This is the Privacy Notice of the Sumsub group of companies: Sum and Substance Ltd., incorporated and registered in England with company number 09688671 (after – Sumsub or we) together with all affiliated companies and trading divisions, irrespective of location or jurisdiction (hereinafter - Sumsub or we). More information about our group can be found in Provision 16 of this Privacy Notice.
Sumsub processes personal data in the course of service provision to its Clients according to their instructions. The client is the Controller that determines the purpose of data processing, exercises control over the User’s personal data, and stipulates the retention period of the User’s data according to its purposes. Sumsub, in turn, is a Processor that conducts only those data processing activities that the client requests. For clarity, Sumsub performs remote identity verification procedures for the client as part of service provision. Before passing such procedures, the User consents to such processing or is properly notified by the client in line with the client’s Privacy Policy.
When developing and improving Services as a matter of public interest and other cases specified in this Privacy Notice, Sumsub is the Controller of Users' personal data.
This Privacy Notice outlines how we process personal data, commit to protecting your information, and provide the framework through which effective management of data protection matters can be achieved while providing our Services. This Privacy Notice does not cover how Sumsub Clients may treat Users' personal data. Clients provide this information in their privacy statements which are not subject to Sumsub's control.
If you are a California resident, you may find information about the CCPA application in Provision 18 of this Notice.
If you are a resident of Illinois, Washington, or Texas, it is necessary to refer to the “Special notice to residents of the states of Illinois, Washington, or Texas (USA)” (Provision 19 of this Privacy Notice). In case of any conflict or ambiguity between the Special Notice and the other provisions of this Privacy Notice, the former will prevail.
Agreement
the Service Provider Agreement concluded with each Client, its annexes and appendices;
Client
the legal entity to which Sumsub provides Services under the Agreement;
Service(s)
the personal identity verification service and connected services provided by Sumsub;
Data Controller, or Controller
the Client where it, alone or jointly with others, determines the purposes and means of the processing of personal data by written instruction for processing activities given to Sumsub;
Data Processor, or Processor
Sumsub where it processes personal data on behalf of a Data Controller;
Third-Party Processors
processors authorised to exercise certain processing activities under the direct authority of Sumsub;
Data Providers
third-party service providers or public authorities used to collect additional information necessary for the provision of the Services;
Data Subject
any individual (hereafter - User) whose personal data Sumsub may process on behalf of the Controller (the Client’s customers);
Personal data
any information relating to an identified or identifiable Data Subject;
Special categories of personal data
personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, or data concerning health or data concerning a natural person's sex life or sexual orientation;
Data concerning health
personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;
Filing system
any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised, or dispersed on a functional or geographical basis used for service provision;
User
any individual in respect of whom the identity verification procedure (or any of its elements) is performed as part of the Services provided to a Client (may be referred to as ‘you’ in this Notice);
Website
sumsub.com;
Processing
any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Personal data breach
a breach of data security leading to unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed;
Consent
any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which they, by a statement or by clear affirmative action, signify agreement to the processing of their personal data;
Livechat
a system that allows Users to have a real-time interaction with Sumsub’s support team in a chatbox on the Website page in the browser;
Customer due diligence procedure
the process and rules established by the Client in line with applicable regulations, including the requirements for identifying its customers, related risks and checking they are who they say they are (may be referred to as ‘KYC’ in this Notice);
Standard Contractual Clauses
standard sets of contractual terms and conditions adopted by the European Commission (or UK-designated authorities) and ensuring appropriate safeguards for data transfers from the EEA and the UK to third countries, which the Controller and the Processor both sign up to, where necessary;
EEA
European Economic Area (the European Union Member States, Norway, Iceland and, Liechtenstein);
AML/CFT
Anti-Money Laundering / Combating the Financing of Terrorism legal rules and standards as envisaged in FATF recommendations, EU regulations, and national legislation;
Politically Exposed Persons (PEPs)
individuals who are or have been entrusted with prominent public functions (e.g., heads of state or government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations, important political party officials), as well as their relatives and close associates;
CCPA
the California Consumer Privacy Act of 2018, Civil Code sections 1798.100.
