Jumio's Privacy Notice

Legal Rights & Agreement Rules · Context

Jumio Online Services Privacy Notice, last updated August 4, 2026

This document is Jumio's Online Services Privacy Notice. It says it describes the privacy practices of Jumio Corporation concerning personal information collected in connection with Jumio's provision of verification, authentication, and related online services (the “Services”). It gives August 4, 2026 as the last updated date and does not state a separate effective date. It also says the scope of consent is described in Section 12.

Supporting quotations

Jumio Online Services Privacy Notice

Last Updated: August 4, 2026

This Privacy Notice (“Notice”) describes the privacy practices of Jumio Corporation (“Jumio,” “us,” or “we”) concerning personal information collected in connection with Jumio’s provision of verification, authentication, and related online services (the “Services”).

The scope of your consent is described in Section 12 (“Your consent”).

Qualifications & exceptions

• The only date stated for this version is 'Last Updated: August 4, 2026'; no separate effective date appears.

Not stated here

• Whether an earlier or later version exists is not established by this saved copy.

Legal Rights & Agreement Rules · Context

Website, Customer-portal and Washington health-data notices are separate from this Notice

The Notice says Jumio's Website Privacy Notice describes its privacy practices for its website and Customer portals. It also directs individuals protected by the Washington State My Health, My Data Act to a separate Washington State Consumer Health Privacy Notice. Both documents are linked but their text is not part of this saved source.

Supporting quotations

Our Website Privacy Notice describes our privacy practices in connection with our website and Customer portals. For individuals protected by the Washington State My Health, My Data Act, please see our Washington State Consumer Health Privacy Notice.

Qualifications & exceptions

• The Notice only points to the linked notices; it does not state whether their practices differ from or add to this Notice.

Not stated here

• The text of the linked Website Privacy Notice is not supplied here.
• The text of the linked Washington State Consumer Health Privacy Notice is not supplied here.

Legal Rights & Agreement Rules · Context

Controller and processor roles turn on who decides and who follows instructions

The Notice explains that privacy laws in certain jurisdictions distinguish controllers (or businesses), which decide why and how personal information is processed, from processors (or service providers), which process personal information on behalf of a controller or business under its instructions.

Supporting quotations

Data protection and privacy laws in certain jurisdictions differentiate between “controllers” (or “businesses”) and “processors” (or “service providers”).

Controller/business: decides why and how to process personal information.

Processor/service provider: processes personal information on behalf of a Controller/Business pursuant to provided instructions.

Qualifications & exceptions

• These are the Notice's own definitions; it does not cite a particular statute for them.

Use & Processing · Context

Jumio's role depends on the Customer; some EEA/UK Customers use it as a processor

Jumio makes the Services available to Customers for integration into their websites and mobile applications. For certain Customers, including some in the EEA/UK, Jumio serves as a processor (or service provider); the Notice otherwise generally describes its practices as a controller. It tells End Users to begin with the Customer with which they have an existing relationship for information about their privacy rights.

Supporting quotations

Important note: Jumio makes the Services available to our Customers (as defined below) for integration into their websites and mobile applications. For certain Customers (including some in the EEA/UK), Jumio serves as a “processor” (or “service provider”). Please begin with the Customer with which you have an existing relationship for information about your privacy rights.

This Notice generally describes Jumio’s privacy practices as a Controller.

Qualifications & exceptions

• The Notice identifies only 'certain Customers (including some in the EEA/UK)' as processor relationships; it does not name them.

Not stated here

• Which role Jumio has for a particular Customer or transaction is not stated in this Notice.
• The Customer's own contract and privacy notice are not supplied here.

Data Access & Collection · Company practice

Providing personal information is voluntary, but the Services may not be possible without it

The Notice says that, while providing personal information is voluntary, Jumio may not be able to provide its Services to Customers without it.

Supporting quotations

While providing your personal information is voluntary, we may not be able to provide our Services to our Customers without it.

Qualifications & exceptions

• The consequence is stated as a possibility ('may not be able to provide our Services'), not as an automatic refusal.

Sharing & Disclosure · Company commitment

Jumio says it does not sell, share or use personal information for cross-contextual behavioral advertising

Under 'Who is Jumio?', the Notice states that Jumio does not sell, share, or otherwise use personal information for cross-contextual behavioral advertising.

Supporting quotations

Please note: we do not sell, share, or otherwise use your personal information for cross-contextual behavioral advertising.

Qualifications & exceptions

• The commitment is limited to cross-contextual behavioral advertising; Section 7 separately describes disclosures for other purposes and a California-specific sale/share statement.

Not stated here

• The Notice does not define 'cross-contextual behavioral advertising' or state how it enforces this limit.

Use & Processing · Company practice

Jumio provides identity verification, authentication and fraud prevention to Customers

Jumio describes an integrated identity verification, authentication, and fraud prevention Service for its Customers. The Service lets Customers verify End Users' identities by processing personal information to assess the authenticity of identity information and detect potentially fraudulent activity.

Supporting quotations

Jumio provides an integrated identity verification, authentication, and fraud prevention Service to its Customers. This Service enables our Customers to verify their End Users’ identities by processing personal information (see Section 5) to assess the authenticity of identity information and detect potentially fraudulent activity.

Qualifications & exceptions

• The description is general; the Notice does not list every verification product or feature.

Not stated here

• The Notice does not state which verification methods or data sources apply to a particular Customer's integration.

Sharing & Disclosure · Company practice

Jumio analyzes collected data and passes risk signals to Customers

Jumio says it helps Customers prevent fraud, verify the identity of their users, and protect the integrity of End User accounts. It uses information about End Users to provide and improve the Services or develop new services for similar purposes, analyzes the collected data, and passes risk signals to Customers to warn them about potential risks in End User transactions and accounts.

Supporting quotations

Jumio is headquartered in Sunnyvale, California and has offices and Customers around the world. We help third-party businesses (“Customers”) prevent fraud, verify the identity of their users (“you” or “End Users”), and protect the integrity of End User accounts. Jumio uses information about you to provide and improve these Services or develop new services for similar purposes. We analyze the collected data and pass along risk signals to our Customers to warn them about potential risks associated with their End User transactions and accounts.

