Amended and Restated TransUnion Master Agreement for Consumer Reporting and Ancillary Services, dated November 25, 2020, between Upstart Network, Inc. and TransUnion LLC

Scope of Agreement. This Agreement applies to any of those information services which Subscriber may desire to receive from TransUnion and which TransUnion offers to Subscriber. Such information services shall herein be collectively referred to as “Services” and all information derived therefrom shall be collectively referred to as “Services Information”.

Subscriber’s Business. Subscriber certifies that the nature of Subscriber’s business is as described by Subscriber in Subscriber’s customer membership materials. Subscriber certifies that Subscriber is not a telephone solicitor doing business in Massachusetts or Connecticut and using the data provided by TransUnion for the initiation of a telephone call or message to encourage the purchase or rental of, or investment in, property, goods or services, that is transmitted to a consumer.

Consumer Reporting Services.

Consumer Report Information. TransUnion makes certain consumer report information services from its consumer reporting database (“Consumer Report Information”) available to its customers who have a permissible purpose for receiving such information in accordance with the Fair Credit Reporting Act (15 U.S.C. §1681 et seq.) including, without limitation, all amendments thereto (“FCRA”).

FCRA Penalties. THE FCRA PROVIDES THAT ANY PERSON WHO KNOWINGLY AND WILLFULLY OBTAINS INFORMATION ON A CONSUMER FROM A CONSUMER REPORTING AGENCY UNDER FALSE PRETENSES SHALL BE FINED UNDER TITLE 18, OR IMPRISONED NOT MORE THAN TWO YEARS, OR BOTH.

Subscriber Certifications. Subscriber certifies that it shall request Consumer Report Information solely for Subscriber’s exclusive one-time use and use such information solely for the permissible purpose(s) set forth below in Sections 3.4 – 3.7, and for no other purpose, subject however, to the additional restrictions set forth herein. If requested by TransUnion, and in addition to the general certification set forth herein, Subscriber agrees to, and shall, individually certify the permissible purpose for each Consumer Report Information it requests. Such individual certification shall be made by Subscriber pursuant to instructions provided from time to time by TransUnion. For purposes of this Agreement, the term “adverse action” shall have the same meaning as that term is defined in the FCRA.

Certain information has been excluded from this agreement because it is both (i) not material and (ii) would be competitively harmful if publicly disclosed.

Consumer Report Information—Permissible Purpose(s):

In connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of the consumer.

In connection with the underwriting of insurance involving the consumer.

Pursuant to the written authorization of the consumer who is the subject of the Consumer Report Information. Subscriber certifies that each such written authorization will expressly authorize Subscriber to obtain the Consumer Report Information, and will contain at a minimum the subject’s name, address, social security number (where available) and signature. Subscriber further agrees to retain copies of all such written authorizations for a minimum of five (5) years from the date of inquiry, and make such written authorizations available to TransUnion upon request. Nothing in this certification, or elsewhere in this Agreement, is intended to allow Subscriber to purchase Consumer Report Information for the purpose of selling or giving the report, or information contained in or derived from it, to the subject of the report, or to any other third party, and Subscriber expressly agrees to refrain from such conduct.

For employment purposes, in which case Subscriber shall request only a TransUnion service expressly designed for employment purposes (“Employment Report”). Subscriber further certifies that it shall not request an Employment Report unless and subject to the following conditions:

A clear and conspicuous disclosure is first made in writing to the consumer before the Consumer Report Information is obtained, in a document that consists solely of the disclosure, that a consumer report may be obtained for employment purposes;

The consumer has authorized in writing the procurement of the Employment Report;

Information from the Employment Report will not be used in violation of any applicable federal or state equal employment opportunity law or regulation;

The Employment Report will only be used once; and,

Before taking adverse action in whole or in part based on the Employment Report, Subscriber shall provide the consumer with a copy of the Employment Report and shall provide the consumer with a copy of the consumer’s rights, in the format approved by the Consumer Financial Protection Bureau (“CFPB”), which form notice shall be supplied to Subscriber by TransUnion either with each report, or one time in print format, in which case Subscriber agrees to duplicate and provide said form notice to the consumer as required hereunder.

To use the Consumer Report Information as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of, the credit or prepayment risks associated with an existing credit obligation.

To use the Consumer Report Information in connection with Subscriber’s legitimate business need for the information in connection with a business transaction that is initiated by a consumer.

To use the Consumer Report Information in connection with Subscriber’s legitimate business need for the information to review an account to determine whether the consumer continues to meet the terms of the account.

To use the Consumer Report Information in connection with a determination of the consumer’s eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant’s financial responsibility or status.

Subscriber is the head of a state or local child support enforcement agency (or state or local government official authorized by the head of such an agency), and on each request the Subscriber certifies that:

The Consumer Report Information is needed for the purpose of establishing an individual’s capacity to make child support payments or determining the appropriate level of such payments;

The paternity of the consumer for the child to which the obligation relates has been established or acknowledged by the consumer in accordance with state laws under which the obligation arises (if required by those laws);

The Subscriber has provided at least 10 days’ prior notice to the consumer whose report is requested, by certified or registered mail to the last known address of the consumer, that the report will be requested; and,

The Consumer Report Information will be kept confidential, will be used solely for a purpose described in subparagraph (A) above, and will not be used in connection with any other civil, administrative, or criminal proceeding, or for any other purpose;

Subscriber is an agency administering a state plan under Section 454 of the Social Security Act (42 U.S.C. 654) and will use the information to set an initial or modified child support award.