Sumsub adheres to the principles of personal data protection as envisaged in the EU GDPR and the UK GDPR. In accordance with these principles, Sumsub assists the Controller in ensuring that the User’s personal data is:
[а] Performance of the Agreement
While serving Clients, Sumsub mainly processes your data as a Processor for the Client's benefit. Sumsub processes personal data for the performance of the Agreements, including indicated services, obligations arising from the Agreement, and related rights, as well as for the execution of rights and fulfilment of obligations deriving from legal acts and processing Users' requests.
Sumsub collects and further processes Users' data for the Client, which may include matters of compliance with applicable AML/CFT and/or other laws and regulations and/or the Client's internal customer due diligence procedures. Once personal data is no longer necessary for the relevant purpose, Sumsub erases it from its servers upon the Client's written instruction without leaving any backup copies after transferring it to the Client.
[b] Other purposes
We may process your data for purposes that serve Sumsub's legitimate interests, which include the following purposes:
Sumsub provides multiple types of automated processing, including, but not limited to, collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination (if so legally binding), or otherwise making available, alignment or combination, restriction, erasure or destruction.
• Document сheck
For fraud detection, Sumsub subjects personal data from photos and scanned copies of documents to automated reading and verification of authenticity by conducting different checks, such as completeness of records, screenshots detection, or cross-checking of all data from all submitted documents (e.g., name, date, and place of birth, signature). We also check the document's security features, including the embedded security chip, machine-readable zone (MRZ), barcodes, QR codes and other security components used for genuine data validation. The Sumsub system analyses the results of the above to make an inference regarding the document’s trustworthiness.
• Biometric processing methods
Sumsub may process biometrics to verify whether provided facial images are likely to match depending on the service chosen by a particular Client. The processing of biometrics means extracting facial features from uploaded or recorded facial images on government-issued identity documents submitted by the User and comparing them. We store this biometric data for a period our Client instructs.
There are several reasons why Clients ask for such biometrics processing. Generally, Clients may wish to check whether an identity document genuinely belongs to the User by comparing a provided facial image to the facial image contained in the identity document.
In addition, Clients may ask us to check whether a User is alive and genuine. To do this, we use our Liveness check to determine if the User isn’t holding a mobile phone, showing any signs of constraint, or attempting to defraud the system using emulators, static images, or ‘deep fakes’. As a rule, the User is prompted to blink, smile, or move their device while passing Liveness. During such checks, we may also detect signs of fraud or other spoofing attacks by comparing the User's facial features to those of known masks. Simultaneously, we may also check whether the User may be generating multiple identities by inspecting whether we have previously verified him/her on behalf of a particular Client. To determine if the User is known to a specific Client, we compare the User's facial image to the facial images of other Users previously verified on behalf of that particular Client.
When required by the Client, we assist in the authentication process. For this, the Client may ask the User to pass liveness. During this process, the User’s face is recognized, and the result is compared with the biometric data records of the said User obtained previously.
For each authentication attempt, we will compare the new liveness facial image with the biometrics of the said User obtained previously.
• Video identification processing
Usually, video identification is a process where the person who is to be identified and the employee-operator sit opposite one another "face to face" in video transmission and communicate with one another. The process is carried out if the Client has a legal obligation to do so (for example, due to AML / CFT regulation). To perform video identification, we provide the Client with functionality so that they can conduct a video interview with Users during onboarding. If the Client prefers, the video identification interview can be provided by Sumsub operators. The content of the video interview and its nature are also completely dependent on the Client’s requirements.
• Data validation
These data validation checks enable Clients to verify data against databases of third-party data providers and detect whether the User is involved in illicit activities, money laundering or terrorism financing. To do this, we will check the data extracted from the uploaded documents or provided by the User against a database of third-party data providers. The data providers we may use depend on the Client’s needs and the User’s location and may include ID registers, proof of address checks, the Social Security Administration and other government or commercial sources and databases, consumer credit agencies, PEP lists, global and country-specific sanctions lists, and adverse media sources.
Throughout the course of the Client’s relationship with the User, we may assist the Client in periodically screening the User’s data against databases to help prevent, detect, and investigate fraud and money laundering.
Sometimes Clients ask us to conduct phone or email risk scoring. When we do it, we screen User’s email address or phone number with the combination of IP address, where available, together with the publicly available information provided by the third-party processors or data providers, based on the data mentioned above and get the risk labels based on its registrations on the web, domain name, delivery option and other parameters.
• Know Your Transaction or KYT check
KYT or “Know Your Transaction” is a check that analyses transaction data relating to senders and recipients. It enables Clients to detect and report unusual/uncharacteristic behaviour and patterns that are characteristic of money laundering, terrorist financing, fraud, or other illicit activity.
