Jumio's Privacy Notice

Legal Rights & Agreement Rules · Context

Jumio Online Services Privacy Notice, last updated August 4, 2026

This document is Jumio's Online Services Privacy Notice. It says it describes the privacy practices of Jumio Corporation concerning personal information collected in connection with Jumio's provision of verification, authentication, and related online services (the “Services”). It gives August 4, 2026 as the last updated date and does not state a separate effective date. It also says the scope of consent is described in Section 12.

Supporting quotations

Jumio Online Services Privacy Notice

Last Updated: August 4, 2026

This Privacy Notice (“Notice”) describes the privacy practices of Jumio Corporation (“Jumio,” “us,” or “we”) concerning personal information collected in connection with Jumio’s provision of verification, authentication, and related online services (the “Services”).

The scope of your consent is described in Section 12 (“Your consent”).

Qualifications & exceptions

• The only date stated for this version is 'Last Updated: August 4, 2026'; no separate effective date appears.

Not stated here

• Whether an earlier or later version exists is not established by this saved copy.

Legal Rights & Agreement Rules · Context

Website, Customer-portal and Washington health-data notices are separate from this Notice

The Notice says Jumio's Website Privacy Notice describes its privacy practices for its website and Customer portals. It also directs individuals protected by the Washington State My Health, My Data Act to a separate Washington State Consumer Health Privacy Notice. Both documents are linked but their text is not part of this saved source.

Supporting quotations

Our Website Privacy Notice describes our privacy practices in connection with our website and Customer portals. For individuals protected by the Washington State My Health, My Data Act, please see our Washington State Consumer Health Privacy Notice.

Qualifications & exceptions

• The Notice only points to the linked notices; it does not state whether their practices differ from or add to this Notice.

Not stated here

• The text of the linked Website Privacy Notice is not supplied here.
• The text of the linked Washington State Consumer Health Privacy Notice is not supplied here.

Legal Rights & Agreement Rules · Context

Controller and processor roles turn on who decides and who follows instructions

The Notice explains that privacy laws in certain jurisdictions distinguish controllers (or businesses), which decide why and how personal information is processed, from processors (or service providers), which process personal information on behalf of a controller or business under its instructions.

Supporting quotations

Data protection and privacy laws in certain jurisdictions differentiate between “controllers” (or “businesses”) and “processors” (or “service providers”).

Controller/business: decides why and how to process personal information.

Processor/service provider: processes personal information on behalf of a Controller/Business pursuant to provided instructions.

Qualifications & exceptions

• These are the Notice's own definitions; it does not cite a particular statute for them.

Legal Rights & Agreement Rules · Company practice

Legal, safety, business-transfer and legal-process purposes are also stated

The Notice says Jumio may also process the Section 5 information to establish, exercise or defend legal claims; investigate, prevent, or act on illegal activities, suspected fraud, violations of its terms and conditions, or threats to property or physical safety; facilitate financing, securitization, insuring, sale, assignment, bankruptcy or other disposal of all or part of its business or assets; respond to valid and enforceable subpoenas, court orders, and other legal process, or as otherwise required by law; and comply with legal or regulatory requirements.

Supporting quotations

We may also process the personal information listed in Section 5 to:

Establish, exercise or defend legal claims;

Investigate, prevent, or act with respect to illegal activities, suspected fraud, violations of our terms and conditions, or situations involving threats to our property, or the property or physical safety of any person or third party;

Facilitate the financing, securitization, insuring, sale, assignment, bankruptcy, or other disposal of all or part of Jumio’s business or assets;

Respond to valid and enforceable subpoenas, court orders, and other legal process, or as otherwise required by law; and

Comply with legal or regulatory requirements.

Qualifications & exceptions

• These purposes are additional to the service purposes, introduced by 'We may also process...'.

Not stated here

• The Notice does not state which recipients receive information for each of these purposes.

Legal Rights & Agreement Rules · User right or choice

Depending on location, users may have access, deletion, correction, objection, withdrawal and complaint rights

The Notice says that, depending on location, users may have the right to access or obtain a copy of their personal information; delete it; correct inaccurate information; object to or restrict processing; withdraw consent; and lodge a complaint with a supervisory authority or regulatory agency.

Supporting quotations

Depending on your location, you may have the right to:

Access or obtain a copy of your personal information.

Delete your personal information.

Correct inaccurate personal information.

Object to or restrict processing of your personal information.

Withdraw your consent (see Section 12 below).