Account Review/Account Monitoring Certification. In the event that Subscriber requests Consumer Report Information for account review or monitoring purposes, whether batch or on-line, Subscriber shall make such requests solely for review or monitoring of Subscriber’s own open accounts and/or closed accounts with balances owing, and for no other purpose. Subscriber shall notify TransUnion in a mutually acceptable format of the review or monitoring methods and criteria desired, and of any desired changes to or deletion of any individual monitoring set, and shall delete individual monitoring sets on any consumers if Subscriber ceases to have a permissible purpose to receive Consumer Report Information on such consumers. When Subscriber requests information as a potential investor or servicer, or current insurer, in connection with a valuation of or an assessment of the credit or prepayment risks associated with an existing credit obligation (“Valuation Account Reviews”), Subscriber shall first obtain the prior written consent of the current account owner or servicer of such accounts and make a copy of such consent available to TransUnion.

Prescreening Certifications. Provided that Subscriber meets all TransUnion reporting requirements for prescreening customers as may be established by TransUnion from time to time, TransUnion, upon request by Subscriber, agrees to extract names from TransUnion’s central computer file of credit information, or to screen names of individuals contained on a base list mutually acceptable to TransUnion and Subscriber, in accordance with selection criteria as specified by Subscriber and acceptable to TransUnion (“Prescreen Services”). Prescreen Services may include scores, attributes and/or other appends as mutually agreed. Each such request for prescreened names, including, but not limited to, such criteria associated with each such request, is hereby incorporated into this Agreement by reference.

Format and Delivery. TransUnion shall supply, and deliver to Subscriber, such Prescreen Services in the form of prescreened lists (“Prescreened Lists”), in a mutually agreed upon format. TransUnion will be responsible for the computer programming of the selection criteria specified by Subscriber.

Third Party Processors. Subscriber shall notify TransUnion, in writing, whether it intends to have a designated third party processor (“Processor”) perform further processing of Prescreened Lists to further refine the selection. Upon such notification, TransUnion shall deliver such Prescreened Lists to Subscriber’s designated Processor provided said Processor has been approved by TransUnion and has executed an agreement for processing with TransUnion. Subscriber shall so notify TransUnion in writing in conjunction with each prescreen request as to whether Subscriber intends to so utilize Processor. Subscriber certifies that neither the criteria used to select the names nor the tape nor media layout description of the attributes will be disclosed by Subscriber to Processor. Subscriber certifies that it will not request or receive from Processor any names of consumers other than those to which it will make a firm offer of credit or insurance, as defined by the FCRA (“Firm Offer”). Moreover, Subscriber shall require that Processor provide to TransUnion, in a mutually agreed upon format, clearly labeled media identifying all consumers on such refined Prescreened List so that TransUnion can post inquiries to its files on such consumers as required by law. Subscriber shall require that Processor provide such media to TransUnion upon completion of such further processing but in no event later than seventy-five (75) days after Processor’s receipt of the media from TransUnion.

Subscriber Solicitation and Use of the Prescreened Lists. Except as otherwise mutually agreed, Subscriber will be responsible for preparation of solicitation materials and all other communications to be made with prescreened individuals. Subscriber hereby certifies that it will extend a Firm Offer of credit or insurance to each and every individual named on the Prescreened List, or Processor-refined Prescreened List, and that such offer will not be withdrawn or withheld after the offer is made, except as permitted by the FCRA. Subscriber further agrees to make available to TransUnion upon request a sample or draft of the mail piece or telemarketing script in which the Firm Offer will be made, and TransUnion may refuse to provide Prescreened Lists if TransUnion has a good faith belief that the proposed offer is not a Firm Offer of credit or insurance. However, notwithstanding this right to review the mail piece or script, TransUnion shall have no liability for failure of such mail piece or script to comply with applicable law, including, but not limited to, the FCRA.

One Time Use. All information received from Prescreened Services is for Subscriber’s exclusive one-time use. Such information shall not be revealed or made available, in whole or in part, to any person except employees of Subscriber or Processor who have a need to know as expressly authorized under this Agreement. In no event shall the Prescreened Services be used for the processing of credit applications or underwriting insurance in the normal course of business. Except solely to the extent necessary to utilize such Prescreened Lists pursuant to the terms and conditions of this Agreement, Subscriber shall not copy the Prescreened Lists, or any portion thereof, without TransUnion’s prior written consent, nor grant any other person or entity the right to do so. Moreover, Subscriber is not granted any ownership rights or title to the Prescreened Lists nor to any information contained in any and all such Prescreened Lists.

Instant Decision Processing. TransUnion offers a suite of automated instant decision processing tools that: (i) determine whether a consumer qualifies for requested products or service, made available subject to the permissible certifications in Section 3.4, above; (ii) reviews existing customers for possible action on an account, made available subject to Section 3.5, above; or, (iii) performs a prescreen of an individual’s consumer credit file against pre-determined credit criteria, made available subject to Section 3.6, above (collectively, “Instant Decision Processing”). When a Subscriber desires to receive any Instant Decision Processing services, the delivery specifications and decision criteria shall be set forth in a separate written Schedule to be attached thereto.

TransUnion has developed a service that allows its customers electing Instant Decision Processing services to retrieve, through the Internet, the instant decision screen and Consumer Report Information, if applicable, generated as a result of a previously processed instant credit decision transaction (“Previous Instant Credit Decision”). Consumer Report Information will be limited for decisions relating to prescreening.

California Certification. If Subscriber is a retailer who uses Consumer Report Information in connection with in-person credit applications, subject to the California Consumer Credit Reporting Agencies Act and all amendments thereto, then Subscriber shall instruct its employees responsible for receiving in-person credit applications from California consumers, including point of sale applications, to inspect the applicant’s photo identification prior to requesting Consumer Report Information. Subscriber shall identify to TransUnion, either by subscriber code or by flag on the affected inquiry when it requests Consumer Report Information for an in-person credit application.

