Terms of Use

These Terms are published by Fraudcheck and take effect from the Effective Date.

These Terms govern access to and use of the Platform and Services.

By accessing the Platform or using any Services, the User is deemed to have accepted these Terms in their entirety.

No separate signature or tick-box confirmation is required.

• 1.1In these Terms, unless the context indicates a contrary intention, the following words bear the meanings assigned to them, and cognate expressions bear corresponding meanings:
• 1.1.1"Account" means the User profile, login credentials and associated configuration used to access the Platform;
• 1.1.2"Additional Services" means any new products, checks, verification services or data offerings introduced by Fraudcheck from time to time, beyond the Services described at registration;
• 1.1.3"AML" means anti-money laundering as regulated under FICA and related legislation;
• 1.1.4"API" means an application programming interface made available by Fraudcheck to allow system integration with the Platform;
• 1.1.5"Applicable Laws" means all laws, regulations, regulatory directives, codes of practice, court orders and legally binding requirements applicable to the use of the Services, including without limitation the NCA, POPIA, FICA, the ECT Act, the Consumer Protection Act 68 of 2008, the Financial Sector Regulation Act 9 of 2017, and all regulations promulgated thereunder, as amended from time to time;
• 1.1.6"Approved Discount" means a percentage discount on the fees set out in a User's Rate Card which has been approved in writing by Fraudcheck's senior management and recorded against the User's Account, as further described in clause 22.9;
• 1.1.7"Authorised Prescribed Purpose" means a Prescribed Purpose assigned to and activated on a User's Account by Fraudcheck at onboarding or subsequently, as further described in clause 10.2;
• 1.1.8"Background Screening Services" means the background verification and background screening Services described in clause 20.1;
• 1.1.9"Biometric Data" means personal information relating to the physical, physiological or behavioural characteristics of a Data Subject that allows for the unique identification of that person, including facial geometry, facial images processed for Liveness Detection, fingerprints, voice patterns and other biometric identifiers Processed through the Platform;
• 1.1.10"Business Client" has the meaning assigned to it in clause 5.1;
• 1.1.11"Business Day" means any day that is not a Saturday, Sunday or public holiday in South Africa;
• 1.1.12"Confidential Information" means any non-public information disclosed by the Disclosing Party to the Receiving Party in connection with the Platform or Services, whether in written, electronic, oral or other form, including without limitation technical information, software, algorithms, system architecture, pricing, business information, security procedures, Personal Information, User Data, Outputs, Consumer Credit Information, trade secrets, methodologies, customer lists, contractual terms and any information relating to the Platform or Services that is by its nature confidential or ought reasonably to be regarded as confidential;
• 1.1.13"Consumer Credit Information" bears the meaning set out in section 70(1)(a) to (d) of the NCA and Regulation 18(6), and includes consumer information supplied as part of the Credit Bureau Services;
• 1.1.14"Consumer Redress Process" means the process described in clause 12 for consumers who dispute the accuracy, currency or fairness of Consumer Credit Information;
• 1.1.15"Credit Bureau Association" means the industry body established to represent registered credit bureaux in South Africa;
• 1.1.16"Credit Bureau Services" means the provision of Consumer Credit Information by a credit bureau for the purpose of enabling the evaluation of a consumer's credit profile, including their credit history, repayment conduct, and financial obligations, which are subject to the additional due diligence requirements in clause 15;
• 1.1.17"Credit Regulatory Framework" means all legislation and law applicable to credit bureaux, credit providers, Consumer Credit Information and Personal Information, including without limitation the NCA, the regulations thereunder, the requirements of the Credit Bureau Association, the Credit Ombud, the South African Credit and Risk Reporting Association, POPIA, and any other legislation enacted or amended from time to time;
• 1.1.18"Data Subject" means the natural or juristic person whose Personal Information is Processed through the Services;
• 1.1.19"Disclosing Party" means the Party disclosing Confidential Information to the Receiving Party;
• 1.1.20"ECT Act" means the Electronic Communications and Transactions Act 25 of 2002;
• 1.1.21"Enterprise Client" has the meaning assigned to it in clause 5.2;
• 1.1.22"Existing Account" has the meaning assigned to it in clause 6.2;
• 1.1.23"Existing Commercial Terms" has the meaning assigned to it in clause 3.3;
• 1.1.24"FIC" means the Financial Intelligence Centre established under FICA;
• 1.1.25"FICA" means the Financial Intelligence Centre Act 38 of 2001, as amended;
• 1.1.26"Force Majeure Event" has the meaning assigned to it in clause 35.1;
• 1.1.27"Fraudcheck" means Fraudcheck Proprietary Limited (registration number 2013/031750/07), a private company incorporated under the laws of South Africa and a Tier 2 registered credit bureau (NCR registration number: NCRCB65);
• 1.1.28"Hosted Data" has the meaning assigned to it in clause 21.1;
• 1.1.29"Hosting Services" means the data hosting and storage Services described in clause 21;
• 1.1.30"Information Officer" means the person designated by Fraudcheck as its Information Officer under POPIA, as further described in clause 8;
• 1.1.31"Information Regulator" means the Information Regulator established under POPIA;
• 1.1.32"Intellectual Property" means all intellectual property rights including without limitation patents, inventions, copyright, trade marks, service marks, trade names, domain names, designs, rights in computer software, database rights, know-how, trade secrets and all other intellectual property rights, whether registered or unregistered, and all applications and renewals thereof;
• 1.1.33"KYC" means know-your-customer processes including identity verification, document verification, Liveness Detection, biometric matching, sanctions screening and related compliance checks;
• 1.1.34"Liveness Detection" means automated or assisted processes used to verify that a selfie or video is of a live person and not a photograph, mask or other spoofing attempt;
• 1.1.35"NCA" means the National Credit Act 34 of 2005, as amended, and all regulations promulgated thereunder;
• 1.1.36"NCR" means the National Credit Regulator established under the NCA;
• 1.1.37"New Account" has the meaning assigned to it in clause 6.1;
• 1.1.38"Operator" means a person who Processes Personal Information on behalf of a Responsible Party, as defined in POPIA;
• 1.1.39"Outputs" means verification results, Credit Bureau Services reports, KYC reports, identity verification results, screening results, compliance checks, background verification results or other information made available through the Services, which may include information obtained from Third-Party Providers;
• 1.1.40"Parties" means Fraudcheck and the User collectively, and "Party" means either one of them as the context indicates;
• 1.1.41"Personal Information" means personal information as defined in POPIA, and includes any information relating to an identifiable, living natural person and, where applicable, an identifiable juristic person;
• 1.1.42"Platform" means Fraudcheck's web application, portal, APIs, mobile interfaces and related systems through which the Services are delivered;
• 1.1.43"Platform Availability" has the meaning assigned to it in Annexure A;
• 1.1.44"POPIA" means the Protection of Personal Information Act 4 of 2013, as amended;
• 1.1.45"Pricing Plan" means each of the Business, Growth, Enterprise – All-Unit and Enterprise – Marginal pricing plans described in clause 5.3, and "Enterprise Pricing Plan" means either of the Enterprise – All-Unit or Enterprise – Marginal Pricing Plans;
• 1.1.46"Primary User" means, where the User is an entity, the individual designated by that entity from time to time as the primary representative responsible for managing the Account on its behalf;
• 1.1.47"Prime Rate" means the prime overdraft rate of interest quoted by the major South African commercial banks from time to time;
• 1.1.48"Prescribed Purpose" means a purpose for which a User is authorised to use Consumer Credit Information as set out in Regulation 18(4), Regulation 23A or the Credit Regulatory Framework;
• 1.1.49"Processing" or "Process" has the meaning assigned in POPIA and includes any operation or set of operations concerning Personal Information, whether automated or not;
• 1.1.50"Rate Card" means the fixed schedule of fees applicable to a Pricing Plan, as published or provided by Fraudcheck from time to time;
• 1.1.51"Receiving Party" means the Party receiving Confidential Information from the Disclosing Party;
• 1.1.52"Responsible Party" means a public or private body or any other person that, alone or in conjunction with others, determines the purpose of and means for Processing Personal Information, as defined in POPIA;
• 1.1.53"Services" means the information and verification services provided by Fraudcheck through the Platform, as further described in clause 7. All Services are accessible upon registration, save that Credit Bureau Services are subject to the additional requirements in clause 15;
• 1.1.54"South Africa" means the Republic of South Africa;
• 1.1.55"Terms" means these Platform Terms of Use, together with all annexures and schedules, as updated from time to time;
• 1.1.56"Third-Party Providers" means all external entities engaged by Fraudcheck from time to time to support the delivery of the Services, including without limitation registered credit bureaux, authorised identity verification and biometric processing providers, government databases, telecommunications providers and other external data sources. The identity of Third-Party Providers is available on written request where required by Applicable Laws;
• 1.1.57"Unscheduled Downtime" has the meaning assigned to it in Annexure A;
• 1.1.58"User" means the entity or individual that registers for and uses an Account. Where the User is an entity, the Primary User manages the Account on its behalf and all actions taken through the Account are binding on the entity;
• 1.1.59"User Data" means all data and information (including Personal Information) submitted to or made available to Fraudcheck by or on behalf of the User in connection with the Services;
• 1.1.60"VAT" means value-added tax as defined in the Value-Added Tax Act 89 of 1991.

