3. CATEGORIES OF PERSONAL DATA PROCESSED BY US AND METHODS OF OBTAINING THEM

The Company receives personal data in the following ways:

3.1. To provide our demo application (hereinafter jointly – Application). The exact information needed depends on the check that’s being carried out on behalf of our client. For example, when verifying the identity of a user, we’ll ask for an image of their identity document as well as a picture or video of their face. We’ll then seek to verify whether the identity document is likely to be genuine and whether the person in the photo or video is likely the same person pictured in the identity document. We will also look to identify signs of fraud (for example, someone wearing a mask to impersonate another person or conceal their own real identity). If the user is successful on both the document and facial verification checks.

In some cases, our application may also further check whether we have previously verified a user on behalf of a specific client by comparing the picture of their face to the pictures previously provided by that client. This helps our client not only verify identity but further protects them and their users by helping them understand when a user may be generating multiple identities.

To do all of this, we closely examine the information contained in the images, including the machine readable data (such as an identity document’s barcode) and the image metadata (such as the name of the camera model used to take the image), video content- our system uses this data to understand the wide variety of facial structures from people all around the world and we may use this data to remove duplicate identities from our systems as deemed necessary by UAREAL.

For demo Application – non-production deployments only – enrollment and authentication session information collected will include the above information as well as the following information, which is never shared or used for any other purpose except to positively identify the user and to improve UAREAL services:

Email address provided – In the event we have questions about how you intend to use our service or what issues you might have had with it, we will use your email address only to contact you directly with questions and to send you only our own product updates if you desire.

3.2. The User. Users are individuals whose identities we verify. We collect users’ information from the users themselves who download our Application. This information might include an image of any identity document (e.g. a passport or a driver’s license), photos (at times, taken in quick succession for anti-fraud purposes) or a video of the user, and the biometric facial identifiers in those images. This enables our application to provide necessary checks and verify that the user is the true owner of the identity document and has not shown signs of fraud. We may also collect device identifiers (metadata).

3.3. Face Comparison. When providing our Application, we will frequently extract and compare numerical biometric data from facial images to understand whether two faces are likely to be a match. We do this on behalf of our clients for two reasons. Primarily, we will check whether a user owns their identity document by comparing an image of their face to the facial image contained in the identity document. When we do this, we do not retain the extracted numerical data for any length of time beyond this comparison.

In addition, we may also check whether we have previously verified a user on behalf of a specific client to help that client understand when a user may be generating multiple identities. We do this by comparing the facial image of a user to the facial images of other users previously verified on behalf of that specific client. To provide this check quickly, we store the numerical biometric data extracted from the previously collected facial images until the client deletes those original images.

3.4. Automated Decision Making and Reports. When we verify an identity or carry out a check on behalf of a client, we provide a Report to that client. This Report details the results of matching. The results are generated from the different machine learning models. We have no human powered processes, that can be used to verify an identity or perform a check.

3.5. Sharing information outside our demo Application. As well as sharing information with users, UAREAL do not share information with external parties: other companies, organizations, government bodies, and individuals outside UAREAL. Data collected is only used to operate our business, provide our products and services, improve existing products and services, develop new products and services, and to improve and personalize User experiences interacting with the software.