Onfido Privacy Policy

Legal Rights & Agreement Rules · Context

This page is the Entrust Identity Verification Services product privacy notice, last updated September 30, 2026

The saved page is titled 'Entrust Identity Verification Services Product Privacy Notice' and states that it was last updated on September 30, 2026. It is a product-specific privacy notice for the Entrust identity verification Services. The saved buffer registration names it the Onfido Privacy Policy; the notice itself names Onfido Ltd as the controller for controller-side processing.

Supporting quotations

Entrust Identity Verification Services Product Privacy Notice

Last updated: September 30, 2026

Qualifications & exceptions

• The notice is product-specific: it addresses the Entrust Identity Verification Services rather than all Entrust or Onfido processing.
• The saved capture's retrieval record did not observe the HTTP status or redirect destination for the source URL.

Not stated here

• Whether the page at onfido.com/privacy and the entrust.com product-privacy page display the same version; the saved record does not establish a redirect.

Legal Rights & Agreement Rules · Context

Customers are organizations; Users are the individuals whose identities are checked

The notice defines Customers as organizations that ask Entrust to provide the Services to verify someone's identity or carry out identity-related checks. Users are the individuals whose identities a Customer has asked Entrust to verify or otherwise check through the Services.

Supporting quotations

“Customers” are organizations that have asked Entrust to provide the Services to verify someone’s identity, or to carry out checks related to their identity.

“Users” are the individuals whose identities a Customer has asked Entrust to verify or otherwise check via the Services.

Qualifications & exceptions

• These definitions govern how the notice uses 'Customer' and 'User' throughout.

Legal Rights & Agreement Rules · Context

Face scan data may be a protected biometric identifier; US policy reference

The notice says these services involve data that may be considered a scan of face geometry or voiceprint, and that may be considered biometric identifiers or biometric information under applicable biometric privacy laws. Users located in the United States should refer to the Facial Scan and Audio Recording Policy for further details.

Supporting quotations

NOTE: These services involve the use of data that may be considered a scan of face geometry or voiceprint, and which may be considered biometric identifiers or biometric information by applicable biometric privacy laws. For more information, please refer to the Facial Scan and Audio Recording Policy for further details.

Users located in the US should refer to the Facial Scan and Audio Recording Policy for further details.

Qualifications & exceptions

• The notice says the data 'may be considered' biometric identifiers or information; it does not itself classify the data under a particular law.
• The United States-specific policy reference is stated separately from the general biometric description.

Not stated here

• The Facial Scan and Audio Recording Policy is linked but not part of the saved source, so its terms are not established here.

Legal Rights & Agreement Rules · Company practice

Qualified Electronic Signature Package combines ETSI-certified identity verification with a qualified signature

The Qualified Electronic Signature (QES) Package provides ETSI-certified identity verification and issuance of a qualified electronic signature, as set out in the product guide. The listed data is full name, email address, telephone number, and information extracted from or describing the identity document.

Supporting quotations

| Other Services |

| Categories of Personal Data ● Full name ● Email address ● Telephone number; and ● information extracted from, or describing, the identity document | Qualified Electronic Signature (“QES”) Package ETSI certified identity verification and issuance of a qualified electronic signature, as set out in the product guide. |

Qualifications & exceptions

• The service is described as ETSI-certified and the details are set out in the product guide.

Not stated here

• The product guide is not part of the saved source, so the signature issuance process and any additional terms are not established here.

Legal Rights & Agreement Rules · Context

Identity Verification Services integrate with other Entrust offerings under their own privacy notices

Entrust Identity Verification Services integrate with other Entrust offerings, including Identity as a Service (IDaaS), Identity Verification as a Service (IDVaaS) and Workflow Signing Services. For privacy considerations for those offerings, the notice directs readers to the relevant Entrust Product Privacy Notice.

Supporting quotations

Entrust Identity Verification Services integrate with other Entrust offerings, including Identity as a Service (IDaaS), Identity Verification as a Service (IDVaaS) and Workflow Signing Services. For more information about privacy considerations for these offerings, review the relevant Entrust Product Privacy Notice.

Qualifications & exceptions

• The notice does not state the privacy terms of the other Entrust offerings; it cross-refers to their own product notices.

Not stated here

• The relevant Entrust Product Privacy Notices for IDaaS, IDVaaS and Workflow Signing Services are not part of the saved source.

