Prefill Services Addendum to the Canopy Connect Terms of Service
Last Updated: April 18, 2024
This Addendum (“Addendum”), applies to you if you utilize Canopy Connect’s prefill products (“Prefill Services”) which provide you with access to data from third-party data providers that source their information from public records and proprietary databases (“Licensed Data”). This Addendum is a supplement to the Canopy Connect Terms of Service located at https://www.usecanopy.com/terms (“Terms”).
1.0 Use and Access of Prefill Services
1.1 Use. You agree that you will use the Prefill Services only for the purpose of: (a) application pre-fill for verification by the end customer; (b) lead or applicant scoring for pre-quote application routing based on risk tolerance categorization; (c) market segmentation or lead evaluation other than in connection with underwriting and/or claims processing; or (d) applicant identification/verification in compliance with the Gramm-Leach-Bliley Act and/or the Drivers Privacy Protection Act ((a)-(d) collectively, the “Intended Use”) and in accordance with all applicable laws and regulations related thereto.
1.2 End User Data. In order to use the Prefill Services, you must provide certain information, which may include non-public data provided by your end users to Canopy Connect to enable the provision of the Prefill Services (such data referred to herein as “End User Data”). You acknowledge that Canopy Connect has no control over the content of End User Data and you shall be solely responsible to ensure that you have obtained any required consent for the processing, use, and transfer of End User Data, and that all End User Data and/or other information transmitted to Canopy Connect for enrichment by its service providers: (A) complies with all applicable laws and regulations now in place or enacted in the future (including privacy and publicity rights); (B) does not infringe or violate any intellectual property rights or confidential information of a third party and (C) to the extent you receives a request from a regulatory or governmental body requiring or requesting information regarding the Licensed Data, you will provide prompt notice to Canopy Connect regarding the nature of the information requested so that Canopy Connect or its service providers, at each party’s sole expense, may provide relevant information or seek to make such information disclosure subject to a protective order or other appropriate remedy to preserve the confidentiality and/or permitted uses of the Licensed Data. You further agree to utilize the data received from Canopy Connect through the Prefill Services solely for the purposes set forth in Section 1.2.
1.3 Access to Motor Vehicle and Household Data. The Driver’s Privacy Protection Act (“DPPA”) as well as state law restricts the use of motor vehicle data to certain “permissible uses”. You acknowledge and shall require your employees and agents to acknowledge compliance with these laws and only permit them to access motor vehicle data for the DPPA permissible purpose of insurance application underwriting. You represent and warrant that motor vehicle data will not be accessed except in furtherance of and shall only be used for such permissible purpose, and that you are the end user of the data. You shall employ commercially reasonable procedures to track and monitor your agents’ and employees’ access to and use of the data and investigate any allegations of misuse of the data in full cooperation with Canopy Connect and/or its third-party provider of motor vehicle data, or at the request of a state. You acknowledge that in addition to other remedies of Canopy Connect, any non-compliance by you with the above provision shall result in Canopy Connect revoking your access to and use of motor vehicle data. You acknowledge that the motor vehicle data is licensed to you for the internal use only of your agents and underwriters and may not be reproduced, or disclosed to anyone else unless permitted by law. Motor vehicle data shall not be appended to any other data or file except in the context of a report prepared for and consistent with the approved DPPA permissible purpose for which the motor vehicle data was accessed. You acknowledge that all rights, title and interest in and to the motor vehicle data is retained by Canopy Connect and/or its third-party provider, and you shall not commit or permit any act or omission that would impair such rights. For purpose of this section, you represent that you are a legitimate business of the type permitted by law to access the motor vehicle data and your employees and agents shall also be subject to the terms and conditions of this Agreement.
1.4 Access to Driving License Data. You shall not use the Licensed Data for consumer credit purposes, consumer insurance underwriting, employment purposes, tenant screening purposes, or for any other purpose(s) covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.) or similar state or local statute, rules and regulations; and (b) abide by such legislation and rules and regulations as may be enacted or adopted after the date of this Agreement, by any federal, state or local government body, including without limitation, the Gramm-Leach-Bliley Act and any similar state or local statute, rules and regulations. You hereby certify that the Licensed Data shall be used solely for the purpose of identity verification/resolution, including validation by a consumer.
