iProov Controller Privacy Policy (Demo App)

Introduction

This Privacy Policy only applies where iProov is the data controller for a demo app.

This Privacy Policy explains what information iProov collects about an end user of an iProov service (“you”), how we may use it, and the steps we take to ensure that it is kept secure. It applies where we act as a controller of your personal data.

This is the case only when you use the iProov’s unmodified demonstration app (iProov Demo App) to try out our service.

This Privacy Policy doesn’t apply where iProov is the processor – that is, where someone else (such as a business, charity or governmental service) is the controller of your personal data.

When we refer to iProov in this Agreement, we mean us and/or the iProov Service, according to the context.

As a controller, what information do we collect?

Each time you give us permission to do so, such as by clicking to give your consent on the iProov Demo App, you authorise us:

  • to record and upload to iProov images of you (User Images)
  • to collect other data (we refer to this as Associated Data) in connection with the device through which User Images are provided (your device), which we use to assist in authenticating you and profiling your device to reduce the risk of impersonation, namely:
    • a unique identifier that we associate with your User Images;
    • data from the gyros and accelerometers of your device;
    • device type, model, and identifier; and
    • the IP address of your device, and its network interfaces.

What types of User Image do we collect ?

A User Image may be provided by means of a photograph or video submitted through your device, or extracted from a trusted reference document (such as a passport or driving licence), when you enrol with iProov (we call this an “Enrolment User Image”), or by means of a photograph or video submitted through your device for an authentication attempt – see How do we use your data? below.

iProov disregards, and does not record, data contained in any reference document you provide at enrolment – it collects only the Enrolment User Image.

How do we use your data?

Each time you submit a User Image for the purposes of authentication (an “authentication attempt”) iProov uses automated imagery analysis and biometric matching technology for the purpose of detecting impersonation and spoofing attempts by reference to the Enrolment User Image. 

Your Enrolment User Image allows us to perform face-matching during subsequent authentication attempts. We process the Enrolment User Image to create a biometric template (being a mathematical abstraction of a user’s facial features which an iProov algorithm uses for face-matching) which can be used for face-matching against authentication attempts. This biometric template is linked to a unique user identifier “User ID” which we will hold for you.  

For the purposes of identifying that the person performing the authentication attempt is the same as in an Enrolment User Image, iProov compares the biometric template from User Images provided in an authentication attempt with the biometric template taken from the Enrolment User Image. The resulting probability of a match between the two biometric templates determines whether iProov issues a pass or fail result for the authentication attempt.

When we process User Images for identification or authentication purposes, they constitute special category personal data for the purposes of European and UK data protection laws, because we are using them – with your consent – for a biometric purpose.  Other than Enrolment User Image and User Images submitted in authentication attempts, we do not collect special categories of personal data about you (such as details about your religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic data) – if we do seek to obtain any of this data from you, we will only do so with your explicit consent.

In addition, we process your User Images and other personal data to address relevant legal, tax or accounting requirements, including potential claims by and against us.

What is our legal basis for processing your personal data ?

Our relevant legal basis (Our basis) for processing your personal data is:

Consent: We obtain explicit Consent to the processing of your User Images and Associated Data.

Whom will we share your personal data with ?

If we transfer your personal data to a country that does not provide a similar level of legal protection to that provided by the United Kingdom’s data protection laws, we put in place legally appropriate safeguards to require the protection of your personal data.

How long will be keep your personal data for ?

We will retain your User Images and Associated Data for as long as your User ID is active for authentication. 

However:

  • You can withdraw your consent to our processing of your User Images and Associated Data for authentication by making a request to enquiries@iproov.com and providing sufficient information in order for us to identify your User Images and Associated Data
  • We will in any event consider your User ID inactive for authentication if you have not initiated an authentication attempt in over 48 hours.

In either case, your User Images, Associated Data and User ID will thereafter be deleted from our systems.  We will make no further use of that data.

Your legal rights 

For so long as your User Images are linked to their Associated Data, and we are capable of associating your request with them, you have the right to:

  • Request access to your personal data (commonly known as a data subject access request). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
  • Request correction of your personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
  • Request erasure of your personal data. This enables you to ask us to delete your personal data where there is no good reason for us continuing to process it.
  • Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; or (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
  • Withdraw consent to the processing of your personal data where we are relying on your consent. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

Note that these rights are only capable of being exercised where and to the extent that we are reasonably capable of identifying you with them.

You will not have to pay a fee to exercise any of your legal rights as specified above. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive; alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity, associate you with your personal data, and ensure your right to access the relevant personal data (or to exercise any of your other legal rights). 

We may also contact you to ask you for further information in relation to your request to help speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Contacting us

If you have any complaints regarding iProov’s compliance with this iProov Controller Privacy Policy or to other data protection matters, please contact iProov’s DPO directly at DPO@iproov.com and we will assist you where we can. We will attempt to resolve any complaints or issues that you may have in accordance with this Privacy Notice and Applicable Law.

If you are unhappy with the investigation or attempts to resolve your complaint, you may have the right to raise a complaint with the Supervisory Authority in your country or jurisdiction. For the UK, the Supervisory Authority is the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection issues (www.ico.org.uk).

If you reside in in the EU, a list of Supervisory Authorities and how to contact them can be found here: https://ec.europa.eu/digital-single-market/en/news/list-personal-data-protection-competent-authorities.

iProov has appointed an EU representative who can be contacted at: iProov Netherlands B.V., Siriusdreef 17 Transpolispa, Hoofddorp, 213WT, Netherlands.  Company Number 74408259 Email: eurepresentative@iproov.com.

We are registered with the ICO under number ZA441165.

iProov Limited (we, us or iProov) is a company incorporated in England & Wales under company number 07866563 whose registered office is at 14 Bank Chambers, 25 Jermyn Street, London SW1Y 6HR, England.