Vermont Certification. Subscriber agrees to comply with Vermont law when requesting a consumer report on a Vermont resident. Subscriber expressly agrees to obtain the consumer’s consent before requesting a consumer report to the extent and in the manner required by Vermont law.

Ancillary Services.

Fraud Prevention Services. TransUnion offers several fraud prevention services that evaluate inquiry input elements against other input elements and/or against proprietary databases to identify potential discrepancies and/or inaccuracies. Fraud prevention service messages may be delivered with Consumer Report Information as a convenience, but are not part of a consumer’s file nor are they intended to be consumer reports. In the event Subscriber obtains any fraud prevention services from TransUnion in conjunction with Consumer Report Information or as a stand-alone service, Subscriber shall not use the fraud prevention services, in whole or in part, as a factor in establishing an individual’s creditworthiness or eligibility for credit, insurance, employment, or for any other purposes under the FCRA. Moreover, Subscriber shall not take any adverse action against any consumer that is based in whole or in part on the fraud prevention services. As a result of information obtained from the fraud prevention services, it is understood that Subscriber may choose to obtain additional information from one or more additional independent sources. Any action or decision as to any individual, which is taken or made by Subscriber based solely on such additional information obtained from such additional independent source(s) shall not be deemed prohibited by this paragraph.

Reference Services.

TransUnion offers a suite of reference services from sources other than its Consumer Reporting Database (“Non-CRD Reference Services”), which it may make available to Subscriber under the terms of this Agreement. Subscriber shall not use Non-CRD Reference Services for marketing purposes without the prior written consent of TransUnion.

TransUnion also offers the suite of reference services from its Consumer Reporting Database (“CRD Reference Services”). If Subscriber desires to receive CRD Reference Services, Subscriber hereby certifies that the specific purpose(s) for which the CRD Reference Services will be requested, obtained and used by Subscriber is one or more of the following uses as described in, and as may be interpreted from time to time, by competent legislative, regulatory or judicial authority, and as being encompassed by Section (6802)(e) of the Gramm-Leach-Bliley Act, Title V, Subtitle A, Financial Privacy (15 U.S.C. § 6801-6809) (“GLB”) and the United States Federal Trade Commission rules promulgated thereunder. Subscriber shall not request, obtain or use such CRD Reference Services for any other purpose.

As necessary to effect, administer, or enforce a transaction requested or authorized by the consumer, or in connection with servicing or processing a financial product or service requested or authorized by the consumer;

As necessary to effect, administer, or enforce a transaction requested or authorized by the consumer, or in connection with maintaining or servicing the consumer’s account with Subscriber and Subscriber is a financial institution;

With the consent or at the direction of the consumer;

To protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability;

For use solely in conjunction with a legal or beneficial interest held by Subscriber and relating to the consumer; or,

For use solely in Subscriber’s fiduciary or representative capacity on behalf of the consumer.

For purposes of this Agreement, the term “Reference Services” shall be deemed to include both Non-CRD Reference Services and CRD Reference Services. Subscriber shall not take any adverse action against any consumer that is based in whole or in part on the Reference Services.

Depersonalized Data Services. From time to time, Subscriber may desire to obtain depersonalized data (“Data Services”) identified in a Data Services request form or other mutually agreed upon document signed by an authorized representative of Subscriber (“Data Services Request” or “DSR”).Subscriber represents and warrants that Subscriber shall use any and all Data Services received pursuant to this Agreement solely for one or more of the following purposes:

Determination of the validity of an existing risk score model or of certain data attributes, when such model or attributes will be used in conjunction with the evaluation of consumer credit information received and used under this Agreement;

Building Subscriber’s own consumer credit information-based model which model shall be used solely in conjunction with the evaluation of consumer credit information received and used under this Agreement;

Review and validation of Subscriber’s policies relating to credit eligibility or any other permissible purpose under the FCRA, which policies Subscriber shall use in conjunction with evaluating consumer credit information received and used under this Agreement;

Determination of the qualitative value of consumer credit information TransUnion provides under this Agreement; or,

Other appropriate purpose as agreed to by TransUnion and Subscriber in an applicable DSR.

Subscriber shall not use Data Services for any other purpose and shall take no action as to any individual consumer as the result of the Data Services received under this Agreement. With respect to each request for Data Services, Subscriber represents and warrants that: (i) it does not have the ability to match the Data Services to the identity of any consumer; (ii) it shall make no attempt to obtain data permitting it to match the Data Services to the identity of any consumer; (iii) it will not accept any information from any third party that permits such a match; and, (iv) it will make no such match.

TransUnion Scores. Subscriber may request, in writing, that TransUnion provide TransUnion Scores to Subscriber, which shall include the Vantage Score, in connection with the delivery of a consumer report obtained hereunder or in connection with the delivery of Data Services under Section 4.3. TransUnion agrees to perform such processing as reasonably practicable. Subscriber shall use TransUnion Scores provided in connection with the delivery of a consumer report only in accordance with its permissible purpose under the FCRA certified at the time of its request for such TransUnion Scores. Subscriber will request Scores only for Subscriber’s exclusive use. Subscriber may store Scores solely for Subscriber’s own use in furtherance of Subscriber’s original purpose for obtaining the Scores

Adverse Action Factors. Subscriber recognizes that factors other than the TransUnion Score may be considered in making a decision as to a consumer. Such other factors include, but are not limited to, the credit report, the individual account history, application information, and economic factors. TransUnion may provide score reason codes to Subscriber, which are designed to indicate the principal factors that contributed to the TransUnion Score, and may be disclosed to consumers as the reasons for taking adverse action, as required by the Equal Credit Opportunity Act (“ECOA”) and its implementing Regulation (“Reg. B”). The TransUnion Score itself, when accompanied by the corresponding reason codes, may also be disclosed to the consumer who is the subject of the TransUnion Score. However, the TransUnion Score itself may not be used as the reason for adverse action under Reg. B.