• 2.1In these Terms:
• 2.1.1clause headings are for convenience only and do not affect interpretation;
• 2.1.2references to the singular include the plural and vice versa;
• 2.1.3references to a gender include all genders;
• 2.1.4references to natural persons include juristic persons and vice versa;
• 2.1.5the word "including" is not to be construed so as to limit the ambit of the provision concerned;
• 2.1.6all amounts are exclusive of VAT unless stated otherwise;
• 2.1.7a reference to any statute includes that statute as amended or re-enacted from time to time;
• 2.1.8the contra proferentem rule shall not apply;
• 2.1.9the eiusdem generis rule shall not apply; and
• 2.1.10in the event of any conflict between these Terms and any annexure, the terms of the applicable annexure shall prevail in respect of the specific subject matter of that annexure, and these Terms shall prevail in respect of all other matters.

• 3.1These Terms govern access to and use of the Platform and Services by all Users and constitute the entire and exclusive agreement between Fraudcheck and the User in respect of the subject matter hereof.
• 3.2These Terms expressly supersede, replace and extinguish all prior versions of Fraudcheck’s terms of use, agreements, terms of service, service level agreements, data use or processing agreements, subscriber agreements, commercial arrangements, memoranda of understanding and all other written or oral understandings between the Parties relating in any way to the Platform or Services ("Prior Agreements"). No Prior Agreement that is not expressly preserved under clause 3.3 or incorporated in these Terms shall have any force or effect as between the Parties.
• 3.3Notwithstanding clause 3.2, where an Existing Account has a documented and agreed commercial arrangement with Fraudcheck that was in effect prior to the Effective Date ("Existing Commercial Terms"), those Existing Commercial Terms shall continue to apply to that Existing Account solely in respect of the agreed transaction volumes, pricing and payment terms, and are not superseded by these Terms. All other aspects of the prior relationship between the Parties are superseded. For the avoidance of doubt, any undocumented, unsigned or unconfirmed arrangements do not constitute Existing Commercial Terms for the purposes of this clause.

• 4.1These Terms are accepted without a separate signature or tick-box. By taking any of the following actions, a User is conclusively deemed to have read, understood and accepted these Terms in their entirety:
• 4.1.1proceeding with or completing the Account registration process (including the enterprise registration pathway);
• 4.1.2clicking any link sent by Fraudcheck to finalise, activate or migrate an Account;
• 4.1.3accessing or using the Platform or Services in any manner; or
• 4.1.4integrating with the Platform via API.
• 4.2Users with Existing Accounts who receive a migration link are required to accept these Terms as a condition of continued access. Proceeding with migration or accessing the updated Platform constitutes acceptance.

• 5.1A Business Client is a User assigned by Fraudcheck to the Business Pricing Plan or the Growth Pricing Plan, and accesses the Platform on Fraudcheck's standard commercial terms. Fees are charged on a per-transaction basis at the fixed fee for each Service set out in the Rate Card for the User's Pricing Plan, as notified to the User in a pricing addendum or other commercial documentation provided at or following registration. The Rate Card fees, the standard payment terms and the service levels set out in these Terms, including Annexure A, apply to Business Clients and are not subject to negotiation, save for any Approved Discount. Fraudcheck may revise the Rate Cards from time to time in accordance with clause 22.
• 5.2An Enterprise Client is a User that registers through the enterprise registration pathway and is assigned by Fraudcheck to an Enterprise Pricing Plan. Enterprise Clients are charged at the tiered fees set out in the Rate Card for their Enterprise Pricing Plan, and operate on committed transaction volumes and payment terms which are agreed separately between the Parties. Upon completion of the registration process, Fraudcheck will contact the Enterprise Client to agree the applicable commercial terms, following which Fraudcheck will send a link to finalise registration and activate the Account. If the Parties fail to agree the applicable commercial terms within 30 (thirty) calendar days of the completion of the registration process, the registration shall lapse and Fraudcheck shall have no obligation to activate the Account. Fraudcheck shall notify the User in writing if the registration lapses. Enterprise commercial terms may vary the standard provisions of these Terms to the extent expressly agreed in writing between the Parties, including without limitation committed transaction volumes or minimum spend, payment terms, service levels (which may enhance the standard service levels in Annexure A), any Approved Discount, data residency or processing location, and bespoke integration or configuration arrangements. For the avoidance of doubt, the fees set out in a Rate Card are not negotiable, and any concession on those fees may only be granted as an Approved Discount.
• 5.3Fraudcheck makes the Services available on the following Pricing Plans, each of which is reflected in a fixed Rate Card:
• 5.3.1Business – the entry-level Pricing Plan for lower-volume Users, under which a single fixed fee applies to each transaction for each Service;
• 5.3.2Growth – a Pricing Plan for Users whose transaction volumes exceed those contemplated by the Business Pricing Plan but who have not been assigned to an Enterprise Pricing Plan, under which a single fixed fee, lower than the corresponding Business fee, applies to each transaction for each Service;
• 5.3.3Enterprise – All-Unit – a Pricing Plan for high-volume Users under which each Service is priced in volume tiers, and the highest volume tier reached by the User for a Service in a calendar month determines the single fee applicable to every transaction for that Service in that calendar month; and
• 5.3.4Enterprise – Marginal – a Pricing Plan for high-volume Users under which each Service is priced in volume tiers, and the transactions falling within each volume tier in a calendar month are charged at the fee applicable to that volume tier only.
• 5.4The volume tiers applicable to each Service under an Enterprise Pricing Plan are set out in the applicable Rate Card. Transaction volumes are measured per Service per calendar month in accordance with clause 22.6, and the volume tier reached in one calendar month does not carry over to any subsequent calendar month.
• 5.5Fraudcheck assigns each User to one Pricing Plan on activation of the Account, having regard to the User's expected transaction volumes and the information provided during registration. Fraudcheck may review a Business Client's actual transaction volumes from time to time and may, on not less than 30 (thirty) calendar days' written notice, reassign the Business Client between the Business and Growth Pricing Plans. A change to or from an Enterprise Pricing Plan must be agreed between the Parties in writing.
• 5.6The Rate Cards apply uniformly to all Users assigned to the relevant Pricing Plan and are not subject to negotiation. Any concession on the fees set out in a Rate Card may only be granted as an Approved Discount in accordance with clause 22.9.
• 5.7Save for fees and provisions expressly applicable to a specific Account type, all provisions of these Terms apply equally to Business Clients and Enterprise Clients.

• 6.1A User opening a New Account must complete the Account registration process on the Platform, submit accurate information and supporting documentation as requested, designate an Primary User (where the User is an entity), and accept these Terms. Fraudcheck conducts a manual review and approval of all New Account applications. A New Account is only activated when Fraudcheck sends the User a link to finalise the Account, which the User must follow to complete access.
• 6.2Users with Existing Accounts will receive a link from Fraudcheck to migrate to the updated Platform. Access to the updated Platform is activated by following that link.
• 6.3The User must provide accurate, current and complete information and must maintain the accuracy of such information at all times.
• 6.4The User is responsible for maintaining the confidentiality of its Account credentials and for all activity conducted through the Account, including activity undertaken by its employees, contractors, agents or system integrations.
• 6.5The User must notify Fraudcheck immediately upon becoming aware of any unauthorised access to or use of its Account.
• 6.6The User must implement access controls and internal procedures to restrict access to the Platform to authorised personnel and integrations only.
• 6.7Where the User integrates the Platform via API:
• 6.7.1API credentials are issued subject to Account creation and acceptance of these Terms;
• 6.7.2every API call made using those credentials constitutes ongoing acceptance of and compliance with these Terms;
• 6.7.3the User must maintain records of all API credentials issued, restrict access on a need-to-know basis, and rotate credentials in accordance with good security practice;
• 6.7.4the User is responsible for all activity conducted through its API credentials, including activity by any system, application or third party to whom the User has granted access; and
• 6.7.5Fraudcheck may revoke API credentials at any time where misuse, a security risk, or a breach of these Terms is suspected.
• 6.8Either Party may request deletion of the User's Account by providing written notice to the other. Account deletion shall take effect 30 (thirty) calendar days after such notice is given (the "Deletion Period"). During the Deletion Period, Fraudcheck shall continue to provide the Services and the User shall continue to be bound by these Terms. The Deletion Period is required to enable Fraudcheck to comply with its regulatory and compliance obligations, including records management and audit requirements under Applicable Laws. Deletion of the Account does not affect any accrued rights or obligations of either Party.

• 7.1Fraudcheck provides the following Services through the Platform:
• 7.1.1identity verification;
• 7.1.2Credit Bureau Services and Consumer Credit Information;
• 7.1.3compliance screening, including sanctions, PEP and adverse media screening;
• 7.1.4background verification;
• 7.1.5background screening;
• 7.1.6fraud detection and prevention Services;
• 7.1.7KYC and AML compliance tools;
• 7.1.8document verification;
• 7.1.9biometric verification and Liveness Detection;
• 7.1.10Hosting Services, subject to clause 21;
• 7.1.11affordability assessments; and
• 7.1.12related compliance workflows and reporting tools.
• 7.2Upon activation of an Account, the User has access to all Services, subject to the additional due diligence requirements applicable to Credit Bureau Services set out in clause 15, and save that Hosting Services are only available where agreed in writing in accordance with clause 21.
• 7.3The specific checks, products, turnaround times and applicable regulatory classifications are as communicated to the User through the Platform or in the applicable commercial documentation.
• 7.4Fraudcheck may update, improve, modify or enhance the Services from time to time. Fraudcheck will provide reasonable prior notice where any such change materially reduces the core functionality of the Services.
• 7.5Additional Services shall only be made available on a mutually agreed commercial basis, recorded in writing between authorised representatives of the Parties.
• 7.6Fraudcheck reserves the right to modify, suspend or discontinue any aspect of the Services where reasonably necessary for operational, regulatory or security reasons, and shall provide reasonable prior notice where practicable.
• 7.7Fraudcheck acts as an authorised reseller of Consumer Credit Information obtained from registered credit bureaux, in its capacity as a Tier 2 registered credit bureau. Certain Services are subject to regulatory restrictions arising from Fraudcheck's obligations under the NCA.