Qualifications & exceptions

• The Notice describes risk signals being passed to Customers but does not list the signals in this section.

Not stated here

• The Notice does not describe the content, format, or accuracy of the risk signals in this section.

Use & Processing · Company practice

Transaction data is collected, analyzed and retained, with automated comparison and face matching

As part of the Service, Jumio collects, analyzes, and retains personal information connected with transactions on an ad–hoc and ongoing basis, including information in government-issued identification documents and facial images. The Notice says these activities may be automated and may include comparing personal information with data previously processed as part of the Service and matching an image of the user's face with the image on the identification document, to verify identity and identify patterns indicative of fraud.

Supporting quotations

As part of this Service, we collect, analyze, and retain personal information collected in connection with transactions on an ad–hoc and an ongoing basis provided by or on behalf of our Customers and their End Users, including information contained in government-issued identification documents and facial images. These processing activities may be performed in an automated manner and include comparing personal information with data previously processed as part of the Service and matching an image of your face with the image contained on your identification document in order to verify identity and identify patterns indicative of fraud.

Qualifications & exceptions

• The Notice says these activities 'may be performed in an automated manner'; it does not state that every check is automated.

Not stated here

• The Notice does not describe the matching technology, error rates, or the extent of human review in this section.

Use & Processing · Company commitment

Jumio says the Service is incrementally improved as new technology becomes practical

The Notice says Jumio is committed to improving the Service to help Customers manage evolving fraud risks, and that the Service entails incremental improvement using new technological innovations as they become practical to implement.

Supporting quotations

Jumio is committed to constantly improving its service in order to help its Customers manage evolving fraud risks. Therefore, the Service entails incremental improvement of the service making use of new technological innovations as they become practical to implement.

Qualifications & exceptions

• The pace and scope of improvement are not specified; 'as they become practical to implement' leaves the timing to Jumio.

Sharing & Disclosure · Company practice

Analysis results and relevant personal information are shared with the Customer and Jumio's service providers

As part of its service, Jumio shares the results of its analyses, along with relevant personal information such as identification document data and facial images, with the Customer the End User has engaged or intends to engage, and with Jumio's service providers acting on its behalf.

Supporting quotations

As part of its service to our Customers, Jumio shares the results of these analyses, as well as relevant personal information (such as identification document data and facial images), with our Customer with whom you have engaged or intend to engage, as well as with Jumio’s service providers acting on its behalf.

Qualifications & exceptions

• The sentence names two recipient groups: the Customer and Jumio's service providers acting on its behalf.

Not stated here

• The Notice does not state what each recipient does with the information after receiving it.

Data Access & Collection · Company practice

Jumio collects information directly, from third-party providers and partners, and automatically

Jumio may obtain personal information directly from the End User or its Customers, from third-party service providers and partners, and automatically. The third-party examples include consumer reporting agencies, fraud prevention services, data brokers, government databases, marketing and analytics providers, and other publicly available sources. The Notice says Jumio may combine third-party information with information it already has about the End User, as permitted by applicable law.

Supporting quotations

Jumio may obtain your personal information from the following sources:

Directly from you or our Customers, such as when you use, access, or submit information in connection with the Services.

Our third-party service providers and partners, such as when our vendors provide us personal information related to you to provide us their services. As permitted by applicable law, we may combine this information with information we have about you. Our third-party service providers and partners include consumer reporting agencies, fraud prevention services, data brokers, government databases, marketing and analytics providers, and other publicly available sources.

Automatically, such as technical information necessary to provide, improve, and develop our Services.

Qualifications & exceptions

• The examples are introduced by 'such as', so the list is not exhaustive.
• Combining information is expressly limited to what is 'permitted by applicable law'.

Not stated here

• The Notice does not identify the specific providers, databases, or public sources used.

Linking & Identification · Company practice

Third-party-sourced information may be combined with information Jumio already holds

The Notice says that, as permitted by applicable law, Jumio may combine personal information it receives from third-party service providers and partners with information it has about the End User.

Supporting quotations

As permitted by applicable law, we may combine this information with information we have about you.

Qualifications & exceptions

• The permission is conditioned on applicable law.

Not stated here

• The Notice does not describe what matching method or identifiers are used to combine records.

Data Access & Collection · Company practice

Authentication may install service workers said not to collect or track; cookies are covered elsewhere

For the Authentication service, Jumio may install service workers on the End User's device to speed up subsequent verifications. The Notice says these service workers do not collect any information about the user and do not track the user. Jumio may also use cookies in connection with the Services and points to its Cookie Notice.

Supporting quotations

If you use Jumio’s Authentication service, we may install service workers on your device to speed up subsequent verifications. These do not collect any information about you and do not track you. We may also use cookies in connection with the Services, which you can learn about by visiting our Cookie Notice.

Qualifications & exceptions

• The no-collection and no-tracking statement is specifically about service workers, not about cookies or other technologies.

Not stated here

• The text of the linked Cookie Notice is not supplied here.
• The Notice does not describe what the cookies collect or how long they last.

Data Access & Collection · Company practice

Section 5 lists identifiers, identification images, government IDs, financial details and images

For the purposes described in Section 6, Jumio may process personal identifiers such as names, addresses, emails and phone numbers; images of identification documents, including photographs and other information such as personal identifiers, demographic characteristics and physical characteristics; government identifiers such as driver's license and passport numbers, with certain identifiers redacted in accordance with applicable laws; financial information such as credit or debit card numbers, CVV, expiration dates and transaction information; and images or recordings such as photographs and visual or audio recordings.

Supporting quotations

For the purposes described in Section 6, Jumio may process the following information:

Personal identifiers, such as names, addresses, emails, phone numbers;

Images of identification documents, such as photographs and other information including personal identifiers, demographic characteristics, physical characteristics, etc.;

Government identifiers, such as driver’s license numbers, passport numbers, etc. (please note: we redact certain identifiers in accordance with applicable laws);

Financial information, such as credit or debit card numbers, CVV, expiration dates, transaction information;

Images or recordings, such as photographs and visual or audio recordings;

Qualifications & exceptions

• The list is introduced by 'may process', so processing any particular category is not stated as certain.
• Government identifiers are subject to redaction 'in accordance with applicable laws'.
• The examples in each item are introduced by 'such as', so they are not exhaustive.

