Entrust Identity Verification Services Product Privacy Notice (incorporated PDF)

Legal Rights & Agreement Rules · Context

Customers ask for checks; Users are the people checked

The notice defines Entrust's “Customers” as organizations that have asked Entrust to verify someone's identity or to carry out checks related to their identity. A Customer's “Users” are the individuals whose identities that Customer has asked Entrust to verify or otherwise check. Those two roles frame the collection and processing statements that follow.

Supporting quotations

Entrust’s “Customers” are organizations that have asked Entrust to verify someone’s identity, or to carry out checks related to their identity.

Entrust’s Customer’s “Users” are the individuals whose identities a Customer has asked Entrust to verify or otherwise check.

Qualifications & exceptions

• The definitions apply throughout this notice.

Data Access & Collection · Company practice

Data comes from the Customer, the User or third-party Data Providers

To provide the Onfido Identity Services to a Customer, Entrust collects certain personal information about that Customer's Users. It may collect that information from the Customer, from the User, or from third-party data providers (“Data Providers”). The notice describes Data Providers as trusted third-party service providers or public authorities who provide additional information depending on the services the Customer has chosen.

Supporting quotations

To provide Onfido Identity Services to a Customer, Entrust will collect certain personal information about the Customer’s Users.

Entrust may collect personal information about a User from the Customer, from the User, or from third party data providers (“Data Providers”). Data Providers are trusted third party service providers or public authorities who provide additional information depending on the Onfido Identity Services a Customer has chosen to use.

Qualifications & exceptions

• The source of the data depends on the service the Customer chooses.

Not stated here

• The notice does not identify the Data Providers or the databases they supply in this section.

Data Access & Collection · Context

The data collected depends on how the Customer uses the service

The precise personal data Entrust collects on a Customer's behalf varies with three choices: how the Customer interacts with Entrust (for example the API or the Onfido Dashboard, Part 1 of the table); the data collection method (for example the Applicant Form or SDK, Part 2); and which Onfido Identity Services the Customer uses (Part 3). The notice then sets out the personal data Entrust may process to provide the services, so the table is a catalogue of possibilities rather than one fixed dataset for every check.

Supporting quotations

The precise personal data Entrust collects on behalf of a Customer varies depending on:

how a Customer chooses to interact with Entrust (for example, via our API or the Onfido Dashboard as set out in Part 1 of the table below);

what data collection method the Customer chooses to use (for example, our Applicant Form or SDK as set out in Part 2 of the table below); and

which Onfido Identity Services the Customer chooses to use (as set out in Part 3 of the table below).

The table below sets out the personal data Entrust may process in order to provide the Onfido Identity Services.

Qualifications & exceptions

• The table lists data Entrust may process, not a guaranteed collection for every service.

Not stated here

• Customer-specific configurations and optional fields beyond the table's examples are not described.

Data Access & Collection · Company practice

Part 1 covers API and Dashboard data, including staff login details

Part 1 of the table covers a Customer that initiates a check or process and interacts directly with Entrust; its columns are the personal data type and the Customer interaction method. Through the API, the categories can include the Onfido User unique identifier; check status/outcome and related information such as a Report; optional data fields the Customer selects from those the API supports (for example a title); technical metadata described in the API Documentation; IP address with city/country location; data uploaded through the “custom input” or “send/receive” workflow features; and other information relevant to the applicable services. The API uses REST principles and standard HTTP response codes. For the Onfido Dashboard, Entrust also collects the full name, login credentials and usage logs of Customer personnel who access it; the Dashboard is described as a graphical interface to the API.

Supporting quotations

| 1. Customer initiates a check/process and interacts directly with Entrust

| Personal Data Type | Customer Interaction Method with Entrust and Description

| Categories of Personal Data: ● Onfido User unique identifier Check status/outcome and related information (e.g., a Report) ● Optional data fields selected by Customer from those technically supported and listed in Onfido’s API Documentation (for example, the User’s title - Mr., Mrs., Miss) ● Technical metadata as described in Onfido’s API Documentation ● IP address and associated city/country level location information ● All data uploaded by Customer via ‘custom input’ or ‘send/receive’ features within the Onfido Identity Services for use during a workflow ● All other information processed by Entrust relevant to the applicable Onfido Identity Services

(Note - Entrust will also collect the full name, login credentials, and usage logs for Customer personnel accessing the Onfido Dashboard)

Application Programming Interface (API) The API is based on REST principles and uses standard HTTP response codes to enable Customer to transmit and receive data from Entrust, as further described in the API Documentation.

Onfido Dashboard The Onfido Dashboard is a graphical user interface to Onfido’s API, as further described in the API Documentation.

Qualifications & exceptions

• Part 1 applies where the Customer initiates the check and interacts with Entrust directly.
• The staff login data concerns Customer personnel who access the Onfido Dashboard.

Not stated here

• The API Documentation is referred to but not supplied, so the full list of technical metadata and optional fields is unknown here.

