Jumio's Privacy Notice

Use & Processing · Context

Jumio's role depends on the Customer; some EEA/UK Customers use it as a processor

Jumio makes the Services available to Customers for integration into their websites and mobile applications. For certain Customers, including some in the EEA/UK, Jumio serves as a processor (or service provider); the Notice otherwise generally describes its practices as a controller. It tells End Users to begin with the Customer with which they have an existing relationship for information about their privacy rights.

Supporting quotations

Important note: Jumio makes the Services available to our Customers (as defined below) for integration into their websites and mobile applications. For certain Customers (including some in the EEA/UK), Jumio serves as a “processor” (or “service provider”). Please begin with the Customer with which you have an existing relationship for information about your privacy rights.

This Notice generally describes Jumio’s privacy practices as a Controller.

Qualifications & exceptions

• The Notice identifies only 'certain Customers (including some in the EEA/UK)' as processor relationships; it does not name them.

Not stated here

• Which role Jumio has for a particular Customer or transaction is not stated in this Notice.
• The Customer's own contract and privacy notice are not supplied here.

Use & Processing · Company practice

Jumio provides identity verification, authentication and fraud prevention to Customers

Jumio describes an integrated identity verification, authentication, and fraud prevention Service for its Customers. The Service lets Customers verify End Users' identities by processing personal information to assess the authenticity of identity information and detect potentially fraudulent activity.

Supporting quotations

Jumio provides an integrated identity verification, authentication, and fraud prevention Service to its Customers. This Service enables our Customers to verify their End Users’ identities by processing personal information (see Section 5) to assess the authenticity of identity information and detect potentially fraudulent activity.

Qualifications & exceptions

• The description is general; the Notice does not list every verification product or feature.

Not stated here

• The Notice does not state which verification methods or data sources apply to a particular Customer's integration.

Use & Processing · Company practice

Transaction data is collected, analyzed and retained, with automated comparison and face matching

As part of the Service, Jumio collects, analyzes, and retains personal information connected with transactions on an ad–hoc and ongoing basis, including information in government-issued identification documents and facial images. The Notice says these activities may be automated and may include comparing personal information with data previously processed as part of the Service and matching an image of the user's face with the image on the identification document, to verify identity and identify patterns indicative of fraud.

Supporting quotations

As part of this Service, we collect, analyze, and retain personal information collected in connection with transactions on an ad–hoc and an ongoing basis provided by or on behalf of our Customers and their End Users, including information contained in government-issued identification documents and facial images. These processing activities may be performed in an automated manner and include comparing personal information with data previously processed as part of the Service and matching an image of your face with the image contained on your identification document in order to verify identity and identify patterns indicative of fraud.

Qualifications & exceptions

• The Notice says these activities 'may be performed in an automated manner'; it does not state that every check is automated.

Not stated here

• The Notice does not describe the matching technology, error rates, or the extent of human review in this section.

Use & Processing · Company commitment

Jumio says the Service is incrementally improved as new technology becomes practical

The Notice says Jumio is committed to improving the Service to help Customers manage evolving fraud risks, and that the Service entails incremental improvement using new technological innovations as they become practical to implement.

Supporting quotations

Jumio is committed to constantly improving its service in order to help its Customers manage evolving fraud risks. Therefore, the Service entails incremental improvement of the service making use of new technological innovations as they become practical to implement.

Qualifications & exceptions

• The pace and scope of improvement are not specified; 'as they become practical to implement' leaves the timing to Jumio.

Use & Processing · Company practice

Section 6 service purposes cover verification, fraud detection, analysis and service improvement

Section 6 says Jumio processes the Section 5 information to provide the Services, which includes verifying Customers' End User identities and preventing fraud; comparing and analyzing newly collected personal information against previously collected information to detect fraudulent activities; preventing the use of fraudulent identification documents; monitoring for and identifying fraudulent transactions; conducting ad hoc and ongoing analysis to identify fraudulent uses and sharing the results and personal information such as government-issued photo ID with a Customer with whom the user had, has, or is intending to initiate a direct relationship; and increasing the accuracy, efficiency, and effectiveness of the Services.

Supporting quotations

We process the personal information described in Section 5 for the following purposes:

To provide the Services, which includes:

Verifying our Customers’ End User identities and preventing fraud;

Comparing and analyzing newly-collected personal information relating to you or another End User against previously-collected personal information relating to you or another End User to detect fraudulent activities;

Preventing the use of fraudulent identification documents;

Monitoring for and identifying fraudulent transactions;

Conducting an ad hoc as well as ongoing analysis to identify fraudulent uses of your data and sharing the results of our analysis and your personal information (e.g, government issued photo ID) with a Customer with whom you had, have or are intending to initiate a direct relationship; and

Increasing the accuracy, efficiency, and effectiveness of the Services;

Qualifications & exceptions

• The list is introduced as purposes for which Jumio processes the Section 5 information; the items under 'To provide the Services' are introduced by 'includes'.