1.5 Access to Driving Record IQ. To the extent you identify driver activity with using the Prefill Services, you acknowledge that Canopy Connect relies upon various State/Federal or third-party provider (“State / Data Providers”) to provide violation identification Prefill Services and the quality, timeliness, and population coverage of the data and Prefill Services may vary
by State / Data Provider. You acknowledge that Canopy Connect has no control over the data provided by State / Data Providers. You certify that neither Canopy Connect nor any State / Data Provider shall have liability of any kind in connection with the violation information provided by the State / Data Providers, including but not limited to any false positives or improperly updated, incomplete, or erroneous information. You acknowledge that violation data may not contain
the same data as a current MVR, and the Prefill Services shall only be used as pointers of possible records. You certify that (a) you will not use violation identification data to deny insurance coverage or take an adverse action against any individual; and (b) prior to making any decisions to deny insurance coverage or take an adverse action against any individual, you will verify the activity on violation identification data directly with an MVR. Additional restrictions may apply on a state by state basis.
1.6 Third Party Providers of Driving License Data and Record IQ. You acknowledge that Canopy Connect relies upon various State/Federal or third-party providers (“State / Data Providers”) to provide violation identification services and the quality, timeliness, and population coverage of the data and services may vary by State / Data Provider. You acknowledges that Canopy Connect has no control over the data provided by State / Data Providers. You certifies that neither Canopy Connect nor any State / Data Provider shall have liability of any kind in connection with the violation information provided by the State / Data Providers, including but not limited to any false positives or improperly updated, incomplete, or erroneous information. You acknowledge that violation data may not contain the same data as a current MVR, and the Prefill Services shall only be used as pointers of possible records. You certify that: (a) you will not use violation identification data to deny insurance coverage or take an adverse action against any individual; and (b) prior to making any decisions to deny insurance coverage or take an adverse action against any individual, you will verify the activity on violation identification data directly with an MVR. Additional restrictions may apply on a state by state basis.
2.0 Your Responsibilities
2.1 Compliance. You shall comply with all applicable privacy, consumer protection, data security, and other similar laws, rules and regulations and comply with any third-party security requirements imposed by Canopy Connect’s service providers or any state regulatory or government agencies. You shall notify Canopy Connect of any actual or suspected unauthorized use or disclosure of the Licensed Data and provide reasonable assistance to Canopy Connect in the investigation and prosecution of any such unauthorized use or disclosure. You agree to provide any consumer notices required by any government or regulatory agency or pursuant to any applicable laws, at your sole cost and expense, for any unauthorized use or disclosure of the Licensed Data accessed using your credentials. From time to time, at the reasonable request of Canopy Connect, you agrees to provide Canopy Connect with reasonably necessary information - and a certification - to demonstrate that you are in compliance with the requirements, processes and procedures agreed to herein.
2.2 Security. You shall implement appropriate procedures and safeguards to prevent the unauthorized use or release of the Licensed Data, including, but not limited to, auditing and monitoring usage of the Licensed Data, and shall issue appropriate instructions to all of your employees having access to the Licensed Data concerning the restrictions contained herein. You shall employ reasonable measures to assure that the Licensed Data is used solely by users allowed to receive, view, or otherwise use the Licensed Data for the Intended Use, and shall implement reasonable mechanisms to remedy any unauthorized use of the Licensed Data
2.3 Information Security Program. You shall maintain a comprehensive written information security program (“Infosec Program”). The Infosec Program will include administrative, technical and physical measures designed to: (a) ensure the security of End User Data, (b) protect against unauthorized access to or use of End User Data and anticipated threats and hazards to End User Data; (c) protect against accidental or malicious threats; (d) apply reasonable controls to prevent, detect, and respond to malicious software or cyber security attacks; and (e) ensure the proper disposal of End User Data. The Infosec Program will be appropriate to your risk profile and activities, and the nature of the End User Data received by you. In any event, the Infosec Program will meet or exceed applicable control objectives captured in industry standards and will comply with applicable laws. You will use up-to-date antivirus software and anti-malware tools designed to prevent viruses, malware and other malicious code in the Customer Application or on Customer’s systems.
2.4 Storage and Display of Licensed Data. You shall implement your use of the Licensed Data in such a manner that the Licensed Data is not displayed or stored in memory within a web browser or browser cache, but shall only display the masked portion of the Licensed Data for verification/validation by the consumer.
2.5 Breach or Unauthorized Disclosure. You shall notify Canopy Connect of any actual or suspected unauthorized use, disclosure or breach of the Licensed Data or Personal Information within 72 hours of the discovery of such event. You shall provide reasonable assistance to Canopy Connect in the investigation and prosecution of any such unauthorized use or disclosure. You agree, at your sole cost and expense, to provide any consumer notices required by any government or regulatory agency or pursuant to any applicable laws for any unauthorized use or disclosure of the Licensed Data accessed using your credentials. For purposes of this Section, “Personal Information” means: (i) any information about an identifiable individual; and (ii) information that is not specifically about an identifiable individual but, when combined with other information, may identify an individual.