Data Access & Collection · Company practice

Studio and third-party tracking carry the same check identifiers

Studio is a visualisation layer and workflow builder giving the Customer no/low-code tools to create and configure dynamic user journeys that incorporate the Onfido Identity Services. Where a Customer has procured a third-party User tracking system to interact with Onfido's API and track Users, the data categories are the Onfido User unique identifier, check status/outcome and related information such as a Report, and optional data fields listed in the API Documentation.

Supporting quotations

| | Studio Studio is a visualisation layer and workflow builder providing the Customer with no/low-code tools to create and configure dynamic user journeys incorporating the Onfido Identity Services.

| Categories of Personal Data: ● Onfido User unique identifier ● Check status/outcome and related information (e.g., a Report) ● Optional data fields as listed in Onfido’s API Documentation | Third Party User Tracking System The Customer procured a third-party User tracking system to interact with Onfido’s API and track Users

Qualifications & exceptions

• Third-party tracking applies only where the Customer procures that system.

Not stated here

• The third-party tracking system is not identified, and the API Documentation is not supplied.

Data Access & Collection · Company practice

The Applicant Form collects User-entered data and reminder emails

Part 2 covers information Entrust collects directly from Users on the Customer's behalf; its columns are the personal data type and the collection method. With the Applicant Form, the User enters data on an Onfido-provided form. The categories include images and text-based data specified in the relevant check or process, the User's email address, the content of the email sent as a reminder to complete the form, and the Onfido User identifier. Entrust can send the form only if the Customer has already provided an email address for the User.

Supporting quotations

| 2. Entrust collects additional information directly from Users on behalf of the Customer

| Personal Data Type | Data Collection Method and Description

| Categories of Personal Data: ● Images and text-based data (as specified in the relevant check or process) ● Email address ● Content of email sent to Users as a reminder to complete the Applicant Form ● Onfido User unique identifier (Note - the Customer must have already provided Entrust with an email address so Entrust can send the Applicant Form to the User) | Applicant Form Enables the User to enter data on an Onfido provided form

Qualifications & exceptions

• Applies where the Customer uses the Applicant Form.
• Sending the form depends on the Customer having supplied the User's email address.

Data Access & Collection · Company practice

The SDK captures documents, faces, video and device metadata

The SDK provides the Customer with drop-in interface screens for mobile (iOS and Android) and web applications to capture identity documents and facial photographs/video for use with the services. Its data can include images/video and information describing them as specified in the check or process; a telephone number and the content of an SMS (web SDK only and optional); IP address with city/country location; anonymised usage data; the Onfido User identifier; and technical metadata described in the API Documentation.

Supporting quotations

| Categories of Personal Data: ● Images/video and information describing the images/video (as specified in the relevant check or process) ● Telephone number (web SDK only and optional) ● Content of SMS (web SDK only and optional) ● IP address and associated city/country level location information ● Anonymised usage data ● Onfido User unique identifier ● Technical metadata as described in Onfido’s API Documentation | SDK The SDK provides the Customer with a drop-in set of user interface screens for mobile (iOS and Android) and web applications to allow the capture of identity documents and facial photographs/video for use with the Onfido Identity Services.

Qualifications & exceptions

• Telephone number and SMS content apply only to the web SDK and are optional.

Not stated here

• The API Documentation's technical metadata list is not supplied.

Use & Processing · Company practice

Identity Record Check confirms User details against third-party databases

Part 3 lists the data Entrust processes to provide each service together with a description of the service. The Identity Record Check searches third-party databases to identify whether a User is included in the relevant databases and confirms the personal data the User provided. Its categories are full name, date of birth, address and postcode (Customer optional), national identifiers where applicable (the notice gives a U.S. Social Security Number as an example), and telephone number.

Supporting quotations

| 3. Entrust processes the data collected in (1) and (2) above and the following data on behalf of Customer in order to provide the Onfido Identity Services

| Personal Data Type | Name of Onfido Identity Service and Description

| Categories of Personal Data: ● Full name ● Date of birth ● Address and postcode (Customer optional) ● National identifiers where applicable (e.g., Social Security Number for U.S Users) | Identity Record Check Searches third party database(s) to identify whether a User is included in the relevant database(s) and confirms the personal data provided by the User

● Telephone number

Qualifications & exceptions

• Address and postcode are Customer-optional.
• National identifiers apply only where applicable; the example given is a U.S. Social Security Number.

Not stated here

• The third-party databases searched are not named.

Use & Processing · Company practice

Document Check assesses whether an ID document is genuine

The Document Check assesses the likelihood that the identity document provided is genuine. It processes images of the identity document and information describing it, plus information extracted from the document electronically where applicable.

Supporting quotations

| Categories of Personal Data: ● Image(s) of the identity document and information describing the identity document ● Information extracted from the identity document electronically, where applicable | Document Check Assesses the likelihood the identity document provided is genuine.

Not stated here

• The notice does not describe the check's accuracy or what a low-likelihood result means for the User.