Use of TransUnion Scores for Model Development or Model Calibration. TransUnion Scores, including the Vantage Score, obtained in conjunction with Data Services under Section 4.3 for the purpose of model development or model calibration, may be used for model development or model calibration in compliance with the following conditions: (i) the Scores may only be used as an independent variable in custom models; (ii) only the raw depersonalized Score and Score segment identifier may be used in modeling (i.e. no other Score information may be used, including, but not limited to, adverse action reasons, documentation, or scorecards may be used); and, (iii) Subscriber’s depersonalized analytics and/or depersonalized third party modeling analytics performed on behalf of Subscriber, using Scores, will be kept confidential and not disclosed to any third party except to: (a) Subscriber’s third party processing agents and other contractors of Subscriber who have executed an agreement that limits the use of the Scores by the third party only to the use permitted to Subscriber and contains the prohibitions set forth herein regarding model development, model calibration, reverse engineering and confidentiality; (b) to governmental regulatory agencies; and/or, (c) as required by law. In no event may Subscriber reverse engineer the TransUnion Scores.

Confidentiality of TransUnion Scores. The TransUnion Score is proprietary to TransUnion and shall not be disclosed to any other third party without TransUnion’s prior written consent, except as expressly permitted herein or where clearly required by law. All TransUnion Scores provided hereunder will be held in strict confidence and may never be sold, licensed, copied, reused, or reproduced, and may never be disclosed, revealed or made accessible, in whole or in part, to any Person, except: (i) to those employees of Subscriber with a need to know and in the course of their employment; (ii) to those third party processing agents and other contractors of Subscriber who have a need to know in connection with Subscriber’s use of the TransUnion Scores as permitted hereunder and who have executed a written agreement that limits the use of the TransUnion Scores by the third party only to the use permitted to Subscriber and contains the prohibitions set forth herein regarding model development, model calibration, reverse engineering and confidentiality; (iii) when accompanied by the corresponding reason codes, to the consumer who is the subject of the score, when in connection with an adverse action notice; (iv) to governmental regulatory agencies; (v) to ratings agencies, dealers, investors and other third parties for the purpose of evaluating assets or investments (e.g., securities) containing or based on obligations of the consumers to which the Scores apply (e.g., mortgages, student loans, auto loans, credit cards), provided that (a) Subscriber may disclose Scores only in aggregated formats (e.g., averages and comparative groupings) that do not reveal individual Scores, (b) Subscriber shall not provide any information that would enable a recipient to identify the individuals to whom the Scores apply, and (c) Subscriber shall enter into an agreement with each recipient that limits the use of the Scores to evaluation of such assets or investments; or, (vi) as required by law. Subscriber shall not, nor permit any third party to, publicly disseminate any results of the validations and/or other reports derived from the TransUnion Scores without TransUnion’s prior written consent. For the purpose of this Section 4.4.3, “Person” shall mean an individual, a partnership, a corporation, a limited liability company, a trust, a joint venture, an unincorporated organization and any Government Authority. For the purpose of this Section 4.4.3, “Government Authority” means any national, provincial, state, municipal, local or foreign government, ministry, department, commission, board, bureau, agency, authority, instrumentality, unit, or taxing authority thereof.

Predictive Triggers Models. TransUnion’s Predictive Triggers Models may be made available to Subscriber in conjunction with Subscriber’s Prescreen and Account Review requests. Subscriber hereby represents and warrants that when Subscriber requests Predictive Triggers Models in conjunction with its Account Review requests, Subscriber shall not use Predictive Triggers Models, nor any information derived therefrom: (i) to take any adverse action as to any individual consumer; or, (ii) for any other reason including, but not limited to, in connection with the collection of an account.

TransUnion Score Performance. Certain TransUnion Scores are implemented with standard minimum exclusion criteria. TransUnion shall not be liable to Subscriber for any claim, injury, or damage suffered directly or indirectly by Subscriber as a result of any Subscriber requested changes to the exclusion criteria which result in normally excluded records being scored by such TransUnion Scores. TransUnion warrants that the scoring algorithms used in the computation of the scoring services provided under this Agreement (“Models”), are empirically derived from credit data and are a demonstrably and statistically sound method of rank-ordering candidate records with respect to the purpose of the TransUnion Scores when applied to the population for which they were developed, and that no scoring algorithm used by a TransUnion Score uses a “prohibited basis” as defined in ECOA and Reg. B promulgated thereunder. The TransUnion Score may appear on a credit report for convenience only, but is not a part of the credit report nor does it add to the information in the report on which it is based.

Third Party Scores and Other Third Party Services. TransUnion has the capability to offer certain non-TransUnion owned scores derived from models built jointly with third parties, and other services provided by third parties, which are subject to separate warranties offered or terms imposed by such third parties. If desired by Subscriber, such third party scores and services shall be made available pursuant to a separate agreement or pursuant to an addendum or Exhibit to this Agreement. For the avoidance of doubt, those Fair Isaac Scores provided by TransUnion to Subscriber pursuant to Exhibit B are third party scores and do not constitute TransUnion-owned Services.

OFAC Name Screen. TransUnion, as a stand-alone service, in conjunction with Consumer Report Information or as an append to an ancillary service, has the capability to offer an indicator in the event a consumer’s name, as supplied by Subscriber to TransUnion on input and not as may be found on TransUnion’s database(s), appears on the United States Department of Treasury Office of Foreign Asset Control File (“OFAC File”). In the event Subscriber obtains OFAC Name Screen services from TransUnion in conjunction with Consumer Report Information or as an append to an ancillary service, Subscriber shall be solely responsible for taking any action that may be required by federal law as a result of a potential match to the OFAC File, and shall not deny or otherwise take any adverse action against any consumer which is based, in whole or in part, on TransUnion’s OFAC Name Screen services.