Lodge a complaint with a supervisory authority or regulatory agency.

Qualifications & exceptions

• The rights are introduced by 'Depending on your location' and 'may have the right to', so they are not stated as available everywhere.
• The withdrawal right cross-refers to Section 12.

Not stated here

• The Notice does not map each right to a jurisdiction or state the conditions or exceptions for each.

Cross-references

• qualified by (model-proposed): Rights are exercised by email, with identity verification, an appeal route and no discrimination — The rights listed in p2-010 depend on the user's location and are exercised through the email procedure in p2-011, which may require identity verification and offers a possible appeal after a denial.

Legal Rights & Agreement Rules · Procedure

Rights are exercised by email, with identity verification, an appeal route and no discrimination

To exercise the rights, the Notice says to email Jumio. Jumio may need to verify the user's identity first. If Jumio denies a request, the user may have the right to appeal by sending an email to the same address. The Notice says Jumio will not discriminate against the user for exercising the rights.

Supporting quotations

To exercise these rights, please email [[email protected]](https://www.jumio.com/cdn-cgi/l/email-protection#71352223311b041c181e5f121e1c). We may need to verify your identity first, and if we deny a request, you may have the right to appeal by sending an email to the same address. We will not discriminate against you for exercising any of the above rights.

Qualifications & exceptions

• The email address is rendered as a Cloudflare-protected placeholder in the saved text; the actual address is not visible in this source.
• The appeal right is stated as 'you may have the right to appeal', not as an unconditional right.

Not stated here

• The Notice does not state a response time, the identity-verification method, or the appeal procedure's steps.

Cross-references

• qualifies (model-proposed): Depending on location, users may have access, deletion, correction, objection, withdrawal and complaint rights — The rights listed in p2-010 depend on the user's location and are exercised through the email procedure in p2-011, which may require identity verification and offers a possible appeal after a denial.

Legal Rights & Agreement Rules · User right or choice

Consent-based processing can be withdrawn at any time without affecting prior lawfulness

The rights section also says that where Jumio processes personal information based on consent, the user may withdraw consent at any time, without affecting the lawfulness of processing based on consent before the withdrawal.

Supporting quotations

Where we process your personal information based on your consent, you may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Qualifications & exceptions

• The statement is limited to processing based on consent and does not affect processing on other legal bases.

Not stated here

• The Notice does not state how withdrawal is communicated or how quickly it takes effect.

Legal Rights & Agreement Rules · User right or choice

Consent can be withdrawn at any time; Jumio may retain information afterward on stated legal grounds

Section 12 says the user may withdraw consent at any time, and withdrawal does not affect the lawfulness of processing based on consent before the withdrawal. If Jumio collected information on the basis of consent and the user withdraws, Jumio may retain the information independent of consent as permitted by applicable law and to the extent necessary to establish, exercise or defend legal claims, comply with legal obligations, or identify potentially fraudulent transactions.

Supporting quotations

You may withdraw your consent at any time. The withdrawal of your consent does not affect the lawfulness of processing based on your consent before its withdrawal. If Jumio has collected your personal information on the basis of your consent and you then withdraw your consent, Jumio may retain your personal information independent of your consent as permitted by applicable law and to the extent necessary to establish, exercise or defend legal claims, to comply with legal obligations, or to identify potentially fraudulent transactions.

Qualifications & exceptions

• Post-withdrawal retention is limited to the three stated grounds and to what is permitted by applicable law.
• The withdrawal right does not itself require deletion of information collected before withdrawal.

Not stated here

• The Notice does not state a deletion timeline for information held solely on consent or how a withdrawal request is processed.

Cross-references

• qualifies (model-proposed): Consent covers obtaining and using personal information for the Services, including biometric data and machine learning — The consent described in p3-001 may be withdrawn at any time; withdrawal does not affect the lawfulness of earlier consent-based processing, and Jumio may retain information afterward only on the stated legal grounds.

Legal Rights & Agreement Rules · Procedure

Brazilian residents can contact Jumio's Data Protection Officer and Encarregado

Section 13 identifies Jumio's Data Protection Officer and Person in Charge ('Encarregado'), Joe Kaufmann, and says he may be contacted at the email address shown.

Supporting quotations

Jumio’s Data Protection Officer and Person in Charge (“Encarregado”), Joe Kaufmann, may be contacted at [[email protected]](https://www.jumio.com/cdn-cgi/l/email-protection#3a4a48534c5b59437a504f57535514595557).

