HL Hunt

2.1Services Provided

Subject to this Agreement, HL Hunt provides Client with access to:

• Decisioning Engine: AI and rules-based evaluation of Applicants and generation of scores, risk tiers, and recommendations across configured product types;
• Explainability & Reason Codes: attribute-level explanations and specific principal reason codes to support Adverse Action and disclosure obligations;
• Configurable Workflows: Client-defined policy rules, cutoffs, overrides, stipulations, and routing for lenders, dealers, and brokers;
• Data Orchestration: intake of application data and, where Client directs and has authority, connection to bureau, income, identity, fraud, and alternative-data sources;
• Fair-Lending Tooling: monitoring, testing, and documentation features to support fair-lending review;
• Dashboards & Analytics: portfolio, performance, and compliance reporting;
• APIs & Integrations: programmatic application submission, decisioning, and loan-origination-system integration;
• Audit & Recordkeeping: versioned logging of inputs, Model versions, Decision Outputs, and configuration changes.

2.2License Grant

Subject to Client's compliance with this Agreement and payment of all fees, HL Hunt grants Client a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Services solely to evaluate Applicants and support Client's own lawful Credit Decisions.

2.3License Restrictions

Client shall NOT:

• use the Services or Decision Outputs for any purpose other than a lawful, permissible underwriting or credit purpose for which it has authority;
• submit data for evaluation without a Permissible Purpose where a Consumer Report is involved;
• use the Services to evaluate Applicants on any Prohibited Basis or to enable unlawful discrimination;
• sublicense, resell, or provide Platform access or Decision Outputs to third parties without HL Hunt's written authorization;
• reverse engineer, decompile, scrape, or attempt to derive the Models or source code;
• use Decision Outputs to train competing models or to build a competing service;
• circumvent access controls, rate limits, or compliance gating;
• use the Services in violation of ECOA, Regulation B, the FCRA, GLBA, or any applicable law.

2.4Service Modifications

HL Hunt may modify, enhance, retrain, or discontinue features and Models at any time and will provide reasonable advance notice of material adverse changes when practicable. HL Hunt may deploy compliance-driven or risk-driven changes immediately and without notice. Client is responsible for revalidating its use of any updated Model as appropriate to its obligations.

3.1Application & Approval

• Access requires completion of onboarding and approval by HL Hunt, which may be granted or refused in HL Hunt's sole discretion.
• Approval is conditioned on underwriting, identity verification, and risk and compliance review.
• HL Hunt may request additional documentation, including licenses, at any time.

3.2Know-Your-Business (KYB) & Permissible-Purpose Certification

Client shall provide accurate, complete, and current information and certifications, including:

• legal entity name, structure, formation documents, and EIN;
• beneficial-ownership information for owners of 25% or more, and control persons with government-issued ID;
• all applicable lending, finance, dealer, or broker licenses and registrations, by state;
• the product types, channels (direct, indirect, dealer, broker), and jurisdictions for which the Platform will be used;
• a certification of the Permissible Purpose for any Consumer Report data used, and of the intended use of Decision Outputs;
• fair-lending and compliance management system documentation on request;
• any other information required by HL Hunt or applicable law.

3.3Licensing & Authority

• Client represents that it holds, or is exempt from, every license required to originate, finance, broker, or decision the products it evaluates through the Platform.
• Client shall maintain such licenses in good standing and promptly notify HL Hunt of any lapse, suspension, revocation, or enforcement action.
• HL Hunt may restrict use by product type, channel, or jurisdiction where Client cannot evidence authority or Permissible Purpose.

4.1HL Hunt as Decisioning-Support Technology

HL Hunt provides decisioning-support software, Models, and Decision Outputs. HL Hunt does not make Credit Decisions, is not the creditor, and does not extend, deny, or set the terms of any credit. Decision Outputs are inputs and recommendations; Client exercises independent judgment and makes the final Credit Decision.