Not stated here

• The Notice does not state which categories apply to every Service or Customer.

Cross-references

• referred to by (model-proposed): Consent covers obtaining and using personal information for the Services, including biometric data and machine learning — The Section 12 consent description expressly incorporates the Section 5 data categories by cross-reference and does not repeat them.

Data Access & Collection · Company practice

Online identifiers, geolocation and usage data are processed

The Section 5 list also includes online identifiers such as IP addresses, geolocation information such as the location of the device, and usage data. Usage data is described as internet or other network data, including the device's operating system, browser type, browser settings such as country and language preferences, and use of Jumio's website or application, such as duration of visit.

Supporting quotations

For the purposes described in Section 6, Jumio may process the following information:

Online identifiers, such as IP addresses;

Geolocation information, such as the location of your device;

Usage data, including data relating to your use of the Services such as internet or other network data, including information about your device’s operating system, browser type, browser settings (e.g., country, language preferences), or your use of our website or application (e.g., duration of visit); and

Qualifications & exceptions

• Each item is an example within the Section 5 list, which is introduced by 'may process'.

Not stated here

• The Notice does not state how precise the geolocation data is or how long usage data is retained.

Inference & Profiling · Company practice

Jumio creates transaction risk calculations and scores for Customers

Section 5 lists inferences among the information Jumio may process, giving the example of a transaction risk calculation and scores. That example describes reviewing whether the IP address or other available information is known to have been used in a fraudulent transaction and providing a Customer an assessment of the likelihood that the transaction is fraudulent.

Supporting quotations

Inferences, such as a transaction risk calculation and scores (e.g., reviewing whether the IP address or other available information is known to have been used in a fraudulent transaction and provide an assessment to a Customer of the likelihood the transaction is fraudulent);

Qualifications & exceptions

• The risk-score description is an example ('such as') within the inferences category, not an exhaustive account of the inferences produced.

Not stated here

• The Notice does not state the inputs, model, or accuracy of the risk calculation, or whether the score is the sole basis for a Customer decision.

Cross-references

• qualified by (model-proposed): Jumio uses automated checks and trained-agent review, but says it does not make the final automated decision — The risk scores described as inferences inform the Customer; Jumio says it does not use automated decision-making to make the final decision with legal or similarly significant effects, and directs questions about those rights to the Customer.

Data Access & Collection · Context

Biometric Data section applies where collected data may be considered biometric in some jurisdictions

Section 5 ends its list with 'Biometric data, see below.' The Biometric Data subsection says Jumio's collection may include data that may be considered biometric data in some jurisdictions.

Supporting quotations

Biometric data, see below.

Biometric Data

Jumio’s collection of personal information may include data that may be considered biometric data in some jurisdictions.

Qualifications & exceptions

• The Notice does not identify the jurisdictions in which the data is treated as biometric.

Not stated here

• The Notice does not state which legal definitions of biometric data it is applying.

Data Access & Collection · Company practice

Biometric data is collected from selfies, videos and identification-document photos using facial recognition

The Notice says Jumio collects biometric data via facial recognition or similar technology from an image such as a selfie, from video including audio, and from an image of the user's face as it appears on an identification document the user provides.

Supporting quotations

We will collect this information via facial recognition or similar technology from an image (e.g., a selfie) or video (including audio), and from an image of your face as it appears on an identification document that you provide.

Qualifications & exceptions

• Collection is described as using 'facial recognition or similar technology'; the Notice does not name a specific algorithm or vendor.

Not stated here

• The Notice does not describe how the audio portion of a video is used.

Sharing & Disclosure · Company practice

Biometric data may be shared with the Customer and service providers and stored for improvement and proof of inspection

The Notice says Jumio may share biometric data with a Customer with which the user has a direct relationship and with its service providers. Jumio may collect, process, re-collect, regenerate, otherwise obtain, and store the data to provide and improve its Services and for long-term proof of inspection of the provided identification.

Supporting quotations

We may share such data with a Customer with which you have a direct relationship and with our service providers. Jumio may collect, process, re-collect, regenerate, otherwise obtain, and store such data for the purpose of providing and improving its Services, and for the long-term proof of inspection of your provided form of identification.

Qualifications & exceptions

• The stated purposes for the collection and storage are providing and improving the Services and long-term proof of inspection.
• Sharing is described as permitted ('may share'), not as a practice in every transaction.

Not stated here

• The Notice does not state how long the Customer or service providers retain biometric data they receive.

Cross-references

• has exception (model-proposed): For the Idwall processing, Jumio says it will not share or disclose Biometric Data — The general statement that Jumio may share biometric data with the Customer and service providers is subject to the Brazil/Idwall section's statement that Jumio will not share or disclose Biometric Data for that processing activity.

Retention & Deletion · Company commitment

Jumio destroys biometric data within three years after it is first provided, subject to shorter legal periods

The Notice states a general rule that Jumio will permanently destroy biometric data derived from images and recordings in its possession within three years after the user first provided those images or videos, except where a shorter period is required by law. The next paragraph states a separate rule where Jumio serves as a processor or service provider.

Supporting quotations

Jumio will permanently destroy such biometric data derived from images and recordings in its possession within three years, except where a shorter period is required by law after you first provided those images or videos.

Qualifications & exceptions

• The three-year clock starts when the user first provided the images or videos.
• A shorter period applies where required by law.
• This paragraph does not itself state the role in which Jumio holds the data; the following paragraph gives a separate processor rule.

Not stated here

• The Notice does not state how destruction is performed or whether it covers backups and disaster-recovery copies.

Cross-references

• contrast (model-proposed): As processor, Jumio destroys biometric data per Customer instructions, capped by relationship end or three years — Two biometric-retention rules are stated: a general three-year period measured from when the user first provided the images or videos, and a processor-specific rule measured from Customer instructions and the Customer's last-interaction notice.

