End User Agreement

This BoomScreen End User Agreement (this “EUA”) is entered into by and between Boom Pay, Inc., a Delaware corporation (“Company”), and the entity identified in the signature block below (“Client”). This EUA is effective as of the date last signed (the “EUA Effective Date”). This EUA is incorporated into and supplements the Master Services Agreement (the “MSA”) between Company and Client (together with any applicable Order(s), the “Agreement”). Capitalized terms not defined in this EUA have the meanings given in the MSA.

Order of precedence. If there is a conflict between this EUA and the MSA or an applicable Order, the following order of precedence applies: (1) the applicable Order; (2) the MSA; and (3) this EUA, except that this EUA will control solely for the limited purpose of satisfying any required end-user certifications, permissible purpose representations, and flow-through data provider terms applicable to Consumer Reports and related screening data.

Scope. This EUA applies only to Client’s use of Company’s tenant screening services (including Consumer Reports, criminal and eviction data, and any related tools) as described in the applicable Order(s) (the “Screening Services”).

1. Client Role Certification

Client must check one box below to certify its role with respect to the Screening Services. Client represents and warrants that it will obtain and use Consumer Reports only as an end user and only for a permissible purpose under the FCRA and applicable law.

[ ] Fee Manager (Property Manager/Agent). 1
Client certifies it manages properties for one or more owners and is obtaining Consumer Reports as the owner’s agent/service provider pursuant to a written agreement with such owner(s). Client will ensure its agreement(s) with owners include flow-through obligations at least as protective as this EUA and the MSA for the use of Consumer Reports, including permissible purpose, confidentiality, security, audit, and compliance obligations.

[ ] Owner Operator (Property Owner). 2
Client certifies it is the property owner and will obtain and use Consumer Reports on its own behalf for tenant screening.

[ ] Owner with Designated Property Manager. 3
Client certifies it is the property owner and has designated the following property manager to act as its agent/service provider for tenant screening: ____________________________________. Client remains responsible for such property manager’s acts and omissions with respect to Consumer Reports and Screening Services.

2. Definitions (Supplemental)

“Consumer Report” has the meaning set forth in the FCRA and includes any credit report, eviction report, criminal history report, score, or other consumer report furnished in connection with tenant screening through the Screening Services.

“Consumer” means the individual who is the subject of a Consumer Report (e.g., an applicant or resident).

“Data Provider” means a Consumer Reporting Agency or other third-party data/service provider whose data is included in or used to provide the Screening Services.

“Data Provider Terms” means the terms, restrictions, and requirements imposed by a Consumer Reporting Agency or other third-party data/service provider whose data is included in or used to provide the Screening Services, as provided in the applicable Vendor Addendum(s).

“End User” (also referred to by Data Providers as “Qualified Subscriber,” “End Client,” “Subscriber,” “User,” or similar terms) means Client, in its capacity as an authorized end user of Consumer Reports obtained through the Screening Services, including Consumer Reports sourced from one or more Consumer Reporting Agencies, for a permissible purpose under the Fair Credit Reporting Act (“FCRA”).

For avoidance of doubt, Client is a “user of consumer reports” as that term is used under the FCRA.

3. Credentialing; Account Access

Client acknowledges that Company may require credentialing, onboarding, and ongoing compliance checks prior to activating or maintaining Client’s access to the Screening Services. Company has no obligation to provide Screening Services until Client has been approved and access is enabled.

Client will promptly notify Company of any material change to Client’s business, ownership/control, locations, authorized users, or other credentialing information.

4. Permissible Purpose; Use Restrictions

Permissible Purpose. Client will request and use Consumer Reports solely for tenant screening purposes in connection with a business transaction initiated by the Consumer, or other permissible purpose expressly permitted by the FCRA and applicable law, as selected and certified by Client in the signature block below and/or the applicable Order.

One-time use; need-to-know. Client will use Consumer Reports only for the specific screening transaction for which the report was obtained and will limit access to personnel who have a need to know for the screening decision.

No resale/redisclosure. Client will not resell, re-disclose, or otherwise provide Consumer Reports or report contents to any third party except (i) to the Consumer, (ii) as required by law, (iii) to Client’s professional advisors and auditors under confidentiality obligations, or (iv) as expressly permitted by the FCRA and applicable law and the applicable Data Provider Terms. Where redisclosure is permitted, Client will ensure the recipient is bound by obligations at least as protective as this EUA and applicable law.

User credentials. Client will maintain unique user credentials for authorized personnel, protect credentials, and promptly report suspected compromise to Company.

Prohibited requests. Client will not request Consumer Reports about itself, its employees, family, friends, or associates, and will not request reports except as required for legitimate tenant screening decisions in the ordinary course of business.

5. Compliance Requirements

Client will comply with the FCRA and all other applicable federal, state, and local laws and regulations relating to tenant screening, privacy, data protection, fair housing, and the use of Consumer Reports (collectively, “Related Law”).

Consumer authorization. Where required by Related Law or Data Provider Terms, Client will provide required disclosures and obtain the Consumer’s written authorization before requesting a Consumer Report.

Ban-the-box / bifurcated process. Client will not order or use certain criminal information prior to the time allowed under applicable “ban-the-box” or bifurcated process requirements.

Adverse action. When Client takes adverse action based in whole or in part on a Consumer Report, Client will provide legally compliant adverse action notices, including all disclosures required by FCRA Section 615(a) and applicable state law.

Disputes. Client will cooperate as reasonably requested with Company and applicable Data Providers in responding to consumer disputes, investigations, and reinvestigations as required by law and the MSA.

6. Data Security; Retention; Breach

Safeguards. Client will maintain administrative, technical, and physical safeguards consistent with industry standards and at least as protective as required by the MSA and applicable Data Provider Terms.

Retention. Client will retain consumer authorizations, application records, and adverse action notices for at least six (6) years (or longer if required by law), and will securely destroy Consumer Reports when no longer needed for the purpose obtained, subject to legal retention requirements. Client acknowledges and agrees that Client is solely responsible for maintaining its own records and information necessary to satisfy these retention obligations. Client may not rely on Company to maintain Client’s records during or after any transition period or upon termination of this Agreement. Nothing in this EUA shall limit Company’s data retention rights as set forth in the MSA.

Security incident notice. Client will notify Company without undue delay (and in any event within the time period required by the MSA) after discovering any actual or suspected unauthorized access, acquisition, or disclosure of Consumer Reports or related Personal Data. Client will cooperate with Company and Data Providers in investigation and remediation and will comply with all legal notification obligations.

7. Data Use Reservation

Nothing in this EUA limits, restricts, or modifies Company’s data processing, use, retention, aggregation, or derivative-work rights as set forth in the MSA, including Company’s right to use de-identified, aggregated, or processed data for compliance, analytics, fraud prevention, and product improvement purposes.

8. Audits

In addition to audit rights in the MSA, Client agrees that Company and/or applicable Data Providers may audit Client’s compliance with this EUA and Data Provider Terms upon reasonable notice during normal business hours. If an audit identifies material non-compliance, Client will promptly cure and may be responsible for audit costs where required by Data Provider Terms or permitted by the MSA.

9. Vendor Flow-Through Terms; Addenda

Client acknowledges that Screening Services may incorporate data or services provided by third parties (including Consumer Reporting Agencies and other vendors). Client agrees to comply with all applicable Data Provider Terms set forth in the Vendor Addendum(s) attached to and incorporated into this EUA.

If Client uses (or continues to use) Screening Services involving a specific vendor after receiving the applicable Vendor Addendum, Client is deemed to have accepted and agreed to such Vendor Addendum.

Where a Vendor Addendum uses different terminology (such as “End User,” “End Client,” “Subscriber,” “User,” or similar terms, such terms shall be understood to refer to Client as defined in this EUA.

10. Miscellaneous

No legal advice. Client acknowledges Company does not provide legal advice and Client remains solely responsible for its compliance obligations.

Survival. Sections 4–9 survive expiration or termination of this EUA to the extent necessary to enforce restrictions, audits, confidentiality, and compliance obligations relating to Consumer Reports.

Signature; Permissible Purpose Certification

Client’s FCRA Permissible Purpose (select one or more as applicable, subject to the Order):
Tenant screening in connection with a business transaction initiated by the consumer (15 U.S.C. § 1681b(a)(3)(F)).

Company: Boom Pay, Inc.

By: _______________________________________
Name of Authorized Signer: Robert Whiting
Title: CEO
Date: ______________________________________

Client (End User / Property Manager):
Legal Name of Entity: _________________________
State/Country of Formation: ____________________

By: ________________________________________
Name of Authorized Signer: ____________________
Title: _______________________________________
Email: ______________________________________
Date: ______________________________________

Exhibit A – Statutory Disclosures and Universal Consumer Reporting Obligations

The Statutory Disclosures and Universal Consumer Reporting Obligations begin immediately after the following line and continue until the end of this Addendum or until otherwise clearly indicated.

––––––––––––––––––––––––––––––––––––
START OF TERMS
––––––––––––––––––––––––––––––––––––

Exhibit A.1

Vermont Fair Credit Reporting Statute, 9 V.S.A. § 2480e (2016)

§ 2480e. Consumer consent

(a) A person shall not obtain the credit report of a consumer unless:
(1) the report is obtained in response to the order of a court having jurisdiction to issue such an order; or (2) the person has secured the consent of the consumer, and the report is used for the purpose consented to by the consumer.

(b) Credit reporting agencies shall adopt reasonable procedures to ensure maximum possible compliance with subsection (a) of this section.

(c) Nothing in this section shall be construed to affect:
(1) the ability of a person who has secured the consent of the consumer pursuant to subdivision (a)(2) of this section to include in his or her request to the consumer permission to also obtain credit reports, in connection with the same transaction or extension of credit, for the purpose of reviewing the account, increasing the credit line on the account, for the purpose of taking collection action on the account, or for other legitimate purposes associated with the account; and (2) the use of credit information for the purpose of prescreening, as defined and permitted from time to time by the Federal Trade Commission.

VERMONT RULES*** CURRENT THROUGH DECEMBER 16, 2016 *** AGENCY 06. OFFICE OF THE ATTORNEY GENERAL SUB-AGENCY 031. CONSUMER PROTECTION DIVISION
CHAPTER 012. Consumer Fraud--Fair Credit Reporting
RULE CF 112 FAIR CREDIT REPORTING
CVR 06-031-012, CF 112.03 (2016)
CF 112.03 CONSUMER CONSENT

(a) A person required to obtain consumer consent pursuant to 9 V.S.A. §§ 2480e and 2480g shall obtain said consent in writing if the consumer has made a written application or written request for credit, insurance, employment, housing or governmental benefit. If the consumer has applied for or requested credit, insurance, employment, housing or governmental benefit in a manner other than in writing, then the person required to obtain consumer consent pursuant to 9 V.S.A. §§ 2480e and 2480g shall obtain said consent in writing or in the same manner in which the consumer made the application or request. The terms of this rule apply whether the consumer or the person required to obtain consumer consent initiates the transaction.

(b)Consumer consent required pursuant to 9 V.S.A. §§ 2480e and 2480g shall be deemed to have been obtained in writing if, after a clear and adequate written disclosure of the circumstances under which a credit report or credit reports may be obtained and the purposes for which the credit report or credit reports may be obtained, the consumer indicates his or her consent by providing his or her signature.

(c)The fact that a clear and adequate written consent form is signed by the consumer after the consumer's credit report has been obtained pursuant to some other form of consent shall not affect the validity of the earlier consent.

Exhibit A.2

Notice to Users of Consumer Reports

OBLIGATIONS OF USERS UNDER THE FCRA

The Fair Credit Reporting Act (FCRA), 15 U.S.C. 1681-1681y, requires that this notice be provided to inform users of consumer reports of their legal obligations. State law may impose additional requirements. The text of the FCRA is set forth in full at the Consumer Financial Protection Bureau's (CFPB) website at www.consumerfinance.gov/learnmore. At the end of this document is a list of United States Code citations for the FCRA. Other information about user duties is also available at the CFPB's website. Users must consult the relevant provisions of the FCRA for details about their obligations.

I. OBLIGATIONS OF ALL USERS OF CONSUMER REPORTS

A. Users Must Have a Permissible Purpose

Congress has limited the use of consumer reports to protect consumers' privacy. All users must have a permissible purpose under the FCRA to obtain a consumer report. Section 604 contains a list of the permissible purposes under the law. These are:

- As ordered by a court or a federal grand jury subpoena. Section 604(a)(1)

- As instructed by the consumer in writing. Section 604(a)(2)

- For the extension of credit as a result of an application from a consumer, or the review or collection of a consumer's account. Section 604(a)(3)(A)

- For employment purposes, including hiring and promotion decisions, where the consumer has given written permission. Sections 604(a)(3)(B) and 604(b)

- For the underwriting of insurance as a result of an application from a consumer. Section 604(a)(3)(C)

- When there is a legitimate business need, in connection with a business transaction that is initiated by the consumer. Section 604(a)(3)(F)(i)

- To review a consumer's account to determine whether the consumer continues to meet the terms of the account. Section 604(a)(3)(F)(ii)

- To determine a consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status. Section 604(a)(3)(D)

In addition, creditors and insurers may obtain certain consumer report information for the purpose of making firm offers of credit or insurance. Section 604(c)

The FCRA imposes limitations upon users who obtain consumer reports for employment purposes. Users making adverse decisions based on information obtained from third parties must also comply with Section 604(b)(3), which is discussed below in Section VII.A.

B. Users Must Provide Certifications

Section 604(f) prohibits any person from obtaining a consumer report from a consumer reporting agency (CRA) unless the person has certified to the CRA the permissible purpose(s) for which the report is being obtained and certifies that the report will not be used for any other purpose.

C. Users Must Notify Consumers When Adverse Actions Are Taken

Section 615(a) requires users to notify consumers when they take an adverse action based in whole or in part on information contained in a consumer report. The notification may be done in writing, orally, or by electronic means. It must include the following:

- The name, address, and telephone number of the CRA (including a toll-free telephone number, if it is a nationwide CRA) that provided the report.

- A statement that the CRA did not make the adverse decision and is not able to explain why the decision was made.

- A statement setting forth the consumer's right to obtain a free disclosure of the consumer's file from the CRA if the consumer requests the report within 60 days.

- A statement setting forth the consumer's right to dispute directly with the CRA the accuracy or completeness of any information provided by the CRA.

Section 615(a) provides the term adverse action: (1) a denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavorable change in the terms of coverage or amount of insurance for employment, or insurance, existing or applied for; (2) a denial of employment or any other adverse employment decision; or (3) an action or determination that is adverse to the consumer's interests in connection with an application for a new credit account, review or collection of a consumer's account, denial or cancellation of credit, or an increase in the charge for credit or a reduction in the credit limit.

D. Users Have Obligations When Fraud and Active Duty Military Alerts Are in Files

When a consumer has placed a fraud alert, including one relating to identity theft, or an active duty military alert with a nationwide consumer reporting agency as defined in Section 603(p) and resellers, Section 605A(h) imposes limitations on users of reports obtained from the consumer reporting agency in certain circumstances, including the establishment of a new credit plan and the issuance of additional cards on an existing credit account. For initial fraud alerts and active duty alerts, the user must have reasonable policies and procedures in place to form a reasonable belief that the user knows the identity of the applicant or contact the consumer at a telephone number specified by the consumer; in the case of extended fraud alerts, the user must contact the consumer in accordance with the contact information provided in the consumer's alert.

E. Users Have Obligations When Notified of an Address Discrepancy

Section 605(h) requires nationwide CRAs, as defined in Section 603(p), to notify users that request reports when the address for a consumer provided by the user in requesting the report is substantially different from the addresses in the consumer's file. When this occurs, users must comply with regulations specifying the procedures to be followed, which are set forth in Regulation V, 12 CFR 1022.82. Users who obtain reports from resellers must take reasonable steps to obtain the notice if it was issued by the nationwide CRA that provided the report, and then follow reasonable procedures specified in the regulations in Regulation V.

F. Users Have Obligations When Disposing of Records

Section 628 requires that all users must properly dispose of records that contain information derived from consumer reports. The rules implementing Section 628, Disposal of Consumer Report Information and Records, in Regulation V, 12 CFR 1022.31, require that any person who maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose must properly dispose of the information or compilation by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.

II. CREDITORS MUST MAKE ADDITIONAL DISCLOSURES

If a person uses a consumer report in connection with an application for, or a grant, extension, or provision of, credit to a consumer on material terms that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through that person, based in whole or in part on a consumer report, the person must provide a risk-based pricing notice to the consumer in accordance with Section 609(g) and the regulations issued pursuant to that section.

Section 609(g) also contains rules for determining when credit terms are materially less favorable.

Consumers may obtain information about their credit scores from a number of sources, including consumer reporting agencies and lenders. A notice delivered in accordance with the risk-based pricing rule is not required where a lender makes a credit score disclosure to the consumer in accordance with Section 609(g)(1)(B)(i).

III. OBLIGATIONS OF USERS WHEN CONSUMER REPORTS ARE OBTAINED FOR EMPLOYMENT PURPOSES

If information from a CRA is used for employment purposes, the user has specific duties, which are set forth in FCRA Section 604(b). The user must:

- Make a clear and conspicuous written disclosure to the consumer before the report is obtained, in a document that consists solely of the disclosure, that a consumer report may be obtained.

- Obtain from the consumer prior written authorization. Authorization to access reports during the term of employment may be obtained at the time of employment.

- Certify to the CRA that the above steps have been followed, that the information being obtained will not be used in violation of any federal or state equal opportunity law or regulation, and that, if any adverse action is to be taken based on the consumer report, a copy of the report and a summary of the consumer's rights will be provided to the consumer.

- Before taking an adverse action, the user must provide a copy of the report to the consumer as well as the summary of consumer rights. (The user should receive this summary from the CRA.) A Section 615(a) adverse action notice should be sent after the adverse action is taken.

An adverse action notice also is required in employment situations if credit information (other than transactions and experience data) obtained from an affiliate is used to deny employment. Section 615(b)(2)

The procedures for investigative consumer reports and employee misconduct investigations are set forth below.

IV. OBLIGATIONS OF USERS OF INVESTIGATIVE CONSUMER REPORTS

Investigative consumer reports are a special type of consumer report in which information about a consumer's character, general reputation, personal characteristics, and mode of living is obtained through personal interviews by an entity or person that is a consumer reporting agency. Consumers who are subjects of such reports are given special rights under the FCRA. If a user intends to obtain an investigative consumer report, Section 606 requires the following:

- The user must disclose to the consumer that an investigative consumer report may be obtained. This must be done in a written disclosure that is mailed, or otherwise delivered, to the consumer not later than three days after the date the report was first requested. The disclosure must include a statement informing the consumer of his or her right to request additional disclosures of the nature and scope of the investigation as described below, and the summary of consumer rights required by Section 609 of the FCRA. (The summary of consumer rights will be provided by the CRA that conducts the investigation.)

- The user must certify to the CRA that the disclosures set forth above have been made and that the user will make the disclosure described below.

- Upon the written request of a consumer made within a reasonable period of time after the disclosures required above, the user must make a complete disclosure of the nature and scope of the investigation. This must be made in a written statement that is mailed, or otherwise delivered, to the consumer no later than five days after the date on which the request was received from the consumer or the report was first requested, whichever is later in time.

V. SPECIAL PROCEDURES FOR EMPLOYEE INVESTIGATIONS

Section 603(x) provides special procedures for investigations of suspected misconduct by an employee or for compliance with Federal, State or local laws and regulations or the rules of a self-regulatory organization, and compliance with written policies of the employer. These investigations are not treated as consumer reports so long as the employer or its agent complies with the procedures set forth in Section 603(x), and a summary describing the nature and scope of the inquiry is made to the employee if an adverse action is taken based on the investigation.

VI. OBLIGATIONS OF USERS OF MEDICAL INFORMATION

Section 604(g) limits the use of medical information obtained from consumer reporting agencies (other than payment history and identifying information) for credit, insurance, and employment purposes. Section 604(g) and Regulation V, 12 CFR 1022.30, generally prohibit creditors from obtaining or using medical information in connection with a determination of eligibility for credit, with certain limited exceptions.

Any user who receives medical information shall not disclose the information to any other person (except where necessary to carry out the purpose for which the information was disclosed, or as permitted by statute, regulation, or order).

VII. OBLIGATIONS OF USERS OF "FIRM OFFERS OF CREDIT OR INSURANCE"

The FCRA permits creditors and insurers to obtain limited consumer report information for use in connection with unsolicited offers of credit or insurance under certain circumstances. Section 604(c); Section 615(d). This practice is known as making firm offers of credit or insurance. Section 604(c) imposes obligations upon users who obtain such information from a CRA. When making firm offers, users must:

- Provide the consumer with the following clear and conspicuous disclosures: (1) information that a consumer report was used to offer credit or insurance; (2) the criteria used to select the consumer; (3) if applicable, that credit or insurance may not be extended if, after responding, the consumer does not meet the criteria; and (4) instructions on how to opt out of future prescreened offers.

- Maintain strict criteria on file in order to qualify for this exception.

- Actually provide firm offers of credit or insurance to consumers, unless the user can demonstrate that the consumer failed to meet the strict criteria maintained on file.

VIII. OBLIGATIONS OF RESELLERS

Section 607(e) requires any person who obtains a consumer report for resale to take the following steps:

- Disclose the identity of the end-user to the source CRA.

- Identify to the source CRA each permissible purpose for which the report will be used by the end-user.

- Establish and follow reasonable procedures to ensure that reports are resold only for permissible purposes, including procedures to obtain: (1) the identity of all end-users; (2) certifications from all users of each purpose for which reports will be used; and (3) certifications that reports will not be used for any purpose other than the purpose(s) specified to the reseller.

Resellers must make reasonable efforts to verify this information before selling the report.

FCRA SECTIONS REFERENCED IN THE NOTICE TO USERS

15 U.S.C. § 1681 et seq.

Section 603 15 U.S.C. § 1681a Definitions
Section 604 15 U.S.C. § 1681b Permissible Purposes
Section 605 15 U.S.C. § 1681c Requirements Relating to Information Contained in Consumer Reports
Section 605A 15 U.S.C. § 1681c-1 Identity Theft Prevention; Fraud Alerts and Active Duty Alerts Section 605B 15 U.S.C. § 1681c-2 Block of Information Resulting From Identity Theft
Section 606 15 U.S.C. § 1681d Disclosure of Investigative Consumer Reports
Section 607 15 U.S.C. § 1681e Compliance Procedures
Section 608 15 U.S.C. § 1681f Disclosures to Governmental Agencies
Section 609 15 U.S.C. § 1681g Disclosures to Consumers
Section 610 15 U.S.C. § 1681h Conditions and Form of Disclosure to Consumers
Section 611 15 U.S.C. § 1681i Procedure in Case of Disputed Accuracy
Section 612 15 U.S.C. § 1681j Charges for Certain Disclosures
Section 613 15 U.S.C. § 1681k Public Record Information for Employment Purposes
Section 614 15 U.S.C. § 1681l Restrictions on Investigative Consumer Reports
Section 615 15 U.S.C. § 1681m Requirements on Users of Consumer Reports
Section 616 15 U.S.C. § 1681n Civil Liability for Willful Noncompliance
Section 617 15 U.S.C. § 1681o Civil Liability for Negligent Noncompliance
Section 618 15 U.S.C. § 1681p Jurisdiction of Courts; Limitation of Actions
Section 619 15 U.S.C. § 1681q Obtaining Information Under False Pretenses
Section 620 15 U.S.C. § 1681r Unauthorized Disclosures by Officers or Employees
Section 621 15 U.S.C. § 1681s Administrative Enforcement
Section 622 15 U.S.C. § 1681s-1 Information on Overdue Child Support Obligations
Section 623 15 U.S.C. § 1681s-2 Responsibilities of Furnishers of Information to Consumer Reporting Agencies
Section 624 15 U.S.C. § 1681s-3 Affiliate Sharing
Section 625 15 U.S.C. § 1681t Relation to State Laws
Section 626 15 U.S.C. § 1681u Disclosures to FBI for Counterintelligence Purposes
Section 627 15 U.S.C. § 1681v Disclosures to Governmental Agencies for Counterterrorism Purposes
Section 628 15 U.S.C. § 1681w Disposal of Records
Section 629 15 U.S.C. § 1681x Corporate and Technological Circumvention Prohibited

Exhibit A.3

Summary of Consumer Rights

Para información en español, visite www.consumerfinance.gov/learnmore o escribe a la Consumer Financial Protection Bureau, 1700 G Street N.W., Washington, DC 20552.