4.2Client as Creditor and Decision-Maker

As between the parties, Client is solely responsible for: each Credit Decision and its terms; configuring policy rules, cutoffs, and overrides; fair-lending compliance and monitoring of its own decisions; issuing all Adverse Action, risk-based pricing, and FCRA notices; obtaining and documenting Permissible Purpose and consents; and compliance with ECOA, Regulation B, the FCRA, GLBA, UDAAP standards, the Military Lending Act, the Servicemembers Civil Relief Act, and all applicable federal and state law.

4.3Consumer-Reporting-Agency Status

The Platform is designed to operate as a tool used by Client on data Client is authorized to obtain and use, with Decision Outputs returned to Client for Client's own use. The parties intend that HL Hunt's provision of the Services not cause HL Hunt to be a consumer reporting agency under the FCRA. Where a configuration would involve HL Hunt assembling or evaluating consumer information for the purpose of furnishing Consumer Reports to third parties, or acting as a reseller, the parties will document additional FCRA terms before such use, and the allocation of related obligations will be set out in the applicable Order Form.

4.4Decisioning Tooling Is Not Legal Advice

The Platform's compliance features (Reason Codes, fair-lending tooling, monitoring, documentation) are configurable tools to assist Client. They are not legal advice and do not guarantee compliance. Client is responsible for reviewing Reason Codes and Decision Outputs for accuracy and legal sufficiency for its products and jurisdictions, and for not approving or denying credit in a manner that violates law.

5.1Permissible Purpose

• Client warrants it has a Permissible Purpose under FCRA § 604 for any Consumer Report or consumer information used in evaluation, and will use Decision Outputs only for that purpose.
• Client is responsible for its agreements and certifications with credit bureaus and other data sources, and for permitted use of those sources.
• Client shall obtain any Applicant authorizations or consents required for the data and channels it uses.

5.2Data Accuracy & Inputs

• Client is responsible for the accuracy, completeness, and lawfulness of all Client Data and application inputs.
• HL Hunt may rely on Client Data and Client-directed data sources as provided and is not obligated to independently verify them.
• Decision Output quality depends on input quality; inaccurate or incomplete inputs may produce unreliable outputs.

5.3Prohibited Inputs

• Client shall not submit Prohibited-Basis characteristics for use as decisioning variables except where expressly required and permitted by law (e.g., certain monitoring data collected and segregated under Regulation B).
• Client shall not submit data it lacks authority or consent to use, or data obtained in violation of law.

6.1Model Design Principles

• Models are developed and documented under a model-governance framework (Exhibit B) intended to align with interagency model-risk-management expectations (including SR 11-7 principles).
• Models are designed not to use Prohibited-Basis characteristics as predictive variables.
• Model versions are tracked, and the version used for each evaluation is logged.

6.2Explainability & Reason Codes

• The Platform generates Reason Codes intended to reflect the specific principal reasons that actually drove a Decision Output, to support Regulation B and FCRA Adverse Action requirements.
• Client is responsible for reviewing Reason Codes for accuracy and adequacy for its specific notices and for not using generic or inaccurate reasons.
• The Platform provides attribute-level explanations to support Client's review and documentation.

6.3Human Oversight & Override

• Client may configure cutoffs, manual review queues, stipulations, and overrides, and retains authority to approve or deny independent of any recommendation.
• Client is responsible for staffing and exercising meaningful human oversight appropriate to its risk and obligations.

6.4Model Limitations

Models are probabilistic and can produce errors or unexpected output, and past performance does not guarantee future results. HL Hunt does not warrant that any Decision Output, score, or Reason Code will be accurate, predictive, or compliant in any instance, and Client must not treat Decision Outputs as a substitute for its own judgment, validation, and compliance.

7.1Prohibited-Basis Discrimination

• Client shall not use the Platform to discriminate against any Applicant on a Prohibited Basis, whether through disparate treatment or unjustified disparate impact.
• Client is responsible for its own fair-lending program, including policies, training, monitoring, and corrective action.