• 8.1Fraudcheck has designated an Information Officer as required under POPIA. The Information Officer is responsible for ensuring Fraudcheck's compliance with POPIA and for managing Data Subject rights requests.
• 8.2Data Subjects who wish to access, correct or delete their Personal Information held by Fraudcheck, or who wish to lodge a complaint in connection with Fraudcheck's Processing of Personal Information, may contact the Information Officer at the address set out in clause 37.1.1.
• 8.3The Information Officer may be contacted for any POPIA-related matters arising out of or in connection with Fraudcheck's Processing of Personal Information.

• 9.1Fraudcheck is a Tier 2 registered credit bureau under the NCA (NCR registration number: NCRCB65) and an authorised reseller of Consumer Credit Information.
• 9.2Access to Credit Bureau Services is restricted by the Credit Regulatory Framework. The User acknowledges that use of Credit Bureau Services is subject to the requirements of the NCA and the regulations promulgated thereunder.
• 9.3Fraudcheck may monitor usage of the Services and may request information, supporting evidence or documentation from the User where reasonably necessary to verify compliance with Applicable Laws.
• 9.4The User shall cooperate with Fraudcheck in responding to any regulatory enquiries, investigations or audits relating to the User's use of the Services.
• 9.5The User shall immediately notify Fraudcheck in writing if it becomes aware of: (a) any investigation, complaint or inquiry by the NCR, the Information Regulator or any other regulatory authority relating to the User's use of the Services; (b) any data breach or security incident involving User Data or Personal Information Processed through the Platform; or (c) any complaint from a Data Subject in connection with information obtained through the Services.
• 9.6The User warrants that it is, and shall at all times remain, compliant with all Applicable Laws governing its use of the Services, including without limitation the NCA, POPIA, FICA and the ECT Act.
• 9.7Nothing in these Terms limits Fraudcheck's independent statutory obligations as a registered credit bureau, and no provision hereof shall be construed to require Fraudcheck to act contrary to any such obligation.

• 10.1Consumer Credit Information may only be accessed for lawful Prescribed Purposes as contemplated in section 70 of the NCA, Regulation 18 and the Credit Regulatory Framework.
• 10.2Fraudcheck assigns one or more Authorised Prescribed Purposes to each User's Account based on its regulatory and compliance assessment of the User's business and the information provided from time to time. Where more than one Authorised Prescribed Purpose has been assigned, the available Authorised Prescribed Purposes will be displayed to the User through the Platform, and the User must select the applicable Authorised Prescribed Purpose for each check run. Where only one Authorised Prescribed Purpose has been assigned, it will apply automatically. The User does not control the assignment of Authorised Prescribed Purposes, which remains solely within Fraudcheck's discretion. The Prescribed Purposes available through the Platform are set out in Annexure B.
• 10.3The User warrants that each time it accesses Consumer Credit Information through the Platform, it does so only for a purpose corresponding to an Authorised Prescribed Purpose activated on its Account, and that it has obtained all consents required by the Credit Regulatory Framework prior to each request.
• 10.4Fraudcheck may, in its sole discretion, add to, withdraw or decline to make available any Authorised Prescribed Purpose on written notice to the User.
• 10.5The User acknowledges that misuse of Consumer Credit Information constitutes an offence under the NCA and may expose the User to civil, regulatory and criminal liability.
• 10.6Fraudcheck may immediately suspend or terminate access to Credit Bureau Services where misuse, unlawful access or non-compliance with this clause is suspected, in accordance with clause 32 and without prejudice to any other rights or remedies.

• 11.1The User may not:
• 11.1.1access the Platform for any unlawful purpose or in a manner contrary to Applicable Laws;
• 11.1.2access Consumer Credit Information without a lawful Authorised Prescribed Purpose or without obtaining required consents;
• 11.1.3access Consumer Credit Information for the purpose of marketing to consumers;
• 11.1.4on-sell, resell or otherwise commercially exploit any Consumer Credit Information, which prohibition is absolute and applies notwithstanding any consent, authorisation or commercial arrangement with Fraudcheck, nor redistribute or otherwise make available any Consumer Credit Information to any third party without Fraudcheck's prior written consent;
• 11.1.5transfer Consumer Credit Information to any person not authorised under the Credit Regulatory Framework to receive, view or access such information;
• 11.1.6attempt to scrape, harvest or extract bulk data from the Platform by automated or other means;
• 11.1.7reverse engineer, decompile, disassemble or otherwise attempt to derive the source code, algorithms or methodologies of the Platform;
• 11.1.8copy, reproduce, aggregate, store, use, resell, redistribute or commercially exploit Outputs without express written authorisation from Fraudcheck (provided that no such authorisation may be given in respect of the on-selling or resale of Consumer Credit Information, as contemplated in clause 11.1.4);
• 11.1.9attempt to interfere with, disrupt or circumvent the security or access controls of the Platform;
• 11.1.10submit malicious code, viruses, denial-of-service attacks or other harmful content to the Platform;
• 11.1.11submit inaccurate, fraudulent or misleading data to the Platform;
• 11.1.12use the Platform to facilitate fraud, identity theft or any other criminal activity;
• 11.1.13permit any unauthorised third party to access or use the Platform through the User's Account or API credentials; or
• 11.1.14take any action that would impose a disproportionate or unreasonable load on Fraudcheck's infrastructure.
• 11.2The User is responsible for ensuring that its employees, contractors and agents comply with this clause. A breach by any such person shall be treated as a breach by the User.
• 11.3The User shall cooperate with Fraudcheck and the NCR in respect of any matter relating to the Credit Regulatory Framework.

• 12.1Where a consumer disputes the accuracy, currency or fairness of any Consumer Credit Information contained in an Output, the User shall direct the consumer to contact Fraudcheck, who will escalate the dispute to the relevant primary credit bureau together with the required supporting documentation.
• 12.2If the consumer remains dissatisfied, they may approach:

• 13.1This clause applies only where the User's Authorised Prescribed Purposes include the consideration of a candidate for employment in a position that requires honesty in dealing with cash or finances (Regulation 18(4)(c)).
• 13.2The User warrants and certifies that:
• 13.2.1it has obtained the required consumer consent before each credit record is requested, in accordance with Regulation 18(5);
• 13.2.2the position in respect of which the Consumer Credit Information is requested requires honesty in dealing with cash or finances, and the relevant job description is clearly documented; and
• 13.2.3all information supplied to Fraudcheck in connection with such request is, to the best of its knowledge, true and correct.
• 13.3Fraudcheck may, on reasonable notice, require the User to produce the consumer consent, the certification and the relevant job description in respect of any request under this clause.

• 14.1Fraudcheck or its authorised representative may conduct compliance assessments - either off-site or, on reasonable prior notice, at the User's premises - to determine whether the User complies with the restrictions governing the use of Consumer Credit Information, uses the Services for a lawful purpose, obtains and retains required consents, and otherwise complies with these Terms and the Credit Regulatory Framework.
• 14.2The User shall implement an effective audit trail in respect of each transaction performed using the Services, recording at minimum:
• 14.2.1the date and time of the request;
• 14.2.2the identity of the requesting user;
• 14.2.3the Authorised Prescribed Purpose relied upon; and
• 14.2.4the consumer's consent reference, where applicable.
• 14.3The audit trail shall be implemented within 1 (one) month of the date of registration or the Effective Date, whichever is later, and shall be made available to Fraudcheck within 14 (fourteen) Business Days of written request.
• 14.4Information disclosed in the course of a compliance assessment shall be treated as Confidential Information in accordance with clause 26.
• 14.5Fraudcheck retains credit reports for a maximum of 72 (seventy-two) hours from the date of generation, in accordance with its conditions of registration with the NCR. The User is solely responsible for storing, retaining and handling any Consumer Credit Information it wishes to retain beyond that period, in accordance with Applicable Laws and the Credit Regulatory Framework.

• 15.1Although all Services are accessible upon activation of a User's Account, access to Credit Bureau Services is gated and requires the completion of additional due diligence by Fraudcheck prior to activation of this functionality.
• 15.2The additional due diligence may include, without limitation, verification of the User's regulatory status, business purpose, identity of representatives, and any other information or documentation that Fraudcheck considers necessary in its sole discretion.
• 15.3Fraudcheck reserves the right to decline to activate Credit Bureau Services for any User where, in its reasonable assessment, the User does not satisfy the requirements of the Credit Regulatory Framework or Fraudcheck's internal compliance standards.
• 15.4Activation of Credit Bureau Services is not automatic and does not follow from Account registration alone. Fraudcheck will notify the User once Credit Bureau Services have been activated on its Account.

