Onfido Facial Scan Policy and Release

Sharing & Disclosure · Company commitment

No sale, lease or trade of Biometric Data; no profit except for the described purposes

Entrust says it will not sell, lease, trade or otherwise profit from Biometric Data, except for the purposes described in the policy. The no-profit restriction therefore carries an exception for those purposes, which include the five processing purposes listed earlier.

Supporting quotations

Entrust will not sell, lease, trade, or, other than for the purposes described in this Policy, otherwise profit from Biometric Data.

Qualifications & exceptions

• The exception is “other than for the purposes described in this Policy”.
• The purposes described include verifying identity, authenticating users, fraud prevention, authenticity checks and improving/developing the Services where permitted by law.

Cross-references

• refers to (model-proposed): Purpose: improve and develop the Services where permitted by law — The no-sale/no-profit sentence is subject to “other than for the purposes described in this Policy”. Improving and developing the Services, where permitted by applicable law, is one of the five purposes the policy describes, so it falls within the exception that the no-sale card carries.

Sharing & Disclosure · Company commitment

Biometric Data is disclosed only in the circumstances the policy lists

When Processing Biometric Data on behalf of the Company (the Entrust client that directed the user to the policy), Entrust says it will only disclose, redisclose or otherwise disseminate Biometric Data in the circumstances listed. The list covers Company instructions and the user's authorization, financial transactions, legal requirements, warrants or subpoenas, the named Providers, and express consent.

Supporting quotations

Disclosure of your Biometric Data: When Processing your Biometric Data on behalf of the Company, Entrust will only disclose, redisclose or otherwise disseminate Biometric Data in the following circumstances:

This Company is an Entrust client.

Qualifications & exceptions

• The “only” commitment is limited to the listed circumstances.
• The commitment is described for Processing on the Company's behalf.

Not stated here

• The policy does not describe how the Company or the Providers may further disclose Biometric Data.

Sharing & Disclosure · Permission or license

Disclosure to complete a Company transaction as instructed and authorized by the user

One listed circumstance is disclosure in accordance with the Company's instructions, to complete a Company transaction, and as requested and authorized by the user or the user's legally authorized representative.

Supporting quotations

In accordance with the Company’s instructions, to complete a Company transaction and as requested and authorized by you or your legally authorized representative;

Qualifications & exceptions

• The circumstance combines the Company's instructions with the user's request or authorization.
• It is tied to completing a Company transaction.

Sharing & Disclosure · Permission or license

Disclosure to complete a financial transaction the user requested or authorized

Another listed circumstance is disclosure to complete a financial transaction that the user or the user's legally authorized representative requested or authorized.

Supporting quotations

To complete a financial transaction requested or authorized by you or your legally authorized representative;

Qualifications & exceptions

• The disclosure is tied to a financial transaction requested or authorized by the user or the user's representative.

Sharing & Disclosure · Permission or license

Disclosure as required by state or federal law or municipal ordinance

Another listed circumstance is disclosure as required by state or federal law, or by a municipal ordinance.

Supporting quotations

As required by state or federal law, or municipal ordinance;

Qualifications & exceptions

• The circumstance covers requirements of state or federal law and municipal ordinances.

Not stated here

• The policy does not identify particular statutes or the process Entrust follows to assess a requirement.

Sharing & Disclosure · Permission or license

Disclosure as required by a warrant or subpoena from a court of competent jurisdiction

Another listed circumstance is disclosure as required pursuant to a warrant or subpoena issued by a court of competent jurisdiction.

Supporting quotations

As required pursuant to a warrant or subpoena issued by a court of competent jurisdiction;

Qualifications & exceptions

• The circumstance names a warrant or subpoena issued by a court of competent jurisdiction.

Not stated here

• The policy does not describe notice to the user or any challenge process.

Sharing & Disclosure · Permission or license

Named Providers: Microsoft Ireland (speech-to-text) and Amazon Web Services (speech-to-text, storage)

Another listed circumstance is disclosure to a third-party Provider acting on Entrust's behalf: Microsoft Ireland Operations Limited, whose technology converts the user's audio recording into written text (“Speech to Text”), and Amazon Web Services, which provides another Speech to Text service as well as cloud storage.

Supporting quotations

To a third-party Provider acting on Entrust’s behalf, namely Microsoft Ireland Operations Limited (whose technology is used to convert your audio recording into written text (“Speech to Text”)) and Amazon Web Services (who provides another Speech to Text service as well as cloud storage); or

Qualifications & exceptions

• The Providers are named as Microsoft Ireland Operations Limited and Amazon Web Services.
• The card describes only the roles the policy states for them; it does not describe their separate practices.

Not stated here

• The policy does not state the terms on which the Providers act or their own retention periods.

Sharing & Disclosure · Permission or license

Disclosure as expressly consented to by the user or an authorized representative

The final listed circumstance is disclosure as expressly consented to by the user or the user's authorized representative.

Supporting quotations

As expressly consented to by you or your authorized representative.

Qualifications & exceptions

• The consent must be express.