A Summary of Your Rights Under the Fair Credit Reporting Act

The federal Fair Credit Reporting Act (FCRA) promotes the accuracy, fairness, and privacy of information in the files of consumer reporting agencies. There are many types of consumer reporting agencies, including credit bureaus and specialty agencies (such as agencies that sell information about check writing histories, medical records, and rental history records). Here is a summary of your major rights under the FCRA. For more information, including information about additional rights, go to www.consumerfinance.gov/learnmore or write to: Consumer Financial Protection Bureau, 1700 G Street N.W., Washington, DC 20552.

- You must be told if information in your file has been used against you. Anyone who uses a credit report or another type of consumer report to deny your application for credit, insurance, or employment – or to take another adverse action against you – must tell you, and must give you the name, address, and phone number of the agency that provided the information.

- You have the right to know what is in your file. You may request and obtain all the information about you in the files of a consumer reporting agency (your "file disclosure"). You will be required to provide proper identification, which may include your Social Security number. In many cases, the disclosure will be free. You are entitled to a free file disclosure if:

- a person has taken adverse action against you because of information in your credit report;

- you are the victim of identity theft and place a fraud alert in your file;

- your file contains inaccurate information as a result of fraud;

- you are on public assistance;

- you are unemployed but expect to apply for employment within 60 days.

In addition, all consumers are entitled to one free disclosure every 12 months upon request from each nationwide credit bureau and from nationwide specialty consumer reporting agencies. See www.consumerfinance.gov/learnmore for additional information.

- You have the right to ask for a credit score. Credit scores are numerical summaries of your credit-worthiness based on information from credit bureaus. You may request a credit score from consumer reporting agencies that create scores or distribute scores used in residential real property loans, but you will have to pay for it. In some mortgage transactions, you will receive credit score information for free from the mortgage lender.

- You have the right to dispute incomplete or inaccurate information. If you identify information in your file that is incomplete or inaccurate, and report it to the consumer reporting agency, the agency must investigate unless your dispute is frivolous. See www.consumerfinance.gov/learnmore for an explanation of dispute procedures.

- Consumer reporting agencies must correct or delete inaccurate, incomplete, or unverifiable information. Inaccurate, incomplete, or unverifiable information must be removed or corrected, usually within 30 days. However, a consumer reporting agency may continue to report information it has verified as accurate.

- Consumer reporting agencies may not report outdated negative information. In most cases, a consumer reporting agency may not report negative information that is more than seven years old, or bankruptcies that are more than 10 years old.

- Access to your file is limited. A consumer reporting agency may provide information about you only to people with a valid need -- usually to consider an application with a creditor, insurer, employer, landlord, or other business. The FCRA specifies those with a valid need for access.

- You must give your consent for reports to be provided to employers. A consumer reporting agency may not give out information about you to your employer, or a potential employer, without your written consent given to the employer. Written consent generally is not required in the trucking industry. For more information, go to www.consumerfinance.gov/learnmore.

- You many limit "prescreened" offers of credit and insurance you get based on information in your credit report. Unsolicited "prescreened" offers for credit and insurance must include a toll-free phone number you can call if you choose to remove your name and address from the lists these offers are based on. You may opt out with the nationwide credit bureaus at 1-888-5-OPTOUT (1-888-567-8688).

- You may seek damages from violators. If a consumer reporting agency, or, in some cases, a user of consumer reports or a furnisher of information to a consumer reporting agency violates the FCRA, you may be able to sue in state or federal court.

- Identity theft victims and active duty military personnel have additional rights. For more information, visit www.consumerfinance.gov/learnmore.

States may enforce the FCRA, and many states have their own consumer reporting laws. In some cases, you may have more rights under state law. For more information, contact your state or local consumer protection agency or your state Attorney General. For information about your federal rights, contact:

TYPE OF BUSINESS:
CONTACT:

1.a. Banks, savings associations, and credit unions with total assets of over $10 billion and their affiliates
a. Consumer Financial Protection Bureau
1700 G Street, N.W.
Washington, DC 20552

b. Such affiliates that are not banks, savings associations, or credit unions also should list, in addition to the CFPB:
b. Federal Trade Commission: Consumer Response Center – FCRA
Washington, DC 20580
(877) 382-4357

2. To the extent not included in item 1 above:

a. National banks, federal savings associations, and federal branches and federal agencies of foreign banks
a. Office of the Comptroller of the Currency
Customer Assistance Group
1301 McKinney Street, Suite 3450
Houston, TX 77010-9050

b. State member banks, branches and agencies of foreign banks (other than federal branches, federal agencies, and Insured State Branches of Foreign Banks), commercial lending companies owned or controlled by foreign banks, and organizations operating under section 25 or 25A of the Federal Reserve Act
b. Federal Reserve Consumer Help Center
P.O. Box. 1200
Minneapolis, MN 55480

c. Nonmember Insured Banks, Insured State Branches of Foreign Banks, and insured state savings associations
c. FDIC Consumer Response Center
1100 Walnut Street, Box #11
Kansas City, MO 64106

d. Federal Credit Unions
d. National Credit Union Administration
Office of Consumer Financial Protection (OCFP)
Division of Consumer Compliance Policy and Outreach (DCCPO)
1775 Duke Street
Alexandria, VA 22314

3. Air carriers
Assistant General Counsel for Office of Aviation Consumer Protection
Aviation Consumer Protection Division
Department of Transportation
1200 New Jersey Avenue, S.E.
Washington, DC 20590

4. Creditors Subject to the Surface Transportation Board
Office of Proceedings, Surface Transportation Board
Department of Transportation
395 E Street, S.W.
Washington, DC 20423

5. Creditors Subject to the Packers and Stockyards Act, 1921
Nearest Packers and Stockyards Administration area supervisor

6. Small Business Investment Companies
Associate Deputy Administrator for Capital Access
United States Small Business Administration
409 Third Street, S.W., 8th Floor
Washington, DC 20416

7. Brokers and Dealers
Securities and Exchange Commission
100 F Street, N.E.
Washington, DC 20549

8. Federal Land Banks, Federal Land Bank Associations, Federal Intermediate Credit Banks, and Production Credit Associations
Farm Credit Administration
1501 Farm Credit Drive
McLean, VA 22102-5090

9. Retailers, Finance Companies, and All Other Creditors Not Listed Above
FTC Regional Office for region in which the creditor operates or Federal Trade Commission: Consumer Response Center – FCRA
Washington, DC 20580
(877) 382-4357

Exhibit A.4

Remedying the Effects of Identity Theft

Para información en español, visite www.consumerfinance.gov/learnmore o escribe a la Consumer Financial Protection Bureau, 1700 G Street NW, Washington, DC 20552.

You are receiving this information because you have notified a consumer reporting agency that you believe that you are a victim of identity theft. Identity theft occurs when someone uses your name, Social Security number, date of birth, or other identifying information, without authority, to commit fraud. For example, someone may have committed identity theft by using your personal information to open a credit card account or get a loan in your name. For more information, visit www.consumerfinance.gov/learnmore or write to: Consumer Financial Protection Bureau, 1700 G Street N.W., Washington, DC 20552.

The Fair Credit Reporting Act (FCRA) gives you specific rights when you are, or believe that you are, the victim of identity theft. Here is a brief summary of the rights designed to help you recover from identity theft.

1. You have the right to ask that nationwide consumer reporting agencies place “fraud alerts” in your file to let potential creditors and others know that you may be a victim of identity theft. A fraud alert can make it more difficult for someone to get credit in your name because it tells creditors to follow certain procedures to protect you. It also may delay your ability to obtain credit. You may place a fraud alert in your file by calling just one of the three nationwide consumer reporting agencies. As soon as that agency processes your fraud alert, it will notify the other two, which then also must place fraud alerts in your file.

- Equifax: 1-800-525-6285; www.equifax.com
- Experian: 1-888-397-3742; www.experian.com
- TransUnion: 1-800-680-7289; www.transunion.com An initial fraud alert stays in your file for at least one year. An extended alert stays in your file for seven years. To place either of these alerts, a consumer reporting agency will require you to provide appropriate proof of your identity, which may include your Social Security number. If you ask for an extended alert, you will have to provide an identity theft report. An identity theft report includes a copy of a report you have filed with a federal, state, or local law enforcement agency, and additional information a consumer reporting agency may require you to submit.

For more detailed information about the identity theft report, visit www.consumerfinance.gov/learnmore.

2. You have the right to free copies of the information in your file (your “file disclosure”). An initial fraud alert entitles you to a copy of all the information in your file at each of the three nationwide agencies, and an extended alert entitles you to two free file disclosures in a 12-month period following the placing of the alert. These additional disclosures may help you detect signs of fraud, for example, whether fraudulent accounts have been opened in your name or whether someone has reported a change in your address. Once a year, you also have the right to a free copy of the information in your file at any consumer reporting agency, if you believe it has inaccurate information due to fraud, such as identity theft. You also have the ability to obtain additional free file disclosures under other provisions of the FCRA. See www.consumerfinance.gov/learnmore.

3. You have the right to obtain documents relating to fraudulent transactions made or accounts opened using your personal information. A creditor or other business must give you copies of applications and other business records relating to transactions and accounts that resulted from the theft of your identity, if you ask for them in writing. A business may ask you for proof of your identity, a police report, and an affidavit before giving you the documents. It may also specify an address for you to send your request. Under certain circumstances a business can refuse to provide you with these documents. See www.consumerfinance.gov/learnmore.

4. You have the right to obtain information from a debt collector. If you ask, a debt collector must provide you with certain information about the debt you believe was incurred in your name by an identity thief – like the name of the creditor and the amount of the debt.

5. If you believe information in your file results from identity theft, you have the right to ask that a consumer reporting agency block that information from your file. An identity thief may run up bills in your name and not pay them. Information about the unpaid bills may appear on your consumer report. Should you decide to ask a consumer reporting agency to block the reporting of this information, you must identify the information to block, and provide the consumer reporting agency with proof of your identity and a copy of your identity theft report. The consumer reporting agency can refuse or cancel your request for a block if, for example, you don’t provide the necessary documentation, or where the block results from an error or a material misrepresentation of fact made by you. If the agency declines or rescinds the block, it must notify you. Once a debt resulting from identity theft has been blocked, a person or business with notice of the block may not sell, transfer, or place the debt for collection.

6. You also may prevent businesses from reporting information about you to consumer reporting agencies if you believe the information is a result of identity theft. To do so, you must send your request to the address specified by the business that reports the information to the consumer reporting agency. The business will expect you to identify what information you do not want reported and to provide an identity theft report.

7. The following FCRA right applies with respect to nationwide consumer reporting agencies:

CONSUMERS HAVETHE RIGHT TO OBTAINA SECURITY FREEZE

You have a right to place a “security freeze” on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit.

As an alternative to a security freeze, you have the right to place an initial or extended fraud alert on your credit file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer's credit file. Upon seeing a fraud alert display on a consumer's credit file, a business is required to take steps to verify the consumer's identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting 7 years.

A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

To learn more about identity theft and how to deal with its consequences, visit www.consumerfinance.gov/learnmore, or write to the Consumer Financial Protection Bureau.

You may have additional rights under state law. For more information, contact your local consumer protection agency or your state Attorney General.

In addition to the new rights and procedures to help consumers deal with the effects of identity theft, the FCRA has many other important consumer protections. They are described in more detail at www.consumerfinance.gov/learnmore.

––––––––––––––––––––––––––––––––––––
END OF TERMS
––––––––––––––––––––––––––––––––––––

Client (End User / Property Manager):

Legal Name of Entity: ________________________________

By: _______________________________

Name: _____________________________

Title: ______________________________

Date: ______________________________

Exhibit B – Plaid Inc. Vendor Addendum

Vendor: Plaid Inc. (“Vendor”)
Effective Date: January 7, 2026
Products/Services Covered: Identity verification, others
1. Flow-Through Obligations. Client agrees to comply with the Vendor’s end-user terms, restrictions, and requirements applicable to the Products/Services Covered (the “Vendor Terms”). Vendor Terms are incorporated by reference or set forth below/attached.

2. Conflicts. If Vendor Terms conflict with this EUA or the MSA, Vendor Terms control solely to the extent necessary to satisfy Vendor requirements for the Products/Services Covered; otherwise, the MSA controls.

3. Audit. Client will cooperate with Vendor or Company audits as required by Vendor Terms.

4. Data Use. Client will use Vendor-provided data solely for permissible purposes and will not resell or redisclose except as permitted by law and Vendor Terms.

5. Security. Client will meet Vendor security requirements and promptly notify Company of any suspected compromise involving Vendor data.

6. Termination/Suspension. Company may suspend access to Vendor data if required by Vendor Terms or to prevent legal/compliance risk.

Vendor Terms Attachment:
[ ✔ ] Included below
[ ] URL/Reference: ______________________________________
If Vendor Terms are included below, the Vendor Terms begin immediately after the following line and continue until the end of this Addendum or until otherwise clearly indicated.

––––––––––––––––––––––––––––––––––––
START OF VENDOR TERMS
––––––––––––––––––––––––––––––––––––

End Client Flow Down Terms

1. Restrictions. Unless Plaid specifically agrees otherwise in writing, End Client will not, and will not enable or assist any third-party to: (i) attempt to reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, or algorithms of the Plaid services described at https://www.plaid.com (“Plaid Services”); (ii) modify, translate, or create derivative works based on the Plaid Services; (iii) make the Plaid Services or information and data of End Client’s end users (“End Users”) provided to End Client via the Plaid Services (such information and data, the “Plaid-Provided Data”) or any derivative work thereof available to, or use the Plaid Services or Plaid-Provided Data (or any derivative work thereof) for the benefit of, anyone other than End Client or End Users; (iv) sell, resell, license, sublicense, distribute, rent, or lease any Plaid Services or Plaid-Provided Data (or any derivative work thereof) to any third-party, or include any Plaid Services or Plaid-Provided Data (or any derivative work thereof) in a service bureau, time-sharing, or equivalent offering; (v) publicly disseminate information from any source regarding the performance of the Plaid Services or Plaid-Provided Data; or (vi) attempt to create a substitute or similar service through use of, or access to, the Plaid Services or Plaid-Provided Data. End Client will use the Plaid Services and Plaid-Provided Data only in compliance with: (a) the End Client application, use case, and other restrictions agreed between Plaid and Partner; (b) the Plaid developer policies (available at https://www.plaid.com/legal); (c) Plaid’s applicable technical user documentation (available at https://www.plaid.com/docs); and (d) any agreements between End Client and End Users (for clarity, including any privacy policy or statement). Notwithstanding anything to the contrary, as between Plaid and End Client, End Client accepts and assumes all responsibility for complying with all applicable laws and regulations in connection with End Client’s activities involving any Plaid Services, Plaid-Provided Data, or End User data. End Client acknowledges and agrees that: (I) Plaid is neither a “consumer reporting agency” nor a “furnisher” of information to consumer reporting agencies under the Fair Credit Reporting Act (“FCRA”); and (II) the Plaid-Provided Data is not a “consumer report” under the FCRA. End Client represents and warrants that it will not, and will not permit or enable any third party to, use the Plaid Services (including Plaid-Provided Data) as a or as part of a “consumer report” as that term is defined in the FCRA, or otherwise use the Plaid Services (including Plaid-Provided Data) such that the Plaid Services (including Plaid-Provided Data) would be deemed “consumer reports” under the FCRA. Notwithstanding anything to the contrary, End Client will be bound by, and will only use the Plaid Services and Plaid-Provided Data in compliance with, the terms and conditions set forth in this agreement. 2. Secondary Investors. Subject to this Section 2 (Secondary Investors), End Client may request that Plaid or Partner disclose Plaid-Provided Data or a Partner product or service including or incorporating Plaid-Provided Data (collectively, the “Shared Data”) to End Client’s Secondary Investors. “Secondary Investor” means a third-party investor or purchaser of a financial product originated by End Client and provided to an End User (e.g., a loan), with which investor or purchaser Plaid maintains a separate technical integration.

i. End Client represents and warrants to Plaid that, before disclosure of Shared Data to any Secondary Investor, End Client will provide and obtain all required (including under applicable law) notices and consents from the applicable End User with respect to disclosure of Shared Data to such Secondary Investor by Plaid or Partner.

ii. Notwithstanding anything to the contrary: (a) as between Plaid and End Client, solely End Client is responsible for its relationships with Secondary Investors and with Partner, including any related billing matters, technical support, or disputes; (b) End Client will enter into legally binding written agreements with each Secondary Investor that are consistent with this Section 2 (Secondary Investors) and all applicable terms and conditions of this Exhibit A (End Client Flow Down Terms), including Section 1 (Restrictions); and (c) as between Plaid and End Client, End Client will remain responsible for the Secondary Investors’ compliance with all of the terms and conditions of this Exhibit A (End Client Flow Down Terms) (including terms relating to use of Plaid-Provided Data or Shared Data).

iii. As between Plaid and End Client, End Client will be fully liable for: (a) any breach by End Client of this Section 2 (Secondary Investors); (b) any acts or omissions of Secondary Investors; and (c) any dispute arising among End Client, Partner, Secondary Investors, and/or End Users relating to the disclosure or use of Shared Data as contemplated in this Section 2 (Secondary Investors).

3. Privacy and Authorizations. Before any End User engages with Partner products or services which include, are derived from, or incorporate the Plaid Services, End Client warrants and will ensure that it provides all notices and obtains all consents required under applicable lawto enable Plaid to process End User data in accordance with Plaid’s privacy policy (currently available at https://www.plaid.com/privacy). End Client will not: (i) make representations or other statements with respect to End User data that are contrary to or otherwise inconsistent with Plaid’s privacy policy; or (ii) interfere with any independent efforts by Plaid to provide End User notice or obtain End User consent.

4. DISCLAIMER; ENFORCEMENT. THE PLAID SERVICES, PLAID-PROVIDED DATA, AND ANY OTHER INFORMATION, SOFTWARE, PRODUCTS, SERVICES AND MATERIALS PROVIDED BY PLAID IN CONNECTION WITH THIS AGREEMENT ARE PROVIDED “AS IS.” TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PLAID NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS MAKE ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR ANY WARRANTY THAT THE SERVICES ARE FREE FROM DEFECTS. WITHOUT LIMITING THE FOREGOING IN THIS SECTION 4 (DISCLAIMER; ENFORCEMENT), NEITHER PLAID NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS MAKE ANY REPRESENTATION OR WARRANTY AS TO THE PLAID-PROVIDED DATA THAT MAY BE OBTAINED FROM USE OF THE PLAID SERVICES OR THAT ANY PLAID SERVICES WILL BE UNINTERRUPTED, OR THAT ANY DATA PROVIDED BY OR THROUGH ANY PLAID SERVICES WILL BE TIMELY, ACCURATE, OR COMPLETE.

PLAID WILL BE AN INTENDED THIRD-PARTY BENEFICIARY OF THE AGREEMENT
BETWEEN PARTNER AND END CLIENT AND MAY DIRECTLY ENFORCE SUCH AGREEMENT AGAINST END CLIENT, WITHOUT PARTNER’S CONSENT OR PARTICIPATION, BUT SOLELY RELATING TO THE PLAID-PROVIDED DATA (INCLUDING FI DATA) AND PLAID SERVICES THAT ARE PROVIDED BY PLAID TO PARTNER OR END CLIENT.

5. FI Data. Through the Partner Services or Plaid Services, End Client may have access to information about or of End Users provided to Plaid by a bank, financial institution, or other data source (each, as designated by Plaid, “FI”, and such information, the “FI Data”).

i. End Client Obligations.

a. End User Consents. End Client will provide all notices to, and obtain all express consents from, each End User as required under applicable laws in connection with End Client’s use, storage, and other processing of any FI Data (such notices and consents, the “Express Consents”). Express Consents will: (A) be clear and conspicuous; (B)generally specify the categories of FI Data that End Client will receive and how End Client will use, store, and otherwise process FI Data; (C) be valid, enforceable, and expressly accepted by each End User; (D) identify any and all third parties or categories of third parties to whom End Client may provide FI Data for processing; (E) specify how End Users may exercise their right to revoke their Express Consent; and (F) include any other required disclosures under applicable laws. End Client will maintain records (which may include technical logs, screenshots, versions of Express Consents obtained) sufficient to demonstrate End Client’s compliance with this Section 5(i)(a) (End User Consents) and will promptly provide such records to Plaid upon request.

b. Scope of Access. End Client will only access FI Data for which it has obtained Express Consents from the End User for the use case reviewed and permitted by Plaid in writing and consented to by the applicable End User (such use case, the “Permitted Use Case”).

For clarity, key factors Plaid will consider during its review of a potential Permitted Use Case include whether the use case is appropriate and useful to provide the End User with the End Client application that the End User has enrolled in, whether the End Client application provides a direct benefit to the End User, whether the use case directly supports the development of new or improved product features for the benefit of End Users, and the jurisdiction(s) in which the End Client operates and/or stores FI Data. If End Client possesses FI Data that exceeds the scope of the End User’s Express Consents, End Client will use industry-standard means to permanently and securely delete (“Delete”) such FI Data; provided that End Client may retain such FI Data to the extent required by applicable laws. If End Client becomes aware that any data it receives from Plaid does not relate to the End User that End Client originally requested FI Data for, End Client will promptly notify Plaid and will Delete such data.

c. Data Use. End Client will use, store and otherwise process FI Data solely in accordance with the End User’s Express Consents and applicable laws.

d. Data Disclosure. End Client will not disclose, transfer, syndicate or distribute FI Data to any third party (including its Permitted Service Providers) (“Data Sharing”) except in each case with the End User’s Express Consent and in accordance with applicable laws.