Legal Rights & Agreement Rules · Company practice

IAM platforms are independent controllers, not Entrust sub-processors; Customers must disclose their use

The identity and access management platforms operate as independent controllers of personal data processed within their services and are not sub-processors of Entrust. Customers are responsible for configuring and disclosing their use of such platforms to their end users, including how personal data is processed in connection with authentication and access management.

Supporting quotations

These identity and access management platforms operate as independent controllers of personal data processed within their services and are not sub-processors of Entrust. Customers are responsible for configuring and disclosing their use of such platforms to their end users, including how personal data is processed in connection with authentication and access management.

Qualifications & exceptions

• The controller status applies to personal data processed within the IAM platform's own services.
• The Customer bears responsibility for configuration and disclosure to end users.

Cross-references

• qualified by (model-proposed): IAM integrations exchange limited user attributes and structured verification results — The limited data exchange with an IAM platform does not make the platform an Entrust sub-processor; the notice treats the platform as an independent controller within its own services.

Legal Rights & Agreement Rules · Context

Customers may have extra legal duties for biometric and sensitive-data Services

Where a Customer makes the listed Services available to a User, the Customer may be subject to additional obligations under applicable data protection laws, particularly where the Services involve biometric data or other sensitive personal data. These may include providing appropriate notices to Users, obtaining required consents, and complying with legal requirements for collection, use, storage and retention. In certain jurisdictions, including the United States, the Services involve data that may be considered biometric identifiers or biometric information, and additional requirements may apply; Customers are responsible for ensuring compliance.

Supporting quotations

Obligations for Biometric and Sensitive Data Processing

Where the Customer makes any of the following Services available to a User, the Customer may be subject to additional obligations under applicable data protection laws, particularly where those Services involve the processing of biometric data or other sensitive personal data.

These obligations may include providing appropriate notices to Users, obtaining any required consents, and complying with applicable legal requirements relating to the collection, use, storage, and retention of such data.

In certain jurisdictions (including the United States), these Services involve the processing of data that may be considered biometric identifiers or biometric information under applicable laws, and additional requirements may apply. Customers are responsible for ensuring compliance with such requirements.

Qualifications & exceptions

• The obligations fall on the Customer, not Entrust.
• The notice says the Customer 'may' be subject to additional obligations, depending on applicable law and the Services used.
• The notice says the data 'may be considered' biometric identifiers or information; it does not itself classify it under a specific law.

Not stated here

• The exact obligations vary by jurisdiction and are not enumerated in the notice.

Legal Rights & Agreement Rules · Context

Covered Services include Facial Similarity Checks, Known Faces, authentication, liveness and document checks

The Services to which the biometric and sensitive-data obligations apply include: Facial Similarity Check - Selfie, Selfie Auto, Video and Motion; Known Faces; Document Known Faces; Authentication: Motion, Face Authentication and Biometric Passkey; Liveness Verification; and Document Check, Document Check Video and Document Check Driver Verification.

Supporting quotations

These services include:

Facial Similarity Check – Selfie, Selfie Auto, Video, Motion

Known Faces

Document Known Faces

Authentication: Motion, Face Authentication, Biometric Passkey

Liveness Verification

Document Check, Document Check Video, Document Check Driver Verification

Qualifications & exceptions

• The list is introduced by 'These services include:' in the section on obligations for biometric and sensitive data processing.
• The list cross-refers to the obligations card; it does not itself state new obligations.

Legal Rights & Agreement Rules · Company commitment

Reports do not determine any outcome for a User; the Customer is solely responsible for acting on them

Reports reflect the outcome of the checks performed and provide an assessment, including an overall result of Clear or Consider and supporting reasons. They are provided for the Customer's use and do not, on their own, determine any outcome relating to a User. The Customer is solely responsible for determining how to act on the information, including making any decisions regarding the User.

Supporting quotations

Reports reflect the outcome of the checks performed and provide an assessment, including an overall result of ‘Clear’ or ‘Consider’ and supporting reasons. Reports are provided for the Customer’s use and do not, on their own, determine any outcome relating to a User. The Customer is solely responsible for determining how to act on the information provided, including making any decisions regarding the User.

Qualifications & exceptions

• The Report is an assessment and does not itself decide any outcome for the User.
• The Customer bears sole responsibility for decisions made from the Report.

