California Privacy Notice

To provide our Identity Services and for “business purposes”, we collect certain categories of personal information about you, our clients’ users. The exact information needed depends on the Identity Services being provided on behalf of our client.  We collect these categories of personal information when you interact with Onfido’s Identity Services:

• Identifiers and contact information - Name, postal address, unique identifier, online identifier, Internet Protocol (IP) address, email address, social security number, driver’s license number, passport number, or other similar identifiers;

• Customer records information - Name, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, bank account number;

• Characteristics of protected classifications under California or federal law - Race, color, national origin, gender, age;

• Device/Network Data and Geolocation data - Information regarding a consumer’s interaction with Onfido’s Identity Services, our client’s website or application, geolocation data (limited to broad geolocation data at a State or City level only);

• Biometric information - Facial recognition data;

• Audio/visual information - Images, videos and audio recordings;

• Inferences drawn from other information - For more information on the inferences we and our Data Providers may draw, please see Onfido’s Privacy Policy.

Under the California Consumer Privacy Act ("CCPA") and other California laws, California residents may have the following rights in addition to those set forth in the Your Rights section of the Onfido Privacy Policy, subject to your submission of an appropriately verified request (see below for verification requirements):

• Right of Access - you have the right to request, for the 12-month period preceding your request, access to categories and specific pieces of personal information about you that we collect, use, disclose, and sell.

• Right to Delete - you have the right to delete certain personal information that we hold about you, subject to exceptions under applicable law.

• Right to Non-Discrimination - You have the right to not to receive discriminatory treatment as a result of your exercise of rights conferred by the CCPA.

• Direct Marketing - You may request a list of personal information we have disclosed about you to third parties for direct marketing purposes during the preceding calendar year.

• Right to Opt-Out of Sale - Onfido does not nor has not sold personal information in the past 12 months, of either adults or minors under the age of 16. If we engage in sales of data (as defined by applicable law, you may direct us to stop selling or disclosing personal information to third parties for commercial purposes.

• Minors - To the extent we have actual knowledge that we collect or maintain personal information of a minor under age 16, those minors between the age of 13 and 16 must opt in to any sales of personal information (as defined under CCPA), and minors under the age of 13 must have a parent consent to sales of personal information (as defined under CCPA). All minors have the right to opt-out later at any time.

Process to Make a CCPA Request

If you would like to exercise any of the rights set out above, please contact the relevant client  that carried out your related check.

Alternatively, you may contact Onfido at privacyrequests@onfido.com, or the postal address below. Please be aware, for most requests Onfido will notify the relevant client (as described  in the Onfido Identity Lifecycle section of our Privacy Policy) so the client (and not Onfido) may fulfill the request. This is necessary where Onfido is acting on the client’s behalf.

All rights requests must be verified to ensure that the individual making the request is authorized to make that request, to reduce fraud, and to ensure the security of your personal information. We will require that you provide your full name, date of birth and address to match against the information we have on file for you. Once we have received this information, we will check our databases and provide you with contact details for the relevant business client so that you may ask them for more information about your data, including any data they are storing with Onfido. We will also notify the business client(s) of your request for information.

If an agent is submitting the request on your behalf, we reserve the right to validate the agent's authority to act on your behalf.  An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with California probate law. Authorized agents that are business entities must be registered with the California Secretary of State to conduct business in California. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity.

The table below describes how we have collected, used and shared the above information in the past 12 months for the purposes of the CCPA.  A more detailed description of these purposes is in our Privacy Policy under “The Information we Collect” and “Sharing Information Outside of Onfido” sections.  Onfido does not nor has not sold personal information in the past 12 months, of either adults or  minors under the age of 16.

• In the past 12 months we have collected the following categories of personal information: Identifiers and contact information; Customer Records Information; Biometric information; Special Categories of Information; Audio/visual Information; Device/Network Data; Location Data (limited to broad location data at a State or City level only) and Inferences drawn from the above.

• The sources of the above information have been: Information you have provided; Information collected automatically; Information provided by Onfido’s Service Providers; and Information Onfido creates or infers.

• Onfido collected and processed this information for the following business purposes which are described in more detail in our Privacy Policy:  Service Provision and Contractual Obligations; Detecting Fraudulent Activity; Internal Processing and Service Improvement; Service Improvement; Security and Incident Detection; Compliance and Other Business Purposes.

• Onfido disclosed the above categories of information for the above business purposes to the following categories of recipients: Our Group; Service Providers; Clients; Successors; Lawful Recipients. Please see the Onfido Privacy Policy for more information about how we share your information.

If you would like more information about how Onfido collects and uses information, please contact Onfido at privacyrequests@onfido.com, or at:

Attention: Privacy Office Onfido Limited 3 Finsbury Avenue London EC2M 2PA United Kingdom

If you would like to raise a concern with or otherwise communicate with our Data Protection Officer, you may contact them at privacyrequests@onfido.com, or at:

Attention: Onfido Data Protection Officer Heward Mills 77 Farringdon Rd London EC1M 3JU, UK.