Jumio's Privacy Notice

Data Access & Collection · Company practice

Providing personal information is voluntary, but the Services may not be possible without it

The Notice says that, while providing personal information is voluntary, Jumio may not be able to provide its Services to Customers without it.

Supporting quotations

While providing your personal information is voluntary, we may not be able to provide our Services to our Customers without it.

Qualifications & exceptions

• The consequence is stated as a possibility ('may not be able to provide our Services'), not as an automatic refusal.

Data Access & Collection · Company practice

Jumio collects information directly, from third-party providers and partners, and automatically

Jumio may obtain personal information directly from the End User or its Customers, from third-party service providers and partners, and automatically. The third-party examples include consumer reporting agencies, fraud prevention services, data brokers, government databases, marketing and analytics providers, and other publicly available sources. The Notice says Jumio may combine third-party information with information it already has about the End User, as permitted by applicable law.

Supporting quotations

Jumio may obtain your personal information from the following sources:

Directly from you or our Customers, such as when you use, access, or submit information in connection with the Services.

Our third-party service providers and partners, such as when our vendors provide us personal information related to you to provide us their services. As permitted by applicable law, we may combine this information with information we have about you. Our third-party service providers and partners include consumer reporting agencies, fraud prevention services, data brokers, government databases, marketing and analytics providers, and other publicly available sources.

Automatically, such as technical information necessary to provide, improve, and develop our Services.

Qualifications & exceptions

• The examples are introduced by 'such as', so the list is not exhaustive.
• Combining information is expressly limited to what is 'permitted by applicable law'.

Not stated here

• The Notice does not identify the specific providers, databases, or public sources used.

Data Access & Collection · Company practice

Authentication may install service workers said not to collect or track; cookies are covered elsewhere

For the Authentication service, Jumio may install service workers on the End User's device to speed up subsequent verifications. The Notice says these service workers do not collect any information about the user and do not track the user. Jumio may also use cookies in connection with the Services and points to its Cookie Notice.

Supporting quotations

If you use Jumio’s Authentication service, we may install service workers on your device to speed up subsequent verifications. These do not collect any information about you and do not track you. We may also use cookies in connection with the Services, which you can learn about by visiting our Cookie Notice.

Qualifications & exceptions

• The no-collection and no-tracking statement is specifically about service workers, not about cookies or other technologies.

Not stated here

• The text of the linked Cookie Notice is not supplied here.
• The Notice does not describe what the cookies collect or how long they last.

Data Access & Collection · Company practice

Section 5 lists identifiers, identification images, government IDs, financial details and images

For the purposes described in Section 6, Jumio may process personal identifiers such as names, addresses, emails and phone numbers; images of identification documents, including photographs and other information such as personal identifiers, demographic characteristics and physical characteristics; government identifiers such as driver's license and passport numbers, with certain identifiers redacted in accordance with applicable laws; financial information such as credit or debit card numbers, CVV, expiration dates and transaction information; and images or recordings such as photographs and visual or audio recordings.

Supporting quotations

For the purposes described in Section 6, Jumio may process the following information:

Personal identifiers, such as names, addresses, emails, phone numbers;

Images of identification documents, such as photographs and other information including personal identifiers, demographic characteristics, physical characteristics, etc.;

Government identifiers, such as driver’s license numbers, passport numbers, etc. (please note: we redact certain identifiers in accordance with applicable laws);

Financial information, such as credit or debit card numbers, CVV, expiration dates, transaction information;

Images or recordings, such as photographs and visual or audio recordings;

Qualifications & exceptions

• The list is introduced by 'may process', so processing any particular category is not stated as certain.
• Government identifiers are subject to redaction 'in accordance with applicable laws'.
• The examples in each item are introduced by 'such as', so they are not exhaustive.

Not stated here

• The Notice does not state which categories apply to every Service or Customer.

Cross-references

• referred to by (model-proposed): Consent covers obtaining and using personal information for the Services, including biometric data and machine learning — The Section 12 consent description expressly incorporates the Section 5 data categories by cross-reference and does not repeat them.

Data Access & Collection · Company practice

Online identifiers, geolocation and usage data are processed

The Section 5 list also includes online identifiers such as IP addresses, geolocation information such as the location of the device, and usage data. Usage data is described as internet or other network data, including the device's operating system, browser type, browser settings such as country and language preferences, and use of Jumio's website or application, such as duration of visit.

Supporting quotations

For the purposes described in Section 6, Jumio may process the following information:

Online identifiers, such as IP addresses;

Geolocation information, such as the location of your device;

Usage data, including data relating to your use of the Services such as internet or other network data, including information about your device’s operating system, browser type, browser settings (e.g., country, language preferences), or your use of our website or application (e.g., duration of visit); and

Qualifications & exceptions

• Each item is an example within the Section 5 list, which is introduced by 'may process'.

Not stated here

• The Notice does not state how precise the geolocation data is or how long usage data is retained.

Data Access & Collection · Context

Biometric Data section applies where collected data may be considered biometric in some jurisdictions

Section 5 ends its list with 'Biometric data, see below.' The Biometric Data subsection says Jumio's collection may include data that may be considered biometric data in some jurisdictions.

Supporting quotations

Biometric data, see below.

Biometric Data

Jumio’s collection of personal information may include data that may be considered biometric data in some jurisdictions.

Qualifications & exceptions

• The Notice does not identify the jurisdictions in which the data is treated as biometric.

Not stated here

• The Notice does not state which legal definitions of biometric data it is applying.

Data Access & Collection · Company practice

Biometric data is collected from selfies, videos and identification-document photos using facial recognition

The Notice says Jumio collects biometric data via facial recognition or similar technology from an image such as a selfie, from video including audio, and from an image of the user's face as it appears on an identification document the user provides.

Supporting quotations

We will collect this information via facial recognition or similar technology from an image (e.g., a selfie) or video (including audio), and from an image of your face as it appears on an identification document that you provide.

Qualifications & exceptions

• Collection is described as using 'facial recognition or similar technology'; the Notice does not name a specific algorithm or vendor.

Not stated here

• The Notice does not describe how the audio portion of a video is used.

Data Access & Collection · Restriction or exception

Services are not directed to children under 13, and Jumio says it will not knowingly collect their information

Section 14 says Jumio's Services are not directed to children under the age of 13, and Jumio will never knowingly collect information from anyone it knows is under 13. It recommends that persons over 13 but under 18 ask their parents for permission before engaging with the Services or sending information about themselves to anyone over the Internet.

Supporting quotations

Children’s privacy

Jumio’s Services are not directed to children under the age of 13, and Jumio will never knowingly collect information from anyone it knows is under the age of 13. We recommend that persons over 13, but under 18 years of age, ask their parents for permission before engaging with the Services or sending any information about themselves to anyone over the Internet.

Qualifications & exceptions

• The no-collection commitment is limited to information from a person Jumio knows is under 13.
• The recommendation for 13-to-17-year-olds is advisory ('We recommend'), not a stated prohibition.

Not stated here

• The Notice does not state what Jumio does if it learns it has collected information from a child under 13.