• Know Your Business or KYB check
If the Client subscribes to the KYB check, it requires us to verify the existence, details, ownership, and control structure (e.g., ultimate beneficial owner(s)) of a legal entity through analysis of corporate documents and review of corporate registries, where available.
• Crypto Travel Rule Solution
The Client may order this check for compliance with their legal obligations under the AML/CFT legislation. This mandates the Virtual Asset Service Provider, or VASP, which could be our Client, to obtain, verify, hold and exchange the particular transaction sender and recipient information with their counterparty VASPs during or before the transaction. When carrying out this check, we verify the user's identity and transfer to/ receive from the Client's counterparty VASP particular user's data using special messaging protocols, such as Travel Rule Protocol (TRP), Sumsub API protocol, and platforms providing encrypted messages and data flows.
• Fraud detection
Sumsub implements a fraud detection and control network based on the anti-fraud checks required by our Clients and those included in our Services by default (e.g., Photoshop use or risk triggers calculation). Such checks require collecting, analysing, and re-using recorded User data.
Generally, Sumsub verifies whether the User’s attributes—geolocation (IP address), device signature (operating system and camera name), email address, or mobile phone—have previously been involved in or related to any fraudulent activity or may currently signal suspicious behaviour patterns and otherwise point out that the User is fake. At the Client’s order, we may check information with our Data Providers on AML/CFT regulations requirements, such as screening through adverse media mentions match or checking for residency in high-risk countries. Besides, we check whether the User creates multiple identities by inspecting whether we have previously verified a User on behalf of a particular Client using biometric data comparison techniques.
All these checks are designed to help us and Clients assess the likelihood of customer trustworthiness, flag potentially fraudulent activities and assign a relevant risk score when the Client needs to acknowledge cases when Users generate multiple identities, compromise their data, or manipulate device or network information. The Client may consult with the fraud detection and control network on the fraud-related level of risk of the User under the onboarding process without accessing any personal data.
• Automated decision-making relief and checks
We conduct identity verification checks on behalf of the Client, however, we do not make any final decisions. Our role is to provide the Client with reports containing information about the identity verification process and results (with the reasoning behind them reflecting the level of fraud or another risk if any. The reasons are derived from the work of our system and its algorithms, including those based on a symbiosis of machine learning models and human supervision and intervention. The final decision on User onboarding is made by a human on the Client’s side when the checks' result is transmitted to the particular Client. The Clients consider this information while deciding to accept or decline a User application, request further checks, or continue to service that User following their risk assessment and investigations.
The checks are either automated, semi-automated, or done by humans. When we carry out checks, we implement a complicated verification system that includes human presence and machine work. A human will be involved if the system cannot reach a verdict on its own or recheck the system verdict. Such may occur when the data is uncertain or the system faces some other difficulty in analysing information during the verification session. Thus, we contribute to ensuring that the verification process is fair and safe for Users.
Certain Sumsub checks may be fully automated due to simplicity, using machine learning, or the Client's request. When Clients use check results to make final decisions regarding Users undergoing verification, the final decision-making process may or may not be automated by the Client. When the Client makes automated decisions, including those based on our check results, they shall inform you of the legal grounds and, if necessary, obtain your consent. Any User can appeal automated decisions by going through the methods provided on the Client's side.
As a service provider, we may have different verification steps for some Clients which require full supervision by a human.
When you've passed verification successfully.
All required checks have been successfully completed. This means that the data you've provided is genuine and compliant with the requirements of the particular Client and approved by them. Now you are allowed to use the service for which you were passing the verification process.
When you cannot pass verification successfully.
Some of the checks need to be more precise. It means that some of the data provided by Users do not comply with the Client's requirements by posing some risk or seeming potentially suspicious or fraudulent (e.g., the device you took the photo from is different from that you passed the whole verification process or the data presented are inconsistent). In this case, we return results to the Client for further consideration by tagging them with the relevant theme (e.g., 'WRONG_ADDRESS' or 'INCOMPLETE_DOCUMENT'). Then, the service for which you passed the verification check will consider and evaluate the results and ask for additional information from you to clarify your application. The Client may reject or freeze your application following its risk procedures or other internal policies.