• 16.1Fraudcheck Processes Personal Information in accordance with POPIA and its obligations as a Responsible Party and, where applicable, as an Operator.
• 16.2As between the Parties:
• 16.2.1the User acts as the Responsible Party in respect of Personal Information relating to the User's own customers, end users and other Data Subjects that is submitted to the Platform;
• 16.2.2Fraudcheck acts as the Operator in respect of such Personal Information, Processing it solely for the purposes of providing the Services; and
• 16.2.3Fraudcheck acts as the Responsible Party in the circumstances set out in clause 16.9.
• 16.3The User, as Responsible Party, remains solely responsible for the following, and warrants that it has fulfilled and shall continue to fulfil each of them:
• 16.3.1determining the lawful basis for Processing Personal Information through the Services;
• 16.3.2ensuring that all Personal Information submitted to the Platform has been lawfully obtained and that Data Subjects have been notified as required by POPIA;
• 16.3.3ensuring that Processing complies with Applicable Laws; and
• 16.3.4obtaining and retaining all required consents prior to submitting any Personal Information, including Biometric Data, to the Platform.
• 16.4Fraudcheck shall, in its capacity as Operator:
• 16.4.1Process Personal Information only as necessary to provide the Services and in accordance with the User's documented instructions, except where required by Applicable Laws;
• 16.4.2implement and maintain appropriate technical and organisational security measures to protect Personal Information;
• 16.4.3ensure that any Third-Party Provider engaged to Process Personal Information in connection with the Services does so under appropriate written arrangements and in accordance with POPIA
• 16.4.4assist the User in responding to Data Subject access requests and exercising Data Subject rights, to the extent reasonably practicable; and
• 16.4.5notify the User without undue delay upon becoming aware of a Personal Information breach involving User Data.
• 16.5The subject matter, duration, nature and purpose of Fraudcheck's Processing of Personal Information as Operator are further described in Annexure C, which constitutes the written mandate contemplated by section 21 of POPIA.
• 16.6Fraudcheck may retain records and Personal Information for periods required by Applicable Laws, regulatory directives, NCR requirements or legitimate operational purposes. Statutory retention obligations override any instruction to delete records prior to the expiry of the legally prescribed retention period.
• 16.7Fraudcheck's Processing of Personal Information is further described in its Privacy Policy, available on the Platform. The Privacy Policy is governed by its own terms and should be read in conjunction with these Terms. The Privacy Policy does not form part of these Terms, and in the event of any conflict between the Privacy Policy and these Terms, these Terms shall prevail.
• 16.8The role of each Party in respect of any Personal Information is determined by which Party determines the purpose of and means for Processing that Personal Information. Fraudcheck may therefore act as Operator in respect of certain Processing and as a Responsible Party in respect of other Processing of the same Personal Information, and its role changes from Operator to Responsible Party in the circumstances set out in clause 16.9.
• 16.9Fraudcheck shall act as an independent Responsible Party, and not as an Operator, to the extent that it Processes Personal Information submitted by or on behalf of the User (including Hosted Data, save that clauses 16.9.2 and 16.9.3 do not apply to Hosted Data):
• 16.9.1to comply with its own obligations under Applicable Laws, the Credit Regulatory Framework, NCR directives or its conditions of registration, including its statutory record-keeping and retention obligations;
• 16.9.2for its own fraud detection and prevention, information security, audit, risk management and Credit Bureau Services purposes;
• 16.9.3to create Service Data in accordance with clause 24.4;
• 16.9.4to respond to or comply with a request, directive or order of the NCR, the Information Regulator, the FIC, a court or any other competent authority;
• 16.9.5after termination of these Terms, deletion of the Account or an instruction by the User to delete Personal Information, where Fraudcheck is required or entitled by Applicable Laws to retain that Personal Information; or
• 16.9.6where the Parties agree in writing that Fraudcheck will determine the purpose of and means for the relevant Processing.
• 16.10Where Fraudcheck acts as a Responsible Party in terms of clause 16.9:
• 16.10.1Fraudcheck shall be responsible for its own compliance with the conditions for the lawful Processing of Personal Information under POPIA in respect of that Processing, including responding to Data Subject requests and objections relating to that Processing;
• 16.10.2Fraudcheck shall Process the relevant Personal Information only to the extent necessary for the applicable purpose contemplated in clause 16.9, and not for any other purpose;
• 16.10.3the Parties shall act as independent Responsible Parties and not as joint Responsible Parties, unless expressly agreed otherwise in writing, and neither Party shall be responsible for the other Party's compliance with POPIA in respect of Processing for which that other Party is the Responsible Party; and
• 16.10.4Fraudcheck's obligations as Operator under clause 16.4 and Annexure C shall not apply to that Processing, without derogating from Fraudcheck's security obligations under clause 31.
• 16.11The User shall ensure that the notices given to, and, where required, the consents obtained from, Data Subjects in terms of POPIA disclose that their Personal Information will be shared with Fraudcheck and may be Processed by Fraudcheck, as an independent Responsible Party, for the purposes described in clause 16.9. The User warrants that it has done so in respect of all Personal Information submitted to the Platform.
• 16.12Save as contemplated in clause 16.9, Fraudcheck shall not Process Personal Information in respect of which it acts as Operator otherwise than in accordance with the User's documented instructions. If Fraudcheck considers that carrying out an instruction from the User would contravene POPIA or any other Applicable Laws, Fraudcheck may decline to carry out that instruction and shall notify the User accordingly.
• 16.13Where either Party receives a request, objection or complaint from a Data Subject in respect of Processing for which the other Party is the Responsible Party, it shall promptly refer that request, objection or complaint to the other Party and provide reasonable assistance to the other Party in responding to it.
• 16.14The User indemnifies Fraudcheck against any regulatory action, fine, penalty, claim or liability arising from the User's failure to comply with its obligations as Responsible Party under this clause or under POPIA.

• 17.1Certain Outputs made available through the Platform are derived from information supplied by Third-Party Providers.
• 17.2Fraudcheck acts as an intermediary in facilitating access to information supplied by Third-Party Providers. Fraudcheck does not originate or independently verify such information and makes no representation or warranty regarding its accuracy, completeness, currency or fitness for any particular purpose.
• 17.3The User acknowledges that:
• 17.3.1Fraudcheck does not control Third-Party Providers and cannot guarantee the availability, accuracy or timeliness of data supplied by them;
• 17.3.2Outputs derived from Third-Party Providers reflect the data held by those providers at the time of the query and may not reflect subsequent changes;
• 17.3.3Fraudcheck is not liable for any error, omission, delay or unavailability of data attributable to a Third-Party Provider; and
• 17.3.4Platform Availability and turnaround times may be affected by the availability and response times of Third-Party Providers' systems.
• 17.4Fraudcheck shall use commercially reasonable efforts to ensure that its contracts with Third-Party Providers include appropriate data protection and security obligations consistent with Applicable Laws.

• 18.1Certain Services, including identity verification, document verification and Liveness Detection, involve the Processing of Biometric Data. Fraudcheck provides these capabilities through its own Platform and, where appropriate, through Third-Party Providers engaged under appropriate data processing arrangements.
• 18.2The User, as Responsible Party, must, and warrants to Fraudcheck that it shall at all times:
• 18.2.1prior to submitting any Biometric Data to the Platform, obtain informed, written consent from the relevant Data Subject for the collection and Processing of their Biometric Data;
• 18.2.2inform the Data Subject of the categories of Biometric Data to be Processed, the purpose of Processing, and the Data Subject's right to withdraw consent;
• 18.2.3retain auditable evidence of such consent; and
• 18.2.4comply with all requirements under POPIA and any other Applicable Laws governing the Processing of Biometric Data.
• 18.3Fraudcheck shall Process Biometric Data solely for the purposes of identity verification and fraud prevention. Biometric Data shall not be used for any other purpose without the Data Subject's consent.
• 18.4The User acknowledges that:
• 18.4.1Biometric Data may be Processed in jurisdictions outside South Africa where operationally required, subject to appropriate cross-border data transfer safeguards in accordance with POPIA;
• 18.4.2Biometric Data shall be retained only for the period required to fulfil the purpose of Processing and in accordance with Applicable Laws;
• 18.4.3Fraudcheck is not liable for errors or inaccuracies in identity verification Outputs that result from the quality, accuracy or completeness of Biometric Data submitted by the User; and
• 18.4.4a list of Third-Party Providers engaged in Biometric Data Processing is available on written request where required by Applicable Laws.
• 18.5Identity verification Outputs, including biometric match scores, are probabilistic in nature and are not a guarantee of identity. The User remains responsible for evaluating these Outputs and must not use them as the sole basis for any high-stakes decision without applying appropriate human review where required by law or by the nature of the decision.
• 18.6Where Applicable Laws (including POPIA section 57) restrict or require safeguards for automated decision-making based on Personal Information, the User is responsible for ensuring compliance and for providing Data Subjects with information about automated decisions that affect them.
• 18.7The User may withdraw consent to the Processing of Biometric Data for a specific Data Subject at any time by written notice to Fraudcheck. Withdrawal of consent does not affect the lawfulness of Processing carried out prior to withdrawal and does not obligate Fraudcheck to delete records it is required to retain under Applicable Laws.

