Data Processing

1. Scope

These terms describe how Identity Entry processes personal information on behalf of the businesses that use it. They form part of the Terms of Service. A signed data processing agreement can be set up for a production deployment together with its commercial terms. To start one, use the contact page.

2. Roles

For checks, the business is the controller and decides why and how personal information is processed. Identity Entry is the processor and handles that information only to provide the service. For account and billing information about the business itself, Identity Entry is the controller, as explained in the Privacy Policy.

3. Details of processing

• Subject matter: identity verification and the extra checks the business turns on.
• People involved: the people the business asks to complete a check.
• Kinds of information: ID document photos and details, selfies, movement-check frames, contact details, consent records and the results of extra checks.
• Duration: for as long as the business uses the service, subject to the Data Retention schedule.

4. Processing on instructions

Identity Entry processes personal information only on the business's documented instructions. The business gives those instructions through its workspace settings, the checks it requests and these terms. If Identity Entry believes an instruction breaks the law, it will tell the business.

5. Confidentiality

Everyone at Identity Entry who can access personal information is bound by a duty of confidentiality and has access only where needed to provide or support the service.

6. Security

Identity Entry applies technical and organizational measures to protect personal information, including encryption of photos before storage, signed short-lived capture links, separation between workspaces and hashed passwords. The Security page describes these measures.

7. Subprocessors

The business authorizes Identity Entry to use the subprocessors listed on the Subprocessors page. Identity Entry holds each subprocessor to data protection obligations that are no less protective than these terms and remains responsible for their work. Identity Entry will give notice before adding or replacing a subprocessor, and the business may object on reasonable data protection grounds.

8. Assistance

Identity Entry will help the business respond to requests from people exercising their rights, and will give reasonable help with data protection impact assessments and consultations with authorities, taking into account the nature of the processing and the information available to it. If a person contacts Identity Entry directly about a check, Identity Entry will pass the request to the business.

9. Security incidents

If Identity Entry becomes aware of a breach of security affecting personal information processed for a business, it will notify that business without undue delay. The notice will describe what is known about the incident, the information affected and the steps being taken, and Identity Entry will provide updates as more becomes known.

10. Deletion and return

When the agreement ends, Identity Entry will delete or return the remaining personal information at the business's choice, unless the law requires it to be kept.

11. Audits

On request, Identity Entry will make available the information reasonably needed to show that it meets these terms, and will respond to reasonable written questions about its processing. Further audits can be arranged by agreement with reasonable notice, at reasonable times and subject to confidentiality.

12. International transfers

Where personal information is processed outside the country where it was collected, Identity Entry relies on the transfer safeguards its subprocessors provide and applies the protections in these terms wherever the information is handled.