Qualifications & exceptions

• The email address is rendered as a Cloudflare-protected placeholder in the saved text; the actual address is not visible in this source.

Not stated here

• The actual email address and any response time are not visible in this saved copy.

Legal Rights & Agreement Rules · Context

For EEA, Swiss, UK and Brazilian residents, Jumio states controller legal bases

Section 14 says that when Jumio processes personal information as a processor or service provider for its Customers, it acts on their behalf. When it processes personal information of residents of the EEA, Switzerland, the UK, or Brazil as a controller, it says it does so on these legal bases: the user's consent; the prevailing legitimate interest of Customers and Jumio to achieve the Section 6 purposes; the prevailing legitimate interest of individuals whose information is used for a fraudulent transaction not to become victims of identity theft; the necessity to comply with legal obligations; and the necessity for the establishment, exercise, or defense of legal claims.

Supporting quotations

Legal basis for processing

When we process personal information as a processor (or service provider) for our Customers, we are acting on their behalf. When we process personal information of residents of the EEA, Switzerland, the UK, or Brazil as a controller (or business), we will do so with the following legal bases:

Your consent;

The prevailing legitimate interest of our Customers and Jumio to achieve the purposes set out in Section 6;

The prevailing legitimate interest of individuals whose personal information is used for a fraudulent transaction to not become victims of identity theft;

The necessity to comply with legal obligations to which we are subject; and

The necessity for the establishment, exercise, or defense of legal claims.

Qualifications & exceptions

• The legal bases are stated only for residents of those regions and only when Jumio acts as a controller.
• The legitimate-interest bases are described as 'prevailing'.

Not stated here

• The Notice does not state which legal basis applies to which processing activity or how a user can object to a legitimate-interest basis.

Legal Rights & Agreement Rules · Company practice

Jumio may update the Notice and will provide notice of material changes appropriately

Section 15 says Jumio may update the Notice as it makes changes to the Services, recommends reviewing the privacy-notices page periodically for updates, and says notice of material changes will be provided appropriately.

Supporting quotations

15. Will this notice change?

We may update this Notice as we make changes to the Services in the future. We recommend reviewing this page periodically for any updates. Notice of material changes will be provided appropriately.

Qualifications & exceptions

• The Notice does not define 'material changes' or specify the form or timing of the notice.

Not stated here

• The linked privacy-notices page is not supplied here, so whether prior versions remain available is not established.

Legal Rights & Agreement Rules · Procedure

Jumio's privacy contacts include a Data Protection Officer and a Sunnyvale mail address

Section 16 gives Jumio's Data Protection Officer email address and a mail address: Jumio Corporation ATTN: Privacy, 100 Mathilda Place, Suite 100, Sunnyvale, CA 94086 U.S.A.

Supporting quotations

16. How do I contact Jumio?

Data Protection Officer: [[email protected]](https://www.jumio.com/cdn-cgi/l/email-protection#6010120916010319200a150d090f4e030f0d).

Mail: Jumio Corporation ATTN: Privacy | 100 Mathilda Place, Suite 100 | Sunnyvale, CA, 94086 U.S.A.

Qualifications & exceptions

• The DPO email is rendered as a Cloudflare-protected placeholder in the saved text; the actual address is not visible in this source.

Not stated here

• The actual DPO email address is not visible in this saved copy.

Legal Rights & Agreement Rules · Context

Jumio names an EU representative in Linz, Austria

Section 16 identifies Jumio's EU Representative as Jumio Software Development GmbH, Lunaplatz 5, 4030 Linz, Austria.

Supporting quotations

EU Representative: Jumio Software Development GmbH, Lunaplatz 5, 4030 Linz, Austria.

Not stated here

• The Notice does not state the EU representative's role beyond the contact details.

Legal Rights & Agreement Rules · Procedure

Unresolved privacy concerns can go to a free U.S.-based third-party dispute resolution provider

Section 16 says that if the user has an unresolved privacy or data use concern that Jumio has not addressed satisfactorily, the user can contact Jumio's U.S.-based third-party dispute resolution provider, free of charge, at the TrustArc watchdog request URL.

Supporting quotations

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at https://feedback-form.trustarc.com/watchdog/request.

Qualifications & exceptions

• The route is described for concerns Jumio has not addressed satisfactorily.
• The Notice does not state a response time or whether the provider's outcome is binding.

Not stated here

• The linked TrustArc form's terms and process are not supplied here.