7.2Fair-Lending Tooling

• The Platform offers monitoring and testing features to support fair-lending review, including outcome analysis and, where supported, searches for less-discriminatory alternatives.
• HL Hunt maintains Model documentation to support fair-lending evaluation under Exhibit B.
• These features assist, but do not replace, Client's independent fair-lending analysis and judgment.

7.3Cooperation

The parties will reasonably cooperate on fair-lending inquiries, including providing Model documentation and analysis appropriate to each party's role, subject to confidentiality and applicable law.

8.1Client Responsibility for Notices

• Client is solely responsible for issuing all Adverse Action notices required under Regulation B and the FCRA within applicable timeframes.
• Client is responsible for FCRA risk-based pricing notices and any credit-score disclosures required when a Consumer Report or score is used.
• Client must ensure that the reasons stated reflect the actual basis for the Credit Decision.

8.2Platform Support

• The Platform supplies Reason Codes and supporting data intended to help Client populate accurate, specific principal reasons.
• The Platform can support generation of notice content as configured; Client remains responsible for the form, accuracy, delivery, and timing of notices.

9.1Applicable Law

Each party shall comply with all laws applicable to its activities, including:

• Equal Credit Opportunity Act (ECOA) and Regulation B, 12 C.F.R. Part 1002;
• Fair Credit Reporting Act (FCRA) and Regulation V, including permissible purpose, adverse action, and risk-based pricing rules;
• Fair Housing Act, where applicable to dwelling-secured credit;
• prohibition on Unfair, Deceptive, or Abusive Acts or Practices (UDAAP), Dodd-Frank § 1031;
• Truth in Lending Act (TILA) and Regulation Z, as applicable to Client's products;
• Military Lending Act (MLA) and Servicemembers Civil Relief Act (SCRA);
• Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule;
• state lending, finance, retail-installment, dealer, and broker laws and licensing;
• state and federal privacy laws (e.g., CCPA/CPRA) and emerging automated-decisioning rules, as applicable;
• OFAC sanctions and anti-money-laundering requirements.

9.2Commercial vs. Consumer Credit

Certain requirements (including some Regulation B and FCRA provisions) apply differently to consumer and business credit. Client is responsible for determining and applying the correct requirements for each product and Applicant type it evaluates.

9.3Regulatory Change

HL Hunt will use commercially reasonable efforts to update default controls and Model governance to reflect material changes in federal law and regulatory guidance. Client remains responsible for jurisdiction- and product-specific configuration and for verifying that the Services meet its obligations.

10.1Accuracy & Disputes

• The Platform supports capture and routing of Applicant inquiries and disputes regarding data and decisions to Client.
• Client is responsible for responding to Applicant disputes and for correcting inaccurate inputs in its systems and at the relevant data source.

10.2Explainability Requests

Where an Applicant or regulator requests the basis for a decision, HL Hunt will reasonably assist Client by providing attribute-level explanations and Reason Code documentation appropriate to HL Hunt's role, subject to confidentiality and trade-secret protection of the Models.

10.3Privacy Rights

Client is responsible for honoring Applicant privacy rights under applicable law; HL Hunt will reasonably assist with verified requests to the extent data is processed through the Platform.

11.1Documentation

• HL Hunt maintains Model development, validation, and monitoring documentation under Exhibit B and will make appropriate summaries available to Client on reasonable request.
• HL Hunt monitors Models for performance, stability, and drift, and may retrain or update Models accordingly.

11.2Client Validation

• Client is responsible for independently validating the Models for its own use, products, and population, including any validation required for regulated institutions.
• Client shall notify HL Hunt of material performance, accuracy, or fairness concerns it identifies.

12.1Fee Structure

Client agrees to pay all fees set forth in the applicable Order Form, which may include platform/subscription fees, per-application or per-decision fees, volume tiers, data pass-through costs, and optional module fees.

