's failure to produce requested Consumer authorizations may result in immediate suspension of the TWN Services until such time as Licensee corrects any discrepancy revealed by an audit.
FCRA Certifications. LICENSEE ACKNOWLEDGES THAT THE TWN SERVICES ARE A "CONSUMER REPORT" AS DEFINED BY THE FCRA.
Permissible Purpose. Licensee certifies that it will order Data only when Licensee intends to use the Data for tenant screening purposes (i) in accordance with the FCRA and all state law FCRA counterparts as though the Data is a consumer report, and (ii) after having obtained one of the following FCRA permissible purposes: (1) in connection with a credit transaction involving the Consumer on whom the Data is to be furnished and involving the extension of credit to, or review or collection of an account of, the Consumer; (2) in connection with the underwriting of insurance involving the Consumer; (3) as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation; (4) in connection with a determination of the Consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status; or (5) when Licensee otherwise has a legitimate business need for the information either in connection with a business transaction that is initiated by the Consumer, or to review an account to determine whether the Consumer continues to meet the terms of the account — and for no other purpose.
Notice to Users. The full text of the "Notice to Users of Consumer Reports: Obligations of Users Under the FCRA" is attached to these TWN Terms as Exhibit 1 and is presented to Licensee as part of the acceptance process described in Section 2.3. Licensee certifies that it has received, reviewed, and will comply with the obligations set forth in the Notice to Users, which explains Licensee's obligations under the FCRA as a user of consumer information, and agrees to use the Data only consistent with the obligations of users of consumer reports as provided for in the Consumer Financial Protection Bureau's Notice to Users.
False Pretenses. IT IS RECOGNIZED AND UNDERSTOOD THAT THE FCRA PROVIDES THAT ANYONE WHO KNOWINGLY AND WILLFULLY OBTAINS INFORMATION ON A CONSUMER FROM A CONSUMER REPORTING AGENCY UNDER FALSE PRETENSES SHALL BE FINED UNDER TITLE 18, UNITED STATES CODE, IMPRISONED FOR NOT MORE THAN TWO (2) YEARS, OR BOTH.
Adverse Action; ECOA. Licensee will comply with the applicable provisions of the FCRA, the federal Equal Credit Opportunity Act and any amendments to it, all state law counterparts of them, and all applicable regulations promulgated under any of them, including, without limitation, any provisions requiring adverse action notification to the Consumer.
State Law Certifications.
Vermont. Licensee certifies that it will comply with applicable provisions under Vermont law. In particular, Licensee certifies that it will order Data relating to Vermont residents that are consumer reports as defined by the Vermont Fair Credit Reporting Act ("VFCRA") only after Licensee has received prior Consumer consent in accordance with VFCRA Section 2480e and applicable Vermont Rules. A copy of Section 2480e of the Vermont Fair Credit Reporting Statute and the applicable Vermont Rule, together with the Vermont Fair Credit Reporting Contract Certification, is attached as Exhibit 2 and is presented to Licensee as part of the acceptance process described in Section 2.3; Licensee certifies that it has received such copy, and Licensee's acceptance of these TWN Terms constitutes its execution and delivery of the certification in Exhibit 2 with respect to any Data Licensee orders relating to Vermont residents.
California Retail Seller. Section 1785.14(a) of the California Civil Code imposes special requirements with respect to transactions in which a "retail seller" (as defined in Section 1802.3 of the California Civil Code) intends to issue credit to a California resident who appears in person on the basis of an application for credit submitted in person ("point of sale transactions"). Licensee certifies that these requirements do not apply to it because (a) Licensee is NOT a "retail seller" (as defined in Section 1802.3 of the California Civil Code), and/or (b) Licensee does NOT issue credit to California residents who appear in person on the basis of applications for credit submitted in person. Licensee further certifies that it will notify EVS and RealPage in writing thirty (30) days PRIOR to becoming a retail seller or engaging in point of sale transactions with respect to California residents.
California ICRAA Compliance. Licensee certifies that it will order the TWN Services that are Investigative Consumer Reports, as defined by California Civil Code Section 1786, et seq. ("ICRAA"), in connection with (i) the hiring of a dwelling unit, as defined in California Civil Code Section 1940, subdivision (c), (ii) employment purposes, or (iii) determining a consumer's eligibility for insurance or the rate for any insurance, in all cases in compliance with these TWN Terms (including all FCRA certifications and requirements) and the following additional requirements; provided that Licensee's use of the TWN Services remains at all times limited to tenant screening purposes as required by Section 3.1. For the purposes of this Section, the term "consumer" shall have the meaning provided in the ICRAA. In making this certification, Licensee will refer to the ICRAA and the below required certifications from the ICRAA:
Insurance Underwriting. If an Investigative Consumer Report is sought in connection with the underwriting of insurance, Licensee certifies that it shall clearly and accurately disclose in writing at the time the application form, medical form, binder, or similar document is signed by the consumer that an Investigative Consumer Report regarding the consumer's character, general reputation, personal characteristics, and mode of living may be made. If no signed application form, medical form, binder, or similar document is involved in the underwriting transaction, the disclosure shall be made to the consumer in writing and mailed or otherwise delivered to the consumer not later than three days after the report was first requested. The disclosure shall include the name and address of any investigative consumer reporting agency conducting an investigation, plus the nature and scope of the investigation requested, and a summary of the provisions of Cal. Civ. Code Section 1786.22.