Use & Processing · Company practice

Document Check–Video stores a 1.5-second video of the ID document

Document Check – Video assesses the likelihood that the identity document is genuine and enhances verification by synchronously capturing a 1.5-second video of the document alongside its image. The notice says the video itself is not used for checks but is stored for customer access, providing an additional security layer. The data includes images of the document and describing information, information extracted electronically where applicable, and the document video with describing information.

Supporting quotations

| Categories of Personal Data: ● Image(s) of the identity document and information describing the identity document ● Information extracted from the identity document electronically, where applicable ● Video of the identity document and information describing the identity document | Document Check – Video Assesses the likelihood that the identity document provided is genuine and enhances the identity verification process by synchronously capturing a 1.5-second video of the identity document alongside the image. While the video itself is not used for checks, it is stored for customer access, providing an additional layer of security.

Qualifications & exceptions

• The video is captured synchronously with the document image.
• The notice says the video is stored for Customer access although it is not used for checks.

Not stated here

• The notice does not describe access controls, retention or deletion for the stored video beyond the general retention section.

Use & Processing · Company practice

Driver Verification reads driving licence data from the document

Document Check - Driver Verification assesses the likelihood that the identity document is genuine and extracts driving licence information. It processes images of the identity document, information describing it, and information extracted from it electronically where applicable.

Supporting quotations

| Categories of Personal Data: ● Image(s) of the identity document and information describing the identity document ● Information extracted from the identity document electronically, where applicable | Document Check - Driver Verification Assesses the likelihood the identity document provided is genuine and extracts driving licence information.

Use & Processing · Company practice

Facial Similarity compares the ID face with a selfie, automatically in one variant

The Facial Similarity Check - Selfie compares the face displayed on an identity document with a facial image captured of the User to verify that they are the same. The Selfie Auto variant performs that comparison automatically and without any human review, comparing the face on the document with any other image of a face. Both variants process an image of the User's face, the face image in the identity document, and scans of face geometry.

Supporting quotations

| Categories of Personal Data: ● Image of the User’s face ● Image of the face in the identity document ● Scans of face geometry | Facial Similarity Check - Selfie Compares the face displayed on an identity document with a facial image captured of the User, to verify that they are the same.

| Categories of Personal Data: ● Image of the User’s face ● Image of the face in the identity document ● Scans of face geometry | Facial Similarity Check - Selfie Auto Automatically (and without any human review) compares the face displayed on an identity document with any other image of a face, to verify that they are the same.

Qualifications & exceptions

• Selfie Auto is described as automatic and without human review.
• The Selfie variant compares a captured facial image; the Auto variant compares with any other image of a face.

Not stated here

• The notice does not state a match threshold, the consequences of a failed comparison, or whether contested Auto results are reviewed by a person.

Cross-references

• contrast (model-proposed): Facial Similarity–Video adds liveness and may capture a voiceprint — The Video variant requires liveness detection and can capture audio and possible voiceprint data; the Selfie variants compare still facial images, and only Selfie Auto is stated to be automatic and without human review.

Use & Processing · Company practice

Facial Similarity–Video adds liveness and may capture a voiceprint

Facial Similarity Check - Video compares the face on the identity document with a facial image captured from a video of the User, while requiring the User to undergo liveness detection. Its data categories are video of the User including audio recordings, the face image from the document, transcribed text from the video clip where applicable, scans of face geometry, and data that may be construed as a voiceprint.

Supporting quotations

| Categories of Personal Data: | Facial Similarity Check - Video

| ● Video of the User (including audio recordings) ● Image of the face in the identity document ● Transcribed text data from the video clip (if applicable) ● Scans of face geometry ● Data that may be construed as a voiceprint | Compares the face displayed on an identity document with a facial image captured from a video of the User, to verify that they are the same, while requiring the User to undergo liveness detection.

Qualifications & exceptions

• Liveness detection is required for this variant.
• Audio is included in the video category, and the notice flags data that may be a voiceprint.

Not stated here

• The notice does not say how voiceprint data is used or whether it is separated from the video; retention is addressed only generally.

Cross-references

• contrast (model-proposed): Facial Similarity compares the ID face with a selfie, automatically in one variant — The Video variant requires liveness detection and can capture audio and possible voiceprint data; the Selfie variants compare still facial images, and only Selfie Auto is stated to be automatic and without human review.
• qualified by (model-proposed): Retention follows Customer need, capped by law and stated maximums — The retention section's only stated maximum is the three-year example for photos/videos including audio recordings, which qualifies how long the facial video and audio capture described in this card may be kept.

Linking & Identification · Company practice

Known Faces checks new faces against past checks and adds a match

Known Faces compares the face on an image or video against a database of scans of face geometry from faces in past checks completed by the Client, and alerts if there is a match. It also adds the extracted scans from the new image or video to that database. For this service, the notice states that scans of face geometry are used for the purpose of uniquely identifying a natural person.