Notwithstanding anything to the contrary, End Client will not sell FI Data.

e. Data Deletion. End Client will promptly Delete any FI Data upon request by the applicable End User; provided that End Client may retain copies of FI Data solely to the extent required by applicable laws.

f. No Attribution. End Client will not charge End Users any fees attributable to an FI for (a) access to its FI Data or (b) use of End User’s account with an FI in connection with the End Client application. In addition, End Client will not suggest or imply a partnership, sponsorship, or other relationship with an FI based on End Client’s receipt of FI Data under the Partner-Client Agreement or this Section 5 (FI Data).

g. No Other Access. During the term of the Agreement, End Client will only access FI Data through the Plaid Services or another manner that uses the FI’s authorized APIs. End Client will not “screen scrape” data from FIs or collect an End User’s log-on credentials for FI accounts, and will not otherwise knowingly obtain from a third party FI Data that was originally sourced through screen scraping an FI. End Client will immediately Delete any such End User log-on credentials in its possession. End Client will maintain records to demonstrate compliance with this Section 5(i)(g) (No Other Access). For the avoidance of doubt, nothing in this Section 5(i)(g) (No Other Access) will prohibit End Client from engaging any third party to obtain services similar to the Plaid Services, provided that such third-party services enable End Client's access to FI Data solely via the FI’s authorized APIs.

h. Compliance with Laws. End Client will comply with all applicable privacy, security, and other laws pertaining to FI Data. End Client will not use, store, disclose, or otherwise process any FI Data for any purpose not permitted under applicable laws. For the avoidance of doubt, End Client acknowledges that Section 1033 of the Dodd-Frank Act may include obligations on End Client relating to processing, handling, and protecting FI Data. End Client will maintain a program designed to ensure compliance with applicable laws, including appropriately training End Client personnel.

i. Information Security Program. End Client will maintain a comprehensive written information security program approved by its senior management (“Infosec Program”).

The Infosec Program will include administrative, technical and physical measures designed to: (a) ensure the security of FI Data, (b) protect against unauthorized access to or use of FI Data and anticipated threats and hazards to FI Data and (c) ensure the proper disposal of FI Data. The Infosec Program will be appropriate to End Client’s risk profile and activities, the nature of the End Client application, and the nature of the FI Data received by End Client. In any event, the Infosec Program will meet or exceed applicable control objectives captured in industry standards and best practices, such as AICPA Trust Service Criteria for Security, NIST 800-53, or ISO 27002, and will comply with applicable laws. End Client will use up-to-date antivirus software and anti-malware tools designed to prevent viruses, malware, and other malicious code in the End Client application or on End Client’s systems.

j. Security Breach Obligations. End Client will notify Plaid promptly (and in any event within twelve (12) hours) via an email to security@plaid.com, following End Client becoming aware of any Security Breach, providing a description of all known facts, the types of End Users affected, and any other information related to such Security Breach that Plaid may reasonably request. End Client will reasonably cooperate with Plaid in investigating and remediating Security Breaches. End Client will be responsible for the costs of investigating, mitigating, and remediating the Security Breach. “Security Breach” means any event that compromises the End Client application or End Client’s systems or that does or reasonably could compromise the security, integrity or confidentiality of FI Data or result in the unauthorized use, disclosure, or loss of FI Data.

k. FI Confidential Information. If Plaid discloses to End Client any confidential or proprietary materials of an FI pertaining to the provision of FI Data hereunder (such materials, “FI Confidential Information”), such materials will be subject to the same obligations that apply to Partner’s Confidential Information under the Partner-Client Agreement, which will in no event be less protective of such information than a reasonable standard of care. FI Confidential Information will also be subject to the same obligations as FI Data under this Section 5(i) (End Client Obligations). End Client will promptly Delete FI Confidential Information in its possession upon Plaid’s request and will provide a written certification regarding such Deletion.

l. Oversight and Cooperation. Toward assessing End Client’s material compliance with this Section 5 (FI Data), End Client will promptly provide all reasonably necessary information and cooperation requested by Plaid, an FI, or any entity with examination, supervision, or other legal or regulatory authority over Plaid or an FI. In the event that Plaid has a good faith reason to believe that End Client is not in material compliance with this Section 5 (FI Data), Plaid will notify End Client and, upon Plaid’s request, End Client will promptly provide sufficient documentation to demonstrate such material compliance. If the documentation provided by End Client in accordance with the immediately prior sentence is insufficient (in Plaid’s reasonable discretion) to demonstrate such material compliance, End Client will submit to a third-party audit by a firm selected by End Client from a list of audit firms reasonably approved by Plaid to verify such compliance. Plaid and FIs may also conduct technical or operational assessments of End Client, which will be subject to advance notice and will not occur more than once per year unless legally required and materially different in scope from a preceding audit.

m. Information Sharing. Where required by an FI or relevant to an End Client’s access or use of FI Data from that FI, Plaid may share with such FI certain information related to End Client’s compliance with this Section 5 (FI Data), including with respect to End Client’s Infosec Program. Plaid will use commercially reasonable efforts to require that such FI treat any such information in a confidential manner.

n. Insurance. End Client will maintain insurance coverage appropriate to End Client’s risk profile and activities, the nature of the End Client application, and the nature of the FI Data received by End Client; provided that such coverage will be no less than industry standard and will include cybersecurity liability insurance.

o. Access Frequency. The parties acknowledge that as of the effective date of the Partner-Client Agreement, no guidelines regarding End Client’s frequency of “batch” pulls of FI Data (such guidelines, the “Guidelines”) apply to Plaid end clients. Notwithstanding the foregoing in this paragraph: (1) End Client will comply with any Guidelines provided in writing by Plaid (including via Partner); and (2) Plaid and Partner may enforce such Guidelines to the extent necessary in accordance with Plaid’s standard practices, which may include throttling, suspension or termination of End Client’s access.

p. End Client Marks License. End Client hereby grants to Plaid and each FI (and each of their third-party service providers) the non-exclusive and non-transferable right and license to use End Client’s trademarks and service marks solely in connection with consent management activities, including use associated with End User facing consent management portals operated by Plaid or an FI.

ii. Suspension. Plaid may suspend End Client’s access to the Plaid Services or FI Data, in whole or in part, if Plaid determines or reasonably believes that: (a) End Client has breached this Section 5 (FI Data); (b) End Client’s use of the Plaid Services or FI Data will or has materially violated an agreement between Plaid and an applicable FI; (c) End Client’s use of the Plaid Services or FI Data will or does pose a risk of material harm, including material reputational harm, to End Users, an FI, or the Plaid Services. In addition, an FI may suspend End Client’s access to FI Data with respect to such FI. Plaid will use commercially reasonable efforts to: (1) notify Partner prior to any suspension described in this paragraph; (2) discuss with Partner in good faith any such suspension; and (3) resume End Client’s access to the Plaid Services and FI Data as promptly as is practicable after the basis for such suspension is cured to Plaid’s (and, as applicable, the relevant FI’s) reasonable satisfaction.

iii. Indemnity. End Client will indemnify, defend and hold harmless each FI, Plaid, and the affiliates of each of the foregoing from any claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs, and expenses arising from or in connection with: (a) any Security Breach resulting in unauthorized disclosure of FI Data provided to End Client hereunder; or (b) End Client’s unauthorized or improper use of FI Data provided to End Client hereunder (including any unauthorized Data Sharing, transmission, access, display, storage, or loss). This Section 5(iii) (Indemnity) is not subject to any limitation of liabilities set forth in the Partner-Client Agreement. Each FI is a third-party beneficiary of this Section 5(iii) (Indemnity).

iv. Modifications. End Client acknowledges that continued access to FI Data provided by certain FIs may necessitate modifications to this Section 5 (FI Data) pertaining to all applicable Plaid end clients. End Client will accept such modifications to continue accessing or using the Plaid Services with respect to such FIs. Plaid will use commercially reasonable efforts to notify Partner of the modifications and the effective date of such modifications. If End Client objects to the modifications, its exclusive remedy is to cease any and all access and use of the Plaid Services as it relates to the applicable FI(s). Continued access to or use of such Plaid Services after the effective date of such modifications to this Section 5 (FI Data) will constitute End Client’s acceptance of such modifications.

v. Miscellaneous. In the event of a conflict with any other agreement or provision (including other provisions within the Partner-Client Agreement), the terms and conditions of this Section 5 (FI Data) will govern and prevail. Capitalized terms used in this Section 5 (FI Data) and not otherwise defined will have the meanings ascribed to them in the Agreement. All provisions of this Section 5 (FI Data) will remain in force in the event of the termination or expiration of this Section 5 (FI Data), the Agreement, or the Partner-Client Agreement.

6. IDV Services. Through the Partner Services, End Client may have access to IDV Services (as defined below). When providing the IDV Services to End Client through the Partner Services, Partner is acting as End Client’s processor and Plaid is acting as Partner’s subprocessor, as further described below. The provisions of this Section 6 (the “IDV Terms”) set out terms and conditions in connection with the IDV Services.

i. DEFINITIONS

a. “End Client Data” means data in electronic form that is transmitted through the IDV Services by, on behalf of, from or to End Client or End Users. For the avoidance of doubt: (i) End Client Data (including End Client Data returned to End Client) is not Plaid-Provided Data; and (ii) End Client Data is not the confidential information of either party.

b. “Identity Verification” means Plaid’s Identity Verification services, including such services' fraud detection and prevention features.

c. “Monitor” means Plaid’s anti-money laundering screening services.

d. “IDV Services” means the services: (i) comprised of Identity Verification and Monitor, as applicable, and the Dashboard; and (ii) that End Client may have access to through the Partner Services. For the avoidance of doubt, the IDV Services are Plaid Services.

e. “Dashboard” means the End Client facing dashboard functionality and dashboard display services within the Identity Verification and Monitor services.

f. “GLBA” means the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801, et seq. and the United States Federal Trade Commission rules promulgated thereunder, as may be interpreted from time to time by a competent regulatory authority.

g. “IDV Privacy Statement” means the end user privacy statement for the IDV Services available at https://plaid.com/legal/#idv-privacy-statement.

h. “PII” means End Client Data that relates to an End User and is deemed “personal data” or “personal information” (or analogous variations of such terms) under applicable privacy or data protection laws.

i. “Process” means collect, disclose, use, store, or otherwise process.

j. For the purposes of these IDV Terms, the terms “controller,” “processor,” and “subprocessor” have the meanings ascribed to them, and are hereby deemed references to the relevant defined terms with analogous meanings, under applicable law. For example, these terms will be deemed references, as applicable, to the terms “business” and “service provider” as such terms are used in the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020.

ii. IDV SERVICES

a. Access. End Client may use the IDV Services subject to, and only in accordance with, applicable law, these IDV Terms, the Partner-Client Agreement, the agreed use cases therein, and any agreements between End Client and End Users (for clarity, including any privacy policy or terms of service) to: (i) verify, via Identity Verification’s matching of End Client Data provided by End Users, applicable End User identities in the normal course of End Client's business; and (ii) assess, via Monitor, the End Client Data for certain screening purposes (e.g., to confirm that End Users do not appear on any watchlist, to provide antifraud or anti-money laundering screening services, etc.). Without limiting the generality of the foregoing, End Client agrees that: (a) End Client will not enable or use the “autofill” functionality of the IDV Services if End Client is located outside of the United States; and (b) any violation of this sentence will be deemed a material breach of these IDV Terms
b. Instructions. To enable Partner to provide the IDV Services to End Client, End Client will submit instructions via the Dashboard (the “Instructions”). The Instructions will include direction regarding: (i) the applicable categories or types of End Client Data that will be processed by the IDV Services on behalf of End Client and its End Users; (ii) when such processing will occur; and (iii) the categories or types of End Users who will provide End Client Data through the IDV Services.

c. Consent. End Client represents and warrants that End Client will provide all notices and obtain all consents as required under applicable law, regulations, and third-party agreements for: (i) End Client to Process End Client Data; and (ii) Partner (and its subprocessors and data sources) to provide or enable the IDV Services by Processing such End Client Data, and to otherwise exercise the rights described in these IDV Terms.

End Client will maintain records sufficient to demonstrate its compliance with this Section 2.3 and will promptly provide such records to Partner upon request.

d. End Client Data. End Client grants to Partner’s IDV Services subprocessor (i.e., Plaid) and its subprocessors a limited and non-exclusive license to: (i) Process End Client Data as necessary to provide or enable the IDV Services; and (ii) Process anonymized, de-identified, or aggregated End Client Data (i.e., End Client Data that is not PII) to maintain, improve, optimize, or develop the IDV Services and to prevent and detect fraud in the IDV Services in accordance with the IDV Privacy Statement. Without limiting the generality of the foregoing, Partner’s IDV Services subprocessor (i.e., Plaid) may disclose End Client Data to its subprocessors subject to restrictions similar to those in these IDV Terms. Notwithstanding anything to the contrary, Partner’s IDV Services subprocessor (i.e., Plaid) may disclose End Client Data as required by law or court order. Subject to the foregoing in this paragraph, End Client will retain its existing rights (if any, including any ownership rights) in and to End Client Data.

iii. COMPLIANCE

a. GLBA. End Client certifies that all End Client’s and Permitted Service Providers’ uses of, and purposes pertaining to, the IDV Services are and will be in accordance with and solely comprised of uses and purposes described in Section 6802(e) of GLBA.

b. Processing on End Client’s Behalf. End Client acknowledges and agrees that, solely with regard to the End Client Data: (i) End Client will determine, via the Instructions, the purpose and means by which Partner’s IDV Services subprocessor (i.e., Plaid) will process End Client Data; (ii) Partner will require Partner’s IDV Services subprocessor (i.e., Plaid) to act on End Client’s Instructions with respect to the details of such subprocessor’s processing of End Client Data (i.e., how, what, when, and why such End Client Data is processed by such subprocessor); and that therefore (a) End Client will be deemed a controller with regard to such End Client Data; (b) Partner will be deemed a data processor with regard to End Client Data; and (c) Partner’s IDV Services subprocessor (i.e., Plaid) and its subprocessors will be deemed subprocessors with regard to End Client Data where such subprocessors facilitate, via the IDV Services, the End Client activities described in Section 2.1). End Client will direct End Users to End Client’s privacy policy for any queries or requests regarding End User rights with respect to, and the processing of, PII applicable to the IDV Services. For the avoidance of doubt, End Client acknowledges and agrees that: (I) End Client’s privacy policy will control and apply with respect to the processing of all PII applicable to the IDV Services; and (II) End Client will make available and maintain all data retention policies and provisions as required under applicable law pertaining to subprocessor storage of PII on End Clients’ behalf in relation to the IDV Services provided under these IDV Terms. Partner agrees that its IDV Services subprocessor will not: (A) process PII for any purpose (including any commercial purpose) other than as necessary to perform the IDV Services for the End Client (which performance includes the activities described in Section 2.4); (B) sell any PII; (C) process PII outside of the business relationship described in these IDV Terms; or (D) combine PII with any other personal information that subprocessor collects (directly from end users or via any third party) other than as expressly permitted for processors or subprocessors under applicable law.

c. Details of Processing. The parties acknowledge and agree that End Client will control, via the Instructions, the types and categories of PII that may be Processed in connection with the IDV Services. For clarity, such types and categories may include names, addresses, dates of birth, phone numbers, identification documents, and images/videos (e.g., photos or selfies). Partner agrees that such Processing will continue, as applicable, in accordance with these IDV Terms.

d. FCRA. End Client acknowledges and agrees that: (i) neither Partner nor its IDV Services subprocessor (i.e., Plaid) is a “consumer reporting agency” or a “furnisher” of information to consumer reporting agencies under the FCRA; and (ii) the End Client Data is not a “consumer report” under the FCRA. End Client represents and warrants that it will not, and will not permit or enable any third party to, use the IDV Services or any End Client Data: (a) as a, or as part of a, “consumer report” as that term is defined in the FCRA; or (b) such that the IDV Services or any End Client Data would be deemed “consumer reports” under the FCRA.

e. End Client Responsibilities. Notwithstanding the applicability or details of End Client’s integration involving the IDV Services, and notwithstanding anything to the contrary in these IDV Terms or any other terms of the Partner-Client Agreement, End Client is solely responsible for its relationships with End Users, including any related billing matters, technical support, and disputes. Without limiting anything in this these IDV Terms, End Client will publish and maintain an easily accessible and legally sufficient: (i) terms of service regarding all applicable End User use of End Client’s services; and (ii) privacy policy. End Client will promptly notify Partner upon making any material changes to such End Client terms of service or privacy policy. End Client is, and will remain, solely responsible and liable for each End User’s and each Permitted Service Provider’s use of and access to the IDV Services. End Client shall have sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of all End Client Data, and for verifying the same.

f. Unauthorized Use. In connection with its processing of any End Client Data, Partner will comply with all obligations (including privacy protection obligations) applicable to it as a processor under applicable law. End Client reserves the right to take reasonable and appropriate steps towards stopping and remediating any unauthorized use of PII. Partner will reasonably cooperate with End Client to facilitate such steps, including by making available to End Client all information reasonably necessary to demonstrate Partner’s compliance with its obligations under these IDV Terms and applicable law.

iv. DISCLAIMER

Partner’s IDV Services subprocessor (i.e., Plaid) makes no warranty with respect to, and disclaims all liability pertaining to: (i) the Instructions and any acts or omissions in accordance therewith; and (ii) the accuracy of any End Client Data and all other data (a) uploaded or otherwise provided to or for the IDV Services by or on behalf of End Client or End Users, and (b) Processed or provided by, or otherwise originating from, Plaid or its data sources in relation to the IDV Services. With respect to the IDV Services, Plaid disclaims all liability for the errors and omissions of it and its data sources.

v. EFFECT OF TERMINATION

Upon termination or expiration of an Order relating to the IDV Services: (i) End Client will destroy or return to Partner all IDV Services documentation provided to End Client relating to such Order; and (ii) following Partner’s receipt of End Client’s request in writing, Partner will facilitate the deletion (or return, per such request) of all End Client Data stored on Partner’s and its subprocessor’s servers relating to such Order, unless retention of the End Client Data is required under applicable law. Without limiting the foregoing, Partner and End Client may mutually agree upon the retention periods for various types or categories of End Client Data.

Notwithstanding anything to the contrary, Partner’s IDV Services subprocessor (i.e., Plaid) disclaims all liability pertaining to: (a) deletion of End Client Data after the termination or expiration of an Order; and (b) End Client’s use of the IDV Services and End Client Data after any Order termination or expiration.

vi. INDEMNITY

End Client will indemnify, defend, and hold harmless Partner’s IDV Services subprocessor (i.e., Plaid) and its affiliates from any claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs and expenses arising from or in connection with: (i) breaches by End Client of these IDV Terms; (ii) acts or omissions of End Client or its employees, affiliates, clients, or contractors relating to the IDV Services; (iii) the Processing of End Client Data by End Client or its Permitted Service Providers; and (iv) the Instructions and any acts or omissions in accordance therewith.

vii. MISCELLANEOUS

In the event of a conflict between these IDV Terms and any other terms and conditions of the Partner-Client Agreement or any agreements between End Client and End Users (for clarity, including any privacy policy or terms of service), the terms and conditions of these IDV Terms will govern and prevail with respect to the IDV Services. Partner may update the IDV Services and these IDV Terms from time to time.

––––––––––––––––––––––––––––––––––––

END OF VENDOR TERMS

––––––––––––––––––––––––––––––––––––

Client (End User / Property Manager):

Legal Name of Entity: ________________________________

By: _______________________________

Name: _____________________________

Title: ______________________________

Date: ______________________________

Exhibit C – Plaid CRA Vendor Addendum

Vendor: Plaid CRA (“Vendor”)
Effective Date: January 7, 2026
Products/Services Covered: Bank Income, others
1. Flow-Through Obligations. Client agrees to comply with the Vendor’s end-user terms, restrictions, and requirements applicable to the Products/Services Covered (the “Vendor Terms”). Vendor Terms are incorporated by reference or set forth below/attached.

2. Conflicts. If Vendor Terms conflict with this EUA or the MSA, Vendor Terms control solely to the extent necessary to satisfy Vendor requirements for the Products/Services Covered; otherwise, the MSA controls.

3. Audit. Client will cooperate with Vendor or Company audits as required by Vendor Terms.

4. Data Use. Client will use Vendor-provided data solely for permissible purposes and will not resell or redisclose except as permitted by law and Vendor Terms.

5. Security. Client will meet Vendor security requirements and promptly notify Company of any suspected compromise involving Vendor data.

6. Termination/Suspension. Company may suspend access to Vendor data if required by Vendor Terms or to prevent legal/compliance risk.

Vendor Terms Attachment:
[ ✔ ] Included below
[ ] URL/Reference: ______________________________________
If Vendor Terms are included below, the Vendor Terms begin immediately after the following line and continue until the end of this Addendum or until otherwise clearly indicated.

––––––––––––––––––––––––––––––––––––
START OF VENDOR TERMS
––––––––––––––––––––––––––––––––––––

End Client Flow Down Terms

1. Restrictions. Before any customers that are end users of Consumer Reports (each an “End Client”), as permissioned by the consumer that the Consumer Report (as defined below) relates to (the “End User”), engages with the Procurer products or services which include, are derived from, or incorporate the FCRA Services (as defined below) or Consumer Reports, End Client represents and warrants that it: (i) understands the nature of the information provided in the Consumer Report can change daily and agrees that each Consumer Report is provided for a one-time use; (ii) has certified that it understands and agrees that Plaid CRA’s provision of the FCRA Services do not indicate ownership or authorization to transact on a bank account and are not to be used by the End Client to confirm ownership or authorization to transact on a bank account; (iii) has certified that it shall ensure that its employees, agents, or contractors working on its behalf do not request and/or obtain Consumer Reports on themselves, coworkers, employees, family members, or friends unless it is in connection with a legitimate permissible purpose previously identified; (iv) has certified that it shall not use or store the FCRA Services outside of the United States; and (v) has certified that it shall not, and shall not enable or assist any third party to: (1) use the FCRA Services to create, enhance, or structure any database in any form for resale or external distribution; (2) modify, translate, or create derivative works based on the FCRA Services; (3) attempt to reverse engineer (except as permitted by law), decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, or algorithms of the FCRA Services; (4) use the FCRA Services in any way that is defamatory, trade libelous, unlawfully threatening, or unlawfully harassing; (5) make the FCRA Services or Consumer Report (or any derivative work thereof) available to, or use the FCRA Services or Consumer Report (or any derivative work thereof) for the benefit of, anyone other than Procurer, End Users, or End Client; (6) publicly disseminate or disclose information from any source regarding the performance of the FCRA Services; or (7) attempt to create a substitute or similar service through use of, or access to, the FCRA Services. End Client represents and warrants that it will use the FCRA Service in accordance with (a) the rights granted under this Agreement, and (b) Plaid Inc. and its subsidiaries Developer Policy (available at www.plaid.com/legal). As used in the Agreement, FCRA Services means together (I) the API Package and (II) a consumer report, as is defined in 15 U.S.C. § 1681a(d), including any data relating to an End User included therein, deposit account verification and activity reports, and enhancements to the consumer reports (collectively “Consumer Reports”). Except as explicitly provided in the Agreement, the End Client agrees that it shall not disclose, disseminate, share, sublicense, resell, or otherwise redistribute the FCRA Services (or any part thereof) to any parent, subsidiary, affiliate, or other third party, except: (x) in connection with the sale of a loan to which the FCRA Services relate; (y) to the End User to whom the Consumer Report relates if an adverse action (as defined by the FCRA) has been taken based on the FCRA Services; or (z) as otherwise required by law.