Employment Purposes. If an Investigative Consumer Report is sought for employment purposes other than suspicion of wrongdoing or misconduct by the subject of the investigation, Licensee certifies that: (a) the consumer has authorized in writing the procurement of the report; and (b) Licensee has provided a clear and conspicuous disclosure in writing to the consumer at any time before the report is procured or caused to be made in a document that consists solely of the following required disclosure, that: (A) an Investigative Consumer Report may be obtained; (B) the permissible purpose of the Investigative Consumer Report is identified; (C) the disclosure may include information on the consumer's character, general reputation, personal characteristics, and mode of living; (D) identifies the name, address, and telephone number of the investigative consumer reporting agency conducting the investigation; (E) notifies the consumer in writing of the nature and scope of the investigation requested, including a summary of the provisions of Cal. Civ. Code Section 1786.22; and (F) notifies the consumer of the Internet Web site address of the investigative consumer reporting agency identified in clause (D) above, or, if the agency has no Internet Web site address, the telephone number of the agency, where the consumer may find information about the investigative reporting agency's privacy practices, including whether the consumer's personal information will be sent outside the United States or its territories and information that complies with Cal. Civ. Code Section 1786.20, subdivision (d).
Hiring of a Dwelling Unit. If an Investigative Consumer Report is sought in connection with the hiring of a dwelling unit, as defined in Cal. Civ. Code subdivision (c) of Section 1940, Licensee certifies that it has, not later than three days after the date on which the report was first requested, provided notice to the consumer in writing that an Investigative Consumer Report will be made regarding the consumer's character, general reputation, personal characteristics, and mode of living. The notification shall also include the name and address of the investigative consumer reporting agency that will prepare the report and a summary of the provisions of Cal. Civ. Code Section 1786.22.
Disclosures. Licensee agrees to provide a copy of the report to the subject of the investigation, as provided in Cal. Civ. Code Section 1786.16, subdivision (b).
Additional Requirements. Licensee shall: (a) provide the consumer a means by which the consumer may indicate on a written form, by means of a box to check, that the consumer wishes to receive a copy of the Investigative Consumer Report. If the consumer wishes to receive a copy of the report, Licensee shall send a copy of the report to the consumer within three (3) business days of the date that the report is provided to Licensee, who may contract with any other entity to send a copy to the consumer. The notice to request the Investigative Consumer Report may be contained on either the disclosure form or a separate consent form. The copy of the report shall contain the name, address, and telephone number of Equifax as the issuer of the Investigative Consumer Report and how to contact Equifax with respect to Investigative Consumer Reports; (b) comply with Cal. Civ. Code Section 1786.40, if Licensee takes adverse action against the consumer to which the Investigative Consumer Report relates — specifically, Licensee acknowledges and agrees, within a reasonable period of time and upon the consumer's written request for the reasons for the adverse action received within sixty (60) days after the consumer learns of the adverse action, to disclose the nature and substance of the information to the consumer, and to clearly and accurately disclose to the consumer his or her right to make this written request at the time the adverse action is communicated to the consumer (EVS contact information for these purposes is set forth in Section 14); and (c) notify EVS of any change in the permissible purpose for which information will be used, where applicable.
Data Security. This Section 7 applies to any means through which Licensee orders or accesses the TWN Services including, without limitation, system-to-system, personal computer or the internet. The term "Authorized User" means a Licensee employee that Licensee has authorized to order the TWN Services and who is trained on Licensee's obligations under these TWN Terms with respect to the ordering and use of the TWN Services, including Licensee's FCRA and other obligations with respect to the access and use of consumer reports.