• Service development
Our Clients use our services to detect whether a real person is passing the identity verification process, as well as any impersonation or spoofing attempts, to prevent money laundering, terrorist financing, fraud, and other activities that are considered a matter of public interest. That is why we, as a service provider, are responsible for providing the highest quality services. For this reason, where we have the authorisation of our Clients, and it is not prohibited by applicable law, we as a data controller use personal data to develop and improve our services by building and enhancing algorithms and developing and testing new verification options, products and services to verify a User's identity better and detect fraud.
We do this in two ways. We deploy a system of recognising specific patterns in the information and making predictions about new data sets based on those patterns by training our computers or so-called 'machine learning.’ Machine learning helps create models based on the information provided by the Users, such as signs of potential fake data, and selects the best models to be integrated into our system. The development of services also includes continuous improvement and assessment. We review our service delivery methods to ensure that we comply with Clients’ requirements and work appropriately by testing and correcting new features and functions. We implement initial and ongoing training for our human analysts to perform those tasks to prevent machine learning models' automatic judgement. It is also beneficial while machine learning models are in the stage of development and aren't adequately suited to perform such tasks.
• Reusable KYC
In this model, our Clients may partner with each other to simplify and speed up verification for mutual Users that have already passed KYC once via Sumsub. For this, Clients ask Sumsub to create a data flow that exchanges previously verified Sumsub KYC data between two different services. Sumsub provides such functionality only after confirmation that these Clients have all necessary legal arrangements. Before sharing the data, the User is asked for consent to such actions.
We may collect and further process the following personal data of Users depending on the particular Service being provided to the Client:
Categories of personal data
Examples
General personal data
Full name, sex, personal identification code or number, date of birth, legal capacity, nationality and citizenship, location (street, city, country, and postcode).
Identity document data
Document type, issuing country, number, expiry date, MRZ, information embedded into document barcodes (may vary depending on the document), security features.
Facial image data
Photos of the face (including selfie images) and photos or scans of the face on the identification document, videos, and sound recordings.
Biometrical data
Facial features.
Banking details
Cardholder name, expiry date, first 6 and last 4 digits of the card number.
Contact details
Address, e-mail address, and phone number.
Transaction data
Full name of the sender and the recipient, the address of the sender and the recipient, and the Unique identifier of the counterparties provided by Sumsub and the particular Client.
Crypto transactions data (Crypto Travel Rule Solution)
Full name of the sender and the recipient, the physical (geographical) address of the sender, or national identity number, or customer identification number (i.e., not a transaction number) that uniquely identifies the originator to the ordering institution, or date and place of birth, recipient account number (e.g., wallet address).
Technical data
Information regarding the date, time, and activity in the Services; IP address and domain name; software and hardware attributes (e.g., camera name and type); general geographic location (e.g., city, country) from User’s device.
Geolocation data
IP address
Unique identifier
Applicant ID created only for identifying the User in the Sumsub system
Relevant publicly available data
Information regarding a person’s status as a Politically Exposed Person (PEP) or presence on sanctions lists.
Additional information
Data provided by the User during communication with Sumsub (e.g., requests, reports).
Sumsub may process the personal data of children, understood as individuals under the age of majority under the national laws of the Client’s country of incorporation, only when the Client ensures that the person with parental responsibility for the child has consented to such processing. Otherwise, if a child’s personal data is accidentally submitted to Sumsub, it will be deleted without undue delay.
When Sumsub is engaged by its Clients to perform identity verification procedures in respect of their Users, the processing of personal data by Sumsub is covered by those legal grounds that are relied on by certain Clients Sumsub has the Agreement with. In line with Article 6 of the EU and UK GDPR, Controllers should rely on an appropriate legal ground when processing personal data. Most of our Clients rely on the following grounds for processing personal data:
We may process your sensitive data if the Client has a reasonable legal ground for such processing.
Where Sumsub pursues its purposes, as said in Provision 4 of this Notice, Sumsub relies on Article 6(1)(f) of the GDPR – legitimate interest. Our legitimate interest arises from the strict necessity of internal analysis and ongoing development and improvement of Sumsub's services that our Clients use to detect fraud and illicit activities to prevent money laundering, terrorist financing, fraud, and other activities, which are considered a matter of substantial public interest. In this case, we use legitimate interest if the Client grants us permission to process data provided that Sumsub's purposes are compatible with those initial purposes for which the personal data has been collected. Such purposes are compatible due to the obligations or interests of our Client regarding the combat of fraud and detection of any illegal actions.