Cross-references

• qualified by (model-proposed): Each Report gives an overall result of Clear or Consider, with reasons for a Consider result — A Clear or Consider result is an assessment, not a decision about the User: the Customer remains solely responsible for how to act on the Report.

Legal Rights & Agreement Rules · Company practice

Entrust acts as controller for this processing; EEA and UK Users get a legal basis for each purpose

The notice distinguishes Entrust's processor role when providing the Services to Customers from its controller role when processing personal data on its own behalf for the purposes in this section. If a User is in the European Economic Area or United Kingdom, Entrust says it will only use the User's personal data for a particular purpose where it has a legal basis, and it sets out those legal bases for each purpose. Onfido Ltd is the Controller for this processing, and the Contact Information section explains how to contact it.

Supporting quotations

Using Personal Data as Controller

As explained above, when we use personal data to provide the Services to our Customers, we are acting on their behalf as their service provider and processor. However, we also process the personal data of Users, and others, on our own behalf (as a “Controller”) for the purposes described in this section.

If a User is in the European Economic Area or United Kingdom, we will only use your personal data for a particular purpose where we have a “legal basis” for this. We have set out below the legal bases we rely upon for each purpose. Onfido Ltd is the Controller for this processing.

Qualifications & exceptions

• The legal-basis limitation is stated for Users in the European Economic Area or United Kingdom.
• Onfido Ltd is named as the controller for this processing.

Cross-references

• refers to (model-proposed): Entrust is controller for controller-side processing; rights depend on residence and applicable law — The rights section applies to the controller-side processing described earlier and states that availability depends on residence and applicable privacy law.

Legal Rights & Agreement Rules · Context

Development processing relies on legitimate interests in tackling fraud

Entrust processes personal data for the development purposes on the basis that it is necessary for the legitimate interests of its Customers and Entrust. It describes financial crime, fraud and corruption as serious issues affecting law enforcement, financial institutions, the private sector, major corporations and individuals, and considers there is a clear legitimate interest in improving and developing the Services to continue effectively tackling and reducing fraud.

Supporting quotations

We process personal data for these purposes on the basis that it is necessary for the legitimate interest of our Customers and Entrust. Financial crime, fraud, and corruption are serious issues that affect not only the law enforcement community but financial institutions, the private sector, and other major corporations – as well as individuals themselves. As such, Entrust considers there is a clear legitimate interest in improving and developing the Services for the purpose of continuing to effectively tackle and reduce fraud.

Qualifications & exceptions

• This is Entrust's stated basis for the development purpose, not a determination that the basis is legally sufficient.

Cross-references

• qualified by (model-proposed): Sensitive data for development is processed mainly on a substantial-public-interest basis, with safeguards — Sensitive personal data used for development is primarily processed on a substantial-public-interest basis, qualifying the general legitimate-interest basis described for development.

Legal Rights & Agreement Rules · Company practice

Sensitive data for development is processed mainly on a substantial-public-interest basis, with safeguards

Where Entrust uses sensitive personal data for the development purposes, such as information that could potentially reveal racial or ethnic origin, it primarily processes the information on the basis that it is necessary for reasons of substantial public interest. The stated public interests include ensuring equality of treatment across all types of Users by measuring and mitigating algorithmic bias, to provide fair and inclusive Services that effectively detect fraud, balanced against Users' rights and freedoms. Entrust says it implements specific safeguards when developing the Services, including pseudonymization where possible, impact assessments and strict security controls.

Supporting quotations

Where we use sensitive personal data for these purposes (for example, information which could potentially reveal information about someone’s racial or ethnic origin), we primarily process this information on the basis that it is necessary for reasons of substantial public interest. Such public interests include ensuring equality of treatment across all types of Users by measuring and mitigating algorithmic bias with a view to providing fair and inclusive Services, which effectively detect fraud, and are balanced against the rights and freedoms of Users. When developing the Services, we implement specific measures to safeguard the rights and freedoms of those individuals whose data is used for this purpose, including pseudonymization (where possible), impact assessments and strict security controls to safeguard their fundamental rights and their interests.

Qualifications & exceptions

• Sensitive data is processed 'primarily' on this basis, leaving room for other bases not described here.
• The examples of sensitive data are illustrative ('for example').
• Safeguards include pseudonymization where possible, impact assessments and strict security controls.