With respect to handling the TWN Services and/or EVS Information, Licensee agrees to:
ensure that only Authorized Users can order or have access to the TWN Services and/or EVS Information;
ensure that Authorized Users do not order the TWN Services for personal reasons or provide them to any third party except as permitted by these TWN Terms;
inform Authorized Users that unauthorized access to consumer reports (Data) may subject them to civil and criminal liability under the FCRA punishable by fines and imprisonment;
ensure that all devices used by Licensee to order or access the TWN Services and/or EVS Information are placed in a secure location and accessible only by Authorized Users, and that such devices are secured when not in use through such means as screen locks, shutting power controls off, or other commercially reasonable security procedures and controls which are standard practice in the data protection industry ("Industry Standard Practices"), for example compliance with ISO 27001 standards;
take all necessary measures to prevent unauthorized ordering of the TWN Services by any persons other than Authorized Users for permissible purposes, including, without limitation, (a) limiting the knowledge of the Licensee security codes, member numbers, User IDs, and any passwords Licensee may use (collectively, "Security Information") to those individuals with a need to know, (b) changing Licensee's user passwords at least every ninety (90) days, or sooner if an Authorized User is no longer responsible for accessing the TWN Services, or if Licensee suspects an unauthorized person has learned the password, and (c) using all security features in the software and hardware Licensee uses to order the TWN Services;
in no event access the TWN Services via any hand-held wireless communication device, including but not limited to, web enabled cell phones, interactive wireless pagers, personal digital assistants (PDAs), mobile data terminals, and portable data terminals;
not use non-company owned assets such as personal computer hard drives or portable and/or removable data storage equipment or media (including but not limited to laptops, zip drives, tapes, disks, CDs, and DVDs) to store EVS Information;
encrypt EVS Information when it is not in use; store all printed data from EVS Information in a secure, locked container when not in use; and completely destroy printed EVS Information when no longer needed by cross-cut shredding machines (or other equally effective destruction method) such that the results are not readable or useable for any purpose;
if Licensee sends, transfers or ships any EVS Information, encrypt the EVS Information using the following minimum standards, which standards may be modified from time to time by EVS: FIPS 140-2 compliant ciphers and algorithms;
monitor compliance with the obligations of this Section 7, and immediately notify EVS if Licensee suspects or knows of any unauthorized access or attempt to access the TWN Services, including, without limitation, a review of invoices for the purpose of detecting any unauthorized activity;
not ship hardware or software between Licensee's locations or to third parties without deleting all Security Information and any EVS Information;
if Licensee uses a third-party service provider to establish access to the TWN Services and/or EVS Information, to the extent EVS approves such service provider in accordance with Section 10 (Service Providers), be responsible for the service provider's use of Security Information, and ensure the service provider safeguards Security Information through the use of security requirements that are no less stringent than those applicable to Licensee under this Section 7;
use Industry Standard Practices to assure data security when disposing of any consumer information or record obtained from the TWN Services. Such efforts must include the use of those procedures issued by the federal regulatory agency charged with oversight of Licensee's activities (e.g., the Consumer Financial Protection Bureau, the applicable banking or credit union regulator) applicable to the disposal of consumer report information or records;
use Industry Standard Practices to secure EVS Information when stored on servers, subject to the following requirements: (a) servers storing EVS Information must be separated from the internet or other public networks by firewalls which are managed and configured to meet industry accepted best practices; (b) protect EVS Information through multiple layers of network security, including but not limited to, industry-recognized firewalls, routers, and intrusion detection/prevention devices (IDS/IPS); (c) secure access (both physical and network) to systems storing EVS Information, which must include authentication and passwords that are changed at least every ninety (90) days; and (d) all servers must be kept current and patched on a timely basis with appropriate security specific system patches, as they are available;
not allow EVS Information to be displayed via the internet unless utilizing, at a minimum, a three-tier architecture configured in accordance with industry best practices; and
use Industry Standard Practices to establish procedures and logging mechanisms for systems and networks that will allow tracking and analysis in the event there is a compromise, and maintain an audit trail history for at least three (3) months for review by EVS.
If EVS reasonably believes that Licensee has violated this Section 7, EVS may, in addition to any other remedy authorized by these TWN Terms, with reasonable advance written notice to Licensee and at EVS's sole expense, conduct, or have a third party conduct on its behalf, an audit of Licensee's network security systems, facilities, practices and procedures to the extent EVS reasonably deems necessary, including an on-site inspection, to evaluate Licensee's compliance with the data security requirements of this Section 7.
Audits. EVS may periodically conduct audits of Licensee regarding its compliance with the FCRA and the certifications and other obligations in these TWN Terms. Audits will be conducted by mail and/or email whenever possible and will require Licensee to provide documentation as to permissible use of particular Data. In addition, EVS shall have the right to audit Licensee's performance under these TWN Terms, from time to time, during normal business hours, at all locations containing relevant records, with ten (10) days' prior notice to Licensee. Licensee shall (i) fully cooperate with and in any such audit, and (ii) promptly correct any discrepancy revealed by such audit, and shall provide EVS or its designee access to properties, records and personnel as EVS may reasonably request to conduct such audit(s). Licensee gives its consent to EVS to conduct such audits and agrees that any failure to cooperate fully and promptly in the conduct of any audit, or Licensee's material breach of these TWN Terms, constitutes grounds for immediate suspension of the TWN Services or termination of Licensee's access to the TWN Services. If EVS terminates Licensee's access due to the conditions in the preceding sentence, Licensee (i) unconditionally releases and agrees to hold EVS harmless and indemnify it from and against any and all liabilities of whatever kind or nature that may arise from or relate to such termination, and (ii) covenants that it will not assert any claim or cause of action of any kind or nature against EVS in connection with such termination. Licensee acknowledges that RealPage is required to provide EVS with documentation indicating that RealPage validated the legitimacy of Licensee prior to contract execution and with a copy of the agreement between RealPage and Licensee.