Additional Terms and Conditions.

Confidentiality. Subscriber shall hold all Services Information in confidence and shall not disclose such information, in whole or in part, to any person except: (i) as required by law (e.g., an order of a court or data request from an administrative or governmental agency with competent jurisdiction) to be disclosed; provided however, that Subscriber shall provide TransUnion with ten (10) days prior written notice before the disclosure of such information pursuant to this Paragraph 5.1; (ii) its employees that have a need to know in connection with its use of the Services Information as permitted under this Agreement; or, (iii) its authorized agents who have a need to know in connection with its use of the Services Information as permitted under this Agreement and who are bound by written obligations sufficient to limit use of such Services Information strictly for Subscriber’s benefit in accordance with the use and other restrictions contained in this Agreement. However, none of the foregoing restrictions shall prohibit Subscriber from disclosing to the subject of the Consumer Report Information, who is the subject of an adverse action, the content of the Consumer Report Information as it relates to any such adverse action. The forgoing obligations of confidentiality with respect to Services Information shall in all instances prevail over contrary or less stringent obligations of confidentiality entered between the parties.

Safeguards. Each party shall implement, and shall take measures to maintain, reasonable and appropriate administrative, technical, and physical security safeguards (“Safeguards”) designed to: (i) insure the security and confidentiality of non-public personal information; (ii) protect against anticipated threats or hazards to the security or integrity of non-public personal information; and, (iii) protect against unauthorized access or use of non-public personal information that could result in substantial harm or inconvenience to any consumer. When a consumer’s first name or first initial and last name is used in combination with both: (i) a social security number, driver’s license or identification card number, or account number, credit or debit card number, and, (ii) any required security code, access code, or password that would permit access to an individual’s financial account (“Personal Information”), and such combined information is delivered to Subscriber unencrypted, Subscriber shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information and to protect the Personal Information from unauthorized access, destruction, use, modification, or disclosure including without limitation, ensuring any Subscriber intentional deletion, destruction and/or disposal of Personal Information (whether in paper, electronic, or any other form, and regardless of medium on which such Personal Information is stored) is performed in a manner so as to reasonably prevent its misappropriation or other unauthorized use including, but not limited to, cross-shredding printed information and pulverizing or incinerating tapes, disks and other such non-paper media.

Authorized Requests. Subscriber shall use the Services and Services Information: (i) solely for the Subscriber’s certified use(s); (ii) solely for Subscriber’s exclusive one-time use; and, (iii) subject to the terms and conditions of this Agreement. Subscriber shall not request, obtain or use Services for any other purpose including, but not limited to, for the purpose of selling, leasing, renting or otherwise providing information obtained under this Agreement to any other party, whether alone, in conjunction with Subscriber’s own data, or otherwise in any service which is derived from the Services. Services shall be requested by, and Services Information shall only disclosed by Subscriber to, Subscriber’s designated and authorized employees and agents having a need to know and only to the extent necessary to enable Subscriber to use the Services and Services Information in accordance with this Agreement, and, with respect to agents, only those who are bound by written obligations sufficient to limit use of such Services and Services Information strictly for Subscriber’s benefit in accordance with the use and other restrictions contained in this Agreement. Subscriber shall ensure that such Subscriber designated and authorized employees and agents shall not attempt to obtain any Services on themselves, associates, or any other person except in the exercise of their official duties.

Rights to Services. Subscriber shall not attempt, directly or indirectly, to reverse engineer, decompile, or disassemble Services and Services Information, or any confidential or proprietary criteria developed or used by TransUnion relating to the Services provided under this Agreement. Except as explicitly set forth in this Agreement the entire right, title and interest in and to the Services and all copyrights, patents, trade secrets, trademarks, trade names, and all other intellectual property rights associated with any and all ideas, concepts, techniques, inventions, processes, or works of authorship including, but not limited to, all materials in written or other tangible form developed or created by TransUnion in its performance of the Services, shall at all times vest exclusively in TransUnion. TransUnion reserves all rights not explicitly granted to Subscriber under this Agreement. Subscriber acknowledges that any misappropriation or threatened misappropriation of TransUnion’s rights in and to the Services and other TransUnion intellectual property, or any breach or threatened breach of the foregoing restrictions, may cause immediate and irreparable injury to TransUnion, and in such event, TransUnion shall be entitled to seek injunctive relief, without the necessity to post bond, in addition to any and all other remedies available at law or in equity. Nothing stated herein will be construed to limit any other remedies available to TransUnion under this Agreement including, but not limited to suspension and/or termination.

Compliance with Laws. Each party hereto shall be responsible for its own compliance with all applicable federal and state legislation, regulations and judicial actions, including, but not limited to, FCRA, GLBA and all other applicable privacy laws, “do not call” laws, the Drivers Privacy Protection Act (18 U.S.C. Section 2721 et seq.) and similar and/or associated state laws and regulations governing the use and disclosure of drivers’ license information, as now or as may become effective, to which it is subject. Changes in the performance of TransUnion’s obligations under this Agreement necessitated by TransUnion’s good faith interpretations of any applicable law, regulation, judicial or regulatory action or license rights, shall not constitute a breach of this Agreement.

Fees and Payments. Subscriber agrees to pay the fees and charges for Services provided to Subscriber under this Agreement. Such pricing is hereby incorporated into this Agreement by reference. Any periodic and/or minimum Subscriber fees under this Agreement are non-refundable, in whole or in part, in the event of a termination of this Agreement. TransUnion reserves the right to change the fees and charges from time to time, but no change in such charges shall become effective as to the Subscriber earlier than thirty (30) days after written notice thereof shall have been given by TransUnion to Subscriber. Subscriber shall also pay all the cost of all media, media shipping, and insurance costs, taxes, duties and/or other charges of any kind imposed by any federal, state, or local governmental entity for the Services, Services Information, or both, provided under this Agreement. However, Subscriber shall not be responsible for taxes imposed upon TransUnion by any federal, state or local authority against the gross income of TransUnion.