2. Permissible Purpose. End Client warrants and ensures that it will, before requesting a Consumer Report: (i) certify to Procurer the End Client’s permissible purpose(s) under the FCRA for obtaining a Consumer Report; (ii) each time it requests a Consumer Report from Procurer, access and use the Consumer Report (a) solely as an end user of such information and (b) solely for the permissible purpose(s) previously identified to Procurer and for no other purpose; and (iii) notify Procurer and Plaid CRA in writing of any change to the permissible purpose certified previously to Procurer and provide to Plaid CRA from time to time, as reasonably necessary to maintain compliance with the FCRA, an updated certification regarding the permissible purpose(s) for using Consumer Reports, or evidence of compliance with the terms of these CRA Terms upon Plaid CRA's request. Towards assessing End Client’s compliance with its permissible purpose(s) certification and use of Consumer Reports, End Client will submit to an audit by Plaid CRA to verify such compliance.

3. Required Consents. End Client warrants and ensures that it will, before requesting a Consumer Report, provide all notices and obtain all consents required under applicable laws, regulations, and third-party agreements for Plaid CRA to provide the FCRA Services and to otherwise collect, use, and process End User data (including End User Input (as defined below)) in accordance with Plaid CRA’s privacy policy (currently available at https://plaid.com/plaid-check-consumer-report/privacy-policy/). End Client may provide Plaid CRA, directly or indirectly via Procurer, certain identifying information regarding an End User, such as first name, last name, and address, to use the FCRA Services (all such information, the “End User Input”).

4. Retention of Documents. All consumer authorizations required by the Agreement or by applicable law, along with all adverse action letters provided to consumers and consumer applications, including copies of government-issued identification needed to verify the identity of the applicant, shall be retained by End Client for a reasonable period of time, but not less than five (5) years, and evidence of such documents shall be made available for inspection by Plaid CRA, its third-party data vendors, or its designee upon demand.

5. End User Authentication. End Client certifies that, before requesting a Consumer Report, (i) it will verify the consumer’s identity prior to presenting the consumer with Plaid CRA’s channel, (ii) it understands that Plaid CRA may rely on this verification, and (iii) it understands and agrees that Plaid CRA has no obligation to separately authenticate or confirm the identity of any consumer presented to the Plaid CRA channel by the End User.

6. DISCLAIMER; ENFORCEMENT. THE FCRA SERVICES, CONSUMER REPORTS, AND ANY OTHER INFORMATION, SOFTWARE, PRODUCTS, SERVICES AND MATERIALS PROVIDED BY PLAID CRA IN CONNECTION WITH THE AGREEMENT ARE PROVIDED “AS IS.” TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PLAID CRA NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS MAKE ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR ANY WARRANTY THAT THE FCRA SERVICES ARE FREE FROM DEFECTS, ANY WARRANTY THAT ANY FCRA SERVICES WILL BE UNINTERRUPTED, OR THAT ANY DATA PROVIDED BY OR THROUGH ANY FCRA
SERVICES WILL BE TIMELY, ACCURATE, OR COMPLETE. PLAID CRA WILL BE AN INTENDED THIRD-PARTY BENEFICIARY OF THE AGREEMENT BETWEEN PROCURER AND END CLIENT AND MAY DIRECTLY ENFORCE SUCH AGREEMENT AGAINST END CLIENT, WITHOUT PROCURER’S CONSENT OR PARTICIPATION, BUT SOLELY RELATING TO THE CONSUMER REPORTS (INCLUDING FI DATA) AND FCRA SERVICES THAT ARE PROVIDED BY PLAID CRA TO PROCURER OR END CLIENT.

7. FI Data. Through the Procurer Application or FCRA Services, End Client may have access to information about or of End Users provided to Plaid CRA by a bank, financial institution, or other data source (each, as designated by Plaid CRA, “FI”, and such information, the “FI Data”). a. End Client Obligations.

i. End User Consents. End Client will provide all notices and obtain all express consents from each End User as required under applicable laws in connection with End Client’s use, storage and other processing of any End User Data (such notices and consents, the “Express Consents”). Express Consents will: (a) be clear and conspicuous; (b) generally specify the categories of End User Data that End Client will receive and how End Client will use, store and otherwise process it; (c) be valid, enforceable, and expressly accepted by each End User; (d) identify any and all third parties or categories of third parties to whom End Client may provide End User Data for processing; (e) specify how End Users may exercise their right to revoke their Express Consent; and (f) include any other required disclosures under applicable laws. End Client will maintain records (which may include technical logs, screenshots, versions of Express Consents obtained) to demonstrate its compliance with this Section 7(a)(i) and will promptly provide such records to Plaid CRA upon request.

ii. Scope of Access. End Client will only access End User Data for which it has obtained Express Consents from the End User for the use case reviewed and permitted by Plaid CRA in writing that is consented to by the applicable End User (such use case, the “Permitted Use Case”). Key factors Plaid CRA will consider during its review include whether the use case is appropriate and useful to provide the End User with the End Client Application that the End User has enrolled in, whether the End Client Application provides a direct benefit to the End User, and whether the use case directly supports the development of new or improved product features for the benefit of End Users, and the jurisdiction(s) in which the End Client operates and/or stores End User Data. If End Client possesses End User Data that exceeds the scope of the End User’s Express Consents, End Client will use industry-standard means to permanently and securely delete (“Delete”) such End User Data. If End Client becomes aware that any data it receives from Plaid CRA does not relate to the End User that End Client originally requested End User Data for, End Client will promptly notify Plaid CRA and will Delete such data. iii. Data Use. End Client will use, store and otherwise process End User Data solely in accordance with the End User’s Express Consents and applicable laws.

iv. Data Disclosure. End Client will not disclose, transfer, syndicate or distribute End User Data to any third party (including its Permitted Users) (“Data Sharing”) except in each case with the End User’s Express Consents and in accordance with applicable laws. Notwithstanding anything to the contrary, End Client will not sell End User Data.

v. Data Deletion. End Client will promptly Delete any End User Data upon request by the applicable End User; provided that End Client may retain copies of End User Data solely to the extent required by applicable laws.

vi. No Attribution. End Client will not charge End Users any fees attributable to an FI for (a) access to its End User Data or (b) use of End User’s account with an FI in connection with the End Client Application. In addition, End Client will not suggest or imply a partnership, sponsorship, or other relationship with an FI based on End Client’s receipt of End User Data under the Agreement or this Addendum.

vii. No Other Access. End Client will only access End User Data through the FCRA Services or another manner that uses the FI’s authorized APIs. ENd Client will not “screen scrape” data from FIs or collect an End User’s log-on credentials for FI accounts, and will not otherwise knowingly obtain from a third party End User data that was originally sourced through screen scraping. End Client will immediately Delete any such End User log-on credentials in its possession. End Client will maintain records to demonstrate compliance with this Section 7(a)(vii) and will provide them to Plaid CRA upon request.

viii. Compliance with Laws. End Client will comply with all applicable privacy, security and other laws, including, as applicable, the Gramm-Leach-Bliley Act, the California Consumer Privacy Act, and all other laws relating to End User Data. End Client will not use, store, disclose, or otherwise process any End User Data for any purpose not permitted under applicable laws. For the avoidance of doubt, End Client acknowledges that Section 1033 of the Dodd-Frank Act may include obligations on End Client relating to processing, handling, and protecting End User Data. End Client will maintain a program designed to ensure compliance with applicable laws, including appropriately training End Client personnel.

ix. Information Security Program. End Client will maintain a comprehensive written information security program approved by its senior management (“Infosec Program”). The Infosec Program will include administrative, technical and physical measures designed to: (a) ensure the security of End User Data, (b) protect against unauthorized access to or use of End User Data and anticipated threats and hazards to End User Data and (c) ensure the proper disposal of End User Data. The Infosec Program will be appropriate to End Client’s risk profile and activities, the nature of the End Client Application, and the nature of the End User Data received by End Client. In any event, the Infosec Program will meet or exceed applicable control objectives captured in industry standards and best practices such as AICPA Trust Service Criteria for Security, NIST 800-53, or ISO 27002 and will comply with applicable laws. End Client will use up-to-date antivirus software and anti-malware tools designed to prevent viruses, malware and other malicious code in the End Client Application or on End Client’s systems.

x. Security Breach Obligations. End Client will promptly notify Plaid CRA (and in no event after more than 12 hours) upon becoming aware of any Security Breach, providing a description of all known facts, the types of End Users affected, and any other information that Plaid may reasonably request. End Client will reasonably cooperate with Plaid CRA in investigating and remediating Security Breaches. End End Client will be responsible for the costs of investigating, mitigating, and remediating the Security Breach, including costs of credit monitoring, call centers, support, and other customary or legally required remediation. “Security Breach” means any event that compromises the End Client Application or End Client’s systems or that does or reasonably could compromise the security, integrity or confidentiality of End User Data or result in its unauthorized use, disclosure or loss.

xi. FI Confidential Information. If Plaid CRA discloses to End Client any confidential or proprietary materials of an FI (such materials, “FI Confidential Information”), such materials will be subject to the same obligations that apply to Plaid CRA’s Confidential Information under the Agreement. FI Confidential Information will also be subject to the same obligations as End User Data under this Section 7(a) (End Client Obligations) of this Addendum. End Client will promptly Delete FI Confidential Information in its possession upon Plaid CRA’s request and will provide a written certification regarding such Deletion.

xii. Oversight and Cooperation. End Client will promptly provide all reasonably necessary information and cooperation requested by Plaid CRA, an FI, or any entity with examination, supervision, or other legal or regulatory authority over Plaid CRA or an FI. In the event that Plaid CRA has a good faith reason to believe that End Client is not in material compliance with this Addendum, Plaid CRA will notify End Client and, at Plaid CRA’s option, End Client will promptly provide sufficient documentation to demonstrate such material compliance or submit to a third-party audit by a firm selected from a Plaid CRA-approved list of audit firms to verify such compliance. Plaid CRA and FIs may also conduct technical or operational assessments of End Client, which will be subject to advance notice and will not occur more than once per year unless legally required and materially different in scope from a preceding audit.

xiii. Information Sharing. Where required by an FI and to the extent relevant to an EndClient’s access or use of End User Data from that FI, Plaid CRA may share with such FI certain information related to End Client’s compliance with this Addendum, including with respect to End Client’s Infosec Program. Plaid CRA will request that such FI treat any such information in a confidential manner.

xiv. Insurance. End Client will maintain insurance coverage appropriate to End Client’s risk profile and activities, the nature of the End Client Application, and the nature of the End User Data received by End Client; provided that such coverage will be no less than industry standard and will include cybersecurity liability insurance.

xv. Access Frequency. End Client will comply with any guidelines provided by Plaid CRA regarding End Client’s frequency of “batch” pulls of End User Data. Plaid CRA may enforce such guidelines in accordance with its standard practices, which may include throttling, suspension or termination of End Client’s access.

xvi. End Client Marks License. End Client hereby grants to Plaid CRA and each FI (and each of their third-party service providers) the non-exclusive and non-transferable right and license to use End Client’s trademarks and service marks solely in connection with consent management activities, including use associated with End User facing consent management portals operated by Plaid CRA or an FI.

b. Suspension. Plaid CRA may suspend or terminate End Client’s access to the FCRA Services or End User Data, in whole or in part, if it believes End Client has breached this Addendum or where End Client’s use of the FCRA Services or End User Data could violate or give rise to liability under any Plaid CRA agreement (including Plaid CRA’s agreement with any FI) or pose a risk of harm, including reputational harm, to any End User, FI, the FCRA Services, or Plaid CRA and its affiliates. In addition, an FI may suspend End Client’s access to End User Data with respect to such FI.

c. Indemnity. End Client will indemnify, defend and hold harmless each FI, Plaid CRA, and the affiliates of each of the foregoing from any claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs and expenses arising from or in connection with: (a) any Security Breach resulting in unauthorized disclosure of End User Data or (b) End Client’s unauthorized or improper use of End User Data (including any unauthorized Data Sharing, transmission, access, display, storage or loss). This Section 7(c) is not subject to any limitation of liabilities set forth in the Agreement. Each FI is a third-party beneficiary of this Section 7(c).

d. Modifications. End Client acknowledges that continued access to End User Data provided by certain FIs may require modifications to this Addendum, and End Client will accept such modifications to continue accessing or using the FCRA Services with respect to such FIs. Plaid CRA will use commercially reasonable efforts to notify End Client of the modifications and the effective date of such modifications through communications via End Client’s account, email, or other means. If End Client objects to the modifications, its exclusive remedy is to cease any and all access and use of the FCRA Services as it relates to such FI(s). Continued access or use of such FCRA Services after the effective date of such modifications to this Addendum will constitute End Client’s acceptance of such modifications.

e. Miscellaneous. In the event of a conflict with the Agreement, the terms and conditions of this Addendum will govern and prevail. Capitalized terms used in this Addendum and not otherwise defined will have the meanings ascribed to them in the Agreement. All provisions of this Addendum will remain in force in the event of this Addendum’s or the Agreement’s termination or expiration.

––––––––––––––––––––––––––––––––––––
END OF VENDOR TERMS
––––––––––––––––––––––––––––––––––––

Client (End User / Property Manager):

Legal Name of Entity: ________________________________

By: _______________________________

Name: _____________________________

Title: ______________________________

Date: ______________________________

‍

Exhibit C – Equifax Vendor Addendum

Vendor: Equifax Information Services LLC (“Equifax”) (“Vendor”)
Effective Date: January 7, 2026
Products/Services Covered: Consumer credit report and scores, others
1. Flow-Through Obligations. Client agrees to comply with the Vendor’s end-user terms, restrictions, and requirements applicable to the Products/Services Covered (the “Vendor Terms”). Vendor Terms are incorporated by reference or set forth below/attached.

2. Conflicts. If Vendor Terms conflict with this EUA or the MSA, Vendor Terms control solely to the extent necessary to satisfy Vendor requirements for the Products/Services Covered; otherwise, the MSA controls.

3. Audit. Client will cooperate with Vendor or Company audits as required by Vendor Terms.

4. Data Use. Client will use Vendor-provided data solely for permissible purposes and will not resell or redisclose except as permitted by law and Vendor Terms.

5. Security. Client will meet Vendor security requirements and promptly notify Company of any suspected compromise involving Vendor data.

6. Termination/Suspension. Company may suspend access to Vendor data if required by Vendor Terms or to prevent legal/compliance risk.

Vendor Terms Attachment:
[ ✔ ] Included below
[ ] URL/Reference: ______________________________________
If Vendor Terms are included below, the Vendor Terms begin immediately after the following line and continue until the end of this Addendum or until otherwise clearly indicated.

––––––––––––––––––––––––––––––––––––
START OF VENDOR TERMS
––––––––––––––––––––––––––––––––––––

Qualified Subscriber Terms and Conditions

Equifax Information Services LLC ("Equifax")
Equifax Information Services (as defined below) will be received by Qualified Subscriber through CRA subject to the following conditions (the “Terms and Conditions”):
1. Any information services and data originating from Equifax (the “Equifax Information Services” or “Equifax Information”) will be requested only for Subscriber's exclusive use and held in strict confidence except to the extent that disclosure to others is required or permitted under the last sentence of this Paragraph. Only designated representatives of Qualified Subscriber will request Equifax Information Services on Qualified Subscriber’s employees, and employees are forbidden to obtain consumer reports on themselves, associates or any other persons except in the exercise of their official duties. Qualified Subscriber will not disclose Equifax Information to the subject of the report except as permitted or required by law, but will refer the subject to Equifax. 2. Qualified Subscriber will hold Equifax and all its agents harmless on account of any expense or damage arising or resulting from the publishing or other disclosure of Equifax Information by Qualified Subscriber, its employees or agents contrary to the conditions of Paragraph 1 or applicable law.

3. Recognizing that information for the Equifax Information Services is secured by and through fallible human sources and that, for the fee charged, Equifax cannot be an insurer of the accuracy of the Equifax Information Services, Qualified Subscriber understands that the accuracy of any Equifax Information Service received by Qualified Subscriber is not guaranteed by Equifax, and Qualified Subscriber releases Equifax and its affiliate companies, agents, employees, and independent contractors from liability, even if caused by negligence, in connection with the Equifax Information Services and from any loss or expense suffered by Qualified Subscriber resulting directly or indirectly from Equifax Information.

4. Qualified Subscriber will be charged for the Equifax Information Services by CRA, which is responsible for paying Equifax for the Equifax Information Services.

5. Written notice by either party to the other will terminate these Terms and Conditions effective ten (10) days after the date of that notice, but the obligations and agreements set forth in Paragraphs 1, 2, 3, 6, 7, and 8 herein will remain in force.

6. Qualified Subscriber certifies that it will order Equifax Information Services that are consumer reports, as defined by the federal Fair Credit Reporting Act, 15 U.S.C. 1681 et seq. ("FCRA"), only when Qualified Subscriber intends to use that consumer report information: (a) in accordance with the FCRA and all state law counterparts; and (b) for one of the following permissible purposes: (i) in connection with a credit transaction involving the consumer on whom the consumer report is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer; (ii) in connection with the underwriting of insurance involving the consumer; (iii) as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation; (iv) when Qualified Subscriber otherwise has a legitimate business need for the information either in connection with a business transaction that is initiated by the consumer, or to review an account to determine whether the consumer continues to meet the terms of the accounts; or (v) for employment purposes; provided, however, that QUALIFIED SUBSCRIBER IS NOT AUTHORIZED TO REQUEST OR RECEIVE CONSUMER REPORTS FOR EMPLOYMENT PURPOSES UNLESS QUALIFIED SUBSCRIBER HAS AGREED IN WRITING TO THE TERMS AND CONDITIONS OF THE EQUIFAX PERSONA SERVICE.

Qualified Subscriber will comply with applicable federal and state laws, rules and regulations relating to such party’s performance of its obligations under these Terms and Conditions including, but not limited to, all applicable consumer financial protection laws. In addition, Qualified Subscriber shall not engage in any unfair, deceptive, or abusive acts or practices.

Qualified Subscriber will use each consumer report ordered under these Terms and Conditions for one of the foregoing purposes and for no other purpose.

7. It is recognized and understood that the FCRA provides that anyone “who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses shall be fined under Title 18, United States Code, imprisoned for not more than two (2) years, or both.” Equifax may periodically conduct audits of Qualified Subscriber regarding its compliance with these Terms and Conditions, including, without limitation, the FCRA, other certifications and security provisions in these Terms and Conditions. Audits will be conducted by mail whenever possible and will require Qualified Subscriber to provide documentation as to permissible use of particular consumer reports. Qualified Subscriber gives its consent to Equifax to conduct such audits and agrees that any failure to cooperate fully and promptly in the conduct of any audit, or Qualified Subscriber’s material breach of these Terms and Conditions, constitute grounds for immediate suspension of service or termination of these Terms and Conditions, notwithstanding Paragraph 5 above. If Equifax terminates these Terms and Conditions due to the conditions in the preceding sentence, Qualified Subscriber (i) unconditionally releases and agrees to hold Equifax harmless and indemnify it from and against any and all liabilities of whatever kind or nature that may arise from or relate to such termination, and (ii) covenants it will not assert any claim or cause of action of any kind or nature against Equifax in connection with such termination.

8. California Law Certification. Qualified Subscriber will refer to Exhibit 1-A in making the following certification, and Qualified Subscriber agrees to comply with all applicable provisions of the California Credit Reporting Agencies Act.

(QUALIFIED SUBSCRIBER’S AUTHORIZED REPRESENTATIVE MUST PLACE HIS/HER INITIALS NEXT TO THE APPLICABLE SPACE BELOW)

1. Are you, Qualified Subscriber, a “retail seller,” as defined in Section 1802.3 of the California Civil Code and referenced in Exhibit 1-A, intending to issue credit to consumers who appear in person on the basis of an application for credit submitted in person?

[ ] Yes

[ ✔ ] No

2. If “yes” to question 1 above, do you, Qualified Subscriber, certify that you will instruct Qualified Subscriber employees and agents to inspect a photo identification of the consumer at the time an application is submitted in person? Do you, Qualified Subscriber, issue credit to consumers who appear in person on the basis of an application for credit submitted in person?

[ ] Yes

[ ] No

9. Vermont Certification. Qualified Subscriber will refer to Exhibit 1-A in making the following certification, and Qualified Subscriber agrees to comply with all applicable provisions under Vermont law and Applicable Vermont rules, as referenced in Exhibit 1-A.

(QUALIFIED SUBSCRIBER’S AUTHORIZED REPRESENTATIVE MUST PLACE HIS/HER INITIALS NEXT TO THE APPLICABLE SPACE BELOW)

1. Do you, Qualified Subscriber, certify that you will order Equifax Information Services relating to Vermont residents consisting of credit reports as defined by the Vermont Fair Credit Reporting Statute, 9 V.S.A. § 2480e, as amended (the “VFCRA”), only after you have received prior consumer consent specific to the purpose for which such credit report is being ordered, in accordance with VFCRA Section 2480e and Applicable Vermont Rules, referenced in Exhibit 1-A?

[ ✔ ] Yes

[ ] No

10. Qualified Subscriber Security.

10.1 This Paragraph 10 applies to any means through which Qualified Subscriber orders or accesses the Equifax Information Services including, without limitation, system-to-system, personal computer or the Internet.

For the purposes of this Paragraph 10, the term “Authorized User” means a Qualified Subscriber employee that Qualified Subscriber has authorized to order or access the Equifax Information Services and who is trained on Qualified Subscriber’s obligations under these Terms and Conditions with respect to the ordering and use of the Equifax Information Services including Qualified Subscriber’s FCRA and other obligations with respect to the access and use of consumer reports.

10.2 Qualified Subscriber will, with respect to handling Equifax Information:
a. ensure that only Authorized Users can order or have access to the Equifax Information Services and take all necessary measures to prevent unauthorized ordering of or access to the Equifax Information Services by any person other than an Authorized User for permissible purposes, including, without limitation, limiting the knowledge of the Qualified Subscriber security codes, member numbers, User IDs, and any passwords Qualified Subscriber may use to those individuals with a need to know. In addition, the User IDs must be unique to each person, and the sharing of User IDs or passwords is prohibited, b. ensure that Authorized Users are trained not to order consumer reports for personal reasons or provide consumer reports to third parties except as permitted by this Agreement and that any unauthorized access or use of consumer reports may subject them to civil and criminal liability under the FCRA, punishable by fines and imprisonment, c. ensure that secure authentication practices are utilized when accessing the Equifax Information Services , including but not limited to restricting access based on Authorized User location and only permitting access to the Equifax Information Services through Qualified Subscriber approved devices, d. ensure that Equifax Information is encrypted in transit with Advanced Encryption Standard (AES)-256 or an equivalent or better National Institute of Standards and Technology (NIST) approved cypher, e. use commercially reasonable efforts to secure Equifax Information at rest, including: (i) encrypting all Equifax Information at rest in accordance with industry accepted encryption standards; (ii) separating Equifax Information from the Internet or other public networks by firewalls configured to meet industry accepted best practices; (iii) protecting Equifax Information through multiple layers of network security, including but not limited to, industry-recognized firewalls, routers, and intrusion detection/prevention devices (IDS/IPS), (iv) securing access (both physical and network) to systems storing Equifax Information; and (v) patching servers on a timely basis with appropriate security-specific system patches, as they are available, f. ensure that: (i) all hard copy Equifax Information is stored in a secure manner; (ii) Equifax Information, including electronic and hard copy information, is securely destroyed when no longer needed for the Equifax Information Services; and (iii) maintain documented policies to ensure compliance with the foregoing, g. not allow Equifax Information to be displayed via the Internet unless utilizing, at a minimum, a three-tier architecture configured in accordance with industry best practices, h. use commercially reasonable efforts to establish procedures and logging mechanisms for systems and networks that will allow tracking and analysis in the event there is a compromise, and maintain an audit trail history, i. provide prompt notification to Equifax of any change in address or office location where Equifax Information Services are or will be accessible, which location is subject to an onsite visit of the new location by Equifax or its designated representative, and j. in the event Qualified Subscriber has a Security Incident involving Equifax Information, Qualified Subscriber will notify Equifax as soon as possible, but in no event more than twenty-four (24) hours following the Security Incident, and: (i) fully cooperate with Equifax in a security assessment process; (ii) promptly remediate any finding; and (iii) take all necessary actions to prevent a recurrence. For purposes of this Section “Security Incident” means any suspected or actual breach, theft or unauthorized access, use, misuse, theft, vandalism, modification or transfer of or to Equifax Information Services or Equifax Information.