Retention & Deletion · Procedure

As processor, Jumio destroys biometric data per Customer instructions, capped by relationship end or three years

Where Jumio serves as a processor or service provider, the Notice says it will permanently destroy biometric data in its possession in accordance with the Customer's instructions, but no later than the earlier of (i) the date the Customer ceases to have a relationship with Jumio or (ii) a date within three years after the Customer informs Jumio that its last interaction with the user occurred, except where a shorter period is required by law.

Supporting quotations

Where Jumio serves as a processor (or service provider), we will permanently destroy any such biometric data in our possession in accordance with the Customer’s instructions but no longer than the earlier of the date (i) that the Customer ceases to have a relationship with Jumio or (ii) that is within three years, except where a shorter period is required by law, after the date that the Customer informs Jumio its last interaction with you has occurred.

Qualifications & exceptions

• This rule applies only where Jumio acts as a processor or service provider.
• The three-year branch is measured from the Customer's notice of last interaction, not from the user's own provision of the data.

Not stated here

• The Notice does not state what happens if the Customer never informs Jumio of its last interaction.

Cross-references

• contrast (model-proposed): Jumio destroys biometric data within three years after it is first provided, subject to shorter legal periods — Two biometric-retention rules are stated: a general three-year period measured from when the user first provided the images or videos, and a processor-specific rule measured from Customer instructions and the Customer's last-interaction notice.

Use & Processing · Company practice

Section 6 service purposes cover verification, fraud detection, analysis and service improvement

Section 6 says Jumio processes the Section 5 information to provide the Services, which includes verifying Customers' End User identities and preventing fraud; comparing and analyzing newly collected personal information against previously collected information to detect fraudulent activities; preventing the use of fraudulent identification documents; monitoring for and identifying fraudulent transactions; conducting ad hoc and ongoing analysis to identify fraudulent uses and sharing the results and personal information such as government-issued photo ID with a Customer with whom the user had, has, or is intending to initiate a direct relationship; and increasing the accuracy, efficiency, and effectiveness of the Services.

Supporting quotations

We process the personal information described in Section 5 for the following purposes:

To provide the Services, which includes:

Verifying our Customers’ End User identities and preventing fraud;

Comparing and analyzing newly-collected personal information relating to you or another End User against previously-collected personal information relating to you or another End User to detect fraudulent activities;

Preventing the use of fraudulent identification documents;

Monitoring for and identifying fraudulent transactions;

Conducting an ad hoc as well as ongoing analysis to identify fraudulent uses of your data and sharing the results of our analysis and your personal information (e.g, government issued photo ID) with a Customer with whom you had, have or are intending to initiate a direct relationship; and

Increasing the accuracy, efficiency, and effectiveness of the Services;

Qualifications & exceptions

• The list is introduced as purposes for which Jumio processes the Section 5 information; the items under 'To provide the Services' are introduced by 'includes'.

Not stated here

• The Notice does not state how the purposes are prioritized or which apply to a particular Service.

Use & Processing · Company practice

Analytics, machine learning, security and anonymized reports are separate stated purposes

Jumio also says it processes the Section 5 information to perform analytics and research concerning the Services and to improve the Services or develop new services, including through machine learning; to protect and improve the security of the Services; and to anonymize the personal information and generate statistical or aggregated reports.

Supporting quotations

To perform analytics and research concerning the Services and to improve the Services or develop new services, including through the use of machine learning;

To protect and improve the security of the Services; and

To anonymize the personal information and generate statistical or aggregated reports.

Qualifications & exceptions

• The machine-learning reference is part of the improvement and development purpose; the Notice does not state which data is used to train models or whether outputs are retained.

Not stated here

• The Notice does not describe the anonymization method or the content of the statistical and aggregated reports.

Legal Rights & Agreement Rules · Company practice

Legal, safety, business-transfer and legal-process purposes are also stated

The Notice says Jumio may also process the Section 5 information to establish, exercise or defend legal claims; investigate, prevent, or act on illegal activities, suspected fraud, violations of its terms and conditions, or threats to property or physical safety; facilitate financing, securitization, insuring, sale, assignment, bankruptcy or other disposal of all or part of its business or assets; respond to valid and enforceable subpoenas, court orders, and other legal process, or as otherwise required by law; and comply with legal or regulatory requirements.

Supporting quotations

We may also process the personal information listed in Section 5 to:

Establish, exercise or defend legal claims;

Investigate, prevent, or act with respect to illegal activities, suspected fraud, violations of our terms and conditions, or situations involving threats to our property, or the property or physical safety of any person or third party;

Facilitate the financing, securitization, insuring, sale, assignment, bankruptcy, or other disposal of all or part of Jumio’s business or assets;

Respond to valid and enforceable subpoenas, court orders, and other legal process, or as otherwise required by law; and

Comply with legal or regulatory requirements.

Qualifications & exceptions

• These purposes are additional to the service purposes, introduced by 'We may also process...'.

Not stated here

• The Notice does not state which recipients receive information for each of these purposes.

Use & Processing · Company practice

Jumio may use AI tools for Section 6 purposes in line with applicable AI regulations

The Notice says Jumio may use artificial intelligence tools for the purposes described in Section 6, in line with applicable AI regulations of the user's jurisdiction.

Supporting quotations

We may, for the purposes described in this Section 6, use artificial intelligence tools in line with applicable AI regulations of your jurisdiction.

Qualifications & exceptions

• The statement is limited to the Section 6 purposes and to the AI regulations of the user's jurisdiction.

Not stated here

• The notice does not identify the AI tools, the data used to train them, or the specific regulations it has in view.

Sharing & Disclosure · Company practice

Jumio may disclose personal information to Customers, service providers, business partners and with consent

Section 7 says Jumio may disclose personal information to Customers in the context of the user's transaction with that Customer; to service providers that help deliver, manage, develop and improve the Services, including third-party cloud service providers; to contract or business partners participating in delivery of the Service, including other companies in Jumio's corporate group; aggregated or anonymized information to third parties, such as publishing a report on usage trends; and with consent, including where the user specifically authorizes disclosure to a third party, including Customers with whom the user has an existing relationship at the time of disclosure.