Sumsub may be under a 'litigation holds' requirement, such as an existing legal claim, juridical procedure, or other legal obligation. In this case, Sumsub applies the legal ground specified in Article 6(1)(c) of the GDPR, which states that processing personal data is necessary to comply with a legal obligation to which Sumsub is subject.
The retention period depends entirely on the processing purpose. Our Clients define how long personal data should be stored and when to delete it. Generally, in line with AML / CFT regulations, regulated financial companies are obliged to store the User's data for five years after the termination of the Client’s relationship with the User or the date of the occasional transaction. In some jurisdictions, there may be a longer mandatory data retention period.
Please note that if you, as a User, would like to make a request to delete the personal data that you have provided for the purpose of a particular Client, please make that request directly to the Client that controls your verification process. For more information about how to do this, please see Provision 10.
In general, personal data, including biometric data, will be retained and stored by Sumsub and will be permanently destroyed based on the Client’s instructions when the Client’s initial purpose and/or retention period prescribed by applicable law expires.
Where Sumsub independently defines the compatible purposes or under the legal obligation, the personal data, including biometric data, will be destroyed after Sumsub’s purposes for collecting the biometric data have been satisfied (and one (1) year of the date the purpose for collecting the data expires for residents of Texas) or after five (5) years from the provision of data to the Sumsub system, whichever occurs first. For the residents of Illinois, the retention period of personal data, including biometric data, will be three (3) years from the date of data provision to the Sumsub system.
Disposal and Destruction Policy
Any personal data is deleted only after (a) obtaining the applicant's data deletion request in line with corresponding procedures by the Client or the Data Subject or (b) the satisfaction of the purpose for data processing, including expiration of retention period prescribed by applicable law.
To delete data from the Sumsub Identity Verification System (Dashboard and storage space), we call a method that searches for a unique applicant identifier (Applicant ID) inside the database. The database contains references, or object IDs, connected to the applicant’s personal data provided to the system. After seeking all these references, the Dashboard system automatically removes them one by one by calling the AWS S3 API Object Deletion method providing Object IDs are placed in the S3 bucket. After all referenced objects are found and deleted from the S3 bucket, the original applicant's personal data is also deleted from Sumsub’s internal database located on AWS Servers. The deletion of biometrics should render it non-recoverable, even using forensic information recovery techniques.
To delete data from the equipment, we implement measures in accordance with the particular Operational System of the equipment. If the information is intended to be rendered non-recoverable, the deletion must be executed by the person who owns it (typically, who has created it) by the ‘empty trash bucket’ mechanism. If any of the methods above is not secure enough considering the sensitivity of the information and such information may be recovered again, the equipment storage medium must be destroyed completely (e.g. shredded, disintegrated, pulverised, or incinerated by burning the device in a licensed incinerator, etc.) in the presence of the Asset Owner.
To delete data from the files located in the removable media, we call the setting and tools designated to the relevant sanitisation method - clearing or purging. If the purging method is not secure enough considering the sensitivity of the information and such information may be recovered again, the removable media containing such information must be destroyed completely (e.g. shredded, crushed, disintegrated, pulverised, or incinerated by burning the device in a licensed incinerator, etc.).
To delete data from mobile devices, we use the means of a particular device. If a certain mobile device is intended to be reused/recycled/donated or is no longer to be used by the Sumsub staff, this staff member must reset the device to the original settings. As a general rule, the procedure for Apple iPhone and iPad OS: Select 'Settings > General > Reset > Erase All Content and Settings menu. For Android OS devices: Select ‘Settings > Backup & Reset > Factory Data Reset > Reset Phone’.
It’s forbidden to handle any sensitive data in any equipment, removable media or mobile devices.
Any request to delete all or any personal data related to a User is fulfilled within 30 days. This period is justified by the complexity of the systems and technologies Sumsub operates to process the data.
Users’ personal data may be retained for up to 90 days (from the Client’s request for data deletion) to comply with any applicable law, regulation, legal process, or governmental request and investigation; to assert legal rights or defend against legal claims; or to prevent, detect, or investigate illegal activity, fraud, abuse, violations of the Client’s or Sumsub’s terms of service, or threats to the security of the Services or the physical safety of any person. Sumsub will delete such personal data of the affected User when no longer legally obligated or reasonably required to retain it.