Not stated here

• The Notice does not state how the purposes are prioritized or which apply to a particular Service.

Use & Processing · Company practice

Analytics, machine learning, security and anonymized reports are separate stated purposes

Jumio also says it processes the Section 5 information to perform analytics and research concerning the Services and to improve the Services or develop new services, including through machine learning; to protect and improve the security of the Services; and to anonymize the personal information and generate statistical or aggregated reports.

Supporting quotations

To perform analytics and research concerning the Services and to improve the Services or develop new services, including through the use of machine learning;

To protect and improve the security of the Services; and

To anonymize the personal information and generate statistical or aggregated reports.

Qualifications & exceptions

• The machine-learning reference is part of the improvement and development purpose; the Notice does not state which data is used to train models or whether outputs are retained.

Not stated here

• The Notice does not describe the anonymization method or the content of the statistical and aggregated reports.

Use & Processing · Company practice

Jumio may use AI tools for Section 6 purposes in line with applicable AI regulations

The Notice says Jumio may use artificial intelligence tools for the purposes described in Section 6, in line with applicable AI regulations of the user's jurisdiction.

Supporting quotations

We may, for the purposes described in this Section 6, use artificial intelligence tools in line with applicable AI regulations of your jurisdiction.

Qualifications & exceptions

• The statement is limited to the Section 6 purposes and to the AI regulations of the user's jurisdiction.

Not stated here

• The notice does not identify the AI tools, the data used to train them, or the specific regulations it has in view.

Use & Processing · Company commitment

Personal information may be processed internationally under adequacy decisions or standard contractual clauses

The Notice says personal information may be transferred to and processed in the United States for the Section 6 purposes, and that the recipients described in Section 7 may process it in countries other than the user's country of residence, where data protection laws may be different from or less stringent than those in the user's country. For transfers from the EEA, Switzerland, the UK, or Brazil, Jumio says it takes measures to help protect the information, and may rely on adequacy decisions for certain countries or include standard contractual clauses in its contracts with recipients, accessible upon request through the Section 16 contact details.

Supporting quotations

Your personal information may be transferred to and processed in the United States for the purposes described in Section 6. The recipients described in Section 7 may process personal information in countries other than your country of residence. The data protection laws in these countries may be different from, or less stringent than, those in your country of residence. We take measures to help protect your personal information when it is transferred from the European Economic Area (“EEA”), Switzerland, the United Kingdom (“UK”), or Brazil to other countries. We may rely on adequacy decisions for certain countries, or include standard contractual clauses in our contracts with recipients which are accessible upon request via the contact details provided in Section 16.

Qualifications & exceptions

• The measures are described as ones Jumio 'may' rely on; the Notice does not state which measure applies to a particular transfer.
• The standard contractual clauses are accessible upon request, not reproduced in the Notice.

Not stated here

• The Notice does not identify the countries involved or the specific recipients for a particular transfer.

Use & Processing · Permission or license

Consent covers obtaining and using personal information for the Services, including biometric data and machine learning

Section 12 says that when the user provides consent, the user is consenting to Jumio obtaining and using personal information (Section 5) to enable provision of the Services to Customers (Section 3). The Notice says this may include processing special categories of personal information, such as biometric data, and is partly based on machine learning and facial recognition algorithms.

Supporting quotations

12. Your consent

When you provide your consent to us, you are consenting to Jumio obtaining and using your personal information (see Section 5) to enable our provision of the Services to our Customers (see Section 3), which may include the processing of special categories of personal information (e.g. biometric data) and is partly based on machine learning and facial recognition algorithms.

Qualifications & exceptions

• The consent description cross-refers to Sections 3 and 5 for the Services and data categories; it does not repeat every item.
• The Notice says the processing 'may include' special categories and 'is partly based on' machine learning and facial recognition.

Not stated here

• The Notice does not state how consent is collected, recorded, or scoped to particular processing.

Cross-references

• refers to (model-proposed): Section 5 lists identifiers, identification images, government IDs, financial details and images — The Section 12 consent description expressly incorporates the Section 5 data categories by cross-reference and does not repeat them.
• qualified by (model-proposed): Consent can be withdrawn at any time; Jumio may retain information afterward on stated legal grounds — The consent described in p3-001 may be withdrawn at any time; withdrawal does not affect the lawfulness of earlier consent-based processing, and Jumio may retain information afterward only on the stated legal grounds.