Supporting quotations

Jumio may disclose your personal information to the following types of recipients and in the following types of scenarios:

Customers, in the context of your transaction with that particular Customer;

Service providers, to help us deliver, manage, develop, and improve the Services, including third-party cloud service providers;

Contract or business partners who are participating in the performance of the delivery of the Service, including other companies that are part of Jumio’s corporate group;

Aggregated or anonymized information with third parties in relation to our Services, such as publishing a report on usage trends;

Consent, if we have obtained your consent to such disclosure, including where you specifically authorize us to disclose your personal information to a third party, including Customers with whom you have an existing relationship at the time of disclosure.

Qualifications & exceptions

• The list is introduced by 'may disclose' and is not stated as exhaustive.
• The consent item applies only if Jumio has obtained consent.

Not stated here

• The Notice does not identify specific recipients except by category; a list can be requested under the next paragraph.

Sharing & Disclosure · Company practice

Legal obligations and business transfers are separate disclosure scenarios

Jumio may disclose personal information as required or permitted by law, such as to auditors, law enforcement agencies, courts, regulatory agencies and others, including to comply with valid legal process. It may also disclose information in business transfers to any acquirer or successor in a corporate sale, merger, reorganization, dissolution or similar event, if the information is part of the assets transferred or shared in preparation for such a transaction.

Supporting quotations

Legal obligations, as required or permitted by law, such as to auditors, law enforcement agencies, courts, regulatory agencies and others, including to comply with valid legal process;

Business transfers to any acquirer or successor in the event of a corporate sale, merger, reorganization, dissolution, or similar event if any of your personal information is part of the assets we transfer or share in preparation for such a transaction; and

Qualifications & exceptions

• The legal-obligation item is framed as 'as required or permitted by law'.
• The business-transfer item applies only if the personal information is part of the transferred or shared assets.

Not stated here

• The Notice does not state what happens to information after a transfer or whether the acquirer applies a different privacy notice.

Sharing & Disclosure · Procedure

A list of third parties that may receive personal information is available on request

The Notice says that if the user requires further information on recipients, a list of third parties with whom Jumio may share personal information can be made available upon request through the contact details in Section 16.

Supporting quotations

If you require further information on the recipients of your personal information, a list of the third parties with whom we may share your personal information can be made available upon request via the contact details provided in Section 16.

Qualifications & exceptions

• The list is described as available on request; it is not included in the Notice.

Not stated here

• The Notice does not state the form, scope, or timing of the list, or whether every recipient is included.

Sharing & Disclosure · Company commitment

For California residents, Jumio does not sell or share personal information except with consent

The California-resident paragraph says that, other than with the user's consent, Jumio does not sell or share personal information. It says the terms 'sell', 'share', and 'personal information' are defined by the CCPA and CPRA.

Supporting quotations

Information for California residents. Other than with your consent, Jumio does not sell or share your personal information. The terms “sell,” “share,” and “personal information” are defined by the California Consumer Privacy Act (the “CCPA”) and the California Privacy Rights Act (“CPRA”).

Qualifications & exceptions

• The statement is limited to California residents and uses the CCPA/CPRA definitions.
• The exception is the user's consent; the Notice does not describe how that consent is obtained.

Not stated here

• The Notice does not state whether Jumio requests consent for any sale or share, or what a consented sale or share would cover.

Retention & Deletion · Company commitment

Jumio retains personal information as long as necessary for Section 6 purposes, legal obligations or legal claims

Except as otherwise provided in the Notice, Jumio says it retains personal information for as long as necessary to fulfill the purposes outlined in Section 6, comply with legal obligations, or defend against potential legal claims.

Supporting quotations

Except as otherwise provided in this Notice, we retain personal information for as long as necessary to: (i) fulfill the purposes outlined in Section 6, (ii) comply with legal obligations, or (iii) defend against potential legal claims.

Qualifications & exceptions

• The rule is expressly subject to other retention provisions in the Notice, including the biometric-data rule in Section 5.
• 'As long as necessary' is not a fixed period.

Not stated here

• The Notice does not state a general maximum retention period; further retention information is available on request.

Cross-references

• qualified by (model-proposed): As processor, Jumio retains personal information only as instructed by the Customer — The general retention rule is expressly subject to other provisions in the Notice; where Jumio is a processor or service provider, retention follows the Customer's instructions rather than the general necessity standard.

Retention & Deletion · Company practice

As processor, Jumio retains personal information only as instructed by the Customer

Where Jumio is a processor or service provider, it says it retains personal information only as instructed by the Customer.

Supporting quotations

Where Jumio is a processor (or service provider), we retain personal information only as instructed by the Customer.

Qualifications & exceptions

• This rule applies only where Jumio acts as a processor or service provider; the general retention rule is stated separately.

Not stated here

• The Notice does not describe what the Customer's instructions typically require.

Cross-references

• qualifies (model-proposed): Jumio retains personal information as long as necessary for Section 6 purposes, legal obligations or legal claims — The general retention rule is expressly subject to other provisions in the Notice; where Jumio is a processor or service provider, retention follows the Customer's instructions rather than the general necessity standard.

Retention & Deletion · Procedure

Further retention-period information is available on request

The Notice says further information on retention periods for personal information is accessible upon request through the contact details in Section 16.

Supporting quotations

If you require further information on the retention periods regarding the processing of your personal information, they are accessible upon request via the contact details provided in Section 16.

Qualifications & exceptions

• The Notice does not state that the retention periods themselves are in the Notice.

Not stated here

• The Notice does not state the form or timing of the response to a request.

Use & Processing · Company commitment

Personal information may be processed internationally under adequacy decisions or standard contractual clauses

The Notice says personal information may be transferred to and processed in the United States for the Section 6 purposes, and that the recipients described in Section 7 may process it in countries other than the user's country of residence, where data protection laws may be different from or less stringent than those in the user's country. For transfers from the EEA, Switzerland, the UK, or Brazil, Jumio says it takes measures to help protect the information, and may rely on adequacy decisions for certain countries or include standard contractual clauses in its contracts with recipients, accessible upon request through the Section 16 contact details.