11. Qualified Subscriber may access, use and store Equifax Credit Information only at or from locations within the territorial boundaries of the United States, Canada, and the United States territories of American Samoa, Guam, the Northern Mariana Islands, Puerto Rico, and the U. S.

Virgin Islands (the “Permitted Territory”). Qualified Subscriber may not access, use or store Equifax Credit Information at or from, or send it to any location outside of the Permitted Territory without first obtaining Equifax’s prior written consent and entering into such written agreements as Equifax may require. Notwithstanding the foregoing, Qualified Subscriber is prohibited from Processing Equifax Information from an Embargoed Country. “Embargoed Country” means any country or geographic region subject to comprehensive economic sanctions or embargoes administered by OFAC or the European Union.

12. These Terms and Conditions will be governed by and construed in accordance with the laws of the State of Georgia, without giving effect to its conflicts of laws provisions. These Terms and Conditions constitute the entire agreement of the parties with respect to Qualified Subscriber receiving Equifax Information Services and no changes in these Terms and Conditions may be made except in writing by an officer of Equifax.

[ ✔ ] Qualified Subscriber has read and understands these Terms and Conditions. (To be checked or initialed by the person signing on behalf of Subscriber.)

[ ✔ ] Qualified Subscriber has read the “Notice to Users of Consumer Reports, Obligations of Users” which explains Qualified Subscriber’s obligations under the FCRA as a user of consumer report information. (To be checked or initialed by the person signing on behalf of Qualified Subscriber.)

EXHIBIT 1-A to CRA Qualified Subscriber Terms and Conditions State Compliance Matters

California Retail Seller Compliance. Provisions of the California Consumer Credit Reporting Agencies Act specifically, as amended effective July 1, 1998, will impact the provision of consumer reports to Qualified Subscriber if Qualified Subscriber is a “retail seller” under California law and Qualified Subscriber intends to request consumer reports from Equifax about consumers applying in person for credit. California Civil Code § 1802.3 defines a “retail seller” as ( “a person engaged in the business of selling goods or services to retail buyers” ,” defined in §1802.4 as “a person who buys goods or obtains services from a retail seller in a retail installment sale and not principally for the purpose of resale”).

Under the foregoing circumstances, before delivering a consumer report to Qualified Subscriber, Equifax must match at least three items of a consumer’s identification within the file maintained by Equifax with the information provided to Equifax by Qualified Subscriber in connection with the in-person credit transaction. Compliance with this law further includes Qualified Subscriber’s inspection of the photo identification of each consumer who applies for in-person credit, mailing extensions of credit to consumers responding to a mail solicitation at specified addresses, taking special actions regarding a consumer’s presentment of a police report regarding fraud, and acknowledging consumer demands for reinvestigations within certain time frames.

If Qualified Subscriber is a “retail seller” and intends to request consumer reports from Equifax about consumers applying in person for credit, Qualified Subscriber certifies that it will instruct its employees and agents to inspect a photo identification of the consumer at the time an application is submitted in person. If Qualified Subscriber is not currently, but subsequently becomes a “retail seller”, Qualified Subscriber agrees to provide written notice to Equifax prior to ordering credit reports in connection with an in-person credit transaction, and agrees to comply with the requirements of the California law as outlined in this Section, and with the specific certifications set forth herein.

Qualified Subscriber certifies agrees that, as a “retail seller” who intends to request consumer reports from Equifax about consumers applying in person for credit, it will either (a) acquire a new customer number for use in processing consumer report inquiries that result from in-person credit applications covered by California law, with the understanding that all inquiries using this new customer number will require that Qualified Subscriber supply at least three items of identifying information from the applicant; or (b) contact Qualified Subscriber’s Equifax sales representative to ensure that Qualified Subscriber’s existing number is properly coded for these transactions.

Vermont Fair Credit Reporting Compliance. Provisions of the Vermont Fair Credit Reporting Statute, 9 V.S.A. § 2480e, as amended (the “VFCRA”) and applicable Vermont Rules (specifically, CVR 06-031-012 Rule CF 112 - Fair Credit Reporting, CF 112.03 Consumer Consent (“Applicable Vermont Rules”)), prohibit Qualified Subscriber from obtaining credit reports, as defined by the VFCRA, without prior consumer consent specific to the purpose for which such credit report is being ordered as specified in VFCRA § 2480e and Applicable Vermont Rules. If Qualified Subscriber designated in Section I.3 of the Agreement that Qualified Subscriber does not comply with these provisions of the VFCRA and Applicable Vermont Rules by obtaining the requisite consumer consent from Vermont consumers, then provision of credit reports, as defined by the VFCRA, to Qualified Subscriber will be impacted. If Qualified Subscriber designated in Section I.3 of this Agreement that Qualified Subscriber is in compliance with VFCRA § 2480e and Applicable Vermont Rules, Qualified Subscriber shall provide notice to Equifax should its ability to certify compliance with VFCRA § 2480e and Applicable Vermont Rules has changed.

Reviews by Equifax pursuant to the section of this Agreement authorizing reviews or audits of Qualified Subscriber’s permissible purpose to obtain consumer reports shall require, as applicable, evidence of specific consumer consent obtained from Vermont consumers as required by the VFCRA and Applicable Vermont Rules.

EXHIBIT B
EQUIFAX INFORMATION SERVICES

This Exhibit contains an Information Services selection list, overviews of the Information Services that may be provided under this Agreement, additional terms and conditions that apply to those Information Services and other special terms and conditions that may affect the provision of Information Services to Qualified Subscriber. CRA’s authorized representative must place his/her initials in the appropriate blanks below to indicate which Information Service(s) will be provided by Equifax on the Effective Date. Additional services may be requested with written notice to Equifax. CRA agrees to abide by the additional terms and conditions and special terms and conditions that apply to those Information Services.

B.I. STANDARD INFORMATION SERVICES
RW__ ACROFILE® and ACROFILEPlus®
_____ Consumer Telephone Service
_____ Consumer Telephone Service
_____ DTEC™
_____ Identity Scan
_____ ID REPORT™
_____ OFAC Alert™
_____ PERSONA® and PERSONA PLUS®
_____ Undisclosed Debt Monitoring Service

B.II. CREDIT SCORE INFORMATION SERVICES
_____ Bankruptcy Navigator Index® 5.0
_____ FICO® Credit Capacity Index
_____ FICO® Risk Score, Classic v4
_____ FICO® Risk Score, Classic v5
_____ FICO® Risk Score, Classic v8
RW__ FICO® Risk Score, Classic v9
_____ FICO® Risk Score, Classic v10
_____ FICO® Risk Score, Classic v10
_____ Enhanced Delinquency Alert System℠
RW__ VantageScore 4℠

B.III. ANCILLARY SERVICES AND ATTRIBUTES
__RW___ Credit Data Attributes (Essentials)

Pre-Built Attribute Packages - a collection of predefined sets of consumer attributes that leverage data available on Equifax’s core consumer credit file. This Service constitutes a consumer report.

-Essentials - a broad collection of 520 of the most utilized predictive consumer credit attributes across a number of industries, concepts, and time.

B.I. STANDARD INFORMATION SERVICES:

(1) ACROFILE and ACROFILE Plus - are the core consumer reports from the Equifax consumer credit database, consisting of identification information, credit file inquiries, public record information and credit account trade lines of the subject of the report. Qualified Subscriber may access these credit reports on an individual basis or through Joint File AccessSM, which provides simultaneous access to the credit files of both husband and wife with a single inquiry.

(2) Consumer Telephone Number Service – is an optional feature which allows published consumer telephone numbers to be displayed on the consumer report.

(3) DTEC - is a consumer report that consists of name, AKA, or former name, current and former addresses, listed telephone number (if available), age, employment, Social Security number and a message pertaining to the Social Security number. Qualified Subscriber certifies that it will order a Full DTEC Report only when it has a permissible purpose to receive a consumer report, as specified in the Qualified Subscriber Terms and Conditions.

(4) Identity Scan - is an on-line warning system containing information that can be used to detect possible or known identity theft and application fraud. Some of the information in the IDENTITY SCAN database is provided by credit grantors. If Qualified Subscriber orders the IDENTITY SCAN service, then Qualified Subscriber agrees to furnish for potential inclusion in Equifax’s IDENTITY SCAN system any data that Qualified Subscriber knows to have been used in connection with a fraudulent transaction or attempted fraudulent transaction with Qualified Subscriber. That data will include but not be limited to consumer names, aliases, Social Security numbers, addresses (current and former), employment (current and former) and telephone numbers (business and residential). Qualified Subscriber grants Equifax permission to evaluate and include such data in Identity Scan and other identity/ fraud products if deemed appropriate by Equifax, and permits Equifax to use such information to test effectiveness of fraud and identity products.

Qualified Subscriber will not use an alert or warning message from the IDENTITY SCAN system in its decision-making process for denying credit, but will use the message as an indication that the consumer’s application information should be independently verified prior to a credit decision. Qualified Subscriber understands that the information supplied by IDENTITY SCAN may or may not apply to the consumer who has applied to Qualified Subscriber for credit. Qualified Subscriber also understands and agrees that data from the IDENTITY SCAN system is proprietary to Equifax and shall not be used as a component of any database or file built or maintained by Qualified Subscriber. The use of such data shall be limited to the specific transaction for which the IDENTITY SCAN alert message is provided.

(5) ID REPORT – is a consumer report consisting of name, AKAs, current and former addresses, employment information, age or date of birth, and Social Security number (only if input by Client

(6) OFAC Alert - is an information service Equifax provides on behalf of Compliance Data Center LLC., an Equifax affiliate. OFAC Alert is based on information that was not collected, in whole or in part, for the purpose of serving as a factor in establishing a consumer’s eligibility for credit or insurance to be used primarily for personal, family or household purposes; employment purposes, or any other purpose authorized under the FCRA. Accordingly, Qualified Subscriber will not use an OFAC Alert indicator as part of its decision-making process for determining the consumer’s eligibility for any credit or any other FCRA permissible purpose. Qualified Subscriber acknowledges that such an indicator is merely a message that the consumer may be listed on one or more U.S. government-maintained lists of persons subject to economic sanctions, and Qualified Subscriber should contact the appropriate government agency for confirmation and instructions. The OFAC Alert indicator may or may not pertain to the individual referenced in your inquiry. Refer to the OFAC Customer Guide for further information.

(7) PERSONA® and PERSONA PLUS® - are consumer reports, from the Equifax consumer credit database, consisting of limited identification information, credit file inquiries, public record information, credit account trade lines, and employment information.

FCRA Certification. Qualified Subscriber will notify Equifax whenever a consumer report will be used for employment purposes. Qualified Subscriber certifies that, before ordering each consumer report to be used in connection with employment purposes, it will clearly and conspicuously disclose to the subject consumer, in a written document consisting solely of the disclosure, that Qualified Subscriber may obtain a consumer report for employment purposes, and will also obtain the consumer’s written authorization to obtain or procure a consumer report relating to that consumer. Qualified Subscriber further certifies that it will not take adverse action against the consumer based in whole or in part upon the consumer report without first providing to the consumer to whom the consumer report relates a copy of the consumer report and a written description of the consumer’s rights as prescribed by the Consumer Financial Protection Bureau (“CFPB”) under Section 609(c)(2) of the FCRA, and will also not use any information from the consumer report in violation of any applicable federal or state equal employment opportunity law or regulation. Qualified Subscriber acknowledges that it has received from Equifax a copy of the written disclosure form prescribed by the CFPB.

(8) Undisclosed Debt Monitoring Service - is intended to monitor certain specified credit behaviors of consumers that have a pending mortgage loan application with Client.

Equifax. Equifax will report to Client for the period that runs one hundred twenty (120) days from the date Equifax first receives from Client a consumer applicant’s identifying information in connection with a request for the Service any: (i) new inquiries (including those arising from secondary use); (ii) new credit account trade lines that are posted in Equifax’s automated consumer credit reporting database; (iii) changes to existing account trade lines that are posted in Equifax’s automated consumer reporting database; and (iv) those additional monitored data elements, if any, (each a “Module”) that are selected and memorialized by Client in this Agreement or in a separate writing. For the avoidance of doubt, the Undisclosed Debt Monitoring Service shall in all events consist of items (i) –
(iii) of the immediately preceding sentence (such version, the “Base Version” of the Service), and any version of the Service selected by Client containing one or more additional (and strictly optional) Modules shall be referred to as a “Configured Version” of the Service.

TransUnion. Upon successful borrower activation with the Service for the consumer’s TransUnion credit file, for any consumers that have a pending/open mortgage loan Equifax will report to Client for the period of one hundred twenty (120) days (unless the End User instructs Equifax otherwise in writing) any: (i) new inquiries; and/or (ii) new credit account trade lines that are posted in TransUnion’s consumer credit reporting database, that are selected and memorialized by Client in this Agreement or in a separate writing. For the avoidance of doubt, the Undisclosed Debt Monitoring Service for the consumer’s TransUnion credit file shall in all events consist of items (i) – (ii) of the immediately preceding sentence (such version, the “TransUnion Version” of the Service).

Additional Terms and Conditions Applicable to the Undisclosed Debt Monitoring Service.

Client Obligations. Client will provide to Equifax a listing of all consumers to be monitored via the Service. Client will provide that listing as frequently, and in a form and manner as the parties agree. Notwithstanding the foregoing, Client must promptly provide to Equifax a notice, in the form and manner agreed upon, identifying those consumers subject to the Service that are no longer in Client’s underwriting process due to any action taken on the credit application other than the granting of a mortgage loan, including, but not limited to, the consumer’s withdrawal of their application or the denial of the applied for credit. Such notice must be provided to Equifax by not later than 9 P.M. ET on the day such action becomes known to Client.

However, notwithstanding the scheduled expiration of such Service notifications, in no event will Equifax and its third party data providers have any liability for Client’s failure to instruct Equifax to delete an individual monitoring set before its expiration date in the event the Client ceases to have a permissible purpose for such monitoring or otherwise notify Equifax as set forth in this paragraph.

Processing. Client acknowledges that: (i) due to the additional processing required to perform the Service, there may be a delay between the time an item appears on a monitored consumer’s credit file in Equifax’s consumer credit reporting database (the system used to provide ACROFILE) and the time that the item is reported to Client via the Service, (ii) provision of the consumer report provided to Client or to a joint user with Client (e.g. a sponsoring lender or secondary purchaser of mortgage loans) for the purpose of secondary use may trigger an inquiry notice that relates to the transaction for which Client is monitoring the subject consumer, and (iii) in some cases related to secondary use inquiries, the identity of the entity requesting the consumer’s credit report will not be available. Client acknowledges that the Undisclosed Debt Monitoring Services, including the Equifax Base Version, Configured Version and the TransUnion Version, require set-up and enrollment through one or more consumer reporting agencies (including Equifax and TransUnion) which may take several days to complete enrollment, and may not result in successful enrollment in any of the Service(s) from Equifax and/or TransUnion. Accordingly, neither Equifax nor TransUnion will have any liability to Client for any delays in enrollment in the Service(s), or any unsuccessful enrollment (or other failure to complete enrollment) in any of the Service(s), for any reason.

B.II. CREDIT SCORE INFORMATION SERVICES

(1) Bankruptcy Navigator Index 5.0 - is a credit scoring service that rank-orders and segments accounts according to the likelihood of bankruptcy over a 24-month period, based on information in the Equifax consumer credit database. The scores returned by the Bankruptcy Navigator Index 5.0 service only represent a prediction of bankruptcy filing relative to other individuals in the Equifax credit database and are not intended to characterize any individual as to credit risk or credit capacity. Qualified Subscriber certifies that it will order this Service only when Qualified Subscriber intends to use the information for the permissible purposes set forth in Section 604(a) of the Fair Credit Reporting Act. Qualified Subscriber will not order the Service for employment purposes.

(2) FICO® Credit Capacity Index™ – is a predictive rank-ordering tool, powered by Fair Isaac, designed and optimized for use with Beacon scores. Credit Capacity Index assigns a consumer credit file a 1-digit decile score (0-9), indicating the relative likelihood that a consumer can safely take on additional debt within a given risk level. Each Credit Capacity Index score is returned with up to four reason codes. (FICO Credit Capacity Index scores are trademarks of Fair Isaac).

(3) FICO® Risk Score, Classic, v5, v8, v9, v10 - is a credit scoring service based on a model developed by Fair Isaac Corporation (“Fair Isaac”) and Equifax that ranks consumers in the Equifax consumer credit database relative to other consumers in the database with respect to the likelihood of those consumers paying their accounts as agreed.

(4) VantageScore, v3,v4SM - is a tri-bureau credit risk model developed using one algorithm across sample data common to all three credit bureaus. The following additional terms and conditions apply to Qualified Subscriber’s receipt and use of VantageScore:

End User Terms for VantageScore – Qualified Subscriber will request VantageScores only for Qualified Subscriber’s exclusive use. Qualified Subscriber may store VantageScores solely for Qualified Subscriber’s own use in furtherance of Qualified Subscriber’s original purpose for obtaining the VantageScores. Qualified Subscriber shall not use the VantageScores for model development or model calibration, except in compliance with the following conditions: (1) the VantageScores may only be used as an independent variable in custom models; (2) only the raw archived VantageScore and VantageScore segment identifier will be used in modeling (i.e., no other VantageScore information including, but not limited to, adverse action reasons, documentation, or scorecards will be used); and (3) Qualified Subscriber’s depersonalized analytics and/or depersonalized third party modeling analytics performed on behalf of Qualified Subscriber, using VantageScores, will be kept confidential and not disclosed to any third party other than as expressly provided for below in (ii), (iv), (v) and/or (vi) of this paragraph). Qualified Subscriber shall not reverse engineer the VantageScore. All VantageScores provided hereunder will be held in strict confidence and may never be sold, licensed, copied, reused, disclosed, reproduced, revealed or made accessible, in whole or in part, to any Person, except: (i) to those employees, agents, and independent contractors of Qualified Subscriber with a need to know and in the course of their employment; (ii) to those third party processing agents and other contractors of Qualified Subscriber who have executed an agreement that limits the use of the VantageScores by the third party only to the use permitted to Qualified Subscriber and contains the prohibitions at least as restrictive as those set forth herein regarding model development, model calibration, reverse engineering and confidentiality; (iii) when accompanied by the corresponding reason codes, to the consumer who is the subject of the VantageScore (provided, that, accompanying reason codes are not required to the extent permitted by law); (iv) to government regulatory agencies; (v) to ratings agencies, dealers, investors and other third parties for the purpose of evaluating assets or investments (e.g., securities) containing or based on obligations of the consumers to which the VantageScores apply (e.g., mortgages, student loans, auto loans, credit ca rds), provided that, as it relates to this subsection (v), (a)

Qualified Subscriber shall not provide any information that would enable a recipient to identify the individuals to whom the VantageScores apply, and (b) Qualified Subscriber shall enter into an agreement with each recipient that limits the use of the VantageScores to evaluation of such assets or investments; or (vi) as permitted with the express, written authorization from VantageScore Solutions, LLC, or as otherwise required by law. Qualified Subscriber agrees that the trademarks, trade names, product names, brands, logos, and service marks (“Vantage Marks”) for VantageScore credit scores and credit scoring models will remain the sole property of VantageScore Solutions, LLC. Qualified Subscriber obtains a limited, non-exclusive, non-transferable, royalty free license to use and display the Vantage Marks in connection with the activities solely permitted by this Agreement. The use of the Vantage Marks under the preceding license is limited to use only in connection with the Services covered by this Agreement, and the Qualified Subscriber expressly agrees not to use the Vantage Marks in connection with any products or services not covered by this Agreement. Any use of the Vantage Marks is subject to VantageScore Solutions, LLC’s prior written authorization. Qualified Subscriber further agrees it will include the Vantage Marks in all advertising and marketing materials which reference the VantageScores or Vantage models and it will comply with the VantageScore Trademark Policy and Brand Guidelines, which may be changed from time to time upon written notice. All use of the Vantage Marks will accrue solely to the benefit of VantageScore Solutions, LLC.

Additional Terms and Conditions Applicable for Credit Score Information Services, other than FICO Scores:

(a) Disclosure of Scores. Qualified Subscriber will hold all information received from Equifax in connection with any Score received from Equifax or CRA under the CRA Agreement for Service in strict confidence and will not disclose that information to the consumer or to others except as required by law or as explicitly permitted in the CRA Agreement for Service. Qualified Subscriber may provide the principal factors contributing to the Score to the subject of the report when those principal factors are the basis of Qualified Subscriber’s adverse action against the subject consumer. Qualified Subscriber must describe the principal factors in a manner which complies with Regulation B of the ECOA.

(b) ECOA Statements. Subject to the terms below, Equifax reasonably believes that, (1) the scoring algorithms used in the computation of the Scores are empirically derived from consumer credit information from Equifax’s consumer credit reporting database, and are demonstrably and statistically sound methods of rank ordering candidate records from the Equifax consumer credit database for the purposes for which the Score was designed particularly, and it is intended to be an “empirically derived, demonstrably and statistically sound credit scoring system” as defined in Regulation B. and (2) the scoring algorithms comprising the Score, except as permitted, do not use a “prohibited basis,” as such phrase is defined in Regulation B. This section and Equifax’s statements herein are contingent on Qualified Subscriber’s use of the Score for the purpose for which it was designed, in compliance with the service definitions described in the CRA Agreement for Service. Qualified Subscriber must validate the Score on its own records. Qualified Subscriber will be responsible for meeting its requirements under the ECOA and Regulation B and will not use any Score in any manner that violates any fair lending laws.