In addition, in the event that TransUnion’s cost of rendering Services increases as a result of federal, state or local laws, ordinances or other regulatory, administrative or governmental acts, then TransUnion may implement a surcharge subject to the following: (i) any surcharge will be applicable generally to TransUnion’s customers; (ii) TransUnion will provide sixty (60) days prior written notice to Subscriber prior to implementing any new surcharge; and, (iii) any surcharge will be applied only to products and services pertaining to consumers in the geographic area affected by the law, ordinance or other regulatory, administrative or governmental ordinance or other regulatory, administrative or governmental act. A legislative surcharge is imposed on certain types of reports pertaining to consumers residing in the United States, and an additional surcharge is imposed on certain reports pertaining to only Colorado residents.

TransUnion shall provide invoices to Subscriber and Subscriber shall pay such invoices within thirty (30) days of the invoice date. Without limiting any of TransUnion’s remedies for non-payment or late payment of invoices, invoices which are not paid within sixty (60) days of the invoice date shall be subject to a late charge of one and one-half percent (1.5%) per month (18% per year) or the maximum allowed by law, whichever is less. If collection efforts are required, Subscriber shall pay all costs of collection, including reasonable attorneys’ fees.

Term, Termination and Survival. The term of this Agreement shall commence upon the Effective Date and shall remain in effect until terminated by any party hereto for any reason whatsoever by providing thirty (30) days prior written notification to the other party. Moreover, without limiting any other remedies to which either party may be entitled, if a party, in good faith, determines that the other party has materially breached any of its obligations under this Agreement, such party shall provide written notice to the other party of such determination. The breaching party shall have thirty (30) days to cure any alleged breach, provided that such breach is curable. If the breaching party fails to cure within thirty (30) days of receiving such written notice or if such breach is not curable, the non-breaching party shall have the right to immediately suspend its performance, in whole or in part, under this Agreement, immediately terminate this Agreement, or both.

The foregoing notwithstanding, TransUnion reserves the right, at TransUnion’s sole option, to immediately suspend its performance, in whole or in part, under this Agreement, or immediately terminate this Agreement, if TransUnion, in good faith and in its sole discretion, determines that: (i) the requirements of any law, regulations and/or judicial action have not been met; (ii) as a result of any new, or changes in existing, laws, regulations, and/or judicial actions, that the requirements of any law, regulation and/or judicial action will not be met; (iii) the use of the Services is the subject of litigation or threatened litigation by any governmental agency; (iv) any product, process, or both, including, without limitation, any software, information, data, or other material, as well as any intellectual property rights embodied by any or all of the foregoing (whether licensed to, owned by, or otherwise controlled by, TransUnion), and necessary (as reasonably demonstrated by TransUnion) for the provision of the Services to Subscriber is/are enjoined, likely to be enjoined (in TransUnion’s counsel’s written opinion), or the licenses thereto is/are otherwise terminated by the licensing entity; and/or, (v) any combination of the foregoing.

With the exception of TransUnion’s obligation, if any, to provide Services under this Agreement, all provisions of this Agreement shall survive any such termination of this Agreement including, but not limited to, all restrictions on Subscriber’s use of Services Information. Moreover, any such termination shall not relieve Subscriber of any fees or other payments due to TransUnion through the date of any such termination nor affect any rights, duties or obligations of either party that accrue prior to the effective date of any such termination.

Warranty.

TransUnion Limited Warranty. TransUnion represents and warrants that the Services will be provided in a professional and workmanlike manner consistent with industry standards. In the event of any breach of this warranty, TransUnion shall exercise commercially reasonable efforts to re-perform the applicable Services which are not in compliance with the above warranty, provided that: (i) TransUnion receives written notice of such breach within ten (10) days after performance of the applicable Services; and (ii) the Services are able to be re-performed. TransUnion, in the event it cannot re-perform such Services, shall refund the fees paid by Subscriber for the applicable Services which are not in compliance with the above warranty. SUBSCRIBER ACKNOWLEDGES AND AGREES THAT TRANSUNION’S SOLE AND EXCLUSIVE OBLIGATION, AND SUBSCRIBER’S SOLE AND EXCLUSIVE REMEDY, IN THE EVENT OF ANY BREACH OF THE FOREGOING WARRANTY IS AS SET FORTH IN THIS PARAGRAPH. TRANSUNION DOES NOT WARRANT THE SERVICES TO BE UNINTERRUPTED OR ERROR-FREE OR THAT THE SERVICES WILL MEET SUBSCRIBER’S REQUIREMENTS. THE WARRANTY SET FORTH IN THIS SECTION 5.8.1 IS IN LIEU OF ALL OTHER WARRANTIES, WHETHER STATUTORY, EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES THAT MIGHT BE IMPLIED FROM A COURSE OF PERFORMANCE OR DEALING OR TRADE USAGE OR WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. NO REPRESENTATIVE OF TRANSUNION IS AUTHORIZED TO GIVE ANY ADDITIONAL WARRANTY.

Subscriber represents and warrants that: (i) it has the authority to enter into and perform under this Agreement; (ii) it has the right to give to TransUnion the rights set forth in this Agreement; and, (iii) it has the right to provide any and all information including, but not limited to, data obtained from third parties, to TransUnion, and to allow TransUnion to provide the same to TransUnion’s subcontractors, for use in performance of the Services.