Supporting quotations

| Categories of Personal Data ● Image or video of the User’s face ● Onfido User unique identifier ● Check status/outcome and related tracking information ● Scans of face geometry | Known Faces (1) Compares the face on an image or video against a database of scans of face geometry of the faces from past checks completed by the Client and alerts if there is a match, and (2) adds the extracted scans of face geometry from the face on the image or video to the database in (1). For this service, scans of face geometry are used for the purpose of uniquely identifying a natural person.

Qualifications & exceptions

• The database consists of faces from the Client's past checks.
• The notice uses “Client” for the Customer in this row.

Not stated here

• The notice does not describe how a User is removed from the database, how long scans remain, or what the Client does with an alert.

Cross-references

• contrast (model-proposed): Repeat Attempts compares document data across a Customer's new Users — Both services compare a new submission with earlier data, but Known Faces compares face geometry while Repeat Attempts compares document data; the notice presents them as separate services with different data categories.

Use & Processing · Company practice

Watchlist reports search sanctions, PEP and adverse-media databases

Watchlist Report – Enhanced searches third-party watchlist and sanctions databases. Watchlist Report - Standard searches watchlist, politically exposed persons and sanctions databases. Watchlist Report - AML also searches adverse media databases. Each report processes full name, date of birth (Customer optional) and address/post/zip code (Customer optional).

Supporting quotations

| Categories of Personal Data: ● Full name ● Date of birth (Customer optional) ● Address and post/zip code (Customer optional) | Watchlist Report – Enhanced Searches third party watchlist and sanctions databases to identify whether a User is included in that database.

| Categories of Personal Data: ● Full name ● Date of birth (Customer optional) ● Address and post/zip code (Customer optional) | Watchlist Report - Standard Searches third party watchlist, politically exposed persons and sanctions databases to identify whether a User is included in that database

| Categories of Personal Data: ● Full name ● Date of birth (Customer optional) ● Address and post/zip code (Customer optional) | Watchlist Report - AML Searches third party watchlist, politically exposed persons, sanctions, and adverse media databases to identify whether a User is included in that database

Qualifications & exceptions

• Date of birth and address/post/zip code are Customer-optional for these reports.
• Each variant searches a different database set; AML adds adverse media.

Not stated here

• The notice does not name the databases, the matching method or the consequences of a hit.

Use & Processing · Company practice

Ongoing watchlist screening repeats every 24 hours

Watchlist AML Ongoing searches third-party watchlist, politically exposed persons, sanctions and adverse media databases every 24 hours to identify whether a User is included. Watchlist Standard Ongoing uses the same database description and the same 24-hour frequency. Both process full name, date of birth and address and post/zip code (Customer optional).

Supporting quotations

| Categories of Personal Data: ● Full name

| ● Date of birth ● Address and post/zip code (Customer optional) | Searches third party watchlist, politically exposed persons, sanctions, and adverse media databases every 24 hours to identify whether a User is included in that database

| Categories of Personal Data: ● Full name ● Date of birth ● Address and post/zip code (Customer optional) | Watchlist Standard Ongoing Searches third party watchlist, politically exposed persons, sanctions, and adverse media databases every 24 hours to identify whether a User is included in that database

Qualifications & exceptions

• Screening recurs every 24 hours.
• Address and post/zip code are Customer-optional; date of birth is not marked optional in these rows.

Not stated here

• The notice does not say how ongoing screening is stopped, how long it continues, or what happens on a match.

Use & Processing · Company practice

Proof of Address Check validates a non-ID address document

The Proof of Address Check checks that a non-ID document is a suitable proof of address. It processes full name, address and postcode, an image of the proof-of-address document and information describing that document.

Supporting quotations

| Categories of Personal Data: ● Full name ● Address and postcode ● Image of proof of address document and information describing the document | Proof of Address Check Checks that a non-ID document is a suitable proof of address

Not stated here

• The notice does not list which document types are accepted.

Use & Processing · Company practice

Autofill extracts document data with optical character recognition

Autofill classifies identity documents and, using optical character recognition technology, returns automatically extracted human-readable data from the identity document. It processes an image of the identity document and information describing it.

Supporting quotations

| Categories of Personal Data: Image of the identity document and information describing the identity document | Autofill Classifies identity documents and using optical character recognition technology, returns automatically extracted human-readable data from the identity document

Qualifications & exceptions

• Extraction uses optical character recognition.

Use & Processing · Company practice

AAMVA check matches details against US state DMV records

The American Association of Motor Vehicle Administrators (AAMVA) Check uses the AAMVA Driver's License Data Verification (DLDV) service, via a third-party sub-processor, to search participating US state DMV databases and match a User's personal details. It processes full name, document ID number, US state code and optional data fields from the identity document at the Customer's option.

Supporting quotations

| Categories of Personal Data: ● Full name ● Document ID number ● US state code ● Optional data fields from the identity Document (at Customer’s option) | American Association of Motor Vehicle Administrators (AAMVA) Check Uses the AAMVA Driver’s License Data Verification (DLDV) service (via a third party sub-processor) to search participating US state DMV databases to match a User’s personal details

Qualifications & exceptions

• The search runs through a third-party sub-processor.
• Only participating state DMV databases are searched.
• Optional document fields are included at the Customer's option.