(c) Release. Equifax does not guarantee the predictive value of the Score with respect to any individual, and does not intend to characterize any individual as to credit capability. Neither Equifax nor its directors, officers, employees, agents, subsidiary and affiliated companies, or any third-party contractors, licensors or suppliers of Equifax will be liable to Qualified Subscriber for any damages, losses, costs or expenses incurred by Qualified Subscriber resulting from any failure of a Score to accurately predict the credit worthiness of Qualified Subscriber’s applicants or customers. In the event the Score is not correctly applied by Equifax to any credit file, Equifax’s sole responsibility will be to reprocess the credit file through the Score at no additional charge.

Additional Terms and Conditions for Credit Score Information Applicable to FICO® Risk Score, Classic:

In addition to the terms and conditions contained in the Agreement, the following additional terms also govern the use by Qualified Subscriber of credit risk Scores or insurance risk Scores of Fair Isaac (“FICO Scores”):

1. From time to time, Qualified Subscriber may request that Equifax provide FICO Scores, for, in each case, one of the following internal decisioning purposes requested: (a) in connection with the review of a consumer report it is obtaining from Equifax; (b) for the review of the portion of its own open accounts and/or closed accounts with balances owing that it designates; (c) as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation; (d) for use as a selection criteria to deliver a list of names to Qualified Subscriber, or Qualified Subscriber’s designated third party processor agent; (e) for transactions not initiated by the consumer for the extension of a firm offer of credit or insurance; or (f) with respect to the insurance risk scores only for use in connection with the underwriting of insurance involving the consumer.

Qualified Subscriber shall use each such FICO Score only once and, with respect to FICO Scores, only in accordance with the permissible purpose under the FCRA for which Qualified Subscriber obtained the FICO Score.

2. Qualified Subscriber acknowledges that the FICO Scores are proprietary and that Fair Isaac retains all its intellectual property rights in the FICO Scores and the Models (defined below) used by Equifax to generate the FICO Scores. Fair Isaac grants to Qualified Subscriber, effective during the term of the Qualified Subscriber agreement, a personal, non-exclusive, non-transferable, limited license to use, internally, the FICO Scores solely for the particular purpose set forth in Section 1 above for which the FICO Scores were obtained, including, but not limited to the single use restrictions set forth above. Qualified Subscriber’s use of the FICO Scores must comply at all times with applicable federal, state and local law and regulations, and Qualified Subscriber hereby certifies that it will use each FICO Score only for a permissible purpose under the FCRA. Qualified Subscriber shall not attempt to discover or reverse engineer the FICO Scores, Models or other proprietary information of Fair Isaac, or use the FICO Scores in any manner not permitted, including, without limitation, for resale to third parties, model development, model validation, model benchmarking, or model calibration. “Model” means Fair Isaac’s proprietary scoring algorithm(s) embodied in its proprietary scoring software delivered to and operated by Equifax.

3. Qualified Subscriber shall not disclose the FICO Scores nor the results of any validations or other reports derived from the FICO Scores to any third party (other than to a consumer as expressly permitted in the Agreement and this Section 3) unless: (a) such disclosure is clearly required by law; (b) Fair Isaac and Equifax provide written consent in advance of such disclosure; and/or (c) such disclosure is to Qualified Subscriber’s designated third party processor agent; provided however that in either (i.e., (b) or (c) above) event, Qualified Subscriber may make such disclosure (or in the event of (c), direct Equifax to deliver such lists, only after Qualified Subscriber has entered into an agreement with the third party that (i) limits use of the FICO Scores to only the use permitted to Qualified Subscriber hereunder, (ii) obligates the third party provider to otherwise comply with these terms, and (iii) names Fair Isaac as an intended third party beneficiary of such agreement with respect to the Models, FICO Scores, and other Fair Isaac intellectual property and with fully enforceable rights. Qualified Subscriber shall not disclose a FICO Score to the consumer to which it pertains unless such disclosure is (i) approved in writing by Fair Isaac or (ii) required by law or is in connection with an adverse action (as defined by the FCRA) and then only when accompanied by the corresponding reason codes.

4. Fair Isaac represents and warrants that the scoring algorithm(s) used in the Models to produce FICO Scores are empirically derived and demonstrably and statistically sound; provided, that, this warranty is conditioned on (i) an Qualified Subscriber’s use of each FICO Score for the purposes for which the respective Model was designed, as applied to the United States population used to develop the scoring algorithm, (ii) the Qualified Subscriber’s compliance with all applicable laws and regulations pertaining to the use of the FICO Scores, including the Qualified Subscriber’s duty (if any) to validate or revalidate the use of credit scoring systems under the ECOA and Regulation B, and (iii) the Qualified Subscriber’s use of the FICO Scores otherwise remaining in compliance with the terms of the Agreement with respect to FICO Scores. FAIR ISAAC AND EQUIFAX HEREBY DISCLAIM ALL OTHER WARRANTIES, WHETHER STATUTORY, EXPRESS OR IMPLIED INCLUDING, WITHOUT LIMITATION, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND OTHER WARRANTIES THAT MIGHT BE IMPLIED FROM A COURSE OF PERFORMANCE OR DEALING OR TRADE USAGE.

5. IN NO EVENT SHALL EQUIFAX OR FAIR ISAAC BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL, INDIRECT, SPECIAL, OR PUNITIVE DAMAGES INCURRED BY ANY PARTY AND ARISING OUT OF THE PERFORMANCE HEREUNDER, EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF SUCH DAMAGES WERE REASONABLY FORESEEABLE. IN NO EVENT SHALL EQUIFAX’S AND FAIR ISAAC’S COMBINED AGGREGATE TOTAL LIABILITY HEREUNDER EXCEED THE AMOUNTS PAID HEREUNDER DURING THE PRECEDING TWELVE (12) MONTHS FOR THE FICO SCORES THAT ARE THE SUBJECT OF THE CLAIM(S) OR TEN THOUSAND DOLLARS ($10,000.00), WHICHEVER AMOUNT IS LESS.

6. Equifax and Qualified Subscriber acknowledge and agree that Fair Isaac is a third party beneficiary hereunder with respect to the Models, FICO Scores, and other Fair Isaac intellectual property and with fully enforceable rights. Qualified Subscriber further acknowledges and agrees that Fair Isaac’s rights with respect to the Models, FICO Scores, other Fair Isaac intellectual property, and all works derived therefrom are unconditional rights that shall survive the termination for any reason.

B.III. CREDIT SCORE INFORMATION SERVICES

Credit Data Attributes

Pre-Built Attribute Packages - a collection of predefined sets of consumer attributes that leverage data available on Equifax’s core consumer credit file. This Service constitutes a consumer report.

- Essentials - a broad collection of 520 of the most utilized predictive consumer credit attributes across a number of industries, concepts, and time.

––––––––––––––––––––––––––––––––––––

END OF VENDOR TERMS

––––––––––––––––––––––––––––––––––––

Client (End User / Property Manager):

Legal Name of Entity: ________________________________

By: _______________________________

Name: _____________________________

Title: ______________________________

Date: ______________________________

Exhibit D – CIC Vendor Addendum

Vendor: Contemporary Information Corporation (“CIC”) (“Vendor”)

Effective Date: January 7, 2026

Products/Services Covered: Criminal data, housing court data

1. Flow-Through Obligations. Client agrees to comply with the Vendor’s end-user terms, restrictions, and requirements applicable to the Products/Services Covered (the “Vendor Terms”). Vendor Terms are incorporated by reference or set forth below/attached.

2. Conflicts. If Vendor Terms conflict with this EUA or the MSA, Vendor Terms control solely to the extent necessary to satisfy Vendor requirements for the Products/Services Covered; otherwise, the MSA controls.

3. Audit. Client will cooperate with Vendor or Company audits as required by Vendor Terms.

4. Data Use. Client will use Vendor-provided data solely for permissible purposes and will not resell or redisclose except as permitted by law and Vendor Terms.

5. Security. Client will meet Vendor security requirements and promptly notify Company of any suspected compromise involving Vendor data.

6. Termination/Suspension. Company may suspend access to Vendor data if required by Vendor Terms or to prevent legal/compliance risk.

Vendor Terms Attachment:
[ ✔ ] Included below
[ ] URL/Reference: ______________________________________

If Vendor Terms are included below, the Vendor Terms begin immediately after the following line and continue until the end of this Addendum or until otherwise clearly indicated.

––––––––––––––––––––––––––––––––––––
START OF VENDOR TERMS
––––––––––––––––––––––––––––––––––––

USE LIMITATIONS. Reseller hereby certifies and agrees that it will request and or use information received from CIC solely for resale to its customers, the end users of the CIC Data. Reseller warrants that its customers will use the information supplied in connection with transactions involving the extension of credit, lease or rental of residential or commercial property to the consumer or the business about whom the CIC Data is sought, and neither Reseller nor its customers will request or use such information for any purpose prohibited by law. All CIC Data provided by CIC to Reseller shall be retained by Reseller, and by extension, Reseller’s clients, in strict confidence and disclosed only to employees and agents whose duties reasonably relate to legitimate business purposes for which information is requested, or as otherwise required by applicable law.

Reseller agrees that it shall not sell or otherwise distribute to any third party or other reseller any information received hereunder, except as otherwise provided by this Agreement or required by law. Reseller further understands that CIC’s services may only be used for the purpose(s) as stated in this Agreement. Reseller understands and agrees that if it changes or alters the information provided in the CIC Data in any manner, that Reseller waives any and all rights against CIC hereunder, and further agrees to indemnify CIC against any and all claims related to Reseller's use of such altered information.

Reseller agrees that either directly or indirectly, using CIC Data, Reseller is prohibited from developing, deriving, enhancing, creating, benchmarking, or otherwise maintaining a public records database that competes with CIC and is prohibited from otherwise reverse engineering CIC Data.

RESELLER REPRESENTATIONS.

(a) Compliance with Law. Reseller warrants and represents that it is in compliance, and at all relevant times will remain in compliance, with all applicable federal, state and/or local laws, ordinances, statutes and regulations which may apply to Reseller’s business and its use of CIC Data. Reseller further represents and warrants that each of its end users must represent and warrant with each request for CIC Data that such end user has a permissible purpose pursuant to the FCRA, for the information that is being requested and used and that its end users are in compliance, and at all relevant times will remain in compliance, with all applicable federal, state and/or local laws, ordinances, statutes and regulations which may apply to end user's business and its use of CIC Data. Reseller acknowledges and agrees that Reseller bears exclusive responsibility for determining each of its end users' permissible purpose.

(b) Retention of Records. Reseller shall require that each of its end users shall (1) maintain for a period of six (6) years a complete and accurate record pertaining to every access to CIC Data, including, but not limited to, the required consents and disclosures obtained from the consumer to which such information is related, and (2) agree to provide copies of such consents and disclosures to CIC upon request.

(c) Economic Sanctions Laws. Reseller acknowledges that CIC is subject to economic sanctions laws, including but not limited to those enforced by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”). Accordingly, Reseller shall comply with all economic sanctions’ laws of the United States.

Reseller shall not provide access to CIC Data to any individuals identified on OFAC’s list of Specially Designated Nationals (“SDN List”). Reseller shall not take any action which would place CIC in a position of noncompliance with any such economic sanctions laws.

(d) Vermont Fair Credit. Reseller certifies that it is in compliance with Section 2480e of the Vermont Fair Credit Reporting Statute, if applicable, and that it has provided its end user with a copy of that statute, which is available at https://legislature.vermont.gov/statutes/section/09/063/02480e.

(e) California Investigative Consumer Reporting Agency Act (“CA ICRAA”). Reseller further certifies, when applicable to its business and prior to obtaining CIC Data, that the Reseller's end user shall comply with all applicable provisions of CA ICRAA, and shall: 1) provide the consumer a written disclosure notice that includes the specific language described in the CA ICRAA; 2) obtain authorization from the consumer as permission to procure the report; 3) provide a means by which the consumer can indicate his or her wish to obtain a copy of the report; and follow the FCRA’s adverse action procedures.

EMPLOYMENT SCREENING. Reseller shall prohibit the use of CIC Data for employment screening or employment pre-screening purposes.

CONSUMER DATA PROTECTION/ACCESS SECURITY REQUIREMENTS. Access Security Requirements. Reseller acknowledges it has received a copy of CIC’s Access Security Requirements, from the website https://www.cicreports.com/FCRA-Access-Security- Requirements-and-CIC-Policies. Reseller agrees to comply with such requirements as modified by CIC from time to time and posted on that website; and Reseller agrees to monitor such website on a monthly basis to obtain notice of any changes to the Access Security Requirements and Reseller agrees to comply with any and all such changes to the Access Security Requirements. Reseller agrees that each time it places an order for CIC Data, Reseller is, and will continue to be, in compliance with these requirements. Reseller certifies that it shall implement and maintain a comprehensive information security program written in one or more readily accessible parts and that contains administrative, technical, and physical safeguards that are appropriate to Reseller’s size and complexity, the nature and scope of its activities, and the sensitivity of the CIC Data provided to it under this Agreement, and that such safeguards shall include the elements set forth in 16 C.F.R. § 314.4 and shall be reasonably designed to: (i) ensure the security and confidentiality of the CIC Data; (ii) protect against any anticipated threats or hazards to the security or integrity of such information; and (iii) protect against Document Ref: EKBUE-4RSSW-YUKOU-P357Z Page 7 of 18 unauthorized access to or use of such information that could result in substantial harm or inconvenience to any consumer. Reseller shall require its end users to comply with the provision of this Section.

FCRA and Access Security Requirements / CIC Policies

IMPORTANT: PLEASE READ CAREFULLY!

We must work together to protect the privacy and information of consumers. The following information security measures are designed to reduce unauthorized access to consumer information. It is your responsibility to implement these controls. If you do not understand these requirements or need assistance, it is your responsibility to employ an outside service provider to assist you. The credit reporting agency reserves the right to make changes to Access Security Requirements without notification. In accessing the credit reporting agency’s services, you agree to follow these security requirements. The security requirements included in this document represent the minimum security requirements acceptable and are intended to ensure that all subscribers or any other organization engaged with CIC and credit reporting agencies) have appropriate controls in place to protect information and systems, including any information that it receives, processes, transfers, transmits, stores, delivers, and/or otherwise accesses on behalf of CIC and credit reporting agencies.

DEFINITIONS

CIC and Credit Reporting Agency Services means credit bureau highly sensitive information including, by way of example and not limitation, data, databases, application software, software documentation, supporting process documents, operation process and procedures documentation, test plans, test cases, test scenarios, cyber incident reports, consumer information , financial records, employee records, and information about potential acquisitions, and such other information that is similar in nature or as mutually agreed in writing, the disclosure, alteration or destruction of which would cause serious damage to CIC’s and Credit Reporting Agencies’ reputation, valuation, and/or provide a competitive disadvantage to CIC and Credit Reporting Agencies.

“Resource” means all subscriber devices, including but not limited to laptops, PCs, routers, servers, and other computer systems that store, process, transfer, transmit, deliver, or otherwise access the CIC and Credit Reporting Agency Services.

1. Implement Strong Access Control Measures

1.1 Do not provide your credit reporting agency Subscriber Codes or passwords to anyone. No one from the credit reporting agency will ever contact you and request your Subscriber Code number or password.

1.2 Proprietary or third party system access software must have credit reporting agency Subscriber Codes and password(s) hidden or embedded. Account numbers and passwords should be known only by supervisory personnel.

1.3 You must request your Subscriber Code password be changed immediately when: any system access software is replaced by another system access software or is no longer used; the hardware on which the software resides is upgraded, changed or disposed; any suspicion of password being disclosed to an unauthorized party (see section 4.3 for reporting requirements.

1.4 Protect credit reporting agency Subscriber Code(s) and password(s) so that only key personnel know this sensitive information. Unauthorized personnel should not have knowledge of your Subscriber Code(s) and password(s).

1.5 Create a separate, unique user ID for each user to enable individual authentication and accountability for access to the credit reporting agency’s infrastructure. Each user of the system access software must also have a unique logon password.

1.6 Logging mechanisms will be in place to sufficiently to identify security incidents, establish individual accountability, and reconstruct events. Audit logs will be retained in a protected state (i.e., encrypted or locked) with a process for periodic review.

1.7 User IDs and passwords must not be shared, posted, or otherwise divulged in any manner. Restrict the number of key personnel who have access to credit information.

1.8 Keep user passwords Confidential.

1.9 Develop strong passwords that are: not easily guessable (i.e. your name or company name, repeating numbers and letters or consecutive numbers \&letters); contain a minimum of eight (8) alpha/numeric characters for standard user accounts; for interactive sessions (i.e. non system-to-system) ensure that passwords are changed periodically (every 90 days is recommended)
1.10 Ensure that passwords are not transmitted, displayed or stored in clear text; protect all end user (e.g. internal and external) passwords using, for example, encryption or a cryptographic hashing algorithm also known as “one way” encryption. When using encryption, ensure that strong encryption algorithm are utilized (e.g. AES 256 or above).

1.11 Implement password protected screensavers with a maximum fifteen (15) minute timeout to protect unattended workstations. Systems should be manually locked before being left unattended.

1.12 Active logins to credit information systems must be configured with a 30 minute inactive session, timeout. 1.13 Accounts will automatically lock out after five (5) consecutive failed login attempts.

1.14 Ensure that personnel who are authorized access to credit information have a business need to access such information and understand these requirements to access such information are only for the permissible purposes listed in the Permissible Purpose Information section of your membership application.

1.15 Subscriber must not install Peer-to-Peer file sharing software on systems used to access, transmit or store credit data.

1.16. Ensure that you and your employees do not access your own credit reports or those reports of any family member(s) or friend(s) unless it is in connection with a credit transaction or for another permissible purpose.

1.17 Implement a process to terminate access rights immediately for users who access credit reporting agency credit information when those users are terminated or when they have a change in their job tasks and no longer require access to that credit information.

1.18. Implement a process to perform periodic user account reviews to validate whether access is needed as well as the privileges assigned.

1.19 Implement a process to periodically review user activities and account usage, ensure the user activities are consistent with the individual job responsibility, business need, and in line with contractual obligations.

1.20 Implement physical security controls to prevent unauthorized entry to your facility and access to systems used to obtain credit information. Ensure that access is controlled with badge readers, other systems, or devices including authorized lock and key.

2. Maintain a Vulnerability Management Program

2.1 Keep operating system(s), Firewalls, Routers, servers, personal computers (laptop and desktop) and all other systems current with appropriate system patches and updates.

2.2 Subscriber will perform regular penetration tests to further assess the security of systems and resources.

2.3 Configure infrastructure such as Firewalls, Routers, personal computers (laptops and desktops), and similar components to industry best security practices, including disabling unnecessary services or features, removing or changing default passwords, IDs and sample files/programs, and enabling the most secure configuration features to avoid unnecessary risks.

2.4 Implement and follow current best security practices for computer virus detection scanning services and procedures:
- Use, implement and maintain a current, commercially available computer virus detection/scanning product on all computers, systems and networks if applicable anti-virus technology exists. Anti-virus software deployed must be capable to detect, remove, and protect against all known types of malicious software such as viruses, worms, spyware, adware, Trojans, and root-kits.

- If you suspect an actual or potential virus, immediately cease accessing the system and do not resume the inquiry process until the virus has been eliminated.

- Ensure that all anti-virus software is current, actively running, and generating audit logs; ensure that antivirus software is enabled for automatic updates and performs scans on a regular basis.

2.5 Implement and follow current best security practices for computer anti-Spyware scanning services and procedures:
- Use, implement and maintain a current, commercially available computer anti-Spyware scanning product on all computers, systems and networks.

- If you suspect actual or potential Spyware, immediately cease accessing the system and do not resume the inquiry process until the problem has been resolved and eliminated.

- Run a secondary anti-Spyware scan upon completion of the first scan to ensure all Spyware has been removed from your computers.

- Keep anti-Spyware software up-to-date by vigilantly checking or configuring auto updates and installing new anti-Spyware definition files weekly, at a minimum. If your company’s computers have unfiltered or unblocked access to the Internet (which prevents access to some known problematic sites), then it is recommended that anti-Spyware scans be completed more frequently than weekly.

3. Protect Data

3.1 Develop and follow procedures to ensure that data is protected throughout its entire information lifecycle from creation, transformation, use, storage, in transit and secure destruction to reduce the risk of exposure to unauthorized parties regardless of the media used to store the data (i.e., tape, disk, paper, etc.)
3.2 All credit reporting agency data is classified as Confidential and must be secured to this requirement at a minimum.

3.3 Procedures for transmission, disclosure, storage, destruction and any other information modalities or media should address all aspects of the lifecycle of the information.

3.4 Encrypt all credit reporting agency data and information when stored electronically on any system including but not limited to laptops, computers, tablets, servers, databases using strong encryption such as AES 256 or above
3.5 Credit data must not be stored locally on smart tablets and smart phones such as iPads, iPhones, Android based devices, etc.

3.6 When using smart tablets or smart phones to access credit data, ensure that such devices are protected via device pass-code.

3.7 Applications utilized to access all credit data via smart tablets or smart phones must protect data while in transmission such as SSL protection and/or use of VPN, etc.

3.8 Only open email attachments and links from trusted sources and after verifying legitimacy.

3.9 When no longer in use, ensure that hard-copy materials containing credit data are crosscut shredded, incinerated, or pulped such that there is reasonable assurance the hard-copy materials cannot be reconstructed.

3.10 When no longer in use, electronic media containing credit data is rendered unrecoverable via a secure wipe program in accordance with industry-accepted standards for secure deletion, or otherwise physically destroying the media (for example, degaussing).

4. Maintain an Information Security Policy

4.1 Suitable to complexity and size of the organization, establish and publish information security and acceptable user policies in one or more readily accessible parts and that contains administrative, technical, and physical safeguards identifying user responsibilities and addressing requirements in line with this document and applicable laws and regulations. Such safeguards shall include the elements set forth in 16 C.F.R. § 314.4 and shall be reasonably designed to (i) ensure the security and confidentiality of the information provided by CIC, (ii) protect against any anticipated threats or hazards to the security or integrity of such information, and (iii) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any consumer
4.2 Establish processes and procedures for responding to security violations, unusual or suspicious events and similar incidents to limit damage or unauthorized access to information assets and to permit identification and prosecution of violators. If you believe credit data may have been compromised, immediately notify CIC within twenty-four (24) hours.

4.3 The FACTA Disposal Rules requires that you implement appropriate measures to dispose of any sensitive information related to consumer credit reports and records that will protect against unauthorized access or use of that information. Telephone notification is preferred (800)288-4757, Email notification will be sent to compliance@cicreports.com.

4.4 Implement and maintain ongoing mandatory security training and awareness sessions for all staff at least annually and establish proof of learning to underscore the importance of security within your organization.

4.5 When using third party service providers (e.g. application service providers) to access, transmit, store or process credit data,ensure policies and procedures are in place that are consistent with the practices described in an industry standard, such as ISO 27002 and / or this Security Requirements document, which is aligned to Experian’s Information Security policy.

5. Build and Maintain a Secure Network

5.1 Protect Internet connections with dedicated, industry-recognized Firewalls that are configured and managed using industry best security practices.

5.2 Internal private Internet Protocol (IP) addresses must not be publicly accessible or natively routed to the Internet. Network address translation (NAT) technology should be used.

5.3 Data requests from Subscriber must include the IP address of the device from which the request originated (i.e., the requesting client’s IP address), where applicable.

