Verification Privacy Notice

• Identity document: photos of the document, or the data read from its chip over NFC (such as name, document number, nationality, dates of birth and expiry, and the chip photo), and the text read from it.
• Selfie and liveness frames: photos of your face taken during the liveness check.
• Biometric data: a mathematical template of your face, created from your selfie and your document photo, and — if the Business enables it — an age estimate.
• Device and network data: IP address and browser user agent.
• Verification results: the outcome of each check, scores, the final decision and a history of the steps.
• Screening results: whether your name matches public sanctions lists or lists of politically exposed persons, if the Business enables screening.

Only to check that you are a real person present during the verification, that your document is genuine and belongs to you, to detect fraud such as the same face being used under different identities with the same Business, and — where enabled — to screen against sanctions lists and to monitor for later changes to them. Your data is not used for advertising, is not sold and is not used to train our models.

Your face is compared with the photo on your document (1:1) and, if the Business enables duplicate detection, with its other verifications (1:N). Biometric templates are used only for these purposes, are never shared with other businesses and are deleted together with your other verification data at the end of the retention period below.

Because biometric data is a special category of personal data in many countries, the Business must obtain your explicit consent, or rely on another basis the law allows, before the verification starts. You give that consent on the first screen of the verification.

The Business determines the legal basis. It is usually your consent (for biometric data, your explicit consent), a legal obligation such as anti-money-laundering rules, or a contract with you. The Business's own privacy notice gives the details.

The checks run automatically and may lead to an automatic approval or rejection. Uncertain cases go to a human reviewer at the Business. If a decision significantly affects you, you can ask the Business for a human review, give your point of view and contest the decision.

The Business that requested the verification receives the result and, depending on its settings, your document data and images. Our hosting provider stores the data on our behalf. When the liveness step starts, your browser downloads face-tracking components from public content delivery networks (jsDelivr and Google), which receive your IP address as part of that download. We disclose data to authorities only where the law requires it.

On servers in Germany (EU) operated for us by Hetzner Online GmbH. If the Business is located in another country, it receives your data there under safeguards it is responsible for.

Unless the Business has agreed a different period with us, your personal data — images, chip data, extracted fields and biometric templates — is deleted automatically and permanently 90 days after the verification is completed. Unfinished verifications expire after 60 minutes and follow the same deletion cycle. The Business can delete your data earlier at any time. Scores and the final decision, which contain no personal data, are kept for audit purposes. Details are in our Data Retention Policy. Our web servers' access logs, which include your IP address, are kept for 12 months to protect the service against attacks and are then deleted automatically.

Depending on the law that applies to you — for example the UK or EU GDPR, Turkey's KVKK, Brazil's LGPD or South Africa's POPIA — you may have the right to access, correct or delete your data, to restrict or object to processing, to data portability, and to withdraw your consent at any time. Withdrawing consent stops further processing but does not affect verifications already completed. Contact the Business; if you write to us at info@idotta.com, we forward your request to it. You can also complain to your data protection authority.

Data travels over encrypted connections, access to it is restricted and logged, and the measures we apply are described on our Security page.

Verifications are intended for adults. If a Business verifies minors, it is responsible for obtaining any consent required from a parent or guardian.

We may update this notice; the date above shows the current version. Contact: IDOTTA LIMITED, Suite 11251, 5 Brayford Square, London E1 0SG, United Kingdom, info@idotta.com.