Not stated here

• The notice does not identify the sub-processor or the participating states.

Use & Processing · Company practice

India Tax ID check confirms a PAN against the income-tax database

The India Tax ID service verifies that the Personal Account Number (PAN) provided by the User or the Customer matches the PAN found on the database held by the Income Tax Department of the Government of India. It processes full name, date of birth and PAN.

Supporting quotations

| Categories of Personal Data: ● Full name ● Date of birth ● Personal Account Number (PAN) | India Tax ID Verifies that the PAN provided by the User or Customer matches the PAN number found on the database held by the Income Tax Department of the Government of India

Qualifications & exceptions

• Scope is the Government of India income-tax PAN database.

Not stated here

• The notice does not describe consent or any additional legal basis for this check.

Use & Processing · Company practice

Phone Verification Report checks phone activity and fraud risk

The Phone Verification Report (1) searches a range of mobile network operator databases, via a third party, to verify whether a phone number a User provided is active and reachable, and (2) considers additional phone intelligence attributes to help the Customer assess the fraud risk associated with the number. The data categories are full name, address, mobile number, mobile number network history details, mobile account details and a mobile risk score.

Supporting quotations

| Categories of Personal Data: | Phone Verification Report

| ● Full name ● Address ● Mobile number ● Mobile number network history details ● Mobile account details ● Mobile risk score | (1) Searches a range of mobile network operator databases (via a third party) to verify if a phone number provided by a User is active and reachable; and (2) Considers additional phone intelligence attributes to help the Customer to assess the fraud risk associated with the phone number

Qualifications & exceptions

• The operator databases are searched via a third party.
• The risk information is provided to help the Customer assess the number; the notice does not say Entrust makes the decision.

Not stated here

• The third-party provider, the databases and the scoring method are not described.

Linking & Identification · Company practice

Repeat Attempts compares document data across a Customer's new Users

Personal data extracted from a document during a check is stored in the Repeat Attempts Database and compared with the same data points from documents other new Users of the Customer submit, for the purposes of detecting and preventing fraud. Abnormal or inconsistent matches are flagged as a possible indicator that the new User's document is not genuine. The categories are the Onfido User identifier, the document image and describing information, extracted information, a document image hash number, and information about anomalous cross-matches with other documents.

Supporting quotations

| Categories of Personal Data: ● Onfido User unique identifier ● Image of the identity document and information describing the identity document ● Information extracted from the document ● Document image hash number ● Information about anomalous cross-matches with other documents | Repeat Attempts Personal Data extracted from the document during a check are stored in the Repeat Attempts Database and are compared to the same data points from other documents submitted by the Customer’s new Users for the purposes of detecting and preventing fraud. Abnormal/inconsistent matches will be flagged as a possible indicator that the document presented by the new User is not genuine.

Qualifications & exceptions

• Comparison is with documents submitted by the same Customer's new Users, as described in the notice.
• A flag is only a possible indicator; the notice does not say it decides the outcome.

Not stated here

• The notice does not state how long Repeat Attempts data is kept or how a User can contest a flag.

Cross-references

• contrast (model-proposed): Known Faces checks new faces against past checks and adds a match — Both services compare a new submission with earlier data, but Known Faces compares face geometry while Repeat Attempts compares document data; the notice presents them as separate services with different data categories.

Use & Processing · Company practice

Motion checks liveness and compares the video face with the ID

Motion compares the face displayed on an identity document with a facial image captured from a video of the User to verify that they are the same, while assessing whether the person in the video is a real person or a presentation attack/spoof. It processes video of the User, the face image from the document, a background audio recording at the Customer's option, and scans of face geometry.

Supporting quotations

| Categories of Personal Data: ● Video of the User ● Image of the face in the identity document ● Background audio recording (at Customer’s option) ● Scans of face geometry | Motion Compares the face displayed on an identity document with a facial image captured from a video of the User, to verify that they are the same, while assessing whether the User in the video is a real person or a presentation attack/spoof.

Qualifications & exceptions

• Background audio is recorded only at the Customer's option.
• Includes an assessment whether the video shows a real person or a spoof.

Not stated here

• The notice does not describe how the spoof assessment works or its error rates.

Inference & Profiling · Company practice

Device Intelligence scores fraud risk from device and behaviour signals

Device Intelligence – Standard analyses technical data, device signals, IP address, geolocation and other fraud signals, collected via the SDK or standard tracking technologies such as JavaScript snippets as Users interact with the services, to assess the likelihood that the User is genuine. The listed categories include device fingerprints and identifiers (audio and video fingerprints, Android/Google Advertising ID, hardware identifiers such as MAC address); uploaded images and videos with metadata; device and browser attributes such as type, model, operating system, browser, screen details, plugins, fonts and battery information; behaviour data such as start/stop times, fields completed, pointer and touch events and distraction events; application authenticity (whether the device uses stolen security tokens); IP address type, location and detection of masking tools such as a VPN or Proxy; and risk scores or levels inferred from those signals. Other fraud signals are listed in the API Documentation.

