Snapshot 231650
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Privacy notice General Privacy Information Key definitions Who we are Yoti as Controller and Processor Information collection and use Information sharing Security and data location Yoti Security Measures Location of your data Your rights Complaints Contact us This information is here to explain to you how Yoti uses your personal data. This is a general notice and contains high-level information that applies across all of our business. For privacy information on specific Yoti products, please see our product privacy notices. Product privacy notices Key definitions Biometrics: A study of people’s unique physical and behavioural characteristics, which aims to identify or recognise people as a unique individual based on traits they have. At Yoti we use biometrics. For example when you set up a Digital ID we take a face scan (also known as a selfie photo), which we store securely and use for the purpose of checking if it’s really you. Data Protection Officer: The person who is responsible for overseeing a company’s data protection implementation to ensure compliance with data privacy law. Encryption: This allows information to be hidden so that it cannot be read without special knowledge such as a key or a password. GDPR / UK GDPR: The General Data Protection Regulation is a legal framework that sets guidelines for the collection and processing of personal information from individuals who live in the UK & European Union (EU). It protects people and lays down rules about how data about people can be used. ISO 27001, 27701 and SOC 2: These are information security and privacy management controls and standards, designed against a set of defined tests that the organisation has to be assessed on. Who we are We are Yoti Limited (‘we’, ‘our’, ‘us’) but you can call us ‘Yoti’. You can get in touch with us by Emailing us at [email protected] (for general queries) or [email protected] (for privacy queries) Writing to us at 1 Aldgate, London, EC3N 1RE (our company number is 08998951) Yoti is a digital identity and age assurance company and our clients buy our products to help them check the identity or age of their users. For example, individuals can use Yoti products to show how old they are when they want to buy age-restricted goods. Yoti takes your privacy very seriously. We design our software and services with privacy at their heart, guided by a set of principles which you can read about here: https://www.yoti.com/ethical-framework. Yoti are monitored by a Guardian Council, who are respected and influential individuals who make sure that Yoti always seeks to do the right thing, and that we are transparent about what we are doing and why. Read more about them here: https://www.yoti.com/ethical-framework. We are also certified as a B Corp company, meaning that we consider the impact of our decisions on employees, consumers, the community and the environment. Read more about it here: https://www.bcorporation.net/. Yoti as Controller and Processor Under UK/EU data protection laws, Yoti is sometimes a controller and sometimes a processor, depending on which product is being used. For example Yoti is the controller of the Digital ID app because we designed the app and decide how data of app users is processed. But when it comes to our age assurance and identity verification products, Yoti is acting as a processor / service provider on behalf of our clients who determine the purpose for doing an age or identity check. You can read more about Yoti’s role in each Product Privacy Notice which can be found on the Product Privacy page. Information collection and use Yoti collects different types of personal information for different reasons. We explain our general reasons (or lawful bases) for collecting this information below. Our Product-specific Privacy Notices provide more specific information on how we collect and use personal data for that product. Performance of a contract When you set up and use our app and associated products and services, almost all the personal information collection and use is necessary to provide the app, product or service. If you provide us your contact details to ask us a question, request more information or contact our Customer Support, we use your details to reply and resolve any issues. Consent We ask you to consent to us using your biometrics. This is because biometric data is sensitive or special category data under the GDPR and the lawful bases available for this data are very limited. There are also biometrics laws in other countries that require consent. See the section on biometrics in our app privacy policy for more information about the biometrics we use and why. Legitimate interests Some personal data collection and use is in our legitimate business interests. To use this lawful basis we assess both our interests and yours, to make sure that what we’re doing does not cause any unjustified privacy intrusion. Some examples include: Fraud reporting and prevention: some fraud prevention bodies we work with such as Cifas require us to report identity fraud we discover. User testing: Yoti performs user surveys and testing to improve our products and services. All of our user testing is voluntary. You can read more here: https://www.yoti.com/privacy/user-testing/ Yoti Internal Fraud Database: We process fraud data as part of our Internal Fraud Database in order to prevent fraud in our products. You can read more here: https://www.yoti.com/privacy/internal-fraud-database Vimeo videos for internal research and development: We use CC0 licensed videos uploaded by registered individuals onto the Vimeo platform in order to help train our anti-spoofing technology. We only use these internally within our R&D team and delete this data after 6 months. Individuals can opt-out of this processing by emailing [email protected]. B2B Marketing & Campaign records: we keep information so we can market to our clients and also so we know who was sent what marketing information and when. Invoice and billing: We use this data for billing and invoicing our clients. Legal obligation If you previously signed up to hear about Yoti but you decide you no longer want to hear from us, we are obliged by law to stop contacting you. To meet this legal obligation we will add your details to a suppression list so you no longer hear from us. Information sharing Yoti will never sell your personal information. However there are some situations where we may share some