Territory. Licensee may access, use and store the TWN Services and/or EVS Information only at or from locations within the territorial boundaries of the United States (the "Permitted Territory"). Licensee may not access, use or store the TWN Services and/or EVS Information at or from, or send them to, any location outside of the Permitted Territory without first obtaining EVS's written permission.
Service Providers. Licensee may not allow a third party service provider (including any Manager acting under Section 2.6(ii)) to access, use, or store the TWN Services and/or EVS Information on Licensee's behalf without first obtaining EVS's prior written approval and entering into such written agreements as EVS may require. The territorial provisions of Section 9 (Territory) are fully applicable to any service provider of Licensee that has access to the TWN Services and/or EVS Information.
No Warranty; Release; Hold Harmless.
Licensee recognizes that EVS does not guarantee the accuracy or completeness of the TWN Services, and Licensee releases EVS and EVS's agents, employees, affiliated credit reporting agencies and independent contractors from any liability, including negligence, in connection with the provision of the TWN Services and from any loss or expense suffered by Licensee resulting directly or indirectly from the TWN Services. Licensee covenants not to sue or maintain any claim, cause of action, demand, cross-action, counterclaim, third-party action or other form of pleading against EVS, EVS's agents, employees, affiliated credit reporting agencies, or independent contractors arising out of or relating in any way to the accuracy, validity, or completeness of any Data or Information from the TWN Services.
Licensee will hold EVS and all its agents harmless on account of any expense or damage arising or resulting from the publishing or other disclosure of EVS Information by Licensee, its employees or agents contrary to Section 3 (Permitted Use; Confidentiality) or applicable law.
Charges; Direct Payment Upon Termination. Licensee will be charged for the TWN Services by RealPage, which is responsible for paying EVS for the TWN Services; provided, however, should the underlying relationship between Licensee and RealPage terminate at any time, charges for the TWN Services will be invoiced directly to Licensee by EVS, and Licensee will be solely responsible to pay EVS directly.
Modification of Services; Compliance with Laws. EVS may modify any of the TWN Services on thirty (30) days' notice. Licensee may terminate the affected TWN Service within thirty (30) days after notice of a modification on written notice; absence of such termination shall constitute Licensee's agreement to the modification. Licensee will comply with all applicable laws, statutes and regulations regarding the TWN Services including, but not limited to, the FCRA. Where applicable, Licensee will comply with Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq. ("GLBA") and the implementing regulations issued thereunder and any other applicable statutes or federal laws, and Licensee will not use or disclose any Information other than in accordance with Section 6802(c) or with one of the General Exceptions of Section 6802(e) of the GLBA and applicable regulations and all other US privacy laws.
EVS Contact Information. Consumer disputes and requests for disclosure regarding EVS Information should be directed to: Equifax Workforce Solutions LLC, 3470 Rider Trail S, Earth City, MO 63045; Toll-free: 1-866-222-5880; Online: https://employees.theworknumber.com.
Exhibits. The following exhibits are attached to and form part of these TWN Terms, and each is presented to Licensee during the acceptance process described in Section 2.3: Exhibit 1 (Notice to Users of Consumer Reports: Obligations of Users Under the FCRA); Exhibit 2 (Vermont Fair Credit Reporting Contract Certification and State Compliance Materials); and Exhibit 3 (Subscriber FCRA Certification).
Trademark. The Work Number® is a registered trademark of Equifax® Inc.
Exhibit 1 to the TWN Terms — Notice to Users of Consumer Reports: Obligations of Users Under the FCRA
All users of consumer reports must comply with all applicable regulations. Information about applicable regulations currently in effect can be found at the Consumer Financial Protection Bureau's website, www.consumerfinance.gov/learnmore.
NOTICE TO USERS OF CONSUMER REPORTS: OBLIGATIONS OF USERS UNDER THE FCRA
The Fair Credit Reporting Act (FCRA), 15 U.S.C. 1681-1681y, requires that this notice be provided to inform users of consumer reports of their legal obligations. State law may impose additional requirements. The text of the FCRA is set forth in full at the Consumer Financial Protection Bureau's (CFPB) website at www.consumerfinance.gov/learnmore. At the end of this document is a list of United States Code citations for the FCRA. Other information about user duties is also available at the CFPB's website. Users must consult the relevant provisions of the FCRA for details about their obligations under the FCRA.
The first section of this summary sets forth the responsibilities imposed by the FCRA on all users of consumer reports. The subsequent sections discuss the duties of users of reports that contain specific types of information, or that are used for certain purposes, and the legal consequences of violations. If you are a furnisher of information to a consumer reporting agency (CRA), you have additional obligations and will receive a separate notice from the CRA describing your duties as a furnisher.
