Biometric Data Retention and Destruction Policy

This Biometric Data Retention and Destruction Policy explains which biometric data Didit processes when it provides identity verification and fraud prevention services to its customers, why Didit uses it, how long it is kept, and how it is destroyed. It is Didit's public written retention schedule and destruction guidelines for biometric data, including for the purposes of the Illinois Biometric Information Privacy Act (740 ILCS 14/15(a)) and Colorado law (C.R.S. § 6-1-1314).

This policy supplements our Verification Privacy Notice, our End User Terms for Identity Verification, and our Privacy Policy.

1. Scope

This policy applies to biometric data that Didit processes when you complete a verification flow (a Didit-hosted flow, SDK, white-label experience, or API-powered journey) that a Didit customer (the "Customer") has set up with a face capture, such as a selfie, a liveness check, or a face match.

2. Who decides and who processes

• The Customer that asks you to verify decides why and how your biometric data is collected. It is the controller of that data, or holds the equivalent role under the applicable law.
• Didit processes biometric data on the Customer's behalf and on its documented instructions, as its processor or service provider.

3. What biometric data Didit collects

Depending on how the Customer set up the verification, Didit may collect:

• Face geometry and face templates: measurements of facial features taken from your selfie, your liveness capture, or the portrait on your identity document, and the templates (numerical representations of a face) created from them.
• Selfie images taken during the verification.
• Document portrait: the image of your face on the identity document you submit.
• Liveness video: the video or image frames captured to confirm that a real person is present.

4. Why Didit uses it

Didit uses biometric data to verify identity and prevent fraud for the Customer, on the Customer's instructions:

• to check that the person presenting an identity document is the person shown on it;
• to confirm that a real, live person is present and to detect spoofing attempts; and
• where the Customer enables them, to detect duplicate accounts and faces on the Customer's blocklist.

5. Retention schedule

Biometric data is deleted at the earliest of:

1. when the Customer's purpose for collecting it has been met;
2. the end of the retention period the Customer set; and
3. for people covered by the state laws below, the state deadline counted from their last verification with that Customer.

Your last verification with a Customer is your most recent verification session for that Customer, and a new session restarts the count. A state deadline applies even when the Customer's retention setting is longer, including when it is set to unlimited. When more than one deadline applies, the earliest one applies.

A state deadline applies to you when, for example, you were in that state when your face was captured, your identity document was issued by that state, or the Customer told Didit that you are in that state.

Didit does not keep biometric data after its deadline.

6. How deletion works

• Permanent. Deletion is permanent. Didit keeps no copy of deleted biometric data.
• Every store. Deletion covers every place where Didit holds the data: the original images and video, the face geometry and templates created from them, and the face search entries used for duplicate and blocklist checks, including on the systems of Didit's subprocessors.
• Automatic. Didit applies the deadlines in section 5 automatically, without waiting for a request.
• Recorded. Didit records that a deletion took place, without keeping the deleted data.

Biometric data is also deleted before any deadline when the Customer instructs Didit to delete it, or when a valid deletion request covering you is accepted (see section 10).

7. No sale or profit

Didit does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.

8. Processors and subprocessors

Didit uses subprocessors, such as cloud hosting and storage providers, to help it provide the service. Didit imposes data-protection obligations on each subprocessor that are substantially similar to those in its Data Processing Addendum, which is part of the Business Terms, and remains liable to the Customer for their compliance. Customers can request the current list of subprocessors at privacy@didit.me.

9. Consent and withdrawal

Before capture. Where the law requires it, you are asked for your explicit consent before your selfie or liveness video is captured. The verification flow explains what is collected, why, and for how long, links to this policy, and asks you to agree, for example by ticking a box. If you decline, the verification ends and Didit does not capture your selfie or liveness video. Your answer is recorded with the verification session.

Customer screens. Where the Customer runs its own verification screens (API or white-label journeys), Didit expects the Customer to clearly identify Didit as the verification provider and to obtain any notice or consent required by law before biometric capture begins.

Withdrawal. You can withdraw your consent at any time by contacting the Customer that asked you to verify, or Didit at privacy@didit.me. Withdrawing consent does not affect processing that took place before it. To have the biometric data already collected deleted, make a deletion request as described in section 10.

10. Access and deletion requests

To access or delete your biometric data, first contact the Customer that asked you to verify: it controls the data and can act on it directly. You can also write to privacy@didit.me or to Didit's Data Protection Officer at dpo@didit.me. Where Didit acts as the Customer's processor, Didit may forward your request to the Customer.

A valid deletion request covering you deletes your biometric data from every store, including any face template that the Customer chose to retain.

11. Security

Didit protects biometric data with a reasonable standard of care designed for sensitive data, including access controls, monitoring, and encryption. Our Information Security Policy describes these safeguards.

12. Changes to this policy

Didit may update this policy to reflect legal, operational, or product changes. When it does, it updates the date at the top of this policy.

13. Contact

If you have questions about this policy, contact:

• privacy@didit.me
• dpo@didit.me