• 19.1Where the User uses the Services in connection with its obligations under FICA, the User acknowledges that it remains solely responsible for:
• 19.1.1conducting customer due diligence and enhanced due diligence in accordance with FICA;
• 19.1.2determining risk ratings and applying appropriate monitoring measures;
• 19.1.3filing suspicious transaction reports and cash threshold reports with the FIC as required;
• 19.1.4maintaining records as required by FICA; and
• 19.1.5ensuring compliance with all obligations under FICA applicable to it as an accountable institution or reporting institution.
• 19.2Outputs obtained through the Services, including sanctions screening results, PEP screening results and adverse media results, are provided for informational purposes only and do not constitute legal or compliance advice. The User must apply its own judgment and, where necessary, seek independent legal advice before acting on such Outputs.
• 19.3Fraudcheck does not act as the User's compliance officer, money laundering reporting officer or legal adviser, and nothing in these Terms or in the Services shall be construed as creating such a relationship.
• 19.4The User indemnifies Fraudcheck against any regulatory penalty, fine, liability or reputational damage arising from the User's failure to comply with its obligations under FICA or any other financial crime legislation.
• 19.5The User warrants that it has identified and understands its obligations as an accountable institution or reporting institution under FICA, and that it shall comply with all such obligations independently of the Services provided by Fraudcheck.

• 20.1This clause applies to all background verification and background screening Services made available through the Platform, including criminal record checks, identity and document checks performed for screening purposes, qualification, employment, professional membership and reference verification, credit checks for employment purposes (which are also subject to clause 13), directorship and adverse media checks, and social media and online presence screening.
• 20.2The User warrants that, before requesting any Background Screening Service in respect of a Data Subject, it has:
• 20.2.1informed the Data Subject of the specific checks to be conducted (including, where applicable, social media and online presence screening), the purpose for which the Outputs will be used and the sources from which information may be obtained;
• 20.2.2obtained the Data Subject's voluntary, specific and informed written consent to each such check, and that it retains auditable evidence of that consent, which it shall produce to Fraudcheck within 5 (five) Business Days of written request;
• 20.2.3where the check involves special personal information (including information relating to criminal behaviour) or the Personal Information of a child, satisfied itself that the Processing is authorised under sections 26 to 35 of POPIA; and
• 20.2.4satisfied itself that each check is relevant, necessary and proportionate to the inherent requirements of the position, engagement or other purpose for which it is requested, and that its request for and use of the Outputs complies with Applicable Laws, including the Employment Equity Act 55 of 1998, the Labour Relations Act 66 of 1995, the Promotion of Equality and Prevention of Unfair Discrimination Act 4 of 2000 and POPIA.
• 20.3Outputs of Background Screening Services are factual reports of information obtained from Third-Party Providers, official records, public sources and information supplied by the User or the Data Subject, as that information exists at the time of the search. Fraudcheck does not assess, rate, score or recommend a Data Subject's suitability for employment, appointment, promotion, engagement, tenancy, membership or any other opportunity, and no Output, flag, indicator, match or risk classification constitutes such an assessment, rating or recommendation.
• 20.4Outputs of Background Screening Services are not binding on the User, the Data Subject or any other person, are not determinative of any matter, and do not constitute a finding of fact, a finding of guilt or wrongdoing, or legal advice. An Output indicating that no record or adverse information was found does not confirm that no such record or information exists.
• 20.5The User is solely and exclusively responsible for any decision it takes in relation to a Data Subject, including any decision to employ or not to employ, appoint, promote, discipline, dismiss, contract with or decline to contract with a Data Subject, whether or not that decision is based wholly or partly on an Output. Fraudcheck is not a party to, does not participate in and shall not be responsible for any such decision. The User shall not state or imply to any Data Subject or third party that any such decision was made, recommended, required or caused by Fraudcheck.
• 20.6In respect of social media, online presence and adverse media screening, the User acknowledges that:
• 20.6.1Outputs are limited to information that is publicly available at the time of the search, and may be incomplete, out of date or presented without its original context;
• 20.6.2Fraudcheck does not verify the authenticity, authorship, accuracy or context of any content, and information may relate to a different person with the same or a similar name or identifier;
• 20.6.3Outputs may reveal information relating to a Data Subject's race, gender, sex, pregnancy, marital status, family responsibility, ethnic or social origin, colour, sexual orientation, age, disability, religion, HIV status, conscience, belief, political opinion, culture, language, birth, health, trade union membership or other protected characteristics, and the User shall not take any such information into account in making any decision where doing so would constitute unfair discrimination or would otherwise contravene Applicable Laws; and
• 20.6.4Fraudcheck does not monitor, interpret or moderate the content of any social media account or other online source.
• 20.7Before taking any decision that is adverse to a Data Subject and that is based wholly or partly on an Output, the User shall, where required by Applicable Laws or where fairness so requires, inform the Data Subject of the relevant information and give the Data Subject a reasonable opportunity to respond to it or to dispute its accuracy. Any dispute by a Data Subject regarding the accuracy of an Output shall be referred to Fraudcheck, which will, where practicable, refer the dispute to the relevant source for review.
• 20.8To the fullest extent permitted by Applicable Laws and subject to clause 29.3, Fraudcheck shall have no liability to the User, any Data Subject or any other person for any loss, damage or claim arising from any decision taken by the User in relation to a Data Subject, including any refusal or loss of employment, appointment or other opportunity, loss of income, reputational harm, or claim of unfair discrimination or unfair labour practice.
• 20.9The User indemnifies and holds Fraudcheck harmless against all claims, losses, liabilities, costs (including legal costs on an attorney-and-own-client scale), fines and penalties arising from any claim or complaint by a Data Subject or any other person, including before the Commission for Conciliation, Mediation and Arbitration, the Labour Court, an Equality Court or the Information Regulator, in connection with the User's use of Background Screening Services or Outputs, or any decision taken by the User in relation to a Data Subject.

• 21.1Hosting Services are available only where agreed in writing between the Parties, including in the commercial documentation applicable to the User's Account. Where so agreed, Fraudcheck shall store and host, on infrastructure operated by or on behalf of Fraudcheck, the User Data, documents, records and Outputs that the User uploads to or designates for storage on the Platform ("Hosted Data"), for the period and on the terms so agreed.
• 21.2Consumer Credit Information, including credit reports, is excluded from the Hosting Services and does not form part of Hosted Data. Credit reports are purged in accordance with clause 14.5, and the User shall not upload or designate any Consumer Credit Information for hosting. Fraudcheck may delete any Consumer Credit Information uploaded in breach of this clause without notice.
• 21.3In providing the Hosting Services, Fraudcheck acts as Operator on behalf of the User, and the User remains the Responsible Party in respect of the Hosted Data. Fraudcheck shall Process Hosted Data only in accordance with the User's documented instructions, clause 16 and Annexure C, save to the extent that clause 16.9 applies.
• 21.4The User warrants and undertakes that:
• 21.4.1before uploading any Personal Information to the Platform as Hosted Data, it has obtained the voluntary, specific and informed consent of each Data Subject to whom that Personal Information relates to the storage and hosting of that Personal Information by a third-party service provider on the User's behalf, including, where applicable, storage outside South Africa in accordance with clause 21.6, and that such consent has not been withdrawn;
• 21.4.2it retains auditable evidence of each such consent and shall produce such evidence to Fraudcheck within 5 (five) Business Days of written request;
• 21.4.3all Hosted Data has been lawfully collected, and each Data Subject has been notified as required by section 18 of POPIA;
• 21.4.4it shall not upload special personal information or the Personal Information of children as Hosted Data unless the Processing thereof is authorised under POPIA and Fraudcheck has agreed in writing to host such information; and
• 21.4.5where a Data Subject withdraws consent or objects to the Processing of their Personal Information, or where the User is no longer entitled to retain it, the User shall promptly delete the relevant Hosted Data or instruct Fraudcheck in writing to do so.
• 21.5The User is solely responsible for the content, accuracy and lawfulness of Hosted Data and for determining the period for which Hosted Data is retained. Fraudcheck does not monitor or review the content of Hosted Data and shall access Hosted Data only to the extent necessary to provide the Hosting Services, to provide support at the User's request, to maintain the security and integrity of the Platform, or as required by Applicable Laws.
• 21.6Hosted Data may be stored in South Africa or, where operationally required or agreed in writing, in another jurisdiction, in which case Fraudcheck shall ensure that appropriate safeguards for the transfer of Personal Information are in place in accordance with section 72 of POPIA.
• 21.7Fraudcheck shall apply the security measures described in clause 31.1 to Hosted Data. Unless otherwise agreed in writing, the Hosting Services do not constitute a backup or disaster recovery service, and the User is responsible for maintaining its own copies of Hosted Data.
• 21.8On termination of these Terms or of the Hosting Services, Fraudcheck shall, subject to payment of all outstanding amounts, make the Hosted Data available to the User for export in a reasonably accessible electronic format for a period of 30 (thirty) calendar days, after which Fraudcheck may delete the Hosted Data, save for any records that Fraudcheck is required to retain under Applicable Laws, which Fraudcheck shall retain as Responsible Party in accordance with clause 16.9.
• 21.9Fees for Hosting Services are as set out in the applicable Rate Card or commercial documentation.
• 21.10The User indemnifies Fraudcheck against all claims, losses, liabilities, fines and penalties arising from a breach of the warranties in clause 21.4 or from the content of any Hosted Data.

