Security · Data
A region is chosen once, and data does not leave it.
Processing happens in the United Kingdom or in the European Union, decided per operator at the start and not per request. Everything below follows from that choice.
- 2regions
- Operator-setretention
- Discardedbiometric template
What is held
Four categories, three fates
- 1
Images
Encrypted at rest and retained to the operator's own policy, because the retention obligation is the operator's licence condition rather than our preference.
- 2
Extracted fields and decisions
The audit trail. These are what make a verdict explainable in year three, so they outlive the images in most configurations.
- 3
Biometric template
Discarded at the decision. It exists to produce a match score and has no use after that score is recorded.
Subject rights
What happens when a player asks
| Request | Who answers | What we do |
|---|---|---|
| Access | The operator | Supply the bundle to you in machine-readable form, within your own response window |
| Rectification | The operator | Correct the field and record the correction; the original stays in the audit trail |
| Erasure | The operator | Delete on instruction, except what a retention obligation requires you to keep |
| Portability | The operator | Export the bundle and the extracted fields |
The operator is the controller and we are the processor, so a request reaches us through you. The division is set out in the data processing terms rather than assumed here.