Indemnification for Intellectual Property Infringement. TransUnion, subject to the limitations of liability contained herein, will defend and indemnify Subscriber against a third party claim that any TransUnion-owned Services infringe a United States patent, copyright, trademark, trade secret or other United States intellectual property rights of a third party, provided that: (i) Subscriber gives TransUnion prompt written notice of any such claim of which it has knowledge; (ii) TransUnion is given full control over the defense of such claim and all related settlement negotiations; and, (iii) Subscriber provides TransUnion with the assistance, information and authority necessary to perform TransUnion’s obligations under this paragraph. Reasonable out-of-pocket expenses incurred by Subscriber in providing such assistance will be reimbursed by TransUnion.

Limitation of Liability. TRANSUNION’S SOLE LIABILITY, AND SUBSCRIBER’S SOLE REMEDY, FOR BREACHES OF THIS AGREEMENT BY TRANSUNION ARISING FROM TRANSUNION’S NEGLIGENCE SHALL BE THE CORRECTION OF ANY DEFECTIVE SERVICE OR THE REFUND OF FEES PAID FOR SAME. SUBSCRIBER’S SOLE LIABILITY, AND TRANSUNION’S SOLE REMEDY, FOR BREACHES OF THIS AGREEMENT BY SUBSCRIBER ARISING FROM SUBSCRIBER’S NEGLIGENCE SHALL BE CAPPED AT THE FEES BILLED UNDER THIS AGREEMENT FOR THE SERVICES GIVING RISE TO THE CLAIM. FOR ALL OTHER CLAIMS BY EITHER PARTY AGAINST THE OTHER ARISING OUT OF SUCH OTHER PARTY’S BREACH OF THIS AGREEMENT, THE CULPABLE PARTY’S AGGREGATE TOTAL LIABILITY SHALL BE CAPPED AT SIX (6) TIMES THE AVERAGE MONTHLY REVENUE BILLED UNDER THIS AGREEMENT PRIOR TO THE CLAIM(S) ARISING.

IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL, INDIRECT, SPECIAL, OR PUNITIVE DAMAGES INCURRED BY THE OTHER PARTY AND ARISING OUT OF THE PERFORMANCE OF THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO LOSS OF GOOD WILL AND LOST PROFITS OR REVENUE, WHETHER OR NOT SUCH LOSS OR DAMAGE IS BASED IN CONTRACT, WARRANTY, TORT, NEGLIGENCE, STRICT LIABILITY, INDEMNITY, OR OTHERWISE, EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THESE LIMITATIONS SHALL APPLY NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY.

ADDITIONALLY, NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR ANY AND ALL CLAIMS ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT BROUGHT MORE THAN TWO (2) YEARS AFTER THE CAUSE OF ACTION HAS ACCRUED.

Assignment and Subcontracting. Neither party may assign or otherwise transfer this Agreement, in whole or in part, without the prior written consent of the other, and such consent shall not be unreasonably withheld. Notwithstanding the foregoing, TransUnion may assign or transfer this Agreement to a wholly-owned subsidiary, in the event of a purchase of substantially all of TransUnion’s assets, or in the event of a corporate form reorganization (e.g., LLC to C-Corporation), and Subscriber may assign or transfer its rights and/or obligations under this Agreement to any Affiliate of Subscriber identified on Exhibit A attached hereto. Moreover, TransUnion shall have the unrestricted right to subcontract the Services to be provided to Subscriber by TransUnion under this Agreement; provided however, that such subcontracting shall not relieve TransUnion of its obligations under this Agreement. The limited warranty and limitation of liability provisions set forth in this Agreement shall also apply for the benefit of TransUnion’s licensors, subcontractors and agents.

Security. Subscriber represents and warrants that: (i) all TransUnion-supplied identification codes (each a “User ID”) and associated passwords (each a “Password”) shall be kept confidential and secure (e.g., Subscriber shall ensure that Passwords are not stored on any desktop and/or portable workstation/terminal nor other storage and retrieval system and/or media, that Internet browser caching functionality is not used to store Passwords and that appropriate firewalls or other electronic barriers are in place); and, (ii) each User ID and Password shall be used solely by individuals Subscriber has authorized to use such User IDs and Passwords. In the event of any unauthorized use, misappropriation or other compromise of User IDs and/or Passwords, Subscriber shall promptly (but in no event later than forty-eight (48) hours after the occurrence of any of the foregoing) notify TransUnion by phone and in writing.

In the event Subscriber will utilize a third party intermediary (e.g., application service provider, Internet service provider or other network provider) for the purpose of transmitting requests for, receiving, archiving, storing, hosting, or otherwise performing processing of any kind related to, Services and/or Services Information, Subscriber shall ensure it has first entered into an agreement with such third party prohibiting such third party’s use of, and access to, the Services and Services Information for any purpose other than to the extent necessary to provide such application or network services to Subscriber. Subscriber shall be solely liable for any of its, such third parties, or other Subscriber agent’s or contractor’s, actions or omissions, including, but not limited to, any misappropriation or other compromise of User ID’s and/or Passwords, any misappropriation and/or unauthorized disclosure of Services Information (including, but not limited to, consumer credit information), any security breaches, or any misuse of the Services Information in violation of this Agreement or applicable law. Furthermore, Subscriber understands and agrees that its third party intermediaries, agents and/or contractors shall not be entitled as a third party beneficiary or otherwise, to take any action or have any recourse against TransUnion in respect of any claim based upon any actual or alleged failure to perform under this Agreement.

No Waiver. No failure or successive failures on the part of either party, or its respective successors or permitted assigns, to enforce any covenant or agreement, and no waiver or successive waivers on the part of either party, or its respective successors or permitted assigns, of any condition of this Agreement, shall operate as a discharge of such covenant, agreement, or condition, or render the same invalid, or impair the right of either party, its respective successors or permitted assigns, to enforce the same in the event of any subsequent breach or breaches by the other party, its successors or permitted assigns.