• 22.1Fees for all Users, including applicable payment terms, are charged at the rates set out in the Rate Card for the User's Pricing Plan, less any Approved Discount, as recorded in a pricing addendum or other commercial documentation provided to the User. Fraudcheck may revise such fees in accordance with this clause 22.
• 22.2Fraudcheck may revise the Rate Cards from time to time on no less than 30 (thirty) calendar days' prior written notice to the User. Any general increase in fees shall be applied uniformly across all Rate Cards. Where the revision increases the fees payable by the User, and the increase is not an adjustment of the kind contemplated in clause 22.3, the User may, subject to any minimum term agreed in the commercial documentation applicable to an Enterprise Client, before the revision takes effect, terminate these Terms by written notice to Fraudcheck, in which event the revision shall not apply to the User prior to termination. If the User does not so terminate, continued use of the Services after the effective date of the revision constitutes acceptance of the revised fees.
• 22.3Where a third party engaged by Fraudcheck to support the provision of a Service increases its charges or changes the basis on which it supplies the information or service necessary for that Service, such that Fraudcheck incurs additional costs in continuing to provide that Service, Fraudcheck may, in respect of that Service only, increase the fees payable by the User by the amount of such additional costs on written notice to the User. An adjustment under this clause 22.3 does not give rise to a right of termination under clause 22.2.
• 22.4A pricing addendum or other commercial documentation agreed between the Parties forms part of these Terms. In the event of any conflict between such pricing addendum or commercial documentation and these Terms, the pricing addendum or commercial documentation shall prevail, but only in respect of fees and payment terms, and these Terms shall prevail in respect of all other matters. A revision of fees made in accordance with this clause 22 does not constitute an amendment to these Terms for the purposes of clause 40.
• 22.5The Enterprise Pricing Plan, committed transaction volumes or minimum spend, payment terms and any Approved Discount applicable to an Enterprise Client are recorded in the commercial documentation agreed between the Parties, and fees are otherwise charged at the rates set out in the Rate Card for the Enterprise Client's Pricing Plan.
• 22.6Transaction volumes and usage of the Services shall be measured in accordance with Fraudcheck's system records, which shall constitute prima facie proof of usage in the absence of manifest error.
• 22.7All invoices are payable by the due date set out in the applicable invoice or commercial documentation. Overdue undisputed amounts shall bear interest at the Prime Rate plus 3% per annum, calculated daily from the due date to the date of payment. Failure to pay undisputed amounts by the due date may result in suspension of access to the Services in accordance with clause 32.
• 22.8Where the User disputes any invoice, it must notify Fraudcheck in writing within 15 (fifteen) Business Days of receipt, specifying the disputed amount and the basis of the dispute. The User must pay the undisputed portion by the due date. Unresolved disputes shall be resolved in good faith, failing which either Party shall be entitled to refer the dispute to determination by an independent auditor agreed between the Parties, or failing agreement within 5 (five) days, appointed by the President of South African Institute of Chartered Accountants (“SAICA”). The auditor's determination shall be final and binding and the costs thereof shall be borne by the unsuccessful Party.
• 22.9Fraudcheck may, in its discretion, grant a User an Approved Discount. An Approved Discount:
• 22.9.1is valid only if approved in writing by Fraudcheck's senior management and recorded against the User's Account;
• 22.9.2applies as a percentage reduction to the fees set out in the User's Rate Card and does not amend the Rate Card;
• 22.9.3applies for the period recorded in the approval and, unless renewed in writing, lapses automatically on expiry of that period, after which the fees set out in the User's Rate Card apply without discount; and
• 22.9.4may be withdrawn by Fraudcheck on written notice if the User breaches these Terms or no longer meets any condition (including any committed transaction volume) on which it was granted.
• 22.10Where a User has been granted an Approved Discount and Fraudcheck revises the Rate Cards in accordance with clause 22.2, the Approved Discount shall, unless otherwise recorded, continue to apply to the revised fees for the remainder of its approved period. Any concession granted in response to a revision of the Rate Cards shall be granted only as an Approved Discount.

• 23.1Fraudcheck shall use commercially reasonable efforts to maintain Platform Availability in accordance with the service levels set out in Annexure A.
• 23.2Fraudcheck shall, upon written request from the User, provide a monthly availability report for the preceding calendar month, setting out total minutes, Unscheduled Downtime (if any) and the calculated Platform Availability percentage.
• 23.3Fraudcheck does not warrant turnaround times for Services that are dependent upon Third-Party Providers, governmental databases or telecommunications infrastructure.

• 24.1Fraudcheck retains all rights, title and interest in and to the Platform, the Services, and all Intellectual Property associated with them, including the software, algorithms, databases, system architecture, methodologies and related technology used to provide the Services.
• 24.2The User retains ownership of User Data submitted to the Platform.
• 24.3Fraudcheck does not claim ownership of the underlying data supplied by Third-Party Providers, but the manner in which such data is presented, Processed and delivered through the Platform constitutes Fraudcheck's Intellectual Property.
• 24.4Service Data, meaning anonymised and aggregated data derived from the provision of the Services (including transaction patterns, verification outcomes, fraud signals and usage data), remains the property of Fraudcheck. Fraudcheck may use such Service Data for any lawful purpose, including fraud model development, risk scoring and analytics, benchmarking, product development, training and improving automated systems, and related operational and commercial purposes, subject to the condition that the data cannot reasonably be used to identify the User, any Data Subject or any specific User Data. Fraudcheck may not use raw Personal Information or User Data for model training or cross-User purposes without a separate lawful basis under POPIA.
• 24.5Subject to these Terms, the User is granted a limited, non-exclusive, non-transferable and revocable licence to access and use the Platform and the Outputs made available through the Services for the User's own lawful business purposes during the term of these Terms.
• 24.6The User shall not sub-licence, assign, transfer or otherwise dispose of any rights granted under clause 24.5 without Fraudcheck's prior written consent.

• 25.1Outputs are provided for informational purposes only. Fraudcheck does not provide legal, financial, credit, compliance or regulatory advice through the Platform or otherwise.
• 25.2The User remains solely responsible for:
• 25.2.1evaluating the Outputs and determining whether additional verification, investigation or advice is required;
• 25.2.2all decisions made using Outputs; and
• 25.2.3ensuring that decisions based on Outputs comply with Applicable Laws, including laws governing automated decision-making.
• 25.3Fraudcheck does not guarantee that Outputs are accurate, complete, current or suitable for any particular purpose. Outputs reflect data available from Third-Party Providers at the time of the query and may not reflect changes that have occurred since the data was last updated.
• 25.4The User may use Outputs in the ordinary course of its business, including for providing services to its own customers, subject to compliance with Applicable Laws and these Terms. The User may not commercially resell or redistribute Outputs except with Fraudcheck's prior written consent. Consumer Credit Information may not be on-sold or resold in any circumstances, as provided in clause 11.1.4.

• 26.1Each Receiving Party acknowledges the importance of the Confidential Information of the Disclosing Party and undertakes:
• 26.1.1not to disclose or publish the Disclosing Party's Confidential Information in any manner or for any purpose without the Disclosing Party's prior written consent, except as permitted by these Terms;
• 26.1.2not to use the Disclosing Party's Confidential Information for any purpose other than the performance of the Parties' obligations under these Terms;
• 26.1.3to restrict dissemination of Confidential Information to those of its personnel, employees, contractors and advisers who need access to it for the purposes of these Terms, on a strict need-to-know basis; and
• 26.1.4to take all reasonable steps to prevent unauthorised disclosure of Confidential Information by its personnel.
• 26.2The Receiving Party shall protect the Disclosing Party's Confidential Information with at least the same degree of care it applies to its own confidential information, and in no event with less than reasonable care.
• 26.3The obligations in this clause do not apply to information that:
• 26.3.1is or becomes publicly available other than through a breach of these Terms;
• 26.3.2was lawfully known to the Receiving Party prior to disclosure by the Disclosing Party;
• 26.3.3is independently developed by the Receiving Party without use of the Disclosing Party's Confidential Information; or
• 26.3.4is required to be disclosed by law, court order or regulatory authority, provided that the Receiving Party gives the Disclosing Party reasonable prior notice where permitted.
• 26.4Fraudcheck may retain Confidential Information to the extent required by and for the duration of its obligations under Applicable Laws, NCR directives and POPIA retention requirements.
• 26.5Upon termination of these Terms, or at the Disclosing Party's written request, the Receiving Party shall promptly return or destroy the Disclosing Party's Confidential Information, subject to any statutory retention obligations, and shall confirm such return or destruction in writing within 7 (seven) Business Days.
• 26.6The obligations in this clause survive termination or expiry of these Terms for so long as the relevant information remains confidential in nature.
• 26.7Each Party acknowledges that a breach of this clause may cause irreparable harm for which monetary damages would be an inadequate remedy, and that the Disclosing Party is entitled to seek urgent injunctive or other equitable relief without the need to post security.