5.4 Administrative access to Firewalls and servers must be performed through a secure internal wired connection only.

5.5 Any stand alone computers that directly access the Internet must have a desktop Firewall deployed that is installed and configured to block unnecessary/unused ports, services, and network traffic. 5.6 Change vendor defaults including but not limited to passwords, encryption keys, SNMP strings, and any other vendor defaults
5.7 For wireless networks connected to or used for accessing or transmission of credit data, ensure that networks are configured and firmware on wireless devices updated to support strong encryption (for example, IEEE 802.11i) for authentication and transmission over wireless networks.

5.8 When using service providers (e.g. software providers) to access Experian, TransUnion, or Equifax data, access to third party tools/services must require multi-factor authentication.

5.9 CIC reserves the right to audit the security mechanisms of the Subscriber to safeguard access to bureau information, systems and electronic communications. Audits may include examination of system security and associated administrative practices.

6. Regularly Monitor and Test Networks

6.1 Perform regular tests on information systems (port scanning, virus scanning, vulnerability scanning).

Ensure that issues identified via testing are remediated according to the issue severity (e.g. fix critical issues immediately, high severity in 15 days, etc.)
6.2 In cases where the Subscriber is accessing bureau information and systems via third party software, the Subscriber agrees to make available to CIC upon request, audit trail information and management reports generated by the vendor software, regarding Subscriber individual Authorized Users.

6.3 Use current best practices to protect your telecommunications systems and any computer system or network device(s) you use to provide Services hereunder to access CIC systems and networks. These controls should be selected and implemented to reduce the risk of infiltration, hacking, access penetration or exposure to an unauthorized third party by: protecting against intrusions; securing the computer systems and network devices; and protecting against intrusions of operating systems or software. Subscriber shall be responsible for and ensure that third party software, which accesses bureau information systems, is secure, and protects this vendor software against unauthorized modification, copy and placement on systems which have not been authorized for its use.

6.4 Subscriber shall report actual security violations or incidents that impact consumer information to CIC within twenty four (24) hours. Subscriber agrees to provide notice to CIC of any confirmed security breach that may involve data related to the contractual relationship, to the extent required under and in compliance with applicable law. Telephone notification is preferred at 800-288-4757, Email notification will be sent to compliance@cicreports.com.

7. Mobile and Cloud Technology

7.1 Storing credit data on mobile devices is prohibited.

7.2 Mobile applications development must follow industry known secure software development standard practices such as OWASP and OWASP Mobile Security Project adhering to common controls and addressing top risks.

7.3 Mobile applications and all other software development processes must follow secure software assessment methodology which includes appropriate application security testing (for example: static, dynamic analysis, penetration testing) and ensuring vulnerabilities are remediated.

7.4 Mobility solution and all other software server/systems should be hardened in accordance with industry and vendor best practices such as Center for Internet Security (CIS) benchmarks, NIS, NSA, DISA and/or other.

7.5 Mobile applications and data shall be hosted on devices through a secure container separate from any personal applications and data. See details below. Under no circumstances is credit data to be exchanged between secured and non-secured applications on the mobile device.

7.6 In case of non-consumer access, that is, commercial/business-to-business (B2B) users accessing credit data via mobile applications (internally developed or using a third party application), ensure that multi-factor authentication and/or adaptive/risk-based authentication mechanisms are utilized to authenticate users to application.

7.7 When using cloud providers to access, transmit, store, or process credit data ensure that:
- Appropriate due diligence is conducted to maintain compliance with applicable laws and regulations and contractual obligations
- Cloud providers must have gone through independent audits and are compliant with one or more of the following standards: ISO 27001, PCI DSS, EI3PA, SSAE 16 – SOC 2 or SOC3, FISMA, CAI / CCM assessment.

8. Bulk Email Communications into CIC or Credit Reporting Agencies

Third party will not “bulk email” communications to multiple CIC or Credit Reporting Agency employees without prior written approval. Third party shall seek authorization in advance of any such campaign.

9. FCRA & Other Policies

9.1 You must always get a subject's written authorization before accessing their credit and/or public record profile. If you access a subject's credit and/or public record information under false pretenses, and/or without their authorization the penalty for such action(s) under the Federal FCRA Section 621(a)(2)(A) is imprisonment for up to one year and up to a $3,500 fine per violation, and/or any civil damages the court may award the party which brought the action. EXCEPTION: The Federal Fair Credit Reporting Act states in effect that a creditor or their authorized agent attempting tocollect a valid and legally enforceable debt (with or without a judgment) from a subject, can obtain a credit profileon that subject without their authorization.

9.2. Record Retention – The Federal Equal Credit Opportunity Act states that a creditor must preserve all written or recorded information connected with an application for 25 months. In keeping with the FCRA/FACTA, the credit reporting agency requires that you retain the credit/rental application for a period of not less than 6 years (both approved and deniedapplicants). When conducting an investigation, particularly following a breach or a consumer complaint that your company impermissibly accessed their credit report, the credit reporting agency will contact you and will request a copy of the original application signed by the consumer or, if applicable, a copy of the sales contract.

9.3 Adverse Action - If you deny a subject for a credit related transaction (in the form of a rental of a dwelling, the financing of a product or service, etc.) you are to provide them with such a notice in writing. This notice must reference that CRA’s name, address and toll free number that provided the report and the CRA did not make the decision to take adverse action. State that the subject can request a copy of their credit profile from the credit reporting agency in question free of charge. They must request their credit profile within 60 days from the date they were denied credit (otherwise, they must pay the credit bureau's prevailing rate for a copy of their report). In addition, the notice must state that the subject has the right to dispute the accuracy or completeness of any information contained in their consumer credit and/or public record report.

9.4 Prohibited Businesses - CIC cannot serve any companies or individuals engaged in any of the following businesses: adult entertainment, businesses in an unrestricted residential location, attorneys or law offices, bail bondsman, check cashing, credit counseling or repair, dating service, financial counseling, genealogical research and people locator service, massage service, pawn shop, private detectives, 3rd party repossession, companies involved in spiritual counseling, future services (ex. health club, timeshare), tattoo service, news agencies, insurance claims, those who intend to re-sell its credit and/or public record reports directly, or indirectly, or those who plan to use (or which do use) such information in any unlawful manner as set forth in the Fair Credit Reporting Act, as well as any other applicable federal, state, and/or local laws(s). Furthermore, CIC cannot serve any individuals or companies which plan to use (or which do use) its reports for any purpose(s) prohibited by its policies and/or agreement. If you misuse said information in the manner(s) described above, your account with CIC will be terminated without notice.

9.5 Death Master File - Subscriber acknowledges that many services containing credit information also contain information from the Death Master File as issued by the Social Security Administration (“DMF”); certify pursuant to Section 203 of the Bipartisan Budget Act of 2013 and 15 C.F.R. § 1110.102 that, consistent with its applicable FCRA or GLB use of credit bureau information, the subscriber’s use of deceased flags or other indicia within the credit information is restricted to legitimate fraud prevention or business purposes in compliance with applicable laws, rules regulations, or fiduciary duty, as such business purposes are interpreted under 15 C.F.R. § 1110.102(a)(1); and certify that the subscriber will not take any adverse action against any consumer without further investigation to verify the information from the deceased flags or other indicia within the credit information.

––––––––––––––––––––––––––––––––––––
END OF VENDOR TERMS
––––––––––––––––––––––––––––––––––––

Client (End User / Property Manager):

Legal Name of Entity: ________________________________

By: _______________________________

Name: _____________________________

Title: ______________________________

Date: ______________________________

Exhibit E – TransUnion (US) Vendor Addendum

Vendor: TransUnion LLC (“TransUnion”) (“Vendor”)
Effective Date: January 7, 2026
Products/Services Covered: Consumer credit report and scores, others
1. Flow-Through Obligations. Client agrees to comply with the Vendor’s end-user terms, restrictions, and requirements applicable to the Products/Services Covered (the “Vendor Terms”). Vendor Terms are incorporated by reference or set forth below/attached.

2. Conflicts. If Vendor Terms conflict with this EUA or the MSA, Vendor Terms control solely to the extent necessary to satisfy Vendor requirements for the Products/Services Covered; otherwise, the MSA controls. 3. Audit. Client will cooperate with Vendor or Company audits as required by Vendor Terms.

4. Data Use. Client will use Vendor-provided data solely for permissible purposes and will not resell or redisclose except as permitted by law and Vendor Terms.

5. Security. Client will meet Vendor security requirements and promptly notify Company of any suspected compromise involving Vendor data.

6. Termination/Suspension. Company may suspend access to Vendor data if required by Vendor Terms or to prevent legal/compliance risk.

Vendor Terms Attachment:
[ ✔ ] Included below
[ ] URL/Reference: ______________________________________
If Vendor Terms are included below, the Vendor Terms begin immediately after the following line and continue until the end of this Addendum or until otherwise clearly indicated.

––––––––––––––––––––––––––––––––––––
START OF VENDOR TERMS
––––––––––––––––––––––––––––––––––––

Required Terms for Agreement between Reseller and End User for Consumer Reports

a. End User is a Property Manager, Owner, or Owner with Designated Property Manager and has a permissible purpose for obtaining consumer reports in accordance with the Fair Credit Reporting Act (15 U.S.C. §1681 et seq.) including, without limitation, all amendments thereto ("FCRA"). The End User certifies its permissible purpose as:
1. In connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of the consumer; or

2. In connection with the underwriting of insurance involving the consumer or review of existing policy holders for insurance underwriting purposes, or in connection with an insurance claim where written permission of the consumer has been obtained; or 3. In accordance with the written instructions of the consumer who is the subject of the Consumer Report. End User certifies that each such written authorization will expressly authorize End User to obtain the Consumer Report. Nothing in this certification, or elsewhere in this Agreement, is intended to allow End User to purchase the Consumer Report for the purpose of selling or giving the report, or information contained in or derived from it, to the subject of the report, unless required by law, or to any other third party, and End User expressly agrees to refrain from such conduct; or 4. In connection with End User’s legitimate business need for information in connection with a business transaction that is initiated by the consumer, including, but not limited to, tenant screening; or 5. As a potential investor, servicer or current insurer, in connection with a valuation of, or assessment of, the credit or prepayment risks associated with an existing credit obligation; or 6. In connection with End User’s legitimate business need for the information to review an account to determine whether the consumer continues to meet the terms of the account; or 7. Available for use by Government Agencies only: In connection with a determination of the consumer’s eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant’s financial responsibility or status.

b. End User certifies that End User shall use the Consumer Reports: (a) solely for the permissible purpose(s) certified by End User and for no other purpose; and (b) solely for End User’s exclusive one-time use. End User shall not request, obtain or use Consumer Reports for any other purpose, including, but not limited to, for the purpose of selling, leasing, renting or otherwise providing information obtained under this Agreement to any other party, whether alone, in conjunction with End User’s own data, or otherwise in any service which is derived from the consumer reports. The Consumer Reports shall only be requested and accessed by End User’s designated and authorized associates, agents, or service providers having a need to know and only to the extent necessary to enable End User to use the Consumer Reports. Any such End User access may only be made to such designated and authorized associates, agents, or service providers who are also bound by contractual language or written obligations sufficient to limit use of such Consumer Report information in accordance with the use and other restrictions contained in this Agreement. End User shall ensure that such designated and authorized associates, agents, or service providers shall not attempt to obtain any Consumer Reports on themselves, associates, or any other person except in the exercise of their official duties.

c. End User agrees to retain copies of all written authorizations for a minimum of five (5) years from the date of inquiry and make such written authorizations available to Reseller upon request.

d. THE FCRA PROVIDES THAT ANY PERSON WHO KNOWINGLY AND WILLFULLY OBTAINS INFORMATION ON A CONSUMER FROM A CONSUMER REPORTING AGENCY UNDER FALSE PRETENSES SHALL BE FINED UNDER TITLE 18 OF THE UNITED STATES CODE OR IMPRISONED NOT MORE THAN TWO YEARS, OR BOTH.

e. End User shall use each Consumer Report only for a one-time use and shall hold the report in strict confidence, and not disclose it to any third parties, except designated and authorized agents or service providers subject to the conditions set forth above in Section 2; provided, however, that End User may, but is not required to, disclose the report to the subject of the report only in connection with an adverse action based on the report, or as otherwise clearly required by law.

f. Moreover, unless otherwise explicitly authorized in an agreement between Reseller and its End User for scores obtained from TransUnion, or as explicitly otherwise authorized in advance and in writing by TransUnion through Reseller, End User shall not disclose to consumers or any third party, any or all such scores provided under such agreement, unless clearly required by law.

g. With just cause, such as violation of the terms of the End User’s contract or a legal requirement, or a material change in existing legal requirements that adversely affects the End User’s agreement, Reseller may, upon its election, discontinue serving the End User and cancel the agreement immediately.

For those End Users that receive information from the Death Master File the agreement between Reseller and End User must also contain the following language:

End User certifies that it meets the qualifications of a Certified Person under 15 CFR Part 1110.2 and that its access to the DMF is appropriate because:
a. Certified Person: End User has a legitimate fraud prevention interest, or has a legitimate business purpose pursuant to a law, governmental rule, regulation or fiduciary duty, and shall specify the basis for so certifying; and b. Security: End User has systems, facilities, and procedures in place to safeguard the accessed information; experience in maintaining the confidentiality, security, and appropriate use of the accessed information, pursuant to requirements similar to the requirements of section 6103(p)(4) of the Internal Revenue Code of 1986; and agrees to satisfy the requirements of such section 6103(p)(4) as if such section applied to End User; and c. End User shall not disclose information derived from the DMF to the consumer or any third party, unless clearly required by law.

d. Penalties: End User acknowledges that failure to comply with the provisions above may subject End User to penalties under 15 CFR 1110.200 of $1,000 for each disclosure or use, up to a maximum of $250,000 in penalties per calendar year.

e. Indemnification and Hold Harmless: End User shall indemnify and hold harmless TransUnion and the U.S. Government/NTIS from all claims, demands, damages, expenses, and losses, whether sounding in tort, contract or otherwise, arising from or in connection with End User’s, or End User’s employees’, contractors’, or subcontractors’, use of the DMF. This provision shall survive termination of the Agreement and will include any and all claims or liabilities arising from intellectual property rights f. Liability:
1. Neither TransUnion nor the U.S. Government/NTIS (a) make any warranty, express or implied, with respect to information provided under this section, including, but not limited to, implied warranties of merchantability and fitness for any particular use; (b) assume any liability for any direct, indirect or consequential damages flowing from any use of any part of the DMF, including infringement of third party intellectual property rights; and (c) assume any liability for any errors or omissions in the DMF. The DMF does have inaccuracies and NTIS and the Social Security Administration (SSA), which provides the DMF to NTIS, do not guarantee the accuracy of the DMF. SSA does not have a death record for all deceased persons. Therefore, the absence of a particular person on the DMF is not proof that the individual is alive. Further, in rare instances, it is possible for the records of a person who is not deceased to be included erroneously in the DMF.

2. If an individual claims that SSA has incorrectly listed someone as deceased (or has incorrect dates/data on the DMF), the individual should be told to contact their local Social Security office (with proof) to have the error corrected. The local Social Security office will:
a. Make the correction to the main NUMIDENT file at SSA and give the individual a verification document of SSA’s current records to use to show any company, recipient/purchaser of the DMF that has the error; OR, b. Find that SSA already has the correct information on the main NUMIDENT file and DMF (probably corrected sometime prior), and give the individual a verification document of SSA’s records to use to show to any company subscriber/ purchaser of the DMF that had the error.

For those End Users that wish to receive TransUnion Scores (including the VantageScore), the agreement between Reseller and End User must also contain the following language:

a. End User may request TransUnion Scores, which shall include the VantageScore (collectively “TransUnion Scores” or “Scores”) in connection with the delivery of a consumer report obtained hereunder. TransUnion agrees to perform such processing as reasonably practicable. End User shall use Scores provided in connection with the delivery of a consumer report only in accordance with its permissible purpose under the FCRA certified at the time of its request for such Scores. End User will request Scores only for End User’s exclusive, one-time use. End User may store Scores solely for End User’s own use in furtherance of End User’s original purpose for obtaining the Scores.

b. Adverse Action Factors. End User recognizes that factors other than the Score may be considered in making a decision as to a consumer. Such other factors include, but are not limited to, the consumer report, the individual account history, application information, and economic factors. Score reason codes may be provided to the End User, which are designed to indicate the principal factors that contributed to the Score and may be disclosed to consumers as the reasons for taking adverse action, as required by the Equal Credit Opportunity Act ("ECOA") and its implementing Regulation (“Reg. B”).

The TransUnion Score itself, when accompanied by the corresponding reason codes, may also be disclosed to the consumer who is the subject of the TransUnion Score. However, the TransUnion Score itself may not be used as the reason for adverse action under Reg. B.

c. End User shall not use any Scores for model development or model calibration and shall not reverse engineer any Scores. TransUnion Scores are proprietary to TransUnion and shall not be disclosed to any other third party without TransUnion’s prior written consent, except as expressly permitted herein or where clearly required by law. All Scores provided hereunder will be held in strict confidence and may never be sold, licensed, copied, reused, or reproduced, and may never be disclosed, revealed or made accessible, in whole or in part, to any Person, except (i) to those employees of End User with a need to know and in the course of their employment; (ii) to those agents and contractors of End User who have a need to know in connection with End User’s use of the Scores as permitted hereunder and who have executed a written agreement that limits the use of the Scores by the third party only to the use permitted to End User and contains the prohibitions set forth herein regarding model development, model calibration, reverse engineering and confidentiality; (iii) when accompanied by the corresponding reason codes, to the consumer who is the subject of the Score, when in connection with an adverse action notice; (iv) to government regulatory agencies; or (v) as required by law. For the purpose of this Section, “Person” shall mean an individual, a partnership, a corporation, a limited liability company, a trust, a joint venture, an unincorporated organization and any Government Authority. For the purpose of this Section, “Government Authority” means any national, provincial, state, municipal, local or foreign government, ministry, department, commission, board, bureau, agency, authority, instrumentality, unit, or taxing authority thereof.

d. Scores without Score Factors or Adverse Action Codes. Scores without score factors or adverse action codes may be made available to End User in conjunction with End User’s request for Consumer Reports. End User hereby represents and warrants that when End User requests Scores without score factors or adverse action codes, End User shall not use such Scores, nor any information derived therefrom: (i) to take any adverse action as to any individual consumer; or, (ii) except for prioritization of collection of a credit account, in connection with the collection of an account, when such use is consistent with the permissible purpose certified by End User to obtain such Score(s).

e. TransUnion Score Performance. Certain TransUnion Scores are implemented with standard minimum exclusion criteria. TransUnion shall not be liable to End User for any claim, injury, or damage suffered directly or indirectly by End User as a result of any End User requested changes to the exclusion criteria which result in normally excluded records being scored by such TransUnion Scores. TransUnion warrants that the scoring algorithms used in the computation of the scoring services provided under this Agreement (“Models”), are empirically derived from credit data and are a demonstrably and statistically sound method of rank-ordering candidate records with respect to the purpose of the TransUnion Scores when applied to the population for which they were developed, and that no scoring algorithm used by a TransUnion Score uses a “prohibited basis” as defined in ECOA and Reg. B promulgated thereunder.

The TransUnion Score may appear on a credit report for convenience only but is not a part of the credit report nor does it add to the information in the report on which it is based.

––––––––––––––––––––––––––––––––––––
END OF VENDOR TERMS
––––––––––––––––––––––––––––––––––––

Client (End User / Property Manager):

Legal Name of Entity: ________________________________

By: _______________________________

Name: _____________________________

Title: ______________________________

Date: ______________________________

Exhibit E – TransUnion (Canada) Vendor Addendum

Vendor: Trans Union of Canada, Inc. (“TransUnion”) (“Vendor”)
Effective Date: January 7, 2026
Products/Services Covered: Consumer report report and scores
1. Flow-Through Obligations. Client agrees to comply with the Vendor’s end-user terms, restrictions, and requirements applicable to the Products/Services Covered (the “Vendor Terms”). Vendor Terms are incorporated by reference or set forth below/attached.

2. Conflicts. If Vendor Terms conflict with this EUA or the MSA, Vendor Terms control solely to the extent necessary to satisfy Vendor requirements for the Products/Services Covered; otherwise, the MSA controls. 3. Audit. Client will cooperate with Vendor or Company audits as required by Vendor Terms.

4. Data Use. Client will use Vendor-provided data solely for permissible purposes and will not resell or redisclose except as permitted by law and Vendor Terms.

5. Security. Client will meet Vendor security requirements and promptly notify Company of any suspected compromise involving Vendor data.

6. Termination/Suspension. Company may suspend access to Vendor data if required by Vendor Terms or to prevent legal/compliance risk.

Vendor Terms Attachment:
[ ✔ ] Included below
[ ] URL/Reference: ______________________________________
If Vendor Terms are included below, the Vendor Terms begin immediately after the following line and continue until the end of this Addendum or until otherwise clearly indicated.

––––––––––––––––––––––––––––––––––––
START OF VENDOR TERMS
––––––––––––––––––––––––––––––––––––

MANDATORY USER TERMS

Agent shall ensure that no User receives any Services (as defined below) unless such User has entered into a signed agreement with Agent that includes the terms and conditions set out in this Exhibit B without modification:

1.0 DEFINITIONS

“Agent” shall mean Boom Pay, Inc.

“Services” means the provision from time to time of consumer credit information, as defined in the applicable consumer reporting laws, whether in the form of a full or partial report (“Credit Reports”), and related services, from Trans Union of Canada, Inc. (“TransUnion”) through the Platform.

“User” shall mean Client and Qualified Subscriber, who is Property Manager, Owner, or Owner with Designated Property Manager.

2.0 USER OBLIGATIONS

2.1 Permissible Purpose/Appointment of Agent. User warrants that it will request Services for User’s exclusive, internal and one-time use only and pursuant to the procedures prescribed by [TransUnion] [Agent] from time to time. User hereby appoints Agent as its agent for the purposes of requesting Services and otherwise facilitating User’s receipt of the Services. User also warrants that inquiries for Credit Reports will be made only for the permissible purposes (as set out in the applicable consumer reporting laws) that are checked below and for no other purpose (check as appropriate):

a) [ ] In connection with the extension of credit to a consumer to whom the information pertains; or

b) [ ] In connection with the purchase or collection of a debt of a consumer to whom the information pertains; or

c) [ ✔ ] For the purpose of the entering into or renewal of a tenancy agreement; or

d) [ ] For employment purposes; or

e) [ ] In connection with the underwriting of insurance involving the consumer; or

f) [ ] To determine the consumer’s eligibility for any matter under a statute or a regulation where the information is relevant to a requirement prescribed by law; or

g) [ ✔ ] Where a direct business need for the information exists in connection with a business or credit transaction involving the consumer.

User warrants that it will not use any Services for investigation purposes, including but not limited to pre-litigation investigative services, without the consumer’s written consent (in accordance with section 2.6, below) or as specifically permitted by applicable law. User understands that User’s ability to request Credit Reports from TransUnion through the Agent is contingent on TransUnion membership requirements including compliance with legal or regulatory objectives in respect of Personal Information (as defined herein) or Credit Reports. In the event of a breach by User of the terms and conditions related to the permitted use of TransUnion Services, TransUnion shall have the right, without notice, to cause Agent to terminate the provision of Services to the User.

