a. End User Consents. End Client will provide all notices to, and obtain all express consents from, each End User as required under applicable laws in connection with End Client’s use, storage, and other processing of any FI Data (such notices and consents, the “ExpressConsents”). Express Consents will: (A) be clear and conspicuous; (B) generally specify the categories of FI Data that End Client will receive and how End Client will use, store, and otherwise process FI Data; (C) be valid, enforceable, and expressly accepted by each EndUser; (D) identify any and all third parties or categories of third parties to whom End Client may provide FI Data for processing; (E) specify how End Users may exercise their right to revoke their Express Consent; and (F) include any other required disclosures under applicable laws.End Client will maintain records (which may include technical logs, screenshots, versions ofExpress Consents obtained) sufficient to demonstrate End Client’s compliance with thisSection 5(i)(a) (End User Consents) and will promptly provide such records to Plaid upon request.
b. Scope of Access. End Client will only access FI Data for which it has obtained ExpressConsents from the End User for the use case reviewed and permitted by Plaid in writing and consented to by the applicable End User (such use case, the “
Permitted Use Case”). For clarity, key factors Plaid will consider during its review of a potential Permitted Use Case include whether the use case is appropriate and useful to provide the End User with the End Client application that the End User has enrolled in, whether the End Client application provides a direct benefit to the End User, whether the use case directly supports the development of new or improved product features for the benefit of End Users, and the jurisdiction(s) in which theEnd Client operates and/or stores FI Data. If End Client possesses FI Data that exceeds the scope of the End User’s Express Consents, End Client will use industry-standard means to permanently and securely delete (“
Delete”) such FI Data; provided that End Client may retain such FI Data to the extent required by applicable laws. If End Client becomes aware that any data it receives from Plaid does not relate to the End User that End Client originally requestedFI Data for, End Client will promptly notify Plaid and will Delete such data.
c. Data Use. End Client will use, store and otherwise process FI Data solely in accordance with the End User’s Express Consents and applicable laws.
d. Data Disclosure. End Client will not disclose, transfer, syndicate or distribute FI Data to any third party (including its Permitted Service Providers) (“
Data Sharing”) except in each case with the End User’s Express Consent and in accordance with applicable laws. Notwithstanding anything to the contrary, End Client will not sell FI Data.
e. Data Deletion. End Client will promptly Delete any FI Data upon request by the applicable EndUser; provided that End Client may retain copies of FI Data solely to the extent required by applicable laws.
f. No Attribution. End Client will not charge End Users any fees attributable to an FI for (a)access to its FI Data or (b) use of End User’s account with an FI in connection with the EndClient application. In addition, End Client will not suggest or imply a partnership, sponsorship, or other relationship with an FI based on End Client’s receipt of FI Data under the Partner-Client Agreement or this
Section 5 (FI Data).
g. No Other Access. During the term of the Agreement, End Client will only access FI Data through the Plaid Services or another manner that uses the FI’s authorized APIs. End Client will not “screen scrape” data from FIs or collect an End User’s log-on credentials for FI accounts, and will not otherwise knowingly obtain from a third party FI Data that was originally sourced through screen scraping an FI. End Client will immediately Delete any such End User log-on credentials in its possession. End Client will maintain records to demonstrate compliance with this
Section 5(i)(g) (No Other Access). For the avoidance of doubt, nothing in this
Section 5(i)(g) (No Other Access) will prohibit End Client from engaging any third party to obtain services similar to the Plaid Services, provided that such third-party services enable EndClient's access to FI Data solely via the FI’s authorized APIs.
h. Compliance with Laws. End Client will comply with all applicable privacy, security, and other laws pertaining to FI Data. End Client will not use, store, disclose, or otherwise process any FIData for any purpose not permitted under applicable laws. For the avoidance of doubt, EndClient acknowledges that Section 1033 of the Dodd-Frank Act may include obligations on EndClient relating to processing, handling, and protecting FI Data. End Client will maintain a program designed to ensure compliance with applicable laws, including appropriately trainingEnd Client personnel.
