Jumio's Privacy Notice

Sharing & Disclosure · Company commitment

Jumio says it does not sell, share or use personal information for cross-contextual behavioral advertising

Under 'Who is Jumio?', the Notice states that Jumio does not sell, share, or otherwise use personal information for cross-contextual behavioral advertising.

Supporting quotations

Please note: we do not sell, share, or otherwise use your personal information for cross-contextual behavioral advertising.

Qualifications & exceptions

• The commitment is limited to cross-contextual behavioral advertising; Section 7 separately describes disclosures for other purposes and a California-specific sale/share statement.

Not stated here

• The Notice does not define 'cross-contextual behavioral advertising' or state how it enforces this limit.

Sharing & Disclosure · Company practice

Jumio analyzes collected data and passes risk signals to Customers

Jumio says it helps Customers prevent fraud, verify the identity of their users, and protect the integrity of End User accounts. It uses information about End Users to provide and improve the Services or develop new services for similar purposes, analyzes the collected data, and passes risk signals to Customers to warn them about potential risks in End User transactions and accounts.

Supporting quotations

Jumio is headquartered in Sunnyvale, California and has offices and Customers around the world. We help third-party businesses (“Customers”) prevent fraud, verify the identity of their users (“you” or “End Users”), and protect the integrity of End User accounts. Jumio uses information about you to provide and improve these Services or develop new services for similar purposes. We analyze the collected data and pass along risk signals to our Customers to warn them about potential risks associated with their End User transactions and accounts.

Qualifications & exceptions

• The Notice describes risk signals being passed to Customers but does not list the signals in this section.

Not stated here

• The Notice does not describe the content, format, or accuracy of the risk signals in this section.

Sharing & Disclosure · Company practice

Analysis results and relevant personal information are shared with the Customer and Jumio's service providers

As part of its service, Jumio shares the results of its analyses, along with relevant personal information such as identification document data and facial images, with the Customer the End User has engaged or intends to engage, and with Jumio's service providers acting on its behalf.

Supporting quotations

As part of its service to our Customers, Jumio shares the results of these analyses, as well as relevant personal information (such as identification document data and facial images), with our Customer with whom you have engaged or intend to engage, as well as with Jumio’s service providers acting on its behalf.

Qualifications & exceptions

• The sentence names two recipient groups: the Customer and Jumio's service providers acting on its behalf.

Not stated here

• The Notice does not state what each recipient does with the information after receiving it.

Sharing & Disclosure · Company practice

Biometric data may be shared with the Customer and service providers and stored for improvement and proof of inspection

The Notice says Jumio may share biometric data with a Customer with which the user has a direct relationship and with its service providers. Jumio may collect, process, re-collect, regenerate, otherwise obtain, and store the data to provide and improve its Services and for long-term proof of inspection of the provided identification.

Supporting quotations

We may share such data with a Customer with which you have a direct relationship and with our service providers. Jumio may collect, process, re-collect, regenerate, otherwise obtain, and store such data for the purpose of providing and improving its Services, and for the long-term proof of inspection of your provided form of identification.

Qualifications & exceptions

• The stated purposes for the collection and storage are providing and improving the Services and long-term proof of inspection.
• Sharing is described as permitted ('may share'), not as a practice in every transaction.

Not stated here

• The Notice does not state how long the Customer or service providers retain biometric data they receive.

Cross-references

• has exception (model-proposed): For the Idwall processing, Jumio says it will not share or disclose Biometric Data — The general statement that Jumio may share biometric data with the Customer and service providers is subject to the Brazil/Idwall section's statement that Jumio will not share or disclose Biometric Data for that processing activity.

Sharing & Disclosure · Company practice

Jumio may disclose personal information to Customers, service providers, business partners and with consent

Section 7 says Jumio may disclose personal information to Customers in the context of the user's transaction with that Customer; to service providers that help deliver, manage, develop and improve the Services, including third-party cloud service providers; to contract or business partners participating in delivery of the Service, including other companies in Jumio's corporate group; aggregated or anonymized information to third parties, such as publishing a report on usage trends; and with consent, including where the user specifically authorizes disclosure to a third party, including Customers with whom the user has an existing relationship at the time of disclosure.

Supporting quotations

Jumio may disclose your personal information to the following types of recipients and in the following types of scenarios:

Customers, in the context of your transaction with that particular Customer;

Service providers, to help us deliver, manage, develop, and improve the Services, including third-party cloud service providers;

Contract or business partners who are participating in the performance of the delivery of the Service, including other companies that are part of Jumio’s corporate group;

Aggregated or anonymized information with third parties in relation to our Services, such as publishing a report on usage trends;

Consent, if we have obtained your consent to such disclosure, including where you specifically authorize us to disclose your personal information to a third party, including Customers with whom you have an existing relationship at the time of disclosure.

Qualifications & exceptions

• The list is introduced by 'may disclose' and is not stated as exhaustive.
• The consent item applies only if Jumio has obtained consent.

