Onfido Privacy Policy

Account & Service Control · Context

Customers interact with Entrust through the API, Dashboard, Studio or a third-party tracking system

Part 1 of the table covers situations where the Customer initiates a check or process and interacts directly with Entrust. It describes four interaction methods: the API, a REST-based interface using standard HTTP response codes; the Dashboard, a graphical user interface to the API; Studio, a visualization layer and workflow builder with no/low-code tools for dynamic user journeys; and a third-party User tracking system that the Customer procures to interact with the API and track Users.

Supporting quotations

| Part 1. Customer initiates a check/process and interacts directly with Entrust |

Application Programming Interface (API) The API is based on REST principles and uses standard HTTP response codes to enable Customer to transmit and receive data from Entrust, as further described in the API Documentation.

Dashboard The Dashboard is a graphical user interface to the API, as further described in the API Documentation.

Studio Studio is a visualization layer and workflow builder providing the Customer with no/low-code tools to create and configure dynamic user journeys incorporating the Services.

Third Party User Tracking System The Customer procured a third-party User tracking system to interact with the API and track Users.

Qualifications & exceptions

• Part 1 applies where the Customer initiates the check and interacts directly with Entrust.
• The table's descriptions are brief; the API Documentation is cited for further detail.

Account & Service Control · Company practice

Biometric Passkey ties an EBT face scan to a passkey and compares it for routine access

Biometric Passkey uses passkey authentication with a scan of the User's face geometry generated during enrollment and embedded in an Encrypted Biometric Token, which is associated with the passkey. The passkey authenticates the User for routine access and, where required, compares the stored face scan with a facial image to verify the User's identity. The listed data is video of the User including optional background audio, the reference face image, transcribed text from the video if applicable, face-geometry scans, data that may be a voiceprint, and a User unique identifier.

Supporting quotations

| Categories of Personal Data ● Video of the User (including background audio recording at Customer’s option) ● Image of the face in the identity document / reference image ● Transcribed text from the video clip (if applicable) ● Scans of face geometry ● Data that may be considered a voiceprint ● User unique identifier | Biometric Passkey Uses passkey authentication with a scan of the User’s face geometry generated during enrollment and embedded in an EBT, which is associated with the passkey. The passkey is used to authenticate the User for routine access and, where required, compares the stored face scan with a facial image to verify the User’s identity. |

Qualifications & exceptions

• The face scan is generated during enrollment and embedded in an EBT associated with the passkey.
• Face comparison occurs only 'where required'; routine access uses the passkey.
• Background audio is optional and at the Customer's option.
• The 365-day face-scan storage maximum stated for these services applies.

Account & Service Control · Procedure

One-Time Password verifies phone possession by sending a unique code to the User's number

One-Time Password (OTP) verifies that the User is in possession of the phone number by sending a unique code to the User's phone number for validation. The listed data is the telephone number and, where applicable, information related to the risk profile of the telephone number.

Supporting quotations

| Categories of Personal Data ● Telephone number; and ● Information related to the risk profile of a telephone number, where applicable | One-Time Password (“OTP”) Verifies that the User is in possession of the phone number by sending a unique code to the User’s phone number for validation. |

Qualifications & exceptions

• Telephone risk-profile information is included only where applicable.

Account & Service Control · Company practice

Passkey lets Users enroll and authenticate accounts with passkeys

The Passkey service provides capabilities for Users to enroll and authenticate their accounts with passkeys. The listed data is a User unique identifier.

Supporting quotations

| Categories of Personal Data • User unique identifier | Passkey Provides capabilities for Users to enroll and authenticate their accounts with Passkeys. |

Not stated here

• The notice does not describe the passkey protocol, storage location or recovery process for this service.