• 27.1Each Party warrants to the other that:
• 27.1.1it has the legal capacity and has taken all necessary action required to authorise it to enter into and perform its obligations under these Terms;
• 27.1.2these Terms constitute a valid and binding obligation on it, enforceable against it in accordance with its terms;
• 27.1.3the execution of these Terms and the performance of its obligations hereunder does not and shall not, to the best of its knowledge and belief:
• 27.1.3.1contravene any Applicable Laws;
• 27.1.3.2where applicable, contravene any provision of its constitutional documents; or
• 27.1.3.3conflict with or constitute a breach of any other agreement or obligation binding on it;
• 27.1.4to the best of its knowledge and belief, it is not aware of any fact or circumstance that may impair its ability to comply with its obligations under these Terms; and
• 27.1.5the individual accepting these Terms on its behalf is duly authorised to do so.
• 27.2Each warranty in clause 27.1 is a separate warranty, is not limited by any other warranty, and shall continue in force notwithstanding completion of the transactions contemplated in these Terms. Each warranty shall prima facie be deemed material and to be a material representation inducing the other Party to enter into these Terms.
• 27.3Fraudcheck further warrants that:
• 27.3.1it is duly registered as a Tier 2 credit bureau under the NCA (NCR registration number: NCRCB65) and shall maintain such registration for as long as Credit Bureau Services are provided;
• 27.3.2it shall provide the Services with due skill, care and diligence and in accordance with Applicable Laws.

• 28.1Except as expressly set out in these Terms:
• 28.1.1the Services and Platform are provided on an "as is" and "as available" basis;
• 28.1.2Fraudcheck makes no warranty that the Services will be uninterrupted, error-free or free from viruses or other harmful components;
• 28.1.3Fraudcheck makes no warranty regarding information sourced from Third-Party Providers and is not responsible for errors, omissions or delays in such data; and
• 28.1.4all implied warranties, conditions and representations, including as to merchantability, fitness for a particular purpose, non-infringement and satisfactory quality, are excluded to the fullest extent permitted by Applicable Laws.

• 29.1To the fullest extent permitted by Applicable Laws, Fraudcheck shall not be liable for:
• 29.1.1indirect, consequential, incidental, special or punitive damages;
• 29.1.2loss of profits, revenue, business, goodwill, anticipated savings or data;
• 29.1.3loss arising from inaccuracies, omissions or delays in information supplied by Third-Party Providers;
• 29.1.4loss arising from the User's failure to comply with its obligations under these Terms or Applicable Laws;
• 29.1.5loss arising from the User's reliance on Outputs without appropriate independent verification; or
• 29.1.6loss arising from a Force Majeure Event.
• 29.2Fraudcheck's total aggregate liability to the User for all claims arising under or in connection with these Terms shall not exceed the total fees paid by the User to Fraudcheck in the 3 (three) calendar months immediately preceding the event giving rise to the claim.
• 29.3Nothing in these Terms limits or excludes liability for: (a) fraud or wilful misconduct; (b) death or personal injury caused by negligence; or (c) any other liability that cannot be excluded or limited by Applicable Laws.
• 29.4The limitations in this clause reflect a fair allocation of risk between commercially sophisticated Parties. The User acknowledges that these limitations are reasonable having regard to this allocation.
• 29.5Nothing in this clause limits the User's liability for regulatory breaches, unlawful use of Consumer Credit Information or Biometric Data, or indemnity obligations under these Terms.

• 30.1The User indemnifies and holds Fraudcheck harmless from and against all claims, losses, liabilities, costs, expenses, regulatory actions, fines, penalties and damages (including legal costs on an attorney-and-own-client scale) arising from or in connection with the User's breach of:
• 30.1.1Applicable Laws in connection with the User's use of the Services and/or Platform; or
• 30.1.2these Terms.
• 30.2The indemnity in clause 30.1 shall not apply to the extent that the relevant loss was directly caused by Fraudcheck's own fraud, wilful misconduct or gross negligence.

• 31.1Fraudcheck warrants that it shall implement and maintain appropriate technical and organisational security measures to protect Personal Information and User Data against unauthorised access, loss, destruction, misuse or disclosure, having regard to the requirements of POPIA, the NCA and applicable regulatory standards, including where appropriate: access controls, encryption, system monitoring, secure hosting environments and internal information security policies.
• 31.2The User shall implement and maintain its own appropriate technical and organisational security measures to protect Personal Information Processed in connection with its use of the Services, and shall ensure that its systems and networks through which it accesses the Platform are adequately secured.
• 31.3Fraudcheck shall retain records relating to Credit Bureau Services, including access logs and bureau requests, for the minimum period required under the NCA, NCR directives and other Applicable Laws, subject to clause 14.5.
• 31.4Fraudcheck may disclose information, including User Data and Outputs, to the NCR, the Information Regulator, the FIC or any other competent regulatory or supervisory authority where required by law or regulatory directive. Such disclosure shall not constitute a breach of confidentiality.
• 31.5In the event of a suspected or actual Personal Information breach involving User Data, Fraudcheck shall notify the User within a reasonable time after becoming aware of the breach and shall provide such information as is reasonably available to assist the User in discharging its notification obligations under POPIA.
• 31.6Upon termination of these Terms, Fraudcheck shall, upon written request by the User and subject to payment of all outstanding amounts, provide the User with a copy of User Data held by Fraudcheck in a reasonably accessible electronic format. Fraudcheck is not required to delete records it is obliged to retain under Applicable Laws.

• 32.1Fraudcheck may suspend the User's access to the Platform or Services, with or without notice, in any of the following circumstances:
• 32.1.1failure to pay undisputed invoices within the agreed payment period;
• 32.1.2material or suspected breach of these Terms or Applicable Laws;
• 32.1.3receipt of a regulatory directive from the NCR, the Information Regulator, the FIC or any other competent authority;
• 32.1.4security risks, system integrity concerns or suspected unauthorised access;
• 32.1.5where required to protect the interests of third parties, including Data Subjects; or
• 32.1.6any other circumstance in which Fraudcheck reasonably considers suspension necessary to protect its interests or the integrity of the Platform.
• 32.2Where the grounds for suspension are remediable, Fraudcheck shall, where reasonably practicable, notify the User of the grounds for suspension and provide a reasonable period within which to remedy the issue before suspension takes effect.
• 32.3Suspension shall not relieve the User of its obligation to pay accrued fees or its liability for any breach.
• 32.4Fraudcheck shall lift the suspension promptly upon satisfaction that the grounds for suspension have been remedied, subject to any regulatory restrictions.
• 32.5Suspension does not preclude Fraudcheck from exercising its right to terminate these Terms in accordance with clause 33.

• 33.1If either Party ("Defaulting Party") commits a material breach of these Terms and fails to remedy such breach within 7 (seven) Business Days of written notice from the other Party ("Aggrieved Party") requiring the breach to be remedied, the Aggrieved Party shall be entitled, at its election:
• 33.1.1to claim immediate specific performance of the Defaulting Party's obligations, with or without claiming damages; or
• 33.1.2to cancel these Terms and claim damages.
• 33.2Notwithstanding clause 33.1, Fraudcheck may terminate these Terms immediately upon written notice to the User without providing a cure period in the following circumstances:
• 33.2.1the User's unlawful use of Consumer Credit Information or Biometric Data;
• 33.2.2the User's fraudulent conduct or wilful misconduct;
• 33.2.3a regulatory directive requiring Fraudcheck to cease providing Services to the User;
• 33.2.4where the User is an entity, the liquidation or winding-up of the User or the commencement of business rescue proceedings in respect of the User, to the extent that termination on this ground is not precluded by the moratorium provisions of the Companies Act 71 of 2008; or

where the User is a natural person, the sequestration of the User's estate.

• 33.2.5any other breach that, by its nature, is incapable of remedy.
• 33.3Any costs awarded shall be recoverable on an attorney-and-own-client scale.
• 33.4Remedies under this clause are cumulative and are not in substitution for any other remedy available at law or in equity.

• 34.1The User may terminate these Terms by requesting deletion of its Account in accordance with clause 6.8. Cessation of use of the Platform does not, on its own, constitute notice of termination and does not relieve the User of liability for fees accrued prior to cessation.
• 34.2Fraudcheck may terminate the User's access to the Platform and Services on 30 (thirty) calendar days' written notice, without cause. Fraudcheck may terminate immediately, without notice, in the circumstances set out in clause 33.2.
• 34.3Upon termination or expiry of these Terms for any reason:
• 34.3.1the User's right to access and use the Services and the Platform shall immediately cease;
• 34.3.2all outstanding undisputed fees accrued up to the date of termination shall immediately become due and payable; and
• 34.3.3Fraudcheck shall not be obliged to transfer any Intellectual Property, Service Data, methodologies or internal systems configurations.
• 34.4Termination shall not affect any accrued rights or obligations of either Party.
• 34.5Any provision of these Terms that by its nature is intended to survive termination or expiry shall do so, including without limitation provisions relating to definitions, intellectual property, confidentiality, limitation of liability, indemnity, dispute resolution and general provisions.

• 35.1For purposes of this clause, "Force Majeure Event" means any event beyond the reasonable control of the affected Party, including acts of God; natural disasters; flood, fire, earthquake or storm; war, armed conflict, terrorism or civil unrest, whether or not formally declared; pandemic or epidemic; labour disputes or industrial action; failure or disruption of telecommunications networks, internet infrastructure or electricity supply; failure or unavailability of Third-Party Providers or governmental systems; governmental actions, regulatory directives or sanctions; or power outages.
• 35.2Neither Party shall be in breach of its obligations under these Terms, or incur any liability, where it is prevented from carrying out those obligations by a Force Majeure Event, provided that:
• 35.2.1the affected Party notifies the other Party in writing as soon as reasonably practicable after the occurrence of the Force Majeure Event;
• 35.2.2the affected Party uses all reasonable endeavours to mitigate the effect of the Force Majeure Event and to resume performance as soon as reasonably practicable; and
• 35.2.3the Force Majeure Event is not caused by or attributable to the affected Party's own fault or negligence.
• 35.3The affected Party is not excused from performance of those of its obligations that are not affected by the Force Majeure Event.
• 35.4If a Force Majeure Event prevents the affected Party from performing any material obligation under these Terms for a continuous period of 30 (thirty) calendar days or more, either Party may terminate these Terms by written notice without liability, other than for fees accrued prior to termination.