When the processing purposes differ from those specified above, Sumsub maintains the following retention period considering the amount, nature and sensitivity of the personal data and the purposes for which we’re permitted to process it.
When we develop and improve identity verification services to prevent and detect fraud and other illicit activity, we will keep the personal data in a pseudonymised format for the period required to calibrate and select the perfect algorithm and model for the detection of fraud and other illicit activity. We may also have to store some records that have been confirmed as relating to fraudulent applications or accounts or obtaining and maintaining records to prove our compliance with legal obligations in and outside the EU and the UK. For example, regarding consent activity log history, the retention period is defined by the criteria derived from requirements by law regarding limitation periods, other applicable regulatory requirements, contractual provisions and industry standards.
When the purpose refers to the establishment, exercise or defence of legal claims (so-called ‘litigation hold’), the retention period is limited to the duration of such proceedings in a specific case or circumstance.
In any case, we do not keep your data longer than we have a lawful basis for doing so.
Upon written request from the Client, Sumsub assists the Client in exercising the Data Subject’s rights. According to privacy laws, you have the right:
To ask Sumsub to execute the rights mentioned above or redirect the request to the Client, you should send a free-form email to [email protected] or use this form. The information on actions taken in response to any request is provided to you within one month. That period may be extended by two further months where necessary, considering the complexity and number of the requests. In this case, we will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.
Please be kindly aware that when you ask us for the execution of the rights as stated above, we may have to take steps to verify that you are the legitimate data owner and/or authorised to make the request due to the Client's request or our own legal obligation.
Sumsub guarantees that making a request for receiving personal data is free unless a reasonable cost is to be charged where requests are unfounded or excessive, or repetitive in character.
Sumsub assists the Controllers (Clients) with the obligation of providing the mechanism for withdrawal of consent (Article 7 (3) EU GDPR and UK GDPR) and objection to processing based on legitimate interests (Article 21 (1) EU GDPR and UK GDPR).
Depending on the legal basis of processing that the Client relies on (consent or legitimate interest), the right to withdraw consent or the right to the object of processing can be exercised.
Sumsub does not make decisions regarding such requests on its own, as Sumsub acts in accordance with the written instructions of the Client, who exercises control over personal data. Sumsub can only redirect the User’s request to the Client for whom the User was verified.
To withdraw consent or object to the legitimate interest of Sumsub, you can use this link to form your request. Please note that to request a restriction or objection to processing, there should be overriding grounds to those we have under the legitimate interest. We underline that due to the importance of identity verification and fraud prevention to the world's financial system - so-called public interest - for which the personal data checks are carried out, it will be rare that we have no compelling, overriding grounds to continue using the personal data following a restriction or objection. Generally, under the given circumstances, there are better options than to terminate the processing of personal data under the restriction or objection request. For example, it would be unfair to hide the result of previous fraudulent patterns that could allow a person to steal money from the account by pretending to be another person.
[a] Sumsub’s responsibilities, and the DPO
Sumsub is responsible for establishing policies and procedures in order to comply with the EU GDPR and the UK GDPR. Our Data Protection Officer can be contacted via the following e-mail address: [email protected].
[b] Sumsub DPO’s responsibilities
Sumsub’s Data Protection Officer holds responsibility for
[c] Sumsub’s personnel responsibilities
Sumsub personnel involved in personal data processing comply with the requirements of this Privacy Notice and other internal rules. This personnel ensures that:
[d] Third-Party Processors acting on behalf of Sumsub
Where third-party companies are engaged to process personal data on behalf of Sumsub, responsibility for the security and appropriate use of the data remains with Sumsub.
Before engaging a Third-Party Processor, Sumsub ensures that it provides sufficient guarantees as regards personal data security. In particular, a written contract establishing the types of personal data to be processed and the purposes of such processing, as well as containing provisions on personal data protection, are concluded between Sumsub and the Third-Party Processor.
Sumsub takes specific measures to ensure personal data protection, including, but not limited to, the following:
1 At present, all personal data is stored and processed on specially designated servers in Germany. When localization of data in a certain region is required by law, Sumsub provides such an opportunity, where possible, based on the contract/Client request (e.g., the Personal Data of Bahrain residents is stored in the Bahrain region).