2.6 Oversight and Cooperation. You will promptly provide all reasonably necessary information and cooperation requested by Canopy Connect, its third-party service providers, or any entity with examination, supervision, or other legal or regulatory authority over Canopy Connect or third-party service provider. In the event that Canopy Connect has a good faith reason to believe that you are not in material compliance with this Addendum, Canopy Connect will notify you and, at Canopy Connect’s option, you will promptly provide sufficient documentation to demonstrate such material compliance or submit to a third-party audit by a firm selected from a Canopy Connect-approved list of audit firms to verify such compliance. Canopy Connect may also conduct compliance audits, which will be subject to advance notice and will not occur more than once per year unless legally required and materially different in scope from a preceding audit.
2.7 Information Sharing. Where required by a third-party service provider or a regulatory body and to the extent relevant to your access or use of Licensed Data, Canopy Connect may share with such parties certain information related to your compliance with this Addendum, including with respect to your Infosec Program. Canopy Connect will request that such third-party treat any such information in a confidential manner.
2.8 Hold Harmless. You shall indemnify and hold harmless Canopy Connect and its service providers, as third party beneficiaries, from and against any damages, losses, liabilities, settlements and expenses (including without limitation costs and attorneys’ fees) in connection with any claim or action that arises from an alleged violation of the Intended Use or from your use of Prefill Services. Although Canopy Connect has no obligation to monitor your use of the Prefill Services, Canopy Connect may do so and may prohibit any use of the Prefill Services it believes may be (or alleged to be) in violation of this Addendum.
2.9 Export. You shall not remove or export from the United States or allow the export or re-export of the Prefill Services, Licensed Data, End User Data or anything related thereto, or any direct product thereof in violation of any restrictions, laws or regulations of the United States Department of Commerce, the United States Department of Treasury Office of Foreign Assets Control, or any other United States or foreign agency or authority.
3.0 Your Responsibility
You represent, covenant, and warrant that: (a) you will not use the Prefill Services, in connection with: (i) any individual reference service application, skip tracing, electronic directory assistance or other e-data look-ups; (ii) employment or a review of employee records, including without limitation for evaluating an individual for employment or for promotions, reassignment, or retention as an employee; (iii) a determination of an individual’s eligibility for a license or other benefit granted by a governmental instrumentality; or (iv) any other type of review, analysis, or assessment of an individual record that is not expressly permitted hereunder, or in connection with credit granting, credit monitoring, account review, collection, or insurance underwriting, or for any other purpose covered by the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq. (“FCRA”)), Federal Trade Commission or Consumer Financial Protection Bureau interpretations of the FCRA, and/or similar federal and state statute; and (b) the Licensed Data and Prefill Services will be used only within the United States and its territories.
4.0 Warranty Disclaimer
TO THE MAXIMUM EXTENT ALLOWABLE BY APPLICABLE LAW, THE PREFILL SERVICES AND LICENSED DATA ARE PROVIDED ON AN “AS IS” BASIS AND CANOPY CONNECT AND ITS DATA PROVIDERS AND SUPPLIERS HEREBY DISCLAIM ANY AND ALL OTHER PROMISES, GUARANTEES AND WARRANTIES WHETHER EXPRESS OR IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES REGARDING ACCURACY, CORRECTNESS, COMPLETENESS, CURRENTNESS, MERCHANTABILITY, TITLE, NON-INFRINGEMENT OR FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL CANOPY CONNECT OR ITS DATA PROVIDERS AND SUPPLIERS BE LIABLE TO YOU OR ANY PERSON OR ENTITY CLAIMING THROUGH YOU FOR ANY LOSS OR INJURY RELATING TO, ARISING OUT OF, OR CAUSED IN WHOLE OR IN PART BY, ITS ACTS OR OMISSIONS, EVEN IF NEGLIGENT, RELATING TO THE ACCURACY, CORRECTNESS, COMPLETENESS, OR CURRENTNESS OF THE PREFILL SERVICES OR LICENSED DATA. You acknowledge the foregoing disclaimer and that every business decision involves assumption of a risk, and that neither Canopy Connect nor its data providers and suppliers underwrites that risk in any manner whatsoever.
5.0 Miscellaneous
In the event of a conflict with the Terms, the terms and conditions of this Addendum will govern
and prevail. Capitalized terms used in this Addendum and not otherwise defined will have the meanings ascribed to them in the Terms. All provisions of this Addendum which, by their nature, should survive termination, will remain in force in the event of this Addendum’s or the Terms’ termination or expiration.