• 36.1A dispute shall arise for purposes of this clause when one Party communicates the dispute and its particularity in writing to the other Party.
• 36.2The Parties shall endeavour to resolve any dispute through good faith negotiation between senior representatives within 5 (five) Business Days of the notice referred to in clause 36.1. If the dispute is not resolved within that period, either Party may refer it directly to arbitration under clause 36.3.
• 36.3All disputes shall be finally resolved by arbitration under the expedited rules of AFSA. The arbitration shall be held in Sandton, Johannesburg. The arbitrator shall be agreed upon by the Parties or, failing agreement within 3 (three) Business Days, appointed by the Chairman of the Johannesburg Bar Council (for legal disputes) or the President of SAICA (for accounting disputes).
• 36.4The arbitrator's award shall be final and binding, shall be given within 30 (thirty) calendar days of finalisation of proceedings, and may be made an order of court. There shall be no right of appeal except in the case of manifest error.
• 36.5Nothing in this clause prevents either Party from applying to a South African court for urgent or interim relief at any time.
• 36.6This clause is separate and divisible from the rest of these Terms and remains in effect even if these Terms are terminated, cancelled or found to be void.

• 37.1The Parties choose as their domicilia citandi et executandi ("domicilium") the following addresses:
• 37.1.1Fraudcheck:

Physical: Fraudcheck Pty Ltd, 1F, 173 Oxford Rd, Rosebank, Johannesburg, 2196

Email: spencerl@fraudcheck.co.za

Attention: Spencer Luck (Information Officer)

• 37.1.2User: The physical address and email address provided by the User at onboarding, as updated Fraudcheck from time to time.
• 37.2Any notice delivered by hand to a responsible person at the physical domicilium during business hours shall be deemed received on the day of delivery, unless the contrary is proved.
• 37.3Any notice sent by email at the email domicilium shall be deemed received on the date of successful transmission, or the next Business Day if transmitted outside of business hours, unless the contrary is proved.
• 37.4Either Party may change its domicilium by written notice, with effect from the 7th (seventh) Business Day after deemed receipt of that notice.
• 37.5Any notice or other communication to be given to any of the Parties in terms of these Terms shall be valid only if it is given in writing, provided that any notice given by email shall be regarded for this purpose as having been given in writing.
• 37.6This clause 37 does not operate so as to invalidate the giving or receipt of any written notice which is actually received by the addressee other than by a method referred to in this clause 37.
• 37.7The User undertakes to immediately notify Fraudcheck in writing of any change in its physical address, email address or Primary User for the purposes of these Terms. This obligation includes notifying Fraudcheck where the designated Primary User leaves the User's employ or is otherwise no longer authorised to act on the User's behalf. Failure to do so shall not invalidate any notice served by Fraudcheck in accordance with the last known details on record.

• 38.1These Terms are accepted electronically through the Platform in accordance with the ECT Act. Electronic acceptance, including by proceeding with registration, following a link sent by Fraudcheck, accessing or using the Platform, or integrating via API, constitutes a legally binding agreement, as set out in clause 4.
• 38.2Communications between the Parties may be conducted electronically, including through the Platform, email or other agreed digital communication channels.
• 38.3The Parties agree that electronic acceptance shall be valid and binding to the same extent as a wet-ink signature, except where a specific provision requires a written signature.

• 39.1These Terms are governed by and construed in accordance with the laws of South Africa.
• 39.2The Parties irrevocably submit to the non-exclusive jurisdiction of the High Court of South Africa, Gauteng Division, Johannesburg, for purposes of seeking urgent or interim relief and for any matters not subject to the dispute resolution process in clause 36.

• 40.1Fraudcheck may update these Terms from time to time to reflect changes in Applicable Laws, regulatory requirements, the Services or operational needs.
• 40.2Updated Terms will be published on the Platform. Fraudcheck shall provide at least 30 (thirty) calendar days' prior written notice of any material change and at least 10 (ten) calendar days' prior written notice of any non-material change, except where a change is required urgently by law or regulatory directive, in which case it takes effect on publication.
• 40.3Continued use of the Services after the effective date of any update constitutes acceptance of the updated Terms. No separate tick-box or confirmation is required.
• 40.4If the User does not accept the updated Terms, it must cease using the Services from the Effective Date and notify Fraudcheck in writing as soon as reasonably practicable thereafter.

• 41.1These Terms, together with all annexures, constitute the entire agreement between the Parties in relation to the subject matter hereof and supersede all prior discussions, negotiations, understandings and agreements between the Parties relating to the Services, subject to clause 3.3.
• 41.2The Parties shall act in good faith in performing their obligations under these Terms and shall do all things reasonably necessary to give effect to the intent and purpose of these Terms.
• 41.3If any provision of these Terms is held to be invalid, unlawful or unenforceable, such provision shall be deemed severed, and the remaining provisions shall continue in full force and effect.
• 41.4No failure or delay by either Party in exercising any right or remedy shall constitute a waiver of that right or remedy. A waiver shall only be effective if made in writing and shall not constitute a waiver of any subsequent breach or default.
• 41.5The User may not assign, transfer or otherwise dispose of any of its rights or obligations under these Terms without Fraudcheck's prior written consent. Fraudcheck may assign or transfer its rights and obligations under these Terms to an affiliate or as part of a merger, acquisition, corporate restructuring or sale of business, provided that the User's rights are not materially prejudiced.
• 41.6No partnership or agency: Nothing in these Terms creates a partnership, joint venture, employment or agency relationship between the Parties. Neither Party has authority to bind the other.
• 41.7Unless these Terms provide otherwise, each Party shall bear its own legal costs in connection with the preparation and negotiation of these Terms.
• 41.8These Terms are entered into for the benefit of the Parties only and do not create any rights in favour of any third party.

Platform Availability

Platform Availability = (Total minutes in the calendar month – Unscheduled Downtime) ÷ Total minutes in the calendar month

Where "Unscheduled Downtime" means periods during which the Platform is unavailable to the User, excluding the following:

• scheduled maintenance windows of up to 4 (four) hours per calendar month, notified to the User at least 48 (forty-eight) hours in advance where reasonably practicable;
• emergency maintenance required to protect the security or integrity of the Platform;
• Force Majeure Events;
• downtime attributable to Third-Party Providers, governmental systems, telecommunications networks or internet service providers; and
• downtime attributable to the User's systems, configurations, equipment or connectivity.

Fraudcheck shall use commercially reasonable efforts to achieve and maintain Platform Availability of at least 99.5% per calendar month.

Maintenance windows

Scheduled maintenance windows shall not exceed 4 (four) hours per calendar month.

Where reasonably practicable, scheduled maintenance shall be:

• scheduled during off-peak hours (typically between 22:00 and 06:00 SAST); and
• notified to the User at least 48 (forty-eight) hours in advance.

Support hours

Incident response times

Resolution times are targets only and do not constitute a guarantee.

Times are measured from when Fraudcheck becomes aware of or is notified of the incident.

The following table sets out the Prescribed Purposes available through the Platform under the Credit Regulatory Framework:

This schedule records the written mandate under which Fraudcheck Processes Personal Information as Operator on behalf of the User as Responsible Party, as contemplated by section 21 of POPIA.

Subject matter

The Processing of Personal Information submitted by the User to the Platform in connection with identity verification, credit bureau enquiries, KYC and AML compliance checks, biometric verification, Background Screening Services, Hosting Services and related Services.

Duration

For the duration of these Terms and for such further period as Fraudcheck is required to retain records under Applicable Laws.

Nature of Processing

Collection, storage, hosting, retrieval, use, transmission to Third-Party Providers and deletion of Personal Information as necessary to provide the Services.

Purpose of Processing

To enable Fraudcheck to deliver the Services to the User, including facilitating access to Consumer Credit Information, conducting identity verification and biometric checks, performing compliance screening, and fulfilling Fraudcheck's regulatory obligations as a registered credit bureau.

Categories of Personal Information Processed

Identity information (name, identity number, date of birth, nationality); contact information (address, email, telephone number); financial information (credit history, payment profile, affordability data); biometric information (facial geometry, liveness detection data, fingerprints where applicable); employment information where relevant to an Authorised Prescribed Purpose; criminal record information, qualification and employment history, and publicly available social media and online information, where relevant to Background Screening Services; and any other Personal Information contained in Hosted Data.

Categories of Data Subjects

The User's customers, employees, prospective employees and other individuals in respect of whom the User submits Personal Information to the Platform.

Operator obligations

Fraudcheck shall Process Personal Information only in accordance with the documented instructions of the User as set out in these Terms, except where required to do otherwise by Applicable Laws. Fraudcheck's obligations as Operator are set out in clause 16.4 of these Terms. Clause 16.9 sets out the circumstances in which Fraudcheck acts as a Responsible Party rather than as an Operator.