information: If you provide fraudulent information If, after investigation, we determine that there has been fraud that meets the criteria for reporting, we will pass the details to relevant fraud prevention agencies to prevent further fraud. One of these agencies is Cifas. Cifas keeps fraud reports for six years. Other Cifas members may use the information we report for fraud prevention purposes. You can find the Cifas privacy information, including how to submit an access request, here: https://www.cifas.org.uk/fpn If we get a request for information from law enforcement or other official authority We will have a legal obligation to share the information if we receive a court or similar legal order ordering us to disclose it. Where we are required to share information with law enforcement or other government authority we will ensure (to the extent such actions are lawful): The request is valid; The information requested is no more than necessary; To redirect the request to the relevant controller (or Yoti Client); and To inform the relevant controller (or Yoti Client) of the request. To verify your details as part of a Yoti Client request for an identity or age check: For some of our products we check certain details with third parties, as part of verifying identity or age. For example, some of our identity check products include the option to check personal details such as your name and address against a credit reference agency such as Experian. In these circumstances Yoti sends the relevant details to the credit reference agency on behalf of the Yoti Client, and sends the result of this check back to the Client to help the Client verify who you are. The relevant Product Privacy Notices will set out when and how this happens in more detail. Depending on how you are using Yoti, we may use trusted third party suppliers to help us with our operations, for example, third party data storage providers, online payment providers and other identity providers: Before we share any data with third parties we always conduct due diligence and ensure that adequate technical safeguards are in place, including security and contractual protections. We also check where data is processed by those third parties, to ensure that there are legal and technical safeguards in place to protect data in countries that may be outside of the UK or EU. When you choose to share your personal information You are able to decide when you want to use a Yoti product or service to verify your identity or age. If you choose to share your information with a third party using Yoti, those third parties may choose to use that information to communicate with you or they may share that information with others. You should make sure to read the privacy notice of that organisation so that you can understand how they manage and use your personal information. Security and data location Yoti Security Measures Security is a core business principle at Yoti. You can read more about Yoti’s technical and organisational security measures here: https://www.yoti.com/security/ We continually test our systems to ensure that we are compliant with the top industry standards for information security including ISO 27001, 27701 and SOC2. Several times a year external audits are carried out on us to check that our security arrangements are compliant with these internationally recognised standards for best practice in security. Location of your data Yoti stores personal information processed as part of Yoti Products securely in our UK data centres. In some cases we may need to transfer your data outside of the UK to be able to deliver our products. For example, we sometimes transfer data to Yoti India, for the purpose of conducting manual ID document checks. In this case we always take additional security measures to protect your data including implementing SCCs, the UK Addendum and conducting a Transfer Impact Assessment. We also sometimes use third party suppliers, some of which have their servers in other countries such as the US. Where we have third parties to support our business we have contract terms and other measures in place to safeguard your information such as supplier due diligence, SCCs, UK IDTA, Transfer Impact Assessments and Adequacy Decisions. The Product Privacy Notices have more information on where we keep data and the security measures relevant to that product. Your rights You have different rights under data protection law with regard to your personal information. Some rights only apply in certain circumstances or to certain information. Generally speaking you have a right to Know what personal information we hold about you and to receive a copy of it; Ask for a copy of your personal information in a portable format or ask us to send it to someone else; ask us to correct inaccurate information about you; Ask us to delete your data (note that this right does not always apply for example if Yoti is required by law to keep your data); Withdraw your consent; Ask us to review an automated decision; Ask for your data to not be used for direct marketing purposes; For the purposes of the California Consumer Protection Act, we do not sell your data. We note that for some of our products Yoti is acting as a processor and has no ability to access or delete your data (see Section 3 of this notice). In this case you will need to contact the controller i.e. the organisation that asked you to complete the age or identity check to exercise your rights. If you want to make any requests to Yoti as controller please email: [email protected]. Complaints You can complain to us directly by following our complaints process which is outlined in detail here: https://support.yoti.com/yotisupport/s/article/How-can-I-raise-a-complain Alternatively you can contact your local privacy regulator directly including: The UK Information Commissioner’s Office (ICO): https://ico.org.uk/global/contact-us/ The Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au/ Contact us There are many different ways to contact Yoti if you wish to exercise your privacy rights the main ones are listed below. You can also contact us from within the Yoti Digital ID app. Email: [email protected]; [email protected] Website: https://www.yoti.com/contact/ If you are in the EU, you can contact our GDPR Representative, the European Data Protection Office (EDPO) by writing to the EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium; or using the EDPO’s online request form available here: https://edpo.com/gdpr-data-request/