Cross-references

• qualifies (model-proposed): Development processing relies on legitimate interests in tackling fraud — Sensitive personal data used for development is primarily processed on a substantial-public-interest basis, qualifying the general legitimate-interest basis described for development.

Legal Rights & Agreement Rules · Context

Statistics processing relies on legitimate interests in understanding aggregate Service use

Entrust processes personal data for the statistics purposes on the basis that it is necessary for Entrust's and its Customer's legitimate interests in understanding, at the aggregate level, how people are using its Identity Services.

Supporting quotations

We process personal data for these purposes on the basis that it is necessary for Entrust’s and our Customer’s legitimate interests in understanding (at the aggregate level) how people are using our Identity Services.

Qualifications & exceptions

• The stated interest is understanding use at the aggregate level.

Legal Rights & Agreement Rules · Company practice

Entrust processes data where needed for legal obligations, legal rights or vital interests

Entrust may process personal data about Customers' Users where necessary for compliance with a legal obligation, to exercise, establish or defend legal rights or claims, or to protect someone's vital interests. For example, it may be required by law to disclose information in response to a request from a government or law enforcement body, as described in the Government and Law Enforcement Requests section.

Supporting quotations

For compliance with applicable law/regulation, to exercise, establish or defend legal rights or claims, or to protect someone’s vital interests

Entrust may process the personal data we collect about our Customers’ Users (as described above) where this is necessary for compliance with a legal obligation, to exercise, establish or defend legal rights or claims, or to protect someone’s vital interests. For example, we may be required by law to:

disclose information in response to a request from a government or law enforcement body as described in the section below headed “Government and Law Enforcement Requests”;

Qualifications & exceptions

• The disclosure example is one illustration of processing under this purpose.
• Government and law enforcement requests are addressed in a separate section of the notice.

Legal Rights & Agreement Rules · Company practice

Entrust may process User data for business transactions and professional advice under legitimate interests

Entrust may need to process a User's personal data in connection with an actual or proposed divestiture, merger, acquisition, joint venture, bankruptcy, dissolution, reorganization or any other similar transaction or proceeding, or to obtain professional advice. It states that it processes personal data for these purposes on the basis that it is necessary for Entrust's legitimate interest in running its business in a commercial and compliant manner.

Supporting quotations

In connection with a business transaction or obtaining professional advice

Entrust may need to process a User’s personal data in connection with an actual or proposed divestiture, merger, acquisition, joint venture, bankruptcy, dissolution, reorganization, or any other similar transaction or proceeding, or to obtain professional advice. We process personal data for these purposes on the basis that it is necessary for Entrust’s legitimate interest in running its business in a commercial and compliant manner.

Qualifications & exceptions

• The transactions listed are examples of similar proceedings.
• The stated basis is Entrust's legitimate interest in running its business commercially and compliantly.

Legal Rights & Agreement Rules · Company practice

Cross-border transfers outside the EEA use Standard Contractual Clauses or another safeguard

The sharing of personal data may involve cross-border transfers. Entrust says it makes cross-border transfers in accordance with relevant data privacy law requirements. For example, it ensures that personal data transferred outside the EEA benefits from an adequate level of protection by requiring sub-processors to enter into European Commission-approved Standard Contractual Clauses, and/or their UK and Switzerland equivalents, if they are not in a country with an adequacy decision and there is no alternative transfer safeguard.

Supporting quotations

International Data Transfers

The sharing of personal data may involve the cross-border transfer of personal data. Entrust makes cross-border transfers of personal data in accordance with relevant data privacy law requirements. For example, we ensure that personal data that is transferred outside of the EEA benefits from an adequate level of protection by requiring sub-processors to enter into the European Commission approved Standard Contractual Clauses (and/or their UK and Switzerland equivalents) if they are not in a country that has the benefit of an adequacy decision and if there is no alternative transfer safeguard.

Qualifications & exceptions

• Standard Contractual Clauses are required only if the destination lacks an adequacy decision and there is no alternative transfer safeguard.
• The UK and Switzerland equivalents may be used alongside the EU clauses.

Legal Rights & Agreement Rules · Procedure

Users must contact the Customer for processor-side privacy requests; Entrust assists the Customer

The Customer is the controller for all personal data Entrust processes to provide the Services. A User of an Entrust Customer who wishes to exercise data privacy rights over that processor-side processing should contact the Customer so it can respond directly. If the User contacts Entrust instead, Entrust will notify the Customer so the Customer can address the request. Entrust, as processor/service provider, will assist the Customer to the extent reasonable and practicable in responding to data subject requests the Customer receives about the Services.

