Biometrics Notice

This Biometrics Notice was last updated on 01 April, 2025

Our Biometric Notice governs the collection, use, safeguarding, handling, storage, retention, disclosure or transmission, redisclosure, and destruction of biometric data in accordance with applicable laws relevant to the biometric Services we provide to GBG customers.

GBG customers are responsible for developing and complying with their own biometric data practices and privacy policies in accordance with applicable laws, including obtaining your affirmative express consent and/or informed written consent on behalf of GBG and our third-party vendors (“GBG Technology Vendors”) before the collection, use, safeguarding, handling, storage, retention, disclosure or transmission, and redisclosure of your biometric data (or personal data utilized for biometric processing).

BIOMETRIC DATA DEFINED

The term “biometric data” as used in this Biometric Notice has the meaning provided under relevant and applicable comprehensive data protection and biometric laws, and includes “biometric identifiers” and “biometric information.”


OUR SERVICES

Why We Collect Your Personal Data for Biometric Processing.

We collect your personal data to provide our Services to our GBG customers so that they can authenticate or verify an individual by asking “Is this person who they say they are?”.

We do not use your personal data for identification purposes; we do not ask “Is this person in a database?”.


Our Biometric Services Explained:

Methods of Collection

How we collect your face images for the biometric processing depends on the specific biometric Service that is being used and/or how our GBG customer choose to set up the Service. We can collect the data directly from you, such as when you download and use our app, or we can collect it indirectly through our GBG customer’s application or platform with which you directly interact.


Facial Images Sources

Our Services utilize your face images collected from two different sources: (1) an identity document (e.g., driver’s license, passport, etc.), and (2) a selfie.


GBG Technology Vendors

Some of our biometric Services may use external service providers (“GBG Technology Vendors”), all of which are listed at the end of this Biometric Notice.

Our Processing and Information provided to GBG Customers

  1. We take your identity document image and your selfie image (collectively, your “facial images”) and compare the two using facial recognition technology to see if the facial images you submitted belong to you.
  2. We do this by using facial recognition technology, either internally or through a GBG Technology Vendor, to extract biometric data by scanning or digitally mapping an individual’s facial features or facial geometry, such as the distance between the eyes or the forehead and chin.
  3. These measurements are then used to create a mathematical algorithm or formula known as a ‘facial template’ or ‘facial signature’ of the extracted data, which is deemed to be biometric data.
  4. An algorithm then compares the biometric data extracted from your facial images to authenticate or verify that the person on the identity document image is the same person on the selfie image.
  5. This process then generates a numerical ‘face match score,’ which we provide to our GBG customer that you are transacting with so they can assess their confidence level in determining whether the facial images collected belong to the same person.


Passive Liveness

Our GBG customers may also purchase our Passive Liveness Service, which detects whether the selfie image is a photo of an actual live person instead of a photo of a non-living person or spoof (e.g., a recording, another picture, a mask, a mannequin, etc.) by analyzing the features of the selfie image while not utilizing facial recognition technology. When GBG customers use our Passive Liveness Services they are asking the question “is this a representation of a live person?” instead of “is this the person who they say they are?”. The technology used by our Passive Liveness Services does not collect or process any facial template, the selfie images are instantly purged when the processing has been completed.

BIOMETRIC DATA DISCLOSURE

We may disclose or transmit your personal data (i.e., your facial images) to our GBG Technology Vendors, such as, when we utilize their facial recognition technology to facilitate the provision of our Services to GBG customers.

We and our GBG Technology Vendors will not sell, lease, trade, or otherwise profit from a person’s biometric data that we may possess as a result of our GBG customer’s use of our Services.

We prohibit any further disclosure or re-disclosure of your biometric data not covered under this Biometric Notice, unless:

  1. You consented;
  2. We are required to do so under state or federal law, or municipal ordinance; or
  3. We are required to do so under a valid warrant or subpoena issued by a court.

OUR DATA SECURITY

We store, transmit, and protect from disclosure all personal data processed under our biometric Services using a reasonable standard of care with measures that are at least equivalent to the measures that we use to store, transmit, and protect from disclosure other confidential and sensitive data, such as drivers’ license numbers and social security numbers.

OUR SERVICES RETENTION SCHEDULE

Our data retention practices vary depending on the biometric Service utilized by our GBG customers to collect and process biometric data and follow the retention schedule provided below. Unless otherwise required by law, once the retention schedule no longer authorizes us to retain your personal data, we will securely and permanently destroy your data, including any biometric data.

The table below sets out the difference between how long we retain ‘facial images’ (i.e., your identity document photo and selfie) and ‘biometric data’ (i.e., the facial template).

 

GBG Services

Categories of Personal Information Collected

Purposes

Facial Images Retention

Biometric Data Retention

IDScan Enterprise

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect and process your facial images using facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Up to 31 days* (GBG’s customer can reduce to instant deletion when processing has been completed)

Facial templates are immediately deleted when processing has been completed

IDScan Core**

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect and process your facial images using facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Facial images are immediately deleted when processing has been completed

Facial templates are immediately deleted when processing has been completed

ExpectID Scan Verify

·  Image from an identity document (e.g., driver’s license, passport)

and

·  Selfie, and

·  Biometric data

To collect, process and disclose your facial images to GBG Technology Vendors, which utilize facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Up to 30 days* (GBG’s customer can reduce to instant deletion when processing has been completed)  

24 hours

ExpectID

Scan Onboard**

(if either Face Review or, Programmatic Face Compare are enabled)

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect, process, and disclose your facial images to GBG Technology Vendors, which utilize facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Up to 30 days* (GBG’s customer can reduce to instant deletion when processing has been completed)  

24 hours

FaceID

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect, process, and disclose your facial images to GBG Technology Vendors, which utilize facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

40-60 seconds 

24 hours

GBG Go**

(if Face Match is enabled)

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect and process your facial images using facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Facial images are immediately deleted when processing has been completed

Facial templates are immediately deleted when processing has been completed

 

·   

 

 

 

* Our GBG customers can choose to reduce or extend the default retention period. 

** Our GBG customers may use this Service without processing any biometric data. This Service will only process biometric data if our GBG customer chooses to enable biometric processing.

GBG TECHNOLOGY VENDORS

We disclose your personal data (i.e., your facial images) to our GBG Technology Vendors, listed below, for the purposes of cloud hosting services and/or technology service providers of facial recognition technology when providing our Services to GBG customers.

 

GBG Services

GBG Technology Vendors

IDScan Enterprise

Amazon Web Services (AWS)

 

Cloud hosting services

IDScan Core

Amazon Web Services (AWS)

 

Cloud hosting services

ExpectID Scan Verify

Quality Technology Services (QTS)

Data center

Acuant, Inc. (see FaceID)

Technology service provider

ExpectID Scan Onboard

Quality Technology Services (QTS)

Data center

Acuant, Inc. (see FaceID)

Technology service provider

FaceID

Amazon Web Services (AWS)

Cloud hosting services

Microsoft, Inc. (Azure)

Technology service provider of facial recognition technology