12.2Billing & Deduction

• Fees are invoiced per the Order Form; undisputed amounts are due within thirty (30) days.
• Overdue amounts accrue interest at the lesser of 1.5%/month or the legal maximum.
• Client authorizes HL Hunt to debit its designated account for amounts due and unpaid.

12.3Fee Changes & Taxes

• HL Hunt may modify fees on thirty (30) days' notice; data and third-party pass-throughs may change immediately. Continued use after the effective date constitutes acceptance.
• Fees are exclusive of taxes other than HL Hunt's income taxes; Client is responsible for applicable taxes.
• Client must raise any billing dispute within sixty (60) days of the charge or waive it, and must pay undisputed amounts during resolution.

13.1Security Program

HL Hunt maintains an information security program with administrative, technical, and physical safeguards consistent with the GLBA Safeguards Rule and industry standards, as further described in Exhibit A, including encryption in transit and at rest, access controls, monitoring, and incident response.

13.2Roles Under Privacy Law

• As between the parties, Client is the controller/owner of Client Data and Applicant information; HL Hunt processes it on Client's behalf to provide the Services per Exhibit A.
• HL Hunt does not sell Applicant personal information and uses it only as permitted by this Agreement and law.
• HL Hunt may use aggregated, de-identified data to operate, secure, and improve the Services and Models, consistent with applicable law and the Order Form.

13.3Breach Notification

• Each party shall notify the other without undue delay (and within 72 hours where feasible) of a confirmed security incident affecting the other's data.
• The parties shall cooperate on investigation, remediation, and any required Applicant or regulator notifications.
• Responsibility for breach costs follows the party whose systems, acts, or omissions caused the incident.

14.1Prohibited Conduct

Client shall NOT use the Platform to:

• discriminate against any Applicant on a Prohibited Basis or otherwise violate fair-lending law;
• obtain or use consumer information without a Permissible Purpose or required authority;
• make or facilitate credit decisions it is not licensed or authorized to make;
• issue Adverse Action or other notices with generic or inaccurate reasons that do not reflect the actual basis of the decision;
• use Decision Outputs for any purpose other than the lawful underwriting purpose certified;
• submit data it lacks authority or consent to use, or that was obtained unlawfully;
• resell, redistribute, or furnish Decision Outputs to third parties without authorization;
• attempt to reverse engineer, extract, or replicate the Models;
• violate ECOA, Regulation B, the FCRA, GLBA, UDAAP standards, the MLA, the SCRA, or any applicable law.

14.2Consequences

• immediate suspension or termination, without notice for serious violations;
• suspension of access to Models or data sources pending investigation;
• cooperation with, and reporting to, regulators and law enforcement;
• indemnification of HL Hunt and pursuit of all available legal remedies.

15.1Recordkeeping

The Platform retains versioned records of inputs, Model versions, Decision Outputs, Reason Codes, and configuration changes for the retention period in Exhibit A (no less than the periods required by ECOA, the FCRA, and applicable law). Client is responsible for retaining its own records, including Adverse Action records, as required.

15.2Examination Support

• HL Hunt will reasonably cooperate with Client's regulators and prudential examiners, including providing Model documentation and validation summaries appropriate to its role.
• Where Client is a regulated institution subject to third-party / service-provider oversight, HL Hunt will support reasonable oversight consistent with applicable guidance.
• Each party may audit the other's compliance with this Agreement upon reasonable notice, no more than annually absent cause.

16.1HL Hunt IP

• HL Hunt retains all right, title, and interest in the Platform, Models, software, documentation, scores, and all related intellectual property.
• The HL Hunt name and logo are trademarks of HL Hunt Inc.
• Client acquires no ownership interest in HL Hunt IP, including in any Model improvements derived from aggregated, de-identified usage as permitted by the Order Form.

16.2Client Data & Content

• Client retains ownership of Client Data and its own policies, rules, and branding.
• Client grants HL Hunt a license to host, process, and use Client Data to provide, secure, and improve the Services and to comply with law, as further specified in the Order Form.
• Client grants a limited license to use Client's name and logo to identify Client as a customer; Client may opt out of marketing use by written notice.