Supporting quotations

Data Privacy Rights

The Customer is the controller for all personal data processed by Entrust for the purpose of providing the Services. If you are a User of an Entrust Customer and you wish to exercise your data privacy rights in relation to how we use your personal data as described in the section of this notice headed “The Personal Data We Process on Behalf of Our Customers”, please contact the Customer so they may respond to you directly. If you contact us instead of our Customer, we will notify the Customer so they are able to address your request. Entrust, as the processor/service provider, will assist the Customer, to the extent reasonable and practicable, in responding to data subject requests the Customer receives with respect to the Services.

Qualifications & exceptions

• This route applies to personal data Entrust processes to provide the Services on the Customer's behalf.
• Entrust's assistance to the Customer is limited to the extent reasonable and practicable.

Legal Rights & Agreement Rules · Context

Entrust is controller for controller-side processing; rights depend on residence and applicable law

Entrust is the controller for the processing described in the 'Using Personal Data as Controller' section. Depending on where the individual lives and subject to applicable privacy law, the individual may have the rights listed in the following items in respect of that processing.

Supporting quotations

Entrust is the controller for the processing of personal data described under the section of this notice headed “Using Personal Data as Controller.” Depending on where you live and subject to applicable privacy law, you may have the following rights in respect of this processing:

Qualifications & exceptions

• The rights apply to controller-side processing, not to data Entrust processes as the Customer's processor.
• Availability depends on where the individual lives and on applicable privacy law.

Cross-references

• referred to by (model-proposed): Entrust acts as controller for this processing; EEA and UK Users get a legal basis for each purpose — The rights section applies to the controller-side processing described earlier and states that availability depends on residence and applicable privacy law.

Legal Rights & Agreement Rules · User right or choice

Controller-side rights include access, correction, suppression, objection and deletion

For controller-side processing, the listed rights include the right to request access to and disclosure of personal data; the right to change or correct personal data if inaccurate; the right to block or suppress processing, enabling a request that Entrust suspend processing in certain circumstances; the right to object to processing based on a legitimate interest (of Entrust or a third party) where the individual feels it impacts their fundamental rights and freedoms; and the right to request deletion of personal data, subject to certain exceptions. Entrust notes it may demonstrate compelling legitimate grounds that override the objection rights and freedoms.

Supporting quotations

the right to request access to and disclosure of your personal data.

the right to change and/or correct your personal data if it is inaccurate.

the right to block or suppress our processing of your personal data. (This enables you to request that Entrust suspends the processing of your data in certain circumstances.)

the right to object to our processing of your personal data where we are relying on a legitimate interest (or those of a third party) and you feel such processing impacts on your fundamental rights and freedoms. (In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal data which override your rights and freedoms.)

the right to request that we delete your personal data, subject to certain exceptions.

Qualifications & exceptions

• The suppression right operates 'in certain circumstances'.
• The objection right is qualified by Entrust's possible showing of compelling legitimate grounds that override it.
• The deletion right is 'subject to certain exceptions'.

Legal Rights & Agreement Rules · User right or choice

Controller-side rights also include portability, consent withdrawal and regulator complaints

The listed rights also include the right to request portability of personal data, with Entrust providing the individual or a chosen third party the data in a structured, commonly used, machine-readable format; the right to withdraw consent where applicable, without affecting the lawfulness of processing before withdrawal or processing conducted on other lawful grounds; and the right to lodge a complaint with the local data protection authority or regulator.

Supporting quotations

the right to request portability of your personal data. We will provide you, or a third party you have chosen, with your personal data in a structured, commonly used, machine-readable format.

the right to withdraw your consent, if applicable. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your information conducted in reliance on lawful processing grounds other than consent.

the right to lodge a complaint with your local data protection authority or regulator.

Qualifications & exceptions

• Portability is provided in a structured, commonly used, machine-readable format.
• Consent withdrawal does not affect prior lawful processing or processing based on other lawful grounds.
• The consent right applies only 'if applicable'.

Legal Rights & Agreement Rules · Procedure

Controller-side rights are exercised by email or post, without discrimination

To exercise rights over controller-side processing, the notice directs individuals to identity-privacyrequests@entrust.com or the postal address below. It states that if an individual exercises any of the data protection rights detailed in the section, Entrust will not discriminate against them.

