Code Of Conduct

Bureau’s Obligations In Respect Of Information

4.1 The Bureau shall ensure that all necessary precautions are taken to ensure that all Information received or collected by the Bureau is:

4.1.1 properly and accurately recorded, maintained, collated, synthesised and/or processed;

4.1.2 protected against loss;

4.1.3 protected against unauthorised access, use, modification or disclosure;

4.1.4 (except for Received Information provided by Members or any Data obtained from public records) from reputable sources which take responsibility for the accuracy, completeness and currency of the Information provided by them to the Bureau; and

4.1.5 in respect of all updates of information and data received or collected on each Individual, updated in all Credit Reports issued from the next Business Day after the date of receipt or collection by the Bureau (unless the Bureau has reasonable grounds for doubting the accuracy of such updates and is in the process of verifying the same and provided always that all Credit Reports generated in respect of the relevant Individual during such period of verification shall contain a cautionary note to the effect that Information on the relevant Individual is under investigation and shall indicate the disputed item(s) under investigation).

4.2 The Bureau shall ensure that it provides no Information to any person or entity except that it may:

4.2.1 provide a Credit Report on a natural person to any Member who so enquires provided always that such enquiry shall be made by a Member who asserts that it is made for a Relevant Purpose and in respect of a natural person who is –

4.2.1.1 a Customer of (or has applied for credit facilities from) such Member; or

4.2.1.2 a surety of a Customer of (or a surety of a party who has applied for credit facilities from) such Member, regardless of whether such Customer or party be a natural person, an unincorporated entity, a corporate entity or any other entity;

4.2.2 provide a Rectification Notice in accordance with the provisions of Clause 8 to Members who appear on the Previous Enquiry Record during the relevant period in the event of a rectification of the Credit File of the relevant Individual;

4.2.3 notify a Member who has requested such notification service (hereinafter referred to as the “Requesting Member”) when another Member (hereinafter referred to as the “Other Member”) requests a Credit Report in respect of a natural person identified to the Bureau by the Requesting Member (hereinafter referred to as the “Identified Individual”). For the purposes of this sub-clause:-

4.2.3.1 the notification shall include the information on such Identified Individual disclosed in the Other Member’s request for a Credit Report; and

4.2.3.2 an Identified Individual must be a natural person in respect of whom the Requesting Member is entitled to request a Credit Report pursuant to Clause 5.1; and

4.2.4 make such disclosure as may be required in accordance with law.

4.3 Without prejudice to the generality of Clauses 4.1 and 4.2, the Bureau shall take measures, including the following, to safeguard the security of Information:

4.3.1 establishment of controls and procedures to be applied when Members seek access to Credit Reports;

4.3.2 maintenance of logs of all accesses, amendments and audit trails to Information database (including Previous Enquiry Records and logs of all incidents involving proven or suspected breach(es) of security which contain particulars of the records affected and explanation(s) of the circumstance(s) and action(s) taken);

4.3.3 review, on a regular basis, of password controls of all Bureau personnel and Members;

4.3.4 review, on a regular basis, of patterns of usage of the information systems, with a view to detecting and investigating any unusual or irregular patterns of access or use;

4.3.5 organisation of workshops in relation to the Code and, in particular, good security practice for attendance by authorised representatives of Members;

4.3.6 development of operational guidelines and disciplinary and contractual procedures to be applied in relation to improper use of access authorities by Bureau personnel, authorised agents and/or Members and/or persons authorised by them; and

4.3.7 development of operational guidelines to ensure adequate protection to minimise the risk of unauthorised entry into the database or interception of communications made to and from the database.

4.4 The Bureau takes no responsibility for any errors or inaccuracies in the Data arising from the Data being obtained by the Bureau containing the same errors or inaccuracies.

4.5 Without prejudice to the generality of Clauses 4.1 and 4.2, the Bureau may collect, assess, collate, synthesize, process, edit, re-sort and/or combine Data (or any part thereof) in such manner as it thinks fit so as to generate Credit Reports.

4.6 Without prejudice to the generality of Clauses 4.1 and 4.2, Information held by the Bureau may be retained by it and used for the development of derivative products for Members such as score cards, behavioural predictive models and similar products provided that it shall not thereby reveal the identity of any Customer and/or Member.

4.7 The Bureau shall ensure that Data is retained and displayed for the relevant periods as indicated in the specimen Credit Report set out in Appendix 2.

4.8 Data which is obtained from Received Information shall be required to be retained and displayed by the Bureau only so long as required:

4.8.1 pursuant to the relevant periods for retention and display as indicated in the specimen Credit Report set out in Appendix 2; or

4.8.2 for the purposes of preparing and providing a Truncated Credit Report (whether or not such a Truncated Credit Report has been requested), and the Bureau shall ensure that any part of such Data which is obtained from Received Information shall be deleted without the ability to be retrieved within the first Business Day after the same ceases to be so required.