i. Information Security Program. End Client will maintain a comprehensive written information security program approved by its senior management (“
Infosec Program”). The Infosec Program will include administrative, technical and physical measures designed to: (a) ensure the security of FI Data, (b) protect against unauthorized access to or use of FI Data and anticipated threats and hazards to FI Data and (c) ensure the proper disposal of FI Data. The Infosec Program will be appropriate to End Client’s risk profile and activities, the nature of theEnd Client application, and the nature of the FI Data received by End Client. In any event, the Infosec Program will meet or exceed applicable control objectives captured in industry standards and best practices, such as AICPA Trust Service Criteria for Security, NIST 800-53, or ISO 27002, and will comply with applicable laws. End Client will use up-to-date antivirus software and anti-malware tools designed to prevent viruses, malware, and other malicious code in the End Client application or on End Client’s systems.
j. Security Breach Obligations. End Client will notify Plaid promptly (and in any event within twelve (12) hours) via an email to
security@plaid.com, following End Client becoming aware of any Security Breach, providing a description of all known facts, the types of End Users affected, and any other information related to such Security Breach that Plaid may reasonably request. End Client will reasonably cooperate with Plaid in investigating and remediating Security Breaches. End Client will be responsible for the costs of investigating, mitigating, and remediating the Security Breach.
“Security Breach” means any event that compromises theEnd Client application or End Client’s systems or that does or reasonably could compromise the security, integrity or confidentiality of FI Data or result in the unauthorized use, disclosure, or loss of FI Data.
k. FI Confidential Information. If Plaid discloses to End Client any confidential or proprietary materials of an FI pertaining to the provision of FI Data hereunder (such materials, “
FIConfidential Information”), such materials will be subject to the same obligations that apply toPartner’s Confidential Information under the Partner-Client Agreement, which will in no event be less protective of such information than a reasonable standard of care. FI ConfidentialInformation will also be subject to the same obligations as FI Data under this
Section 5(i) (EndClient Obligations). End Client will promptly Delete FI Confidential Information in its possession upon Plaid’s request and will provide a written certification regarding such Deletion.
l. Oversight and Cooperation. Toward assessing End Client’s material compliance with this
Section 5 (FI Data), End Client will promptly provide all reasonably necessary information and cooperation requested by Plaid, an FI, or any entity with examination, supervision, or other legal or regulatory authority over Plaid or an FI. In the event that Plaid has a good faith reason to believe that End Client is not in material compliance with this
Section 5 (FI Data), Plaid will notify End Client and, upon Plaid’s request, End Client will promptly provide sufficient documentation to demonstrate such material compliance. If the documentation provided byEnd Client in accordance with the immediately prior sentence is insufficient (in Plaid’s reasonable discretion) to demonstrate such material compliance, End Client will submit to a third-party audit by a firm selected by End Client from a list of audit firms reasonably approved by Plaid to verify such compliance. Plaid and FIs may also conduct technical or operational assessments of End Client, which will be subject to advance notice and will not occur more than once per year unless legally required and materially different in scope from a preceding audit.
m. Information Sharing. Where required by an FI or relevant to an End Client’s access or use of FI Data from that FI, Plaid may share with such FI certain information related to End Client’s compliance with this
Section 5 (FI Data), including with respect to End Client’s Infosec Program.Plaid will use commercially reasonable efforts to require that such FI treat any such information in a confidential manner.
n. Insurance. End Client will maintain insurance coverage appropriate to End Client’s risk profile and activities, the nature of the End Client application, and the nature of the FI Data received by End Client; provided that such coverage will be no less than industry standard and will include cybersecurity liability insurance.
o. Access Frequency. The parties acknowledge that as of the effective date of the Partner-ClientAgreement, no guidelines regarding End Client’s frequency of “batch” pulls of FI Data (such guidelines, the “
Guidelines”) apply to Plaid end clients. Notwithstanding the foregoing in this paragraph: (1) End Client will comply with any Guidelines provided in writing by Plaid (including via Partner); and (2) Plaid and Partner may enforce such Guidelines to the extent necessary in accordance with Plaid’s standard practices, which may include throttling, suspension or termination of End Client’s access.
p. End Client Marks License. End Client hereby grants to Plaid and each FI (and each of their third-party service providers) the non-exclusive and non-transferable right and license to useEnd Client’s trademarks and service marks solely in connection with consent management activities, including use associated with End User facing consent management portals operated by Plaid or an FI.
%20copy%201.svg)