Supporting quotations

Your personal information may be transferred to and processed in the United States for the purposes described in Section 6. The recipients described in Section 7 may process personal information in countries other than your country of residence. The data protection laws in these countries may be different from, or less stringent than, those in your country of residence. We take measures to help protect your personal information when it is transferred from the European Economic Area (“EEA”), Switzerland, the United Kingdom (“UK”), or Brazil to other countries. We may rely on adequacy decisions for certain countries, or include standard contractual clauses in our contracts with recipients which are accessible upon request via the contact details provided in Section 16.

Qualifications & exceptions

• The measures are described as ones Jumio 'may' rely on; the Notice does not state which measure applies to a particular transfer.
• The standard contractual clauses are accessible upon request, not reproduced in the Notice.

Not stated here

• The Notice does not identify the countries involved or the specific recipients for a particular transfer.

Security & Safeguards · Company commitment

Jumio uses commercially reasonable safeguards but cannot guarantee absolute security

Jumio says it uses commercially reasonable safeguards designed to protect personal information against loss or unauthorized access, use, modification, or deletion. It also says no security program is foolproof and it cannot guarantee absolute security, and points to a Security page for more details.

Supporting quotations

We use commercially reasonable safeguards designed to protect your personal information against loss or unauthorized access, use, modification, or deletion. However, no security program is foolproof, and thus we cannot guarantee absolute security. For more details, please visit our Security page.

Qualifications & exceptions

• The commitment is expressly qualified by the statement that no security program is foolproof and absolute security cannot be guaranteed.

Not stated here

• The linked Security page is not supplied here, so its specific measures are not part of this analysis.

Legal Rights & Agreement Rules · User right or choice

Depending on location, users may have access, deletion, correction, objection, withdrawal and complaint rights

The Notice says that, depending on location, users may have the right to access or obtain a copy of their personal information; delete it; correct inaccurate information; object to or restrict processing; withdraw consent; and lodge a complaint with a supervisory authority or regulatory agency.

Supporting quotations

Depending on your location, you may have the right to:

Access or obtain a copy of your personal information.

Delete your personal information.

Correct inaccurate personal information.

Object to or restrict processing of your personal information.

Withdraw your consent (see Section 12 below).

Lodge a complaint with a supervisory authority or regulatory agency.

Qualifications & exceptions

• The rights are introduced by 'Depending on your location' and 'may have the right to', so they are not stated as available everywhere.
• The withdrawal right cross-refers to Section 12.

Not stated here

• The Notice does not map each right to a jurisdiction or state the conditions or exceptions for each.

Cross-references

• qualified by (model-proposed): Rights are exercised by email, with identity verification, an appeal route and no discrimination — The rights listed in p2-010 depend on the user's location and are exercised through the email procedure in p2-011, which may require identity verification and offers a possible appeal after a denial.

Legal Rights & Agreement Rules · Procedure

Rights are exercised by email, with identity verification, an appeal route and no discrimination

To exercise the rights, the Notice says to email Jumio. Jumio may need to verify the user's identity first. If Jumio denies a request, the user may have the right to appeal by sending an email to the same address. The Notice says Jumio will not discriminate against the user for exercising the rights.

Supporting quotations

To exercise these rights, please email [[email protected]](https://www.jumio.com/cdn-cgi/l/email-protection#71352223311b041c181e5f121e1c). We may need to verify your identity first, and if we deny a request, you may have the right to appeal by sending an email to the same address. We will not discriminate against you for exercising any of the above rights.

Qualifications & exceptions

• The email address is rendered as a Cloudflare-protected placeholder in the saved text; the actual address is not visible in this source.
• The appeal right is stated as 'you may have the right to appeal', not as an unconditional right.

Not stated here

• The Notice does not state a response time, the identity-verification method, or the appeal procedure's steps.

Cross-references

• qualifies (model-proposed): Depending on location, users may have access, deletion, correction, objection, withdrawal and complaint rights — The rights listed in p2-010 depend on the user's location and are exercised through the email procedure in p2-011, which may require identity verification and offers a possible appeal after a denial.

Legal Rights & Agreement Rules · User right or choice

Consent-based processing can be withdrawn at any time without affecting prior lawfulness

The rights section also says that where Jumio processes personal information based on consent, the user may withdraw consent at any time, without affecting the lawfulness of processing based on consent before the withdrawal.

Supporting quotations

Where we process your personal information based on your consent, you may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Qualifications & exceptions

• The statement is limited to processing based on consent and does not affect processing on other legal bases.

Not stated here

• The Notice does not state how withdrawal is communicated or how quickly it takes effect.

Use & Processing · Permission or license

Consent covers obtaining and using personal information for the Services, including biometric data and machine learning

Section 12 says that when the user provides consent, the user is consenting to Jumio obtaining and using personal information (Section 5) to enable provision of the Services to Customers (Section 3). The Notice says this may include processing special categories of personal information, such as biometric data, and is partly based on machine learning and facial recognition algorithms.

Supporting quotations

12. Your consent

When you provide your consent to us, you are consenting to Jumio obtaining and using your personal information (see Section 5) to enable our provision of the Services to our Customers (see Section 3), which may include the processing of special categories of personal information (e.g. biometric data) and is partly based on machine learning and facial recognition algorithms.

Qualifications & exceptions

• The consent description cross-refers to Sections 3 and 5 for the Services and data categories; it does not repeat every item.
• The Notice says the processing 'may include' special categories and 'is partly based on' machine learning and facial recognition.

Not stated here

• The Notice does not state how consent is collected, recorded, or scoped to particular processing.

Cross-references

• refers to (model-proposed): Section 5 lists identifiers, identification images, government IDs, financial details and images — The Section 12 consent description expressly incorporates the Section 5 data categories by cross-reference and does not repeat them.
• qualified by (model-proposed): Consent can be withdrawn at any time; Jumio may retain information afterward on stated legal grounds — The consent described in p3-001 may be withdrawn at any time; withdrawal does not affect the lawfulness of earlier consent-based processing, and Jumio may retain information afterward only on the stated legal grounds.