OBLIGATIONS OF ALL USERS OF CONSUMER REPORTS
Users Must Have a Permissible Purpose
Congress has limited the use of consumer reports to protect consumers' privacy. All users must have a permissible purpose under the FCRA to obtain a consumer report. Section 604 contains a list of the permissible purposes under the law. These are:
As ordered by a court or a federal grand jury subpoena. Section 604(a)(1)
As instructed by the consumer in writing. Section 604(a)(2)
For the extension of credit as a result of an application from a consumer, or the review or collection of a consumer's account. Section 604(a)(3)(A)
For employment purposes, including hiring and promotion decisions, where the consumer has given written permission. Sections 604(a)(3)(B) and 604(b)
For the underwriting of insurance as a result of an application from a consumer. Section 604(a)(3)(C)
When there is a legitimate business need, in connection with a business transaction that is initiated by the consumer. Section 604(a)(3)(F)(i)
To review a consumer's account to determine whether the consumer continues to meet the terms of the account. Section 604(a)(3)(F)(ii)
To determine a consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status. Section 604(a)(3)(D)
For use by a potential investor or servicer, or current insurer, in a valuation or assessment of the credit or prepayment risks associated with an existing credit obligation. Section 604(a)(3)(E)
For use by state and local officials in connection with the determination of child support payments, or modifications and enforcement thereof. Sections 604(a)(4) and 604(a)(5)
In addition, creditors and insurers may obtain certain consumer report information for the purpose of making "prescreened" unsolicited offers of credit or insurance. Section 604(c). The particular obligations of users of "prescreened" information are described in Section VII below.
Users Must Provide Certifications
Section 604(f) prohibits any person from obtaining a consumer report from a consumer reporting agency (CRA) unless the person has certified to the CRA the permissible purpose(s) for which the report is being obtained and certifies that the report will not be used for any other purpose.
Users Must Notify Consumers When Adverse Actions Are Taken
The term "adverse action" is defined very broadly by Section 603. "Adverse actions" include all business, credit, and employment actions affecting consumers that can be considered to have a negative impact as defined by Section 603(k) of the FCRA — such as denying or canceling credit or insurance, or denying employment or promotion. No adverse action occurs in a credit transaction where the creditor makes a counteroffer that is accepted by the consumer.
Adverse Actions Based on Information Obtained From a CRA
If a user takes any type of adverse action as defined by the FCRA that is based at least in part on information contained in a consumer report, Section 615(a) requires the user to notify the consumer. The notification may be done in writing, orally, or by electronic means. It must include the following:
The name, address, and telephone number of the CRA (including a toll-free telephone number, if it is a nationwide CRA) that provided the report.
A statement that the CRA did not make the adverse decision and is not able to explain why the decision was made.
A statement setting forth the consumer's right to obtain a free disclosure of the consumer's file from the CRA if the consumer makes a request within 60 days.
A statement setting forth the consumer's right to dispute directly with the CRA the accuracy or completeness of any information provided by the CRA.
Adverse Actions Based on Information Obtained From Third Parties Who Are Not Consumer Reporting Agencies
If a person denies (or increases the charge for) credit for personal, family, or household purposes based either wholly or partly upon information from a person other than a CRA, and the information is the type of consumer information covered by the FCRA, Section 615(b)(1) requires that the user clearly and accurately disclose to the consumer his or her right to be told the nature of the information that was relied upon if the consumer makes a written request within 60 days of notification. The user must provide the disclosure within a reasonable period of time following the consumer's written request.
Adverse Actions Based on Information Obtained From Affiliates
If a person takes an adverse action involving insurance, employment, or a credit transaction initiated by the consumer, based on information of the type covered by the FCRA, and this information was obtained from an entity affiliated with the user of the information by common ownership or control, Section 615(b)(2) requires the user to notify the consumer of the adverse action. The notice must inform the consumer that he or she may obtain a disclosure of the nature of the information relied upon by making a written request within 60 days of receiving the adverse action notice. If the consumer makes such a request, the user must disclose the nature of the information not later than 30 days after receiving the request. If consumer report information is shared among affiliates and then used for an adverse action, the user must make an adverse action disclosure as set forth in I.C.1 above.
Users Have Obligations When Fraud and Active Duty Military Alerts are in Files
When a consumer has placed a fraud alert, including one relating to identity theft, or an active duty military alert with a nationwide consumer reporting agency as defined in Section 603(p) and resellers, Section 605A(h) imposes limitations on users of reports obtained from the consumer reporting agency in certain circumstances, including the establishment of a new credit plan and the issuance of additional credit cards. For initial fraud alerts and active duty alerts, the user must have reasonable policies and procedures in place to form a belief that the user knows the identity of the applicant or contact the consumer at a telephone number specified by the consumer; in the case of extended fraud alerts, the user must contact the consumer in accordance with the contact information provided in the consumer's alert.
Users Have Obligations When Notified of an Address Discrepancy
Section 605(h) requires nationwide CRAs, as defined in Section 603(p), to notify users that request reports when the address for a consumer provided by the user in requesting the report is substantially different from the addresses in the consumer's file. When this occurs, users must comply with regulations specifying the procedures to be followed. Federal regulations are available at www.consumerfinance.gov/learnmore.
Users Have Obligations When Disposing of Records
Section 628 requires that all users of consumer report information have in place procedures to properly dispose of records containing this information. Federal regulations have been issued that cover disposal.