16.3Feedback

Feedback, suggestions, and ideas Client provides become HL Hunt's property and may be used without compensation or attribution.

17.1Confidential Information

"Confidential Information" means non-public information disclosed by either party, including business plans, pricing, Model details and documentation, Applicant data, and trade secrets.

17.2Obligations & Exceptions

• Each party shall protect the other's Confidential Information using no less than reasonable care and use it only to perform under this Agreement.
• Obligations do not apply to information that is public through no fault of the receiver, rightfully known prior to disclosure, independently developed, or required to be disclosed by law (with notice where permitted).

17.3Duration

Confidentiality obligations survive termination for five (5) years; trade secrets remain protected for as long as they qualify as trade secrets.

18.1Client Representations

Client represents and warrants that:

• it is duly organized, validly existing, and has authority to enter this Agreement;
• the person accepting has authority to bind Client;
• all information and certifications provided to HL Hunt are true, accurate, and complete;
• it holds all licenses and registrations required to make or facilitate the Credit Decisions it evaluates;
• it has a Permissible Purpose for all consumer information used and all required Applicant consents;
• it will make all Credit Decisions and will not discriminate on any Prohibited Basis;
• it will issue all required Adverse Action, FCRA, and risk-based pricing notices accurately and timely;
• it will comply with ECOA, Regulation B, the FCRA, GLBA, UDAAP standards, the MLA, the SCRA, and all applicable law;
• it is not subject to any sanction, debarment, or regulatory bar affecting eligibility.

18.2Ongoing Effect

These representations are made as of the Effective Date and are deemed repeated each time Client submits an Applicant for evaluation or uses a Decision Output.

19.1No Warranties

TO THE MAXIMUM EXTENT PERMITTED BY LAW, HL HUNT DISCLAIMS ALL WARRANTIES, INCLUDING:

• IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT;
• WARRANTIES THAT DECISION OUTPUTS, SCORES, OR REASON CODES WILL BE ACCURATE, PREDICTIVE, COMPLETE, COMPLIANT, OR FREE FROM BIAS OR ERROR;
• WARRANTIES THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE;
• WARRANTIES REGARDING THIRD-PARTY DATA SOURCES, BUREAUS, OR PROVIDERS.

19.2No Legal or Compliance Advice

HL HUNT IS NOT A LAW FIRM AND DOES NOT PROVIDE LEGAL, REGULATORY, OR COMPLIANCE ADVICE. DECISIONING AND COMPLIANCE FEATURES ARE TOOLS, NOT ASSURANCES. CLIENT IS RESPONSIBLE FOR ITS OWN VALIDATION, FAIR-LENDING ANALYSIS, AND LEGAL COUNSEL.

20.1Exclusion of Consequential Damages

TO THE MAXIMUM EXTENT PERMITTED BY LAW, HL HUNT SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING LOST PROFITS, CREDIT LOSSES, LOST DATA, BUSINESS INTERRUPTION, OR LOSS OF GOODWILL, WHETHER IN CONTRACT, TORT, OR OTHERWISE, EVEN IF ADVISED OF THE POSSIBILITY.

20.2Cap on Liability

HL HUNT'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY CLIENT TO HL HUNT IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

20.3Exceptions

The limitations do not apply to: (a) Client's indemnification obligations; (b) Client's payment obligations; (c) either party's breach of confidentiality; (d) infringement of the other's intellectual property; (e) Client's violations of law, including fair-lending, ECOA, or FCRA violations in making Credit Decisions; or (f) liability that cannot be limited by law.

20.4Allocation of Risk

These limitations reflect the agreed allocation of risk and are a fundamental basis of the bargain; HL Hunt would not provide the Services without them.