Legal Rights & Agreement Rules · User right or choice

Consent can be withdrawn at any time; Jumio may retain information afterward on stated legal grounds

Section 12 says the user may withdraw consent at any time, and withdrawal does not affect the lawfulness of processing based on consent before the withdrawal. If Jumio collected information on the basis of consent and the user withdraws, Jumio may retain the information independent of consent as permitted by applicable law and to the extent necessary to establish, exercise or defend legal claims, comply with legal obligations, or identify potentially fraudulent transactions.

Supporting quotations

You may withdraw your consent at any time. The withdrawal of your consent does not affect the lawfulness of processing based on your consent before its withdrawal. If Jumio has collected your personal information on the basis of your consent and you then withdraw your consent, Jumio may retain your personal information independent of your consent as permitted by applicable law and to the extent necessary to establish, exercise or defend legal claims, to comply with legal obligations, or to identify potentially fraudulent transactions.

Qualifications & exceptions

• Post-withdrawal retention is limited to the three stated grounds and to what is permitted by applicable law.
• The withdrawal right does not itself require deletion of information collected before withdrawal.

Not stated here

• The Notice does not state a deletion timeline for information held solely on consent or how a withdrawal request is processed.

Cross-references

• qualifies (model-proposed): Consent covers obtaining and using personal information for the Services, including biometric data and machine learning — The consent described in p3-001 may be withdrawn at any time; withdrawal does not affect the lawfulness of earlier consent-based processing, and Jumio may retain information afterward only on the stated legal grounds.

Sharing & Disclosure · Company practice

For Brazilian residents, Jumio may share identifiers and images with Idwall as an independent controller

Section 13 says that in certain circumstances, to verify End Users' identification and for fraud prevention, Jumio may process and share personal identifiers (names, addresses, emails, phone numbers), government identifiers such as the CPF (with certain identifiers redacted in accordance with applicable national laws), and images such as photographs with Idwall, a third-party fraud prevention service provider acting as an independent data controller.

Supporting quotations

13. Additional information for Brazilian residents

In certain circumstances, to properly verify End Users’ identification and for fraud prevention purposes, Jumio may process and share the following information with Idwall, a third-party service provider for fraud prevention acting as an independent data controller as defined by applicable law:

Personal identifiers (e.g., names, addresses, emails, phone numbers);

Government identifiers (e.g., individual taxpayers’ registry (CPF)) please note that Jumio redacts certain government identifiers in accordance with applicable national laws; and

Images (e.g., photographs).

Qualifications & exceptions

• The section is specifically for Brazilian residents.
• Idwall is described as an independent data controller, not a Jumio processor.
• The government-identifier item notes that Jumio redacts certain identifiers in accordance with applicable national laws.

Not stated here

• Idwall's privacy policy is linked but its text is not supplied here, so Idwall's own practices are not analyzed.

Sharing & Disclosure · Company commitment

For the Idwall processing, Jumio says it will not share or disclose Biometric Data

Section 13 says that for this processing activity, Jumio will not share or disclose any Biometric Data. It refers the reader to Idwall's Privacy Policy for information about privacy rights, retention, and how personal information is used and shared.

Supporting quotations

For this processing activity, Jumio will not share or disclose any Biometric Data. Please refer to Idwall’s Privacy Policy for more information about your privacy rights, retention, and how your personal information is used and shared.

Qualifications & exceptions

• The no-disclosure statement is limited to the Brazil/Idwall processing activity described in this section.

Not stated here

• Idwall's Privacy Policy is linked but not supplied here; its retention and rights terms are outside this analysis.

Cross-references

• exception to (model-proposed): Biometric data may be shared with the Customer and service providers and stored for improvement and proof of inspection — The general statement that Jumio may share biometric data with the Customer and service providers is subject to the Brazil/Idwall section's statement that Jumio will not share or disclose Biometric Data for that processing activity.

Legal Rights & Agreement Rules · Procedure

Brazilian residents can contact Jumio's Data Protection Officer and Encarregado

Section 13 identifies Jumio's Data Protection Officer and Person in Charge ('Encarregado'), Joe Kaufmann, and says he may be contacted at the email address shown.

Supporting quotations

Jumio’s Data Protection Officer and Person in Charge (“Encarregado”), Joe Kaufmann, may be contacted at [[email protected]](https://www.jumio.com/cdn-cgi/l/email-protection#3a4a48534c5b59437a504f57535514595557).

Qualifications & exceptions

• The email address is rendered as a Cloudflare-protected placeholder in the saved text; the actual address is not visible in this source.

Not stated here

• The actual email address and any response time are not visible in this saved copy.

Data Access & Collection · Restriction or exception

Services are not directed to children under 13, and Jumio says it will not knowingly collect their information

Section 14 says Jumio's Services are not directed to children under the age of 13, and Jumio will never knowingly collect information from anyone it knows is under 13. It recommends that persons over 13 but under 18 ask their parents for permission before engaging with the Services or sending information about themselves to anyone over the Internet.

Supporting quotations

Children’s privacy

Jumio’s Services are not directed to children under the age of 13, and Jumio will never knowingly collect information from anyone it knows is under the age of 13. We recommend that persons over 13, but under 18 years of age, ask their parents for permission before engaging with the Services or sending any information about themselves to anyone over the Internet.

Qualifications & exceptions

• The no-collection commitment is limited to information from a person Jumio knows is under 13.
• The recommendation for 13-to-17-year-olds is advisory ('We recommend'), not a stated prohibition.

Not stated here

• The Notice does not state what Jumio does if it learns it has collected information from a child under 13.

Inference & Profiling · Company practice

Jumio uses automated checks and trained-agent review, but says it does not make the final automated decision

Section 14 says Jumio implements measures such as machine learning capabilities or manual review by specially trained verification agents to safeguard data quality. When processing automatically, it applies criteria such as checks on the integrity and quality of photographs and documents; extraction and analysis of text, graphical layout, documents, face photographs, biometric data and background; analysis of all steps combined, considering multiple variables, predictions and confidence values for a final score; lookups against known images and known fraudulent cases; procedures to minimize demographic bias in machine learning algorithms; and, in identity verification, comparing a selfie or video against the identification-document photograph to confirm the individual is genuinely present. Jumio says these automated checks inform the Customer, but Jumio does not use automated decision-making to make a final decision that would produce legal or similarly significant effects for the user; it directs questions about automated decision-making rights to the Customer.