Suppose certain types of personal data, such as the Dutch BSN, Korean RRN, Japanese My number card and related sensitive data, or Singaporean NRIC number, as well as other country-specific requirements, are under special protection regimes (if any). In those cases, Sumsub will take the necessary measures not to process such data, such as requesting the User to cover data with a sticker or processing restrictions using blurring technology, unless the respective Client has the legal basis for processing it freely.
Where a personal data breach occurs or is suspected, it is reported immediately to the Data Protection Officer (DPO) or the Director and, where applicable, to the data protection authority, the respective Client and, if applicable, to the individual affected by the breach. The report includes full and accurate details of the incident (including its reasons and magnitude) and sets out the planned measures intended to eliminate the breach.
The report is provided directly to the concerned Client, and further breach mitigation is supported.
[a] Third Parties
If the Client agrees, Sumsub may have to apply third parties for data processing activities, which include the following categories:
Sumsub requires the Third Parties to respect the security of personal data and treat it according to the applicable law. In addition, Third Parties are mostly limited to only accessing or using personal data to provide services to Sumsub and must provide reasonable assurances they will appropriately safeguard the data in line with Provision 13[d] of this Notice.
[b] Recipients
Where it is required by law, Sumsub may have to provide personal data to the Recipients, which includes the following categories:
Sumsub is a group of companies established as a network of the following legal entities operating worldwide. The Sumsub services are provided by the operating company, Sum and Substance Ltd. (registered in England and Wales under company number 09688671), which acts for and on behalf of itself and the other members of the Sumsub group of companies. The following entities constitute the Sumsub group of companies:
The Sumsub EU representative is SUMSUB LTD - incorporated and registered in Cyprus with company number HE 405087.
Sumsub confirms that all personal data is submitted by Data Subjects Sumsub’s servers located in the EU and/or subject to any national localisation requirements in the respective countries where such requirements exist. The Client may choose the location of personal data processing (including storage) to comply with the applicable laws.
Where it is necessary for service provision or to ensure convenient and reliable communication with the Data Subjects, Sumsub transfers personal data outside of the EU/EEA, or the UK to the Third-Parties and Recipients indicated in Provision 16 of this Notice.
Whenever a transfer of personal data outside the EU or the EEA is carried out, Sumsub implements appropriate safeguards as set out in Chapter V of the EU GDPR by transferring on the basis of the EU Adequacy Decision (or UK Adequacy Regulations) and by concluding Standard Contractual Clauses with the Controller. Third-Party Processors likewise rely on appropriate safeguards, which include Binding Corporate Rules, Standard Contractual Clauses, etc. Cross-border personal data transfers from the UK to the EU/EEA countries are permitted by the UK Government.
It should be underlined that Sumsub does not sell personal data and strictly complies with restrictions and prohibitions under CCPA and the EU or the UK GDPR.
For more information on the CCPA application to Sumsub processing activities, please refer to the CCPA Privacy Notification.
Personal data processed by Sumsub may include certain ‘biometric identifiers’ (such as scans of facial geometry or voiceprints) and ‘biometric information’ (data extracted from and based on biometric identifiers), which are used to verify the identity of the User.
Whenever such biometric identifiers and/or biometric information (collectively ‘biometric data’) are used as part of the services rendered by Sumsub to any Client, such data shall be processed by Sumsub on behalf of such Client and permanently deleted as stated in Provision 9 of this Notice. In the latter case, Sumsub shall not perform any operations regarding such data other than its storage for the period required by the applicable law.
In any event, biometric data shall only be collected and further processed by Sumsub after having obtained written informed consent of the respective Data Subject to such collection and further processing.
In case of any conflict or inconsistency between the other provisions of this Privacy Notice and the terms of this special notice, the latter shall prevail whenever the laws of the states of Illinois, Washington, or Texas (USA) are applicable to the legal relationship between Sumsub and any Data Subject.
The Client is independently responsible for complying with the privacy regulation, including BIPA, providing all necessary disclosures and obtaining all required consents.
This Privacy Notice is constantly reviewed and amended in order to provide appropriate compliance with the relevant data protection laws.
Sumsub reserves the right to make amendments to this Notice at any time and for any reason. Any amendments will be effective immediately upon us posting the updated Privacy Notice on our website. Users of our website waive the right to receive specific notice about such amendments. You are invited to review this Privacy Notice at any time to stay informed about updates.
If you want to observe the previous version of this Privacy Notice, please contact us at [email protected] or visit this link. Our technical and legal support teams work 24/7 and will answer you shortly.