Supporting quotations

| Categories of Personal Data: ● Onfido User unique identifier ● Document number and other data extracted from any associated document check; ● IP address and IP address type, including associated city/region/country level location and detection of any IP masking tools such as a VPN or Proxy; ● Check status/outcome and related tracking information; ● Inferences and outputs from Device Intelligence e.g. risk score, risk level;

Analysis of technical data, device signals, IP address, geolocation, and other fraud signals (collected via the SDK or standard tracking technologies (e.g. JavaScript snippets) from Users as they interact with the Onfido Identity Services) to assess the likelihood that the User is genuine

● Device Fingerprint, device identifiers including audio and video fingerprint, Android/Google Advertising ID (AAID or GAID), hardware-based identifiers (e.g. MAC address)

● Images and videos uploaded by U ser and any related metadata and metatags

● Information about Users' device including hardware and software attributes (e.g. device type and model, manufacturer, operating system type and version (e.g. iOS or Android), browser type and version, user-agent, navigator, screen details, plugins, fonts, memory, WebGL, battery information, language, time zone, camera name, microphone name, aspect ratio, resolution, frame rate, etc.)

● Information about a User’s behaviour when interacting with the Onfido Identity Services, including how the User uses the Onfido Identity Services such as start/stop time, forms/fields completed, pointer and touch events, time zone offset, distraction events

● Application Authenticity - Whether the device is using stolen security tokens

Qualifications & exceptions

• Collection can occur through the SDK or standard tracking technologies such as JavaScript snippets.
• Risk scores and levels are described as inferences and outputs of the service.

Not stated here

• The API Documentation's further fraud signals are not supplied, and the notice does not state retention for these signals.

Use & Processing · Company practice

QES package verifies identity for a qualified electronic signature

The Qualified Electronic Signature (“QES”) Package provides ETSI-certified identity verification and issuance of a qualified electronic signature, as set out in the product guide. It processes full name, email address, telephone number, and information extracted from or describing the identity document.

Supporting quotations

| Categories of Personal Data: ● Full name ● Email address ● Telephone number; and ● Information extracted from, or describing, the identity document | Qualified Electronic Signature (“QES”) Package ETSI certified identity verification and issuance of a qualified electronic signature, as set out in the product guide

Qualifications & exceptions

• The notice ties the package to a separate product guide.
• ETSI certification is stated for the package.

Not stated here

• The QES product guide is referred to but not supplied, so its detailed terms are outside this source.

Security & Safeguards · Procedure

One-Time Password confirms the User holds the phone number

The One-Time Password (“OTP”) service verifies that the User is in possession of the phone number by sending a unique code to that number for validation. It processes the telephone number and, where applicable, information related to the risk profile of that telephone number.

Supporting quotations

| Categories of Personal Data: ● Telephone number; and | One-Time Password (“OTP”)

| ● Information related to the risk profile of a telephone number, where applicable | Verifies that the User is in possession of the phone number by sending a unique code to the User’s phone number for validation

Qualifications & exceptions

• Validation happens by sending a unique code to the User's phone number.
• Risk-profile information applies only where applicable.

Not stated here

• The notice does not state code lifetime, retry limits or delivery channels.

Retention & Deletion · Company practice

Retention follows Customer need, capped by law and stated maximums

Entrust provides the services on behalf of Customers for reasons the Customer identifies, and it relies on the Customer to tell it when the personal information is no longer needed, subject to maximum retention periods imposed by applicable laws or defined by Data Providers or by Entrust. The notice's example is the Onfido Facial Scan and Voice Recording Policy, which it says sets a maximum of three years after submission for photos/videos including audio recordings. Entrust may store personal information longer where it has a legitimate legal reason, for example a binding legal order not to destroy it.

Supporting quotations

Entrust provides the Onfido Identity Services on behalf of its Customers for a variety of different reasons. Those reasons are identified by the Customer and Entrust relies on them to tell Entrust when they no longer need to store the personal information Entrust has collected on their behalf, subject to maximum retention periods imposed by applicable laws or defined by Data Providers or by Entrust.

(For example, the Onfido Facial Scan and Voice Recording Policy explains that the maximum period of time for which Entrust will retain photos/videos (including audio recordings) is three (3) years following submission of the photos/videos.

Where Entrust has a legitimate legal reason, it may store personal information for longer than described above (e.g., where it is under a binding legal order not to destroy information).

Qualifications & exceptions

• The Customer decides when it no longer needs the data.
• Caps can come from applicable law, Data Providers or Entrust.
• Longer storage is allowed for a legitimate legal reason such as a binding legal order.

Not stated here

• The Facial Scan and Voice Recording Policy is referred to but not supplied, so its full scope and exact wording are unknown here.
• The notice does not list maximum periods for the other services.

