National Center for Safety Initiatives LLC 8/15/2019

DocuSign Envelope ID.4F8A5C36-6108-4FB3-9B63-6018FD5692BB NATIONAL CENTER FOR SAFETY INITIATIVES END-USER AGREEMENT ADDENDUM A Access Security Requirements The parties acknowledge they must work together to protect the privacy of consumers. The following measures are designed to reduce unauthorized access of consumer reports. In accessing consumer information,End-User agrees to the following: 1. End-User will take reasonable procedures to protect its account number and password so that only key personnel employed by your company know this sensitive information,including not posting this information anywhere in the facility.End-User agrees to request an account password change immediately if a person who knows the password leaves its company or no longer needs to have access due to a change in duties. 2. End-User agrees that system access software,whether developed by your company or purchased from a third party vendor,will have End-User's account number and password"hidden"or embedded and be known only by supervisory personnel. End-User will assign each user of its system access software a unique logon password.If such system access software is replaced by different access software and therefore no longer is in use or, alternatively,the hardware upon which such system access software resides is no longer being used or is being disposed of,or if the password has been compromised or believed to be compromised in any way,End-User will change its password immediately. 3. End-User agrees it will not discuss its account number or password by telephone with any unknown caller,even if the caller claims to be an employee of Company 4. End-User will restrict the ability to obtain consumer information to a few key personnel. 5. End-User agrees to place all terminal devices used to obtain consumer information in a secure location within its facility so that unauthorized persons cannot easily access them. 6. End-User agrees it will turn off and lock all devices or systems used to obtain consumer information. 7. End-User will secure hard copies and electronic files of consumer reports within its facility so that unauthorized persons cannot easily access them. 8. End-User agrees to shred and/or destroy all hard copy consumer reports when they are no longer needed and erase and overwrite or scramble electronic files containing consumer information when no longer needed and when applicable regulation(s)permit destruction. 9. End-User agrees to notify its employees that End-User can access credit information only for the permissible purposes listed in the Fair Credit Reporting Act. APPENDIX A