Jumio destroys biometric data within three years after it is first provided, subject to shorter legal periods
The Notice states a general rule that Jumio will permanently destroy biometric data derived from images and recordings in its possession within three years after the user first provided those images or videos, except where a shorter period is required by law. The next paragraph states a separate rule where Jumio serves as a processor or service provider.
Details
Who
Jumio
What it does
permanently destroy biometric data
What it covers
biometric data derived from images and recordings
When
within three years after you first provided the images or videos
Exception
where a shorter period is required by law
Supporting quotations
Jumio will permanently destroy such biometric data derived from images and recordings in its possession within three years, except where a shorter period is required by law after you first provided those images or videos.
Qualifications & exceptions
The three-year clock starts when the user first provided the images or videos.
A shorter period applies where required by law.
This paragraph does not itself state the role in which Jumio holds the data; the following paragraph gives a separate processor rule.
Not stated here
The Notice does not state how destruction is performed or whether it covers backups and disaster-recovery copies.
As processor, Jumio destroys biometric data per Customer instructions, capped by relationship end or three years
Where Jumio serves as a processor or service provider, the Notice says it will permanently destroy biometric data in its possession in accordance with the Customer's instructions, but no later than the earlier of (i) the date the Customer ceases to have a relationship with Jumio or (ii) a date within three years after the Customer informs Jumio that its last interaction with the user occurred, except where a shorter period is required by law.
Details
Who
Jumio
Condition
where Jumio serves as a processor or service provider
What it does
permanently destroy biometric data per Customer instructions
When
earlier of Customer relationship end or within three years after the Customer's last-interaction notice
Exception
where a shorter period is required by law
Supporting quotations
Where Jumio serves as a processor (or service provider), we will permanently destroy any such biometric data in our possession in accordance with the Customer’s instructions but no longer than the earlier of the date (i) that the Customer ceases to have a relationship with Jumio or (ii) that is within three years, except where a shorter period is required by law, after the date that the Customer informs Jumio its last interaction with you has occurred.
Qualifications & exceptions
This rule applies only where Jumio acts as a processor or service provider.
The three-year branch is measured from the Customer's notice of last interaction, not from the user's own provision of the data.
Not stated here
The Notice does not state what happens if the Customer never informs Jumio of its last interaction.
Jumio retains personal information as long as necessary for Section 6 purposes, legal obligations or legal claims
Except as otherwise provided in the Notice, Jumio says it retains personal information for as long as necessary to fulfill the purposes outlined in Section 6, comply with legal obligations, or defend against potential legal claims.
Except as otherwise provided in this Notice, we retain personal information for as long as necessary to: (i) fulfill the purposes outlined in Section 6, (ii) comply with legal obligations, or (iii) defend against potential legal claims.
Qualifications & exceptions
The rule is expressly subject to other retention provisions in the Notice, including the biometric-data rule in Section 5.
'As long as necessary' is not a fixed period.
Not stated here
The Notice does not state a general maximum retention period; further retention information is available on request.
Cross-references
qualified by (model-proposed): As processor, Jumio retains personal information only as instructed by the Customer — The general retention rule is expressly subject to other provisions in the Notice; where Jumio is a processor or service provider, retention follows the Customer's instructions rather than the general necessity standard.
Retention & Deletion · Company practice
As processor, Jumio retains personal information only as instructed by the Customer
Where Jumio is a processor or service provider, it says it retains personal information only as instructed by the Customer.
Details
Who
Jumio
Condition
where Jumio is a processor or service provider
What it does
retain personal information only as instructed by the Customer
Supporting quotations
Where Jumio is a processor (or service provider), we retain personal information only as instructed by the Customer.
Qualifications & exceptions
This rule applies only where Jumio acts as a processor or service provider; the general retention rule is stated separately.
Not stated here
The Notice does not describe what the Customer's instructions typically require.
Further retention-period information is available on request
The Notice says further information on retention periods for personal information is accessible upon request through the contact details in Section 16.
Details
Who
Jumio
What it does
provide retention-period information on request
What it covers
retention periods
Supporting quotations
If you require further information on the retention periods regarding the processing of your personal information, they are accessible upon request via the contact details provided in Section 16.
Qualifications & exceptions
The Notice does not state that the retention periods themselves are in the Notice.
Not stated here
The Notice does not state the form or timing of the response to a request.