2.2Record Retention. User will maintain copies of all consents (whether in written, tape-recorded or electronic formats) for a minimum of three (3) years from the date of the relevant inquiry and shall make copies of such consents available to Agent or TransUnion upon request. User shall ensure that all consents are in verifiable form.

2.3Compliance and applicable laws. When requesting and/or using Services, User agrees to comply with all applicable Canadian, Provincial and local laws, including the various provincial consumer reporting acts or equivalent, the Personal Information Protection and Electronic Documents Act (Canada) or equivalent provincial privacy acts, and any applicable regulations, judicial orders and/or orders of an administrative tribunal, as are now or may in the future become effective throughout the term of these user terms (“User Terms”).

2.4 Restrictions on Services. Services shall only be requested by, and disclosed by User to, User's designated and authorized employees, agents or representatives (each a, “Representative”) on a need-to-know basis (provided such Representatives are bound by a confidentiality agreement at least as strict as the confidentiality provisions set forth herein) and only to the extent necessary to enable User to use the Services in accordance herewith. User shall ensure that such Representatives do not attempt to obtain Services as it relates to themselves, their associates, or any other person, except in the exercise of their official duties. Nothing herein is intended to allow User to receive Services for the purpose of selling or otherwise providing them, or the information contained or derived from Services, to the consumer who is the subject thereof, or to any third party. For further clarity, User is prohibited from selling Credit Reports directly to consumers hereunder. User may make disclosures to consumers only as clearly required by law. Where the User has made a legally permissible disclosure to a consumer, and such consumer has questioned information contained in such consumer’s Credit Report, User shall refer such consumer directly to TransUnion for further investigation.

2.5 Audits and Investigations. User shall cooperate with Agent and/or TransUnion with regards to any investigation launched as a result of a consumer complaint or any other investigation necessary to ensure compliance with these User Terms and applicable laws. User shall re- verify disputed information and inquiries upon request by Agent, on behalf of TransUnion, and confirm such disputed items to Agent and/or TransUnion within five (5) business days. User understands and agrees that a failure to do so may result in the disputed information being deleted by TransUnion as “unverifiable”. Furthermore, during the term of these User Terms and for period of three (3) years thereafter, Agent and/or TransUnion may audit User’s policies, procedures and records to ensure compliance with these User Terms, including compliance with applicable laws, upon reasonable notice and during normal business hours.

2.6 Consent. User warrants that it will have obtained prior to requesting from TransUnion (through the Agent) any Personal Information (as defined below), including but not limited to Credit Reports, disclosed as part of the Services, the appropriate active and informed consent in accordance with applicable laws necessary for TransUnion to perform the Services. User warrants that it will use such Personal Information only as permitted by such consent. As used herein, “Personal Information” means information about an identifiable consumer. User will permit Agent and/or TransUnion to review a copy of User’s consent form(s) and/or privacy policy, and will forward any revised consent form(s) and/or privacy policy for review by Agent and/or TransUnion within a reasonable period of time after their adoption. User agrees to make changes to such documents as Agent and/or TransUnion may request from time to time that are necessary, in the sole opinion of TransUnion, for TransUnion to lawfully provide the Services.

2.7 Third Party Information. Where User requests Services to be performed by TransUnion based on information obtained from a third party, User represents and warrants that it has obtained the agreement and/or consent of such third party for the intended use and that such use is consistent with applicable law.

2.8 Configuration. Many of the Services are configurable and the configuration, delivery specifications and/or decision criteria of the User shall be as agreed upon between Agent and TransUnion. User acknowledges and agrees that it is solely responsible to determine its compliance obligations, in particular without limitation, its compliance with the provincial consumer reporting legislation, privacy legislation or the Proceeds of Crime (Money Laundering and Terrorist Financing Regulations) or other applicable law or regulation and as a result, User is solely responsible to obtain its own legal advice and to determine the configuration required from the Agent such that it meets these compliance obligations.

2.9 Fraud and ID Management Services. In the event User obtains any Fraud and ID Management Services from TransUnion in conjunction with Credit Reports or as a stand-alone service, User shall re-verify all information that triggers a potential fraud message and/or a no match, and shall not deny or otherwise take any adverse action (as defined in the applicable consumer reporting laws) against any consumer based solely on TransUnion’s Services. TransUnion does not guarantee the accuracy, completeness or reliability of the Fraud and ID Management Services, and a fraud message, a match, or lack of a match, is not intended, in itself, to guarantee reliability. Accordingly, User agrees to use the Fraud and ID Management Services at its own risk.

2.10 TransUnion Scores. In the event the User obtains scoring products (“TransUnion Scores”), the following terms shall apply: The TransUnion Scores may be delivered with a Credit Report for convenience only but the TransUnion Score does not form part of the Credit Report and does not update, enhance, modify, supplement or change the information in the Credit Report on which it is based. User agrees that the TransUnion Scores are for User’s exclusive use. User may store TransUnion Scores solely for User's own use in furtherance of User's original purpose for obtaining the TransUnion Scores and for no other purpose. User recognizes that factors other than the TransUnion Score may be considered in making a decision about a consumer. Such other factors include, but are not limited to, the Credit Report, the individual account history, application information, and economic factors. TransUnion may provide score reason codes to User. The score reason codes are designed to indicate the principal factors that contributed to the TransUnion Score, and may be disclosed to consumers as the reasons for taking adverse action, as required by applicable consumer reporting law. The TransUnion Score itself is proprietary and may not be used as the reason for adverse action and accordingly, shall not be disclosed to a credit applicant, except as clearly required by law.

2.11 Governmental Permits. User represents and warrants that User has obtained all Governmental Permits required to be obtained and that are necessary to carry on its business in each province and that each Governmental Permit is valid, subsisting and in good standing. User shall remain in good standing with all Governmental Authorities having jurisdiction or authority over or in respect of it and to obtain and maintain in good standing throughout the term all Governmental Permits necessary in connection with the operation of its business, including those required to be obtained and/or maintained pursuant to applicable law.

For the purposes of these User Terms, ”Governmental Permit” means any license, right, permit, franchise, privilege, registration, direction, decree, consent, order, permission, approval or authority issued or provided, or to be issued or provided, by any Governmental Authority, including, where relevant to a User, directives issued by the any Canadian gaming control regulator. “Governmental Authority” means the government of Canada, or any political subdivision thereof, whether provincial, territorial, state, municipal or local, and any governmental, executive, legislative, judicial, administrative or regulatory agency, department, ministry, authority, instrumentality, commission, board, bureau or similar body, whether federal, provincial, territorial, state, municipal or local, in each case, having jurisdiction in the relevant circumstances.

3.0 CONFIDENTIAL INFORMATION

User agrees that User will receive information of a confidential and/or proprietary nature in connection with these User Terms, and such confidential and proprietary information will be held in strict confidence by the User and shall be disclosed only (i) upon demand to governmental regulatory agencies; or (ii) as required by law. User shall protect any such confidential or proprietary information with at least the same degree of care it uses to protect its own information of a similar nature (although not less than a reasonable degree of care) or as required under applicable laws. For greater certainty, User agrees that it shall keep all Credit Reports and their content confidential and not use any Credit Report except for the purposes set out in section 2.1 and consistent with the consent provided by the consumer under section
2.6 to whom a Credit Report relates.

4.0 SAFEGUARDING

User shall implement, and shall take measures to maintain, reasonable and appropriate administrative, technical, and physical security safeguards (“Safeguards”) designed to: (i) ensure the security and confidentiality of Personal Information, including Credit Reports, derived from the Services, accessible through the Platform, and/or otherwise received from TransUnion and/or Agent; (ii) protect against anticipated threats or hazards to the security or integrity of Personal Information; and, (iii) protect against unauthorized access or use of Personal Information. User shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information and to protect the Personal Information from unauthorized access, destruction, use, modification, or disclosure including without limitation, ensuring any User intentional deletion, destruction and/or disposal of Personal Information (whether in paper, electronic, or any other form, and regardless of medium on which such Personal Information is stored) is performed in a manner so as to reasonably prevent its misappropriation or other unauthorized use including, but not limited to, cross-shredding printed information and pulverizing or incinerating tapes, disks and other such non-paper media. User acknowledges and agrees that the provision of Services may be dependent on User’s completion of a satisfactory security audit and questionnaire that demonstrates compliance with these terms.

User is responsible for: (i) any breaches to its Safeguards, including those emanating from its leased lines, modems or other communication devices; (ii) any failure by User to establish or maintain its Safeguards; (iii) any loss, theft or unauthorized access, disclosure, distribution, copying, modification, use or destruction of Personal Information; (iv) any unauthorized access to or use of any software, hardware or systems of Agent or TransUnion, including any authorized access or use of any account credentials or membercodes; (v) any unauthorized entry to the facilities where TransUnion Credit Reports or Services may have been accessible; (vi) any unauthorized release of or access to TransUnion Credit Reports or Services by an employee, agent, contractor or subcontractor of User resulting from a breach of its Safeguards or otherwise; or (vii) any unauthorized access to or use of the Platform (each, a “Breach”).

In the event of a Breach, User shall immediately (but in no event later than twenty-four (24) hours after the occurrence of the Breach) notify Agent or TransUnion by phone and in writing with the following information: (i) a description of the Breach (and, if known, the cause); (ii) the date on (or the period during which) the Breach occurred; (iii) details of the Personal Information impacted by the Breach; (iv) details of consumer impact, if known by User, including the number of impacted consumers; (v) a description of the steps taken to contain, mitigate and recover from the Breach; and (vi) any other information reasonably required by Agent or TransUnion in connection with such Breach.

User shall fully cooperate with TransUnion and Agent in mitigating any damages due to any Breach. Such cooperation shall include, but not necessarily be limited to, allowing TransUnion and/or Agent to participate in the investigation of the cause and extent of such Breach. Such cooperation shall not relieve User of any liability it may have as a result of such Breach.

TransUnion or Agent reserve the right to suspend or terminate User’s access to all or part of the Services if User fails to comply with its obligations in this Section 4.0 (Safeguarding) or TransUnion or Agent reasonably suspect that User is experiencing or has experienced a Breach. In addition, TransUnion or Agent may require User to modify its account credentials, undergo a security assessment or agree to additional security controls in order to regain access to Services, in their sole discretion. Upon request by TransUnion or Agent, User shall provide a certificate signed by User’s forensic auditor or Chief Information Officer (or equivalent) to confirm that the Breach has been fully remediated and that there is no further risk to Personal Information.

User shall ensure that all of its employees, agents, contractor and subcontractors comply with the requirements set out in this Section 4.0 (Safeguarding) and other obligations of User in these User Terms.

5.0 SYSTEM AND ACCESS

User acknowledges that TransUnion is not responsible for the availability, performance, or security of Agent’s Platform, or for User’s inability to obtain access to the Services. User is responsible for all Breaches emanating from any of User’s password or code misuse or any Breaches using such User’s password or code.

TransUnion shall have no liability in relation thereto and User acknowledges that TransUnion shall assume that the individual(s) logging into or accessing the Platform using the specific code(s) and password(s) assigned to User are in fact authorized to do so by User.

6.0 OWNERSHIP

User agrees that the Services provided hereunder are confidential and proprietary to TransUnion and except as explicitly set forth herein, and subject to the licenses granted to User hereunder, the entire right, title and interest in and to the Services and all copyrights, patents, trade secrets, trademarks, trade names, and all other intellectual property rights associated with any and all ideas, concepts, techniques, inventions, processes, or works of authorship including, but not limited to, all materials in written or other tangible form developed or created by TransUnion in its performance of the Services, shall at all times vest exclusively in TransUnion.

TransUnion reserves all rights not explicitly granted to User hereunder. User shall not attempt, directly or indirectly, to reverse engineer, decompile, or disassemble the Services or any confidential or proprietary criteria developed or used by TransUnion relating to the Services provided hereunder.

Subject to User’s compliance with all the terms and conditions herein, Agent grants to User, on behalf of TransUnion: (a) a worldwide, paid- up, non-transferable, revocable and non-exclusive license to all Services provided hereunder for use by User, within User’s internal business operations; and (b) a worldwide, paid-up, limited, revocable and non-exclusive license to use any and all TransUnion-owned intellectual property rights that are integrated into such Services to the extent necessary for User to exercise, unencumbered, its rights set forth herein. Such licenses shall not be deemed to include sublicensing rights or any rights to third party works including, but not limited to, any TransUnion subcontractor intellectual property rights, unless TransUnion explicitly otherwise grants such rights to User in writing.

7.0 WARRANTY

The User recognizes that the Services furnished to User through the Platform are based upon data obtained from sources considered to be reliable. However, due to the possibilities of errors inherent in the procurement and compilation of statistical data involving a large number of individuals, the accuracy, reliability or completeness of the information provided as part of the Services by TransUnion is not warranted and the Services are provided “AS IS” and User shall use the Services at its own risk. In addition, TransUnion makes no representations or warranties that the use of the Services or any particular configuration of such Services requested by User via Agent will enable User to meet its compliance obligations. OTHER THAN AS SET FORTH IN THIS SECTION 7.0, TRANSUNION MAKES NO OTHER WARRANTIES AND HEREBY DISCLAIMS ALL OTHER WARRANTIES, REPRESENTATIONS, OR CONDITIONS, WHETHER STATUTORY, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES OR CONDITIONS AS TO QUALITY OR FITNESS FOR A PARTICULAR PURPOSE OR THAT THE SERVICES WILL BE OF MERCHANTABLE QUALITY. FURTHERMORE, TRANSUNION’S SOLE LIABILITY, AND USER’S SOLE REMEDY, FOR BREACH OF THIS WARRANTY BY TRANSUNION SHALL BE THE CORRECTION OF ANY DEFECTIVE SERVICE (PROVIDED THAT, TRANSUNION RECEIVES A WRITTEN NOTICE WITH A REASONABLY DETAILED DESCRIPTION OF THE DEFECT WITHIN TEN (10) DAYS AFTER THE PERFORMANCE OF THE SERVICE) AND/OR THE REFUND OF FEES PAID FOR SAME AT TRANSUNION’S DISCRETION. USER ACKNOWLEDGES AND AGREES THAT THESE USER TERMS SHALL NOT GIVE RISE TO ANY THIRD PARTY RIGHTS AGAINST TRANSUNION’S DATA SUPPLIERS AND/OR LICENSORS AND THAT, TO THE MAXIMUM EXTENT PERMITTED BY LAW, ALL RIGHTS AND OBLIGATIONS UNDER THESE USERS AND ANY LIABILITY RESULTING THEREFROM ARE SOLELY BETWEEN THE PARTIES HERETO.

8.0 INDEMNIFICATION

User shall indemnify and hold harmless TransUnion and its directors, officers, employees, representatives and agents from any and all claims, losses, liabilities or damages, including consequential damages, and costs (including reasonable attorney’s fees) arising directly or indirectly from, but not limited to: (i) the failure or alleged failure of User to perform any of its obligations described in these User Terms, and the failure by User to comply with any provision of the User Terms including but not limited to, any breach which results in the non-permissible use of the Services provided hereunder; (ii) the negligence or intentional wrongful conduct of User, and/or its directors, officers, employees, agents, contractor or subcontractors; (iii) the use or misuse of Services by the User; (iv) a violation by User of any applicable laws, including but not limited to the failure of User to obtain and/or maintain in good standing any relevant Governmental Permits; (v) any claims by individuals relating to the use, retention or disclosure of Personal Information, including, without limitation, Credit Reports or information included in the Services; (vi) any claims arising out of actions or omissions of User, or its employees, agents, subcontractors; or (vii) any breach of Section
3.0 (Confidential Information) or Section 4.0 (Safeguarding).

9.0 LIMITED LIABILITY

IN NO EVENT SHALL TRANSUNION BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL, INDIRECT, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES INCURRED BY USER ARISING OUT OF THE DELIVERY OF CREDIT REPORTS TO THE PLATFORM OR PROVISION OF SERVICES, INCLUDING BUT NOT LIMITED TO LOSS OF GOODWILL, LOSS OF DATA AND LOST PROFITS OR REVENUE, WHETHER OR NOT SUCH LOSS OR DAMAGE IS BASED IN CONTRACT, WARRANTY, TORT, NEGLIGENCE, STRICT LIABILITY OR OTHERWISE, EVEN IF TRANSUNION HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. FURTHERMORE, IN NO EVENT SHALL TRANSUNION’S TOTAL AGGREGATE LIABILITY TO USER, OR ANY THIRD PARTY ARISING IN RESPECT OF THE SERVICES UNDER THESE USER TERMS AND/OR IN RESPECT OF THE SERVICES EXCEED THE TOTAL AMOUNT OF FEES PAID BY THE USER FOR THE SERVICES DURING THE THREE (3) MONTH PERIOD IMMEDIATELY PRECEDING THE FIRST EVENT GIVING RISE TO A CLAIM FOR LIABILITY, WHETHER SUCH CLAIM IS BASED IN CONTRACT, TORT, WARRANTY, NEGLIGENCE, STRICT LIABILITY OR OTHERWISE. THESE LIMITATIONS SHALL SURVIVE AND APPLY NOTWITHSTANDING THE VALIDITY OF THE LIMITED REMEDIES PROVIDED HEREUNDER. IN NO EVENT WILL TRANSUNION BE LIABLE FOR ANY DISPUTE THAT ARISES BETWEEN USER AND AGENT.

10.0 THIRD PARTY BENEFICIARY

TransUnion is an intended third party beneficiary of these User Terms.

––––––––––––––––––––––––––––––––––––

END OF VENDOR TERMS

––––––––––––––––––––––––––––––––––––

Client (End User / Property Manager):

Legal Name of Entity: ________________________________

By: _______________________________

Name: _____________________________

Title: ______________________________

Date: ______________________________

Exhibit F – Certn Vendor Addendum

Vendor: Certn (USA) Inc. (“Vendor”)
Effective Date: January 7, 2026
Products/Services Covered: Criminal data
1. Flow-Through Obligations. Client agrees to comply with the Vendor’s end-user terms, restrictions, and requirements applicable to the Products/Services Covered (the “Vendor Terms”). Vendor Terms are incorporated by reference or set forth below/attached.

2. Conflicts. If Vendor Terms conflict with this EUA or the MSA, Vendor Terms control solely to the extent necessary to satisfy Vendor requirements for the Products/Services Covered; otherwise, the MSA controls. 3. Audit. Client will cooperate with Vendor or Company audits as required by Vendor Terms.

4. Data Use. Client will use Vendor-provided data solely for permissible purposes and will not resell or redisclose except as permitted by law and Vendor Terms.

5. Security. Client will meet Vendor security requirements and promptly notify Company of any suspected compromise involving Vendor data.

6. Termination/Suspension. Company may suspend access to Vendor data if required by Vendor Terms or to prevent legal/compliance risk.

Vendor Terms Attachment:
[ ✔ ] Included below
[ ] URL/Reference: ______________________________________
If Vendor Terms are included below, the Vendor Terms begin immediately after the following line and continue until the end of this Addendum or until otherwise clearly indicated.

––––––––––––––––––––––––––––––––––––
START OF VENDOR TERMS
––––––––––––––––––––––––––––––––––––
This Vendor Addendum – Certn (this “Certn Addendum”) is a Data Provider Addendum incorporated into and made part of the BoomScreen End User Agreement (“EUA”) between Boom Pay, Inc. (“Company”) and Client. This Certn Addendum constitutes “Data Provider Terms” for purposes of the EUA.

Capitalized terms not defined in this Certn Addendum have the meanings given in the EUA or the MSA, as applicable.

1. Certn as Consumer Reporting Agency

Client acknowledges that certain Screening Services incorporate Consumer Reports provided by Certn (USA) Inc. (“Certn”), a Consumer Reporting Agency as defined under the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (“FCRA”).

Client further acknowledges that, for purposes of the FCRA, Client is a user of consumer reports and an End User, as those terms are used under applicable law and the EUA.

2. Permissible Purpose; Scope of Use

Client certifies that it has a Permissible Purpose under the FCRA and applicable law to obtain Consumer Reports from Certn through the Screening Services, and that such Consumer Reports will be used solely for tenant screening, leasing, or property management purposes, in connection with a business transaction initiated by the Consumer, and for no other purpose.

Client shall not request, obtain, or use Consumer Reports from Certn for any purpose not expressly permitted by the FCRA, applicable law, this EUA, or this Certn Addendum.

3. FCRA Certifications

To the extent the Screening Services involve Consumers or properties located in the United States, Client represents, warrants, and certifies that it:
(a) Has a permissible purpose to obtain Consumer Reports under the FCRA;
(b) Has complied, and will comply, with all applicable disclosure and written authorization requirements prior to requesting any Consumer Report;
(c) Will comply with all applicable adverse action requirements under the FCRA and applicable state law, including providing required notices, disclosures, and copies of Consumer Reports when taking adverse action based in whole or in part on a Consumer Report; and (d) Will not use Consumer Reports in violation of any applicable equal opportunity, anti-discrimination, or fair housing laws, including the Fair Housing Act and ECOA.

4. Limitation on Disclosure and Access

Client shall limit access to Consumer Reports obtained from Certn to those of Client’s personnel who have a legitimate need to know for the applicable screening decision and shall not resell, re-disclose, or otherwise disseminate Consumer Reports except as permitted by the FCRA, applicable law, the EUA, and this Certn Addendum.

5. Confidentiality; Security; Retention

Client’s obligations with respect to confidentiality, data security, breach notification, and data retention for Consumer Reports obtained from Certn are governed by Sections 6 and 8 of the EUA, which are incorporated by reference into this Certn Addendum.

6. Accuracy; Independent Judgment

Client acknowledges that Consumer Reports provided by Certn are compiled from third-party sources and may not be error-free. Client agrees to exercise its own independent judgment when evaluating Consumer Reports and acknowledges that neither the Company nor Certn provides any guarantee, opinion, or recommendation regarding a Consumer’s suitability, character, or fitness for tenancy.

7. Consumer Requests and Disputes

Client acknowledges that Consumers have rights under applicable law to request copies of their Consumer Reports and to dispute the accuracy or completeness of information contained therein. Client agrees to cooperate, as reasonably requested, with Company and Certn in responding to such requests, disputes, and reinvestigations as required by law and the MSA.

8. Condition Precedent; Suspension

Client acknowledges and agrees that Client’s execution of the EUA and acceptance of this Certn Addendum, including the certifications set forth herein, are conditions precedent to Client’s access to Consumer Reports sourced from Certn. Company may suspend or terminate Client’s access to Certn-related Screening Services if Client fails to comply with this Certn Addendum, the EUA, or applicable law.

9. Precedence; Survival

This Certn Addendum is subject to the Order of Precedence set forth in the EUA and is intended solely to satisfy required end-user certifications, permissible purpose representations, and vendor flow-through terms applicable to Certn Consumer Reports.

Client’s obligations under this Certn Addendum shall survive termination of the EUA for so long as Client retains or has access to Consumer Reports obtained from Certn.

––––––––––––––––––––––––––––––––––––
END OF VENDOR TERMS
––––––––––––––––––––––––––––––––––––

Client (End User / Property Manager):

Legal Name of Entity: ________________________________

By: _______________________________

Name: _____________________________

Title: ______________________________

Date: ______________________________

‍