CREDITORS MUST MAKE ADDITIONAL DISCLOSURES
If a person uses a consumer report in connection with an application for, or a grant, extension, or provision of, credit to a consumer on material terms that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through that person, based in whole or in part on a consumer report, the person must provide a risk-based pricing notice to the consumer in accordance with regulations prescribed by the CFPB.
Section 609(g) requires a disclosure by all persons that make or arrange loans secured by residential real property (one to four units) and that use credit scores. These persons must provide credit scores and other information about credit scores to applicants, including the disclosure set forth in Section 609(g)(1)(D) ("Notice to the Home Loan Applicant").
OBLIGATIONS OF USERS WHEN CONSUMER REPORTS ARE OBTAINED FOR EMPLOYMENT PURPOSES
Employment Other Than in the Trucking Industry
If information from a CRA is used for employment purposes, the user has specific duties, which are set forth in Section 604(b) of the FCRA. The user must:
Make a clear and conspicuous written disclosure to the consumer before the report is obtained, in a document that consists solely of the disclosure, that a consumer report may be obtained.
Obtain from the consumer prior written authorization. Authorization to access reports during the term of employment may be obtained at the time of employment.
Certify to the CRA that the above steps have been followed, that the information being obtained will not be used in violation of any federal or state equal opportunity law or regulation, and that, if any adverse action is to be taken based on the consumer report, a copy of the report and a summary of the consumer's rights will be provided to the consumer.
Before taking an adverse action, the user must provide a copy of the report to the consumer as well as the summary of consumer's rights. (The user should receive this summary from the CRA.) A Section 615(a) adverse action notice should be sent after the adverse action is taken.
An adverse action notice also is required in employment situations if credit information (other than transactions and experience data) obtained from an affiliate is used to deny employment. Section 615(b)(2)
The procedures for investigative consumer reports and employee misconduct investigations are set forth below.
Employment in the Trucking Industry
Special rules apply for truck drivers where the only interaction between the consumer and the potential employer is by mail, telephone, or computer. In this case, the consumer may provide consent orally or electronically, and an adverse action may be made orally, in writing, or electronically. The consumer may obtain a copy of any report relied upon by the trucking company by contacting the company.
OBLIGATIONS WHEN INVESTIGATIVE CONSUMER REPORTS ARE USED
Investigative consumer reports are a special type of consumer report in which information about a consumer's character, general reputation, personal characteristics, and mode of living is obtained through personal interviews by an entity or person that is a consumer reporting agency. Consumers who are the subjects of such reports are given special rights under the FCRA. If a user intends to obtain an investigative consumer report, Section 606 requires the following:
The user must disclose to the consumer that an investigative consumer report may be obtained. This must be done in a written disclosure that is mailed, or otherwise delivered, to the consumer at some time before or not later than three days after the date on which the report was first requested. The disclosure must include a statement informing the consumer of his or her right to request additional disclosures of the nature and scope of the investigation as described below, and the summary of consumer rights required by Section 609 of the FCRA. (The summary of consumer rights will be provided by the CRA that conducts the investigation.)
The user must certify to the CRA that the disclosures set forth above have been made and that the user will make the disclosure described below.
Upon the written request of a consumer made within a reasonable period of time after the disclosures required above, the user must make a complete disclosure of the nature and scope of the investigation. This must be made in a written statement that is mailed, or otherwise delivered, to the consumer no later than five days after the date on which the request was received from the consumer or the report was first requested, whichever is later in time.
SPECIAL PROCEDURES FOR EMPLOYEE INVESTIGATIONS
Section 603(x) provides special procedures for investigations of suspected misconduct by an employee or for compliance with Federal, state or local laws and regulations or the rules of a self-regulatory organization, and compliance with written policies of the employer. These investigations are not treated as consumer reports so long as the employer or its agent complies with the procedures set forth in Section 603(x), and a summary describing the nature and scope of the inquiry is made to the employee if an adverse action is taken based on the investigation.
OBLIGATIONS OF USERS OF MEDICAL INFORMATION
Section 604(g) limits the use of medical information obtained from consumer reporting agencies (other than payment information that appears in a coded form that does not identify the medical provider). If the information is to be used for an insurance transaction, the consumer must give consent to the user of the report or the information must be coded. If the report is to be used for employment purposes — or in connection with a credit transaction (except as provided in federal regulations) — the consumer must provide specific written consent and the medical information must be relevant. Any user who receives medical information shall not disclose the information to any other person (except where necessary to carry out the purpose for which the information was disclosed, or as permitted by statute, regulation, or order).
OBLIGATIONS OF USERS OF "PRESCREENED" LISTS
The FCRA permits creditors and insurers to obtain limited consumer report information for use in connection with unsolicited offers of credit or insurance under certain circumstances. Sections 603(l), 604(c), 604(e), and 615(d). This practice is known as "prescreening" and typically involves obtaining from a CRA a list of consumers who meet certain preestablished criteria. If any person intends to use prescreened lists, that person must (1) before the offer is made, establish the criteria that will be relied upon to make the offer and to grant credit or insurance, and (2) maintain such criteria on file for a three-year period beginning on the date on which the offer is made to each consumer. In addition, any user must provide with each written solicitation a clear and conspicuous statement that:
Information contained in a consumer's CRA file was used in connection with the transaction.
