Entrust Identity Verification Services Product Privacy Notice (incorporated PDF)

Data Access & Collection · Company practice

Data comes from the Customer, the User or third-party Data Providers

To provide the Onfido Identity Services to a Customer, Entrust collects certain personal information about that Customer's Users. It may collect that information from the Customer, from the User, or from third-party data providers (“Data Providers”). The notice describes Data Providers as trusted third-party service providers or public authorities who provide additional information depending on the services the Customer has chosen.

Supporting quotations

To provide Onfido Identity Services to a Customer, Entrust will collect certain personal information about the Customer’s Users.

Entrust may collect personal information about a User from the Customer, from the User, or from third party data providers (“Data Providers”). Data Providers are trusted third party service providers or public authorities who provide additional information depending on the Onfido Identity Services a Customer has chosen to use.

Qualifications & exceptions

• The source of the data depends on the service the Customer chooses.

Not stated here

• The notice does not identify the Data Providers or the databases they supply in this section.

Data Access & Collection · Context

The data collected depends on how the Customer uses the service

The precise personal data Entrust collects on a Customer's behalf varies with three choices: how the Customer interacts with Entrust (for example the API or the Onfido Dashboard, Part 1 of the table); the data collection method (for example the Applicant Form or SDK, Part 2); and which Onfido Identity Services the Customer uses (Part 3). The notice then sets out the personal data Entrust may process to provide the services, so the table is a catalogue of possibilities rather than one fixed dataset for every check.

Supporting quotations

The precise personal data Entrust collects on behalf of a Customer varies depending on:

how a Customer chooses to interact with Entrust (for example, via our API or the Onfido Dashboard as set out in Part 1 of the table below);

what data collection method the Customer chooses to use (for example, our Applicant Form or SDK as set out in Part 2 of the table below); and

which Onfido Identity Services the Customer chooses to use (as set out in Part 3 of the table below).

The table below sets out the personal data Entrust may process in order to provide the Onfido Identity Services.

Qualifications & exceptions

• The table lists data Entrust may process, not a guaranteed collection for every service.

Not stated here

• Customer-specific configurations and optional fields beyond the table's examples are not described.

Data Access & Collection · Company practice

Part 1 covers API and Dashboard data, including staff login details

Part 1 of the table covers a Customer that initiates a check or process and interacts directly with Entrust; its columns are the personal data type and the Customer interaction method. Through the API, the categories can include the Onfido User unique identifier; check status/outcome and related information such as a Report; optional data fields the Customer selects from those the API supports (for example a title); technical metadata described in the API Documentation; IP address with city/country location; data uploaded through the “custom input” or “send/receive” workflow features; and other information relevant to the applicable services. The API uses REST principles and standard HTTP response codes. For the Onfido Dashboard, Entrust also collects the full name, login credentials and usage logs of Customer personnel who access it; the Dashboard is described as a graphical interface to the API.

Supporting quotations

| 1. Customer initiates a check/process and interacts directly with Entrust

| Personal Data Type | Customer Interaction Method with Entrust and Description

| Categories of Personal Data: ● Onfido User unique identifier Check status/outcome and related information (e.g., a Report) ● Optional data fields selected by Customer from those technically supported and listed in Onfido’s API Documentation (for example, the User’s title - Mr., Mrs., Miss) ● Technical metadata as described in Onfido’s API Documentation ● IP address and associated city/country level location information ● All data uploaded by Customer via ‘custom input’ or ‘send/receive’ features within the Onfido Identity Services for use during a workflow ● All other information processed by Entrust relevant to the applicable Onfido Identity Services

(Note - Entrust will also collect the full name, login credentials, and usage logs for Customer personnel accessing the Onfido Dashboard)

Application Programming Interface (API) The API is based on REST principles and uses standard HTTP response codes to enable Customer to transmit and receive data from Entrust, as further described in the API Documentation.

Onfido Dashboard The Onfido Dashboard is a graphical user interface to Onfido’s API, as further described in the API Documentation.

Qualifications & exceptions

• Part 1 applies where the Customer initiates the check and interacts with Entrust directly.
• The staff login data concerns Customer personnel who access the Onfido Dashboard.

Not stated here

• The API Documentation is referred to but not supplied, so the full list of technical metadata and optional fields is unknown here.

Data Access & Collection · Company practice

Studio and third-party tracking carry the same check identifiers

Studio is a visualisation layer and workflow builder giving the Customer no/low-code tools to create and configure dynamic user journeys that incorporate the Onfido Identity Services. Where a Customer has procured a third-party User tracking system to interact with Onfido's API and track Users, the data categories are the Onfido User unique identifier, check status/outcome and related information such as a Report, and optional data fields listed in the API Documentation.

Supporting quotations

| | Studio Studio is a visualisation layer and workflow builder providing the Customer with no/low-code tools to create and configure dynamic user journeys incorporating the Onfido Identity Services.

| Categories of Personal Data: ● Onfido User unique identifier ● Check status/outcome and related information (e.g., a Report) ● Optional data fields as listed in Onfido’s API Documentation | Third Party User Tracking System The Customer procured a third-party User tracking system to interact with Onfido’s API and track Users

Qualifications & exceptions

• Third-party tracking applies only where the Customer procures that system.

Not stated here

• The third-party tracking system is not identified, and the API Documentation is not supplied.

Data Access & Collection · Company practice

The Applicant Form collects User-entered data and reminder emails

Part 2 covers information Entrust collects directly from Users on the Customer's behalf; its columns are the personal data type and the collection method. With the Applicant Form, the User enters data on an Onfido-provided form. The categories include images and text-based data specified in the relevant check or process, the User's email address, the content of the email sent as a reminder to complete the form, and the Onfido User identifier. Entrust can send the form only if the Customer has already provided an email address for the User.

Supporting quotations

| 2. Entrust collects additional information directly from Users on behalf of the Customer

| Personal Data Type | Data Collection Method and Description

| Categories of Personal Data: ● Images and text-based data (as specified in the relevant check or process) ● Email address ● Content of email sent to Users as a reminder to complete the Applicant Form ● Onfido User unique identifier (Note - the Customer must have already provided Entrust with an email address so Entrust can send the Applicant Form to the User) | Applicant Form Enables the User to enter data on an Onfido provided form

Qualifications & exceptions

• Applies where the Customer uses the Applicant Form.
• Sending the form depends on the Customer having supplied the User's email address.

Data Access & Collection · Company practice

The SDK captures documents, faces, video and device metadata

The SDK provides the Customer with drop-in interface screens for mobile (iOS and Android) and web applications to capture identity documents and facial photographs/video for use with the services. Its data can include images/video and information describing them as specified in the check or process; a telephone number and the content of an SMS (web SDK only and optional); IP address with city/country location; anonymised usage data; the Onfido User identifier; and technical metadata described in the API Documentation.

Supporting quotations

| Categories of Personal Data: ● Images/video and information describing the images/video (as specified in the relevant check or process) ● Telephone number (web SDK only and optional) ● Content of SMS (web SDK only and optional) ● IP address and associated city/country level location information ● Anonymised usage data ● Onfido User unique identifier ● Technical metadata as described in Onfido’s API Documentation | SDK The SDK provides the Customer with a drop-in set of user interface screens for mobile (iOS and Android) and web applications to allow the capture of identity documents and facial photographs/video for use with the Onfido Identity Services.

Qualifications & exceptions

• Telephone number and SMS content apply only to the web SDK and are optional.

Not stated here

• The API Documentation's technical metadata list is not supplied.