Supporting quotations

If you wish to exercise your rights in relation to how we use your personal information as described under the section headed “Using Personal Data As Controller”, please contact us at identity-privacyrequests@entrust.com or at the postal address below. If you exercise any of your data protection rights detailed in this section, we will not discriminate against you.

Qualifications & exceptions

• The contact route applies to the controller-side processing described in the section.

Legal Rights & Agreement Rules · Procedure

Government and law enforcement requests go to the Customer unless a legal requirement compels disclosure

A government or law enforcement body seeking personal data or confidential information about a check on a particular User should contact the Customer on whose behalf the check was carried out. Because Entrust provides the Services on behalf of Customers, it says it cannot disclose information related to a specific check unless the relevant Customer directs it to, or Entrust is subject to a legal requirement such as a court order or statutory power mandating disclosure. A body that has such a legal requirement should contact identity-privacyrequests@entrust.com with clear details of the legal requirement in its message.

Supporting quotations

Government and Law Enforcement Requests

If you are a government or law enforcement body that wishes to request personal data or confidential information related to a check that we may have conducted on a particular User, please contact the Customer on whose behalf the check was carried out. Since we provide our Services on behalf of our Customers, we are not able to disclose any information related to a specific check unless the relevant Customer directs us to do so, or we are subject to a legal requirement (such as a court order or statutory power mandating disclosure) to do so. If you wish to request the disclosure of information in respect of which there is such a legal requirement, please contact us at identity-privacyrequests@entrust.com providing clear details of the legal requirement in your message. providing clear details of the legal requirement in your message.

Qualifications & exceptions

• The general route is to the Customer, not Entrust.
• Disclosure without Customer direction requires a legal requirement such as a court order or statutory power.
• The saved text repeats the closing phrase 'providing clear details of the legal requirement in your message.' twice.

Legal Rights & Agreement Rules · Company practice

Entrust may update the notice; material changes are communicated and the last-updated date shows effect

Entrust may update this Product Privacy Notice from time to time to reflect changes in its processing practices, applicable laws or operational requirements. Where it makes material changes, it will take reasonable steps to inform affected individuals, which may include notice through the product, by email or by other appropriate means. The updated notice will be available at https://www.entrust.com/legal-compliance/product-privacy, and the 'last updated' date will indicate when the changes became effective.

Supporting quotations

Amendments to this Privacy Notice

We may update this Product Privacy Notice from time to time to reflect changes in our processing practices, applicable laws, or operational requirements.

Where we make material changes to this notice, we will take reasonable steps to inform affected individuals, which may include providing notice through the product, by email, or by other appropriate means.

The updated notice will be made available at https://www.entrust.com/legal-compliance/product-privacy, and the

“last updated” date will indicate when the changes became effective.

Qualifications & exceptions

• Updates may occur from time to time, not on a fixed schedule.
• Notice of material changes may be through the product, email or other appropriate means.
• The notice does not state an advance-notice period.

Not stated here

• The notice does not state how far in advance material changes take effect or whether continued use signifies acceptance.

Legal Rights & Agreement Rules · Procedure

Privacy questions go to Onfido Limited in London; the DPO is contactable through Mishcon de Reya

Questions about the notice go to Onfido Limited at identity-privacyrequests@entrust.com or Attention: Privacy Office, 9 Devonshire Square, 4th Floor, London, United Kingdom, EC2M 4YF. To raise a concern or communicate with the Data Protection Officer, the notice gives DPO@mishcon.com, Attention: Entrust DPO, Mishcon de Reya LLP, Africa House, 70 Kingsway, London, WC2B 6AH, United Kingdom.

Supporting quotations

Contact Information

If you would have any questions about this notice, please contact Onfido Limited at identity-privacyrequests@entrust.com or at: Attention: Privacy Office, 9 Devonshire Square, 4th Floor, London, United Kingdom, EC2M 4YF.

If you would like to raise a concern or otherwise communicate with our Data Protection Officer, you may contact them at DPO@mishcon.com Attention: Entrust DPO, Mishcon de Reya LLP, Africa House, 70 Kingsway, London, WC2B 6AH, United Kingdom

Qualifications & exceptions

• The notice names Onfido Limited as the contact for privacy questions.
• The Data Protection Officer is contacted through Mishcon de Reya LLP at the stated address.