The consumer received the offer because he or she satisfied the criteria for credit worthiness or insurability used to screen for the offer.
Credit or insurance may not be extended if, after the consumer responds, it is determined that the consumer does not meet the criteria used for screening or any applicable criteria bearing on credit worthiness or insurability, or the consumer does not furnish required collateral.
The consumer may prohibit the use of information in his or her file in connection with future prescreened offers of credit or insurance by contacting the notification system established by the CRA that provided the report. The statement must include the address and toll-free telephone number of the appropriate notification system.
In addition, the CFPB has established the format, type size, and manner of the disclosure required by Section 615(d), with which users must comply. The relevant regulation is 12 CFR 1022.54.
OBLIGATIONS OF RESELLERS
Disclosure and Certification Requirements
Section 607(e) requires any person who obtains a consumer report for resale to take the following steps:
Disclose the identity of the end-user to the source CRA.
Identify to the source CRA each permissible purpose for which the report will be furnished to the end-user.
Establish and follow reasonable procedures to ensure that reports are resold only for permissible purposes, including procedures to obtain: (1) the identity of all end-users; (2) certifications from all users of each purpose for which reports will be used; and (3) certifications that reports will not be used for any purpose other than the purpose(s) specified to the reseller. Resellers must make reasonable efforts to verify this information before selling the report.
Reinvestigations by Resellers
Under Section 611(f), if a consumer disputes the accuracy or completeness of information in a report prepared by a reseller, the reseller must determine whether this is a result of an action or omission on its part and, if so, correct or delete the information. If not, the reseller must send the dispute to the source CRA for reinvestigation. When any CRA notifies the reseller of the results of an investigation, the reseller must immediately convey the information to the consumer.
Fraud Alerts and Resellers
Section 605A(f) requires resellers who receive fraud alerts or active duty alerts from another consumer reporting agency to include these in their reports.
LIABILITY FOR VIOLATIONS OF THE FCRA
Failure to comply with the FCRA can result in state government or federal government enforcement actions, as well as private lawsuits. Sections 616, 617, and 621. In addition, any person who knowingly and willfully obtains a consumer report under false pretenses may face criminal prosecution. Section 619.
The CFPB's website, www.consumerfinance.gov/learnmore, has more information about the FCRA, including publications for businesses and the full text of the FCRA.
Citations for FCRA sections in the U.S. Code, 15 U.S.C. § 1681 et seq.: Section 602, 15 U.S.C. 1681; Section 603, 15 U.S.C. 1681a; Section 604, 15 U.S.C. 1681b; Section 605, 15 U.S.C. 1681c; Section 605A, 15 U.S.C. 1681cA; Section 605B, 15 U.S.C. 1681cB; Section 606, 15 U.S.C. 1681d; Section 607, 15 U.S.C. 1681e; Section 608, 15 U.S.C. 1681f; Section 609, 15 U.S.C. 1681g; Section 610, 15 U.S.C. 1681h; Section 611, 15 U.S.C. 1681i; Section 612, 15 U.S.C. 1681j; Section 613, 15 U.S.C. 1681k; Section 614, 15 U.S.C. 1681l; Section 615, 15 U.S.C. 1681m; Section 616, 15 U.S.C. 1681n; Section 617, 15 U.S.C. 1681o; Section 618, 15 U.S.C. 1681p; Section 619, 15 U.S.C. 1681q; Section 620, 15 U.S.C. 1681r; Section 621, 15 U.S.C. 1681s; Section 622, 15 U.S.C. 1681s-1; Section 623, 15 U.S.C. 1681s-2; Section 624, 15 U.S.C. 1681t; Section 625, 15 U.S.C. 1681u; Section 626, 15 U.S.C. 1681v; Section 627, 15 U.S.C. 1681w; Section 628, 15 U.S.C. 1681x; Section 629, 15 U.S.C. 1681y.
Exhibit 2 to the TWN Terms — Vermont Fair Credit Reporting Contract Certification and State Compliance Materials
Vermont Fair Credit Reporting Contract Certification
Licensee ("Subscriber") acknowledges that it subscribes to receive various information services from Equifax Workforce Solutions LLC, a provider of Equifax Verification Solutions ("EVS"), in accordance with the Vermont Fair Credit Reporting Statute, 9 V.S.A. § 2480e (1999), as amended (the "VFCRA") and the Federal Fair Credit Reporting Act, 15 U.S.C. 1681 et seq., as amended (the "FCRA") and its other state law counterparts. In connection with Subscriber's use of EVS information services in relation to Vermont consumers, Subscriber hereby certifies as follows:
Vermont Certification. Subscriber certifies that it will comply with applicable provisions under Vermont law. In particular, Subscriber certifies that it will order EVS Employment Information relating to Vermont residents, that are credit reports as defined by the VFCRA, only after Subscriber has received prior consumer consent in accordance with VFCRA § 2480e and applicable Vermont Rules. Subscriber further certifies that the copy of § 2480e of the Vermont Fair Credit Reporting Statute set forth below was received as part of this Exhibit 2.
