On the processing of personal data