Independent Contractors. This Agreement is not intended to create or evidence any employer-employee arrangement, agency, partnership, joint venture, or similar relationship of any kind whatsoever between TransUnion and Subscriber. Moreover, no party shall, by virtue of this Agreement, have any right or power to create any obligation, express or implied, on behalf of any other party.

Construction and Severability. All references in this Agreement to the singular shall include the plural where applicable. Titles and headings to sections or paragraphs in this Agreement are inserted for convenience of reference only and are not intended to affect the interpretation or construction of this Agreement. If any term or provision of this Agreement is held by a court of competent jurisdiction be invalid, void, or unenforceable, the remainder of the provisions shall remain in full force and effect and shall in no way be affected, impaired or invalidated.

Force Majeure. Neither party shall be liable to the other for failure to perform or delay in performance under this Agreement if, and to the extent, such failure or delay is caused by conditions beyond its reasonable control and which, by the exercise of reasonable diligence, the delayed party is unable to prevent or provide against. Such conditions include, but are not limited to, acts of God; strikes, boycotts or other concerted acts of workers; failure of utilities; laws, regulations or other orders of public authorities; military action, state of war, acts of terrorism, or other national emergency; fire or flood. The party affected by any such force majeure event or occurrence shall give the other party written notice of said event or occurrence within five (5) business days of such event or occurrence.

Audit Rights. During the term of this Agreement and for a period of three (3) years thereafter, TransUnion may, upon reasonable notice and during normal business hours, audit Subscriber’s policies, procedures and records which pertain to this Agreement to ensure compliance with this Agreement.

No Presumption against Drafter. Each of the parties has jointly participated in the negotiation and drafting of this Agreement. In the event of any ambiguity or a question of intent or interpretation arises, this Agreement shall be construed as if drafted jointly by each of the parties and no presumptions or burdens of proof shall arise favoring any party by virtue of the authorship of any of the provisions of this Agreement.

Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of Illinois regardless of the laws that might otherwise govern under applicable Illinois principles of conflicts of law.

Trademarks. Both Subscriber and TransUnion shall submit to the other party for written approval, prior to use, distribution, or disclosure, any material including, but not limited to, all advertising, promotion, or publicity in which any trade name, trademark, service mark, and/or logo (hereinafter collectively referred to as the “Marks”) of the other party are used (the “Materials”). Such party, from whom approval is being requested, shall not unreasonably withhold its approval. Both parties shall have the right to require, at each party’s respective discretion and as communicated in writing, the correction or deletion of any misleading, false, or objectionable material from any Materials. Moreover, when using the other party’s Marks pursuant to this Agreement, a party shall take all reasonable measures required to protect the other party’s rights in such Marks, including, but not limited to, the inclusion of a prominent legend identifying such Marks as the property of the other party. In using each other’s Marks pursuant to this Agreement, each party acknowledges and agrees that: (i) the other party’s Marks are and shall remain the sole properties of the other party; (ii) nothing in this Agreement shall confer in a party any right of ownership in the other party’s Marks; and, (iii) neither party shall contest the validity of the other party’s Marks. Notwithstanding anything in this Agreement to the contrary, TransUnion shall have the right to disclose to third parties Subscriber’s marks to the extent they appear in consumer credit reports containing Subscriber’s account information and/or inquiries without the prior written approval of Subscriber.

CFPB Notices. By signing this Agreement, Subscriber acknowledges receipt of a copy of the Consumer Financial Protection Bureau’s “Notice to Users of Consumer Reports: Obligations of Users Under the FCRA” and a copy of the Consumer Financial Protection Bureau’s “Notices to Furnishers of Information: Obligations of Furnishers Under the FCRA”. Any future updates to the forgoing notices will be accessible by Subscriber on TransUnion’s website.

Entire Agreement. THIS AGREEMENT INCLUDING, WITHOUT LIMITATION, ALL EXHIBITS AND ATTACHMENTS HERETO, CONSTITUTES THE ENTIRE AGREEMENT BETWEEN TRANSUNION AND SUBSCRIBER AND SUPERSEDES ALL PREVIOUS AGREEMENTS AND UNDERSTANDINGS, WHETHER ORAL OR WRITTEN, EXPRESS OR IMPLIED, SOLELY WITH RESPECT TO THE SUBJECT MATTER OF THIS AGREEMENT. THIS AGREEMENT MAY NOT BE ALTERED, AMENDED, OR MODIFIED EXCEPT BY WRITTEN INSTRUMENT SIGNED BY THE DULY AUTHORIZED REPRESENTATIVES OF BOTH PARTIES. THIS AGREEMENT SHALL NOT BE BINDING ON EITHER PARTY UNTIL SIGNED BY TRANSUNION. THE INDIVIDUAL EXECUTING THIS AGREEMENT ON BEHALF OF SUBSCRIBER HAS DIRECT KNOWLEDGE OF ALL FACTS CERTIFIED AND THE AUTHORITY TO BIND SUBSCRIBER TO THE TERMS OF THIS AGREEMENT.

Upstart Network, Inc.

/s/ Peter Turek

/s/ Dave Girouard

Peter Turek                     SVP

Dave Girouard                         CEO

11/25/2020

11/25/2020

Physical Address, City, State and Zip Code

Upstart Network, Inc.

/s/ Dave Girouard

Dave Girouard                     CEO

11/25/2020

Certain information, as identified by [***], has been excluded from this agreement because it is both (i) not material and (ii) would be competitively harmful if publicly disclosed.

Subject to the terms and conditions of the Agreement, the following is the current pricing*:

Certain information, as identified by [***], has been excluded from this agreement because it is both (i) not material and (ii) would be competitively harmful if publicly disclosed.