This certification is executed and delivered by Licensee's electronic acceptance of the TWN Terms in the manner described in Section 2.3 of the TWN Terms, and applies to any Data Licensee orders relating to Vermont residents. RealPage's record of that acceptance (including the identity of the accepting individual, the accepting entity, and the date and time of acceptance) constitutes the record of this certification.
Vermont Fair Credit Reporting Statute, 9 V.S.A. § 2480e (1999) — § 2480e. Consumer consent
A person shall not obtain the credit report of a consumer unless: (1) the report is obtained in response to the order of a court having jurisdiction to issue such an order; or (2) the person has secured the consent of the consumer, and the report is used for the purpose consented to by the consumer.
Credit reporting agencies shall adopt reasonable procedures to assure maximum possible compliance with subsection (a) of this section.
Nothing in this section shall be construed to affect: (1) the ability of a person who has secured the consent of the consumer pursuant to subdivision (a)(2) of this section to include in his or her request to the consumer permission to also obtain credit reports, in connection with the same transaction or extension of credit, for the purpose of reviewing the account, increasing the credit line on the account, for the purpose of taking collection action on the account, or for other legitimate purposes associated with the account; and (2) the use of credit information for the purpose of prescreening, as defined and permitted from time to time by the Consumer Financial Protection Bureau.
VERMONT RULES — CURRENT THROUGH JUNE 1999 — AGENCY 06. OFFICE OF THE ATTORNEY GENERAL, SUB-AGENCY 031. CONSUMER PROTECTION DIVISION, CHAPTER 012. Consumer Fraud — Fair Credit Reporting, RULE CF 112 FAIR CREDIT REPORTING, CVR 06-031-012, CF 112.03 (1999) — CF 112.03 CONSUMER CONSENT
A person required to obtain consumer consent pursuant to 9 V.S.A. §§ 2480e and 2480g shall obtain said consent in writing if the consumer has made a written application or written request for credit, insurance, employment, housing or governmental benefit. If the consumer has applied for or requested credit, insurance, employment, housing or governmental benefit in a manner other than in writing, then the person required to obtain consumer consent pursuant to 9 V.S.A. §§ 2480e and 2480g shall obtain said consent in writing or in the same manner in which the consumer made the application or request. The terms of this rule apply whether the consumer or the person required to obtain consumer consent initiates the transaction.
Consumer consent required pursuant to 9 V.S.A. §§ 2480e and 2480g shall be deemed to have been obtained in writing if, after a clear and adequate written disclosure of the circumstances under which a credit report or credit reports may be obtained and the purposes for which the credit report or credit reports may be obtained, the consumer indicates his or her consent by providing his or her signature.
The fact that a clear and adequate written consent form is signed by the consumer after the consumer's credit report has been obtained pursuant to some other form of consent shall not affect the validity of the earlier consent.
Exhibit 3 to the TWN Terms — Subscriber FCRA Certification
Licensee, by its electronic acceptance of the TWN Terms in the manner described in Section 2.3 of the TWN Terms, hereby certifies to RealPage, Inc. (or the applicable RealPage CRA Affiliate) ("RealPage"), a consumer reporting agency and authorized reseller of The Work Number®, as follows:
Licensee has read and understands its obligations under the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. ("FCRA") as a user of consumer reports, including as set forth in the Notice to Users of Consumer Reports: Obligations of Users Under the FCRA (Exhibit 1 to the TWN Terms), a copy of which Licensee acknowledges it has received and reviewed.
Licensee understands that the FCRA provides that anyone who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses shall be fined under Title 18, United States Code, imprisoned for not more than two (2) years, or both.
Licensee will order The Work Number data only for tenant screening purposes, with an FCRA permissible purpose as set forth in Section 5 of the TWN Terms, and for no other purpose, and will not resell or disclose such data except as permitted by the TWN Terms or required by law.
Licensee certifies that it is not any of the following: (i) an adult entertainment service of any kind (including online gambling, where legal); (ii) a company that handles physical third party repossession; (iii) a dating service; (iv) a company that charges advance fees for debt or mortgage assistance relief (excluding refinancing of a dwelling loan or services offered by attorneys); (v) a debt settlement company; or (vi) a private investigation or detective service (excluding assisting with pre-employment services with written consent).
Licensee will notify RealPage promptly of any change in the permissible purpose for which it uses The Work Number data or in any of the certifications above.
This certification is executed and delivered electronically through Licensee's affirmative check-box acceptance of the TWN Terms within the RealPage ordering process, which constitutes Licensee's electronic signature in accordance with the federal E-SIGN Act and applicable state electronic transactions laws. RealPage will retain a record of each acceptance, including the accepting entity, the version accepted, and the date, time, and identity of the accepting individual, and will make such records available to EVS upon request.