21.1Client Indemnification

Client shall indemnify, defend, and hold harmless HL Hunt and its officers, directors, employees, and agents from any claims, demands, losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees) arising out of or related to:

• Client's breach of this Agreement or violation of any law or regulation;
• any Credit Decision made or facilitated by Client;
• any ECOA, Regulation B, FCRA, fair-lending, UDAAP, MLA, SCRA, or state-law claim arising from Client's use of the Services;
• Client's use of consumer information without a Permissible Purpose or required authority;
• Client's failure to issue accurate, timely Adverse Action or required notices;
• any Applicant or third-party claim related to Client's products or decisions;
• any security incident caused by Client's systems, acts, or omissions;
• Client's negligence, willful misconduct, or misrepresentation.

21.2HL Hunt Indemnification

HL Hunt shall indemnify Client against third-party claims that the Platform, as provided and used in accordance with this Agreement, infringes such third party's U.S. intellectual-property rights, subject to the limitations in Section 20.

21.3Procedure & Survival

• The indemnified party will promptly notify the indemnifying party, which may control the defense; the indemnified party shall reasonably cooperate.
• No settlement imposing non-monetary obligations on the indemnified party may be made without its consent.
• Indemnification obligations survive termination.

22.1Term

• This Agreement begins on the Effective Date and continues for the term in the Order Form, renewing as stated therein.
• Either party may terminate for convenience on thirty (30) days' written notice, subject to the Order Form.

22.2Termination by HL Hunt

HL Hunt may suspend or terminate immediately, without notice, if Client: breaches a material term; engages in prohibited, discriminatory, or unlawful use; uses data without Permissible Purpose; loses a required license; provides false information or certifications; poses unacceptable legal, financial, or reputational risk; becomes insolvent; or where a regulator, partner, or law requires it.

22.3Suspension

HL Hunt may suspend access to the Services, Models, or data sources pending investigation, including without notice in urgent circumstances, and will endeavor to notify Client and state the reason where possible.

23.1Upon Termination

• Client's right to use the Services and Models ends; no new evaluations may be submitted.
• All outstanding fees and amounts owed become immediately due.
• Client must cease using any Decision Outputs except as required to complete pending notices and recordkeeping.
• Client must cease displaying HL Hunt marks.

23.2Data Return & Deletion

• Client may export Client Data and decision records within sixty (60) days of termination in a standard format.
• After the export window, HL Hunt may delete or de-identify Client Data, except records it must retain for legal, regulatory, or audit purposes.

23.3Survival

The following survive: Definitions, Compliance Allocation, Fees, Data Security, Acceptable Use, Records/Audit, Intellectual Property, Confidentiality, Disclaimers, Limitation of Liability, Indemnification, Effects of Termination, Dispute Resolution, and General Provisions.

24.1Governing Law

This Agreement is governed by the laws of the Commonwealth of Kentucky, without regard to conflict-of-law principles.

24.2Mandatory Arbitration

All disputes arising out of or relating to this Agreement shall be resolved by final and binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before a single arbitrator in Lexington, Kentucky. Judgment on the award may be entered in any court of competent jurisdiction. This clause governs disputes between HL Hunt and Client only and does not affect Applicant or consumer rights.

24.3Class Action & Jury Waiver

EACH PARTY WAIVES ANY RIGHT TO A JURY TRIAL AND TO PARTICIPATE IN A CLASS ACTION, CLASS ARBITRATION, OR REPRESENTATIVE PROCEEDING. All claims between the parties must be brought individually.

24.4Equitable Relief & Limitation

• Either party may seek injunctive relief in any court of competent jurisdiction to protect intellectual property or Confidential Information or to prevent irreparable harm.
• Any claim between the parties must be filed within one (1) year after it arose or be permanently barred.
• The prevailing party is entitled to recover reasonable attorneys' fees and costs.

25.1Entire Agreement

This Agreement, its exhibits, incorporated policies, and each Order Form constitute the entire agreement and supersede all prior understandings.