Supporting quotations

Data quality and automated decision making

To help safeguard the quality of the data provided by the Services, Jumio implements measures such as machine learning capabilities or manual review by specially trained verification agents. When we process the personal information automatically, we apply the following examples of criteria:

Checks on the integrity and quality of photographs;

Checks on the integrity and recognition of documents;

Extraction and analysis of text, graphical layout, and any other available information on the documents, face photographs and biometric data, and background;

Analysis of results of all the steps combined, considering multiple variables, predictions and confidence values for a final score;

Lookups against known images as well as known fraudulent cases;

Procedures to minimize demographic bias in machine learning algorithms; and

In cases of identity verification, a selfie or video may be used to compare against the photograph on an identification document, to ensure the individual is genuinely present during the transaction.

Jumio uses these automated checks to inform our Customer, but Jumio does not use automated decision-making to make a final decision that would produce legal or similarly significant effects for you. Please contact the Customer directly with any questions regarding the rights you may have to the extent your personal information is subject to automated decision-making.

Qualifications & exceptions

• The no-final-decision statement is Jumio's own characterization; the Notice says the automated checks inform the Customer and directs the user to the Customer for questions about automated decision-making rights.
• The list of criteria is introduced by 'the following examples of criteria', so it is not exhaustive.

Not stated here

• The Notice does not describe the Customer's decision process, the role of human review by the Customer, or the accuracy of the scores.

Cross-references

• qualifies (model-proposed): Jumio creates transaction risk calculations and scores for Customers — The risk scores described as inferences inform the Customer; Jumio says it does not use automated decision-making to make the final decision with legal or similarly significant effects, and directs questions about those rights to the Customer.

Legal Rights & Agreement Rules · Context

For EEA, Swiss, UK and Brazilian residents, Jumio states controller legal bases

Section 14 says that when Jumio processes personal information as a processor or service provider for its Customers, it acts on their behalf. When it processes personal information of residents of the EEA, Switzerland, the UK, or Brazil as a controller, it says it does so on these legal bases: the user's consent; the prevailing legitimate interest of Customers and Jumio to achieve the Section 6 purposes; the prevailing legitimate interest of individuals whose information is used for a fraudulent transaction not to become victims of identity theft; the necessity to comply with legal obligations; and the necessity for the establishment, exercise, or defense of legal claims.

Supporting quotations

Legal basis for processing

When we process personal information as a processor (or service provider) for our Customers, we are acting on their behalf. When we process personal information of residents of the EEA, Switzerland, the UK, or Brazil as a controller (or business), we will do so with the following legal bases:

Your consent;

The prevailing legitimate interest of our Customers and Jumio to achieve the purposes set out in Section 6;

The prevailing legitimate interest of individuals whose personal information is used for a fraudulent transaction to not become victims of identity theft;

The necessity to comply with legal obligations to which we are subject; and

The necessity for the establishment, exercise, or defense of legal claims.

Qualifications & exceptions

• The legal bases are stated only for residents of those regions and only when Jumio acts as a controller.
• The legitimate-interest bases are described as 'prevailing'.

Not stated here

• The Notice does not state which legal basis applies to which processing activity or how a user can object to a legitimate-interest basis.

Legal Rights & Agreement Rules · Company practice

Jumio may update the Notice and will provide notice of material changes appropriately

Section 15 says Jumio may update the Notice as it makes changes to the Services, recommends reviewing the privacy-notices page periodically for updates, and says notice of material changes will be provided appropriately.

Supporting quotations

15. Will this notice change?

We may update this Notice as we make changes to the Services in the future. We recommend reviewing this page periodically for any updates. Notice of material changes will be provided appropriately.

Qualifications & exceptions

• The Notice does not define 'material changes' or specify the form or timing of the notice.

Not stated here

• The linked privacy-notices page is not supplied here, so whether prior versions remain available is not established.

Legal Rights & Agreement Rules · Procedure

Jumio's privacy contacts include a Data Protection Officer and a Sunnyvale mail address

Section 16 gives Jumio's Data Protection Officer email address and a mail address: Jumio Corporation ATTN: Privacy, 100 Mathilda Place, Suite 100, Sunnyvale, CA 94086 U.S.A.

Supporting quotations

16. How do I contact Jumio?

Data Protection Officer: [[email protected]](https://www.jumio.com/cdn-cgi/l/email-protection#6010120916010319200a150d090f4e030f0d).

Mail: Jumio Corporation ATTN: Privacy | 100 Mathilda Place, Suite 100 | Sunnyvale, CA, 94086 U.S.A.

Qualifications & exceptions

• The DPO email is rendered as a Cloudflare-protected placeholder in the saved text; the actual address is not visible in this source.

Not stated here

• The actual DPO email address is not visible in this saved copy.

Legal Rights & Agreement Rules · Context

Jumio names an EU representative in Linz, Austria

Section 16 identifies Jumio's EU Representative as Jumio Software Development GmbH, Lunaplatz 5, 4030 Linz, Austria.

Supporting quotations

EU Representative: Jumio Software Development GmbH, Lunaplatz 5, 4030 Linz, Austria.

Not stated here

• The Notice does not state the EU representative's role beyond the contact details.

Legal Rights & Agreement Rules · Procedure

Unresolved privacy concerns can go to a free U.S.-based third-party dispute resolution provider

Section 16 says that if the user has an unresolved privacy or data use concern that Jumio has not addressed satisfactorily, the user can contact Jumio's U.S.-based third-party dispute resolution provider, free of charge, at the TrustArc watchdog request URL.

Supporting quotations

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at https://feedback-form.trustarc.com/watchdog/request.

Qualifications & exceptions

• The route is described for concerns Jumio has not addressed satisfactorily.
• The Notice does not state a response time or whether the provider's outcome is binding.

Not stated here

• The linked TrustArc form's terms and process are not supplied here.