Not stated here

• The Notice does not identify specific recipients except by category; a list can be requested under the next paragraph.

Sharing & Disclosure · Company practice

Legal obligations and business transfers are separate disclosure scenarios

Jumio may disclose personal information as required or permitted by law, such as to auditors, law enforcement agencies, courts, regulatory agencies and others, including to comply with valid legal process. It may also disclose information in business transfers to any acquirer or successor in a corporate sale, merger, reorganization, dissolution or similar event, if the information is part of the assets transferred or shared in preparation for such a transaction.

Supporting quotations

Legal obligations, as required or permitted by law, such as to auditors, law enforcement agencies, courts, regulatory agencies and others, including to comply with valid legal process;

Business transfers to any acquirer or successor in the event of a corporate sale, merger, reorganization, dissolution, or similar event if any of your personal information is part of the assets we transfer or share in preparation for such a transaction; and

Qualifications & exceptions

• The legal-obligation item is framed as 'as required or permitted by law'.
• The business-transfer item applies only if the personal information is part of the transferred or shared assets.

Not stated here

• The Notice does not state what happens to information after a transfer or whether the acquirer applies a different privacy notice.

Sharing & Disclosure · Procedure

A list of third parties that may receive personal information is available on request

The Notice says that if the user requires further information on recipients, a list of third parties with whom Jumio may share personal information can be made available upon request through the contact details in Section 16.

Supporting quotations

If you require further information on the recipients of your personal information, a list of the third parties with whom we may share your personal information can be made available upon request via the contact details provided in Section 16.

Qualifications & exceptions

• The list is described as available on request; it is not included in the Notice.

Not stated here

• The Notice does not state the form, scope, or timing of the list, or whether every recipient is included.

Sharing & Disclosure · Company commitment

For California residents, Jumio does not sell or share personal information except with consent

The California-resident paragraph says that, other than with the user's consent, Jumio does not sell or share personal information. It says the terms 'sell', 'share', and 'personal information' are defined by the CCPA and CPRA.

Supporting quotations

Information for California residents. Other than with your consent, Jumio does not sell or share your personal information. The terms “sell,” “share,” and “personal information” are defined by the California Consumer Privacy Act (the “CCPA”) and the California Privacy Rights Act (“CPRA”).

Qualifications & exceptions

• The statement is limited to California residents and uses the CCPA/CPRA definitions.
• The exception is the user's consent; the Notice does not describe how that consent is obtained.

Not stated here

• The Notice does not state whether Jumio requests consent for any sale or share, or what a consented sale or share would cover.

Sharing & Disclosure · Company practice

For Brazilian residents, Jumio may share identifiers and images with Idwall as an independent controller

Section 13 says that in certain circumstances, to verify End Users' identification and for fraud prevention, Jumio may process and share personal identifiers (names, addresses, emails, phone numbers), government identifiers such as the CPF (with certain identifiers redacted in accordance with applicable national laws), and images such as photographs with Idwall, a third-party fraud prevention service provider acting as an independent data controller.

Supporting quotations

13. Additional information for Brazilian residents

In certain circumstances, to properly verify End Users’ identification and for fraud prevention purposes, Jumio may process and share the following information with Idwall, a third-party service provider for fraud prevention acting as an independent data controller as defined by applicable law:

Personal identifiers (e.g., names, addresses, emails, phone numbers);

Government identifiers (e.g., individual taxpayers’ registry (CPF)) please note that Jumio redacts certain government identifiers in accordance with applicable national laws; and

Images (e.g., photographs).

Qualifications & exceptions

• The section is specifically for Brazilian residents.
• Idwall is described as an independent data controller, not a Jumio processor.
• The government-identifier item notes that Jumio redacts certain identifiers in accordance with applicable national laws.

Not stated here

• Idwall's privacy policy is linked but its text is not supplied here, so Idwall's own practices are not analyzed.

Sharing & Disclosure · Company commitment

For the Idwall processing, Jumio says it will not share or disclose Biometric Data

Section 13 says that for this processing activity, Jumio will not share or disclose any Biometric Data. It refers the reader to Idwall's Privacy Policy for information about privacy rights, retention, and how personal information is used and shared.

Supporting quotations

For this processing activity, Jumio will not share or disclose any Biometric Data. Please refer to Idwall’s Privacy Policy for more information about your privacy rights, retention, and how your personal information is used and shared.

Qualifications & exceptions

• The no-disclosure statement is limited to the Brazil/Idwall processing activity described in this section.

Not stated here

• Idwall's Privacy Policy is linked but not supplied here; its retention and rights terms are outside this analysis.

Cross-references

• exception to (model-proposed): Biometric data may be shared with the Customer and service providers and stored for improvement and proof of inspection — The general statement that Jumio may share biometric data with the Customer and service providers is subject to the Brazil/Idwall section's statement that Jumio will not share or disclose Biometric Data for that processing activity.