25.2Amendments

HL Hunt may amend this Agreement by posting revised terms or notifying Client; material changes are communicated at least thirty (30) days in advance when practicable. Continued use after the effective date constitutes acceptance.

25.3Assignment

Client may not assign without HL Hunt's prior written consent; HL Hunt may assign to a successor or affiliate. Attempted assignments in violation are void.

25.4Severability & Waiver

Invalid provisions are modified to the minimum extent necessary or severed; remaining provisions continue in force. No failure to enforce is a waiver.

25.5Force Majeure

Neither party is liable for failures due to causes beyond reasonable control, including acts of God, war, terrorism, labor disputes, government action, pandemics, or failures of data sources, bureaus, or providers.

25.6Independent Contractors

The parties are independent contractors; nothing creates a partnership, joint venture, agency, or employment relationship.

25.7Notices & Electronic Signature

Notices to HL Hunt go to the address in Section 26; notices to Client go to the email on file or via the Dashboard. Electronic acceptance has the same legal effect as a handwritten signature.

25.8Third-Party Beneficiaries

Where Client uses the Platform on behalf of a funding lender or bank partner, such party may be an intended beneficiary with respect to Client's compliance obligations. No other third-party beneficiaries are created.

A.1 Roles & Scope

HL Hunt processes Client Data and Applicant information solely to provide the Services, on Client's documented instructions and as required by law. As between the parties, Client is the data owner/controller and HL Hunt is the processor/service provider. HL Hunt does not "sell" or "share" personal information as defined under applicable privacy law.

A.2 Security Safeguards

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256 or equivalent);
• Role-based access controls, least-privilege, and multi-factor authentication for privileged access;
• Network segmentation, logging, monitoring, and intrusion detection;
• Vulnerability management, patching, and periodic penetration testing;
• Written information security program aligned to the GLBA Safeguards Rule and SOC 2 control objectives;
• Vendor/subprocessor due diligence and flow-down of obligations.

A.3 Subprocessors

HL Hunt may engage subprocessors (e.g., cloud hosting, data and bureau providers, identity/fraud providers, model infrastructure) under written terms no less protective than this Addendum. A current subprocessor list is available on request; HL Hunt will provide notice of material changes.

A.4 Incident Response & Retention

• Notification of confirmed security incidents without undue delay (target 72 hours), with cooperation on remediation and notice obligations;
• Inputs, Model versions, Decision Outputs, and Reason Codes retained no less than the periods required by ECOA, the FCRA, and applicable state law;
• On termination, data returned/exported within sixty (60) days, then deleted or de-identified except records required to be retained by law.

A.5 Applicant Requests

HL Hunt will reasonably assist Client in responding to verified Applicant rights requests (access, correction, deletion, explanation) to the extent the data is processed through the Platform and consistent with recordkeeping obligations and Model trade-secret protection.

B.1 Governance Framework

HL Hunt maintains a model-governance framework covering development, documentation, validation, approval, monitoring, and change management, intended to align with interagency model-risk-management principles (including SR 11-7). Each Model version is documented and version-controlled, and the version used for each evaluation is logged.

B.2 Variable & Fairness Controls

• Models are designed to exclude Prohibited-Basis characteristics as predictive variables;
• HL Hunt conducts fairness and disparate-impact analysis during development and monitoring, and, where supported, evaluates less-discriminatory alternatives;
• HL Hunt documents variable rationale to support fair-lending and adverse-action review.

B.3 Explainability & Reason Codes

• The Platform produces Reason Codes intended to reflect the specific principal reasons driving each Decision Output;
• Reason-code methodology is documented and available in summary form to support Client's notices and review;
• Client is responsible for verifying that the reasons used in its notices are accurate and adequate.

B.4 Monitoring & Documentation Access

• HL Hunt monitors performance, stability, drift, and fairness metrics and may retrain or update Models;
• HL Hunt will make appropriate validation and governance summaries available to Client and, where applicable, its examiners;
• Client is responsible for its own independent validation and ongoing fair-lending monitoring of its decisions.