Cross-references

• qualifies (model-proposed): Facial Similarity–Video adds liveness and may capture a voiceprint — The retention section's only stated maximum is the three-year example for photos/videos including audio recordings, which qualifies how long the facial video and audio capture described in this card may be kept.

Sharing & Disclosure · Company practice

Sub-processors receive User data; the current list is on Entrust's site

Entrust says it will need to share personal data about the Customer's Users with third-party service providers (“sub-processors”) in connection with providing the Onfido Identity Services. For the current list of sub-processors, the notice directs readers to https://www.entrust.com/legal-compliance/data-privacy/sub-processors.

Supporting quotations

Entrust will need to share personal data relating to the Customer’s Users with third party service providers (“sub-processors”) in connection with the provision of the Onfido Identity Services to Customers.

For the current list of sub-processors, visit https://www.entrust.com/legal-compliance/data-privacy/sub-processors.

Qualifications & exceptions

• The sharing described is in connection with providing the services.

Not stated here

• The linked sub-processor list is not supplied, so the identities, locations and functions of the sub-processors are unknown here.

Cross-references

• refers to (model-proposed): Cross-border transfers rely on adequacy or standard contractual clauses — The sub-processor sharing rule is the premise for the transfer section: sharing with a sub-processor may involve a cross-border transfer, which the transfers section then qualifies.

Sharing & Disclosure · Company commitment

Cross-border transfers rely on adequacy or standard contractual clauses

Sharing personal data with a sub-processor may involve a cross-border transfer. Entrust says it makes cross-border transfers in accordance with relevant data privacy law requirements. Its example: for personal data transferred outside the EEA, it ensures an adequate level of protection by requiring sub-processors to enter into the European Commission-approved Standard Contractual Clauses (and/or their UK and Switzerland equivalents) if they are not in a country with an adequacy decision and there is no alternative transfer safeguard.

Supporting quotations

Entrust will need to share personal data relating to the Customer’s Users with third party service providers (“sub-processors”) in connection with the provision of the Onfido Identity Services to Customers.

The sharing of personal data with a sub-processor may involve the cross-border transfer of personal data. Entrust makes cross-border transfers of personal data in accordance with relevant data privacy law requirements. For example, we ensure that personal data that is transferred outside of the EEA benefits from an adequate level of protection by requiring sub-processors to enter into the European Commission approved Standard Contractual Clauses (and/or their UK and Switzerland equivalents) if they are not in a country that has the benefit of an adequacy decision and if there is no alternative transfer safeguard.

Qualifications & exceptions

• The stated safeguard is an example for transfers outside the EEA.
• The clauses are required only where there is no adequacy decision and no alternative safeguard.

Not stated here

• The notice does not identify the destination countries, the sub-processors or which safeguard applies to a particular transfer.

Cross-references

• referred to by (model-proposed): Sub-processors receive User data; the current list is on Entrust's site — The sub-processor sharing rule is the premise for the transfer section: sharing with a sub-processor may involve a cross-border transfer, which the transfers section then qualifies.

Security & Safeguards · Company commitment

Entrust pseudonymizes data where possible and applies security measures

Where possible, Entrust pseudonymizes, de-identifies and/or aggregates personal data to protect privacy and minimize security risks; it defines pseudonymized data as information replaced, transformed or removed so that it no longer identifies an individual without additional information. Entrust also takes appropriate administrative, physical, technical and organizational measures designed to help protect the information from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction, and points to a Guide to Security at Onfido for more information.

Supporting quotations

Where possible, we pseudonymize, de-identify and/or aggregate personal data to protect privacy and minimize security risks. Pseudonymized data is where we replace, transform, or remove information so that it no longer identifies an individual without additional information. Entrust also takes appropriate administrative, physical, technical and organizational measures designed to help protect the information it holds from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. For more information about information security in relation to the Onfido Identity Services, please visit the Guide to Security at Onfido.

Qualifications & exceptions

• Pseudonymization is described as happening 'where possible'.
• The measures are described as designed to help protect, not as a guarantee.

Not stated here

• The Guide to Security at Onfido is not supplied, and the notice names no specific standard, audit or breach-notification duty.

Account & Service Control · User right or choice

Users exercise privacy rights through the Customer as controller

The Customer is the controller for all personal data Entrust processes to provide the services. A User of an Entrust Customer who wants to exercise data privacy rights about the processing described in this notice is told to contact the Customer so it can respond directly. If the User contacts Entrust instead, Entrust will notify the Customer so it may fulfil the request. As processor/service provider, Entrust will assist the Customer, to the extent reasonable and practicable, in responding to data subject requests.

Supporting quotations

as a service provider/processor pursuant to applicable data privacy laws

The Customer is the controller for all personal data processed by Entrust for the purpose of providing the Onfido Identity Services. If you are a User of an Entrust Customer and you wish to exercise your data privacy rights in relation to how we use your personal data as described in this product privacy notice, please contact the Customer so they may respond to you directly. If you contact us instead of our Customer, we will notify the Customer so they may fulfill your request.

Entrust, as the processor/service provider, will assist the Customer, to the extent reasonable and practicable, in responding to data subject requests the Customer receives with respect to the Onfido Identity Services.

Qualifications & exceptions

• Requests are routed to the Customer as controller.
• Entrust's assistance is limited to the extent reasonable and practicable.

Not stated here

• The notice does not list the rights that exist, the applicable law, or response timelines; those depend on the Customer and law not supplied here.

Cross-references

• qualified by (model-proposed): The notice covers Onfido identity checks run as a processor — The opening processor role explains the rights route: because Entrust acts as a service provider/processor, Users exercise data privacy rights through the Customer as controller, and Entrust only assists.

Legal Rights & Agreement Rules · Company practice

Amendments take effect when posted on the product-privacy page

Entrust reserves the right to amend the notice from time to time as its business, laws, regulations and industry standards evolve. Changes are effective immediately following their posting at https://www.entrust.com/legal-compliance/product-privacy, and readers are encouraged to review the notice from time to time.

Supporting quotations

We reserve the right to amend this product privacy notice from time to time as our business, laws, regulations and industry standards evolve. Any changes are effective immediately following the posting of such changes to https://www.entrust.com/legal-compliance/product-privacy. We encourage you to review this notice from time to time to stay informed.

Qualifications & exceptions

• No prior notice or individual notice is stated.
• Effect is immediate on posting.

Not stated here

• The linked page is not supplied; this saved text is the May 29, 2024 version and no successor is announced in it.

Account & Service Control · Procedure

Privacy questions go to privacyrequests@onfido.com

The notice's contact section says questions about the product privacy notice go to privacyrequests@onfido.com. It gives no postal address, telephone number or separate representative in this section.

Supporting quotations

For questions about this product privacy notice, please contact privacyrequests@onfido.com.

Qualifications & exceptions

• Email is the only contact route stated for this notice.

Not stated here

• Whether a data protection officer or an EU/UK representative is appointed is not stated in this source.

Use & Processing · Context

The notice covers Onfido identity checks run as a processor

Onfido Ltd., a subsidiary of Entrust Corporation and called “Entrust” in this notice, explains here how it collects and processes personal data as a service provider/processor under applicable data privacy laws in order to provide the Onfido Identity Services. The notice is written to help business Customers understand that processing and to explain it to their Users. It expressly excludes the processing Entrust conducts as a controller for the same services: those details are said to be in the separate Onfido Privacy Policy.

Supporting quotations

This product privacy notice describes how Onfido Ltd. (who, being a subsidiary of Entrust Corporation, is referred to in this notice as “Entrust”) will collect and process personal data as a service provider/processor pursuant to applicable data privacy laws in order to provide the Onfido Identity Services.

This notice does not provide details of the processing that Entrust conducts in relation to the Onfido Identity Services as a controller. Details of such processing are in the Onfido Privacy Policy.

Qualifications & exceptions

• The role described is service provider/processor for the processing this notice covers.
• Audience: Entrust's business Customers and, through them, the individuals whose identities are checked.

Not stated here

• The Onfido Privacy Policy is referred to but not supplied, so Entrust's controller-side processing is outside this source.
• The notice does not name the applicable data privacy laws.

Cross-references

• qualifies (model-proposed): Users exercise privacy rights through the Customer as controller — The opening processor role explains the rights route: because Entrust acts as a service provider/processor, Users exercise data privacy rights through the Customer as controller, and Entrust only assists.

Use & Processing · Company commitment

Identity verification helps Customers admit Users quickly and securely

The notice states that the Onfido Identity Services help Customers verify their Users so they can access their services quickly, easily and securely. When Entrust verifies an identity, carries out checks related to an identity, or provides user authentication services, the notice says Entrust is committed to protecting the privacy and security of that identity.

Supporting quotations

The Onfido Identity Services help our Customers to verify their Users so they can access their services quickly, easily, and securely. When Entrust verifies an identity, carries out checks related to an identity, or provides user authentication services, Entrust is committed to protecting the privacy and security of that identity.

Qualifications & exceptions

• Covers identity verification, identity-related checks and user authentication.

Not stated here

• The source sentence does not make clear whether “they” and “their services” refer to the Customer or the User, so this card leaves that reference open.

Legal Rights & Agreement Rules · Context

This saved version is last updated May 29, 2024

The document is titled “Onfido Identity Services Product Privacy Notice” and carries the line “Last updated: May 29, 2024”. It states no separate effective date and announces no successor version; its amendment clause says changes take effect when posted (see the amendments card).

Supporting quotations

Onfido Identity Services Product Privacy Notice

Last updated: May 29, 2024

Qualifications & exceptions

• The date shown is a last-updated date, not an effective date.

Not stated here

• The saved copy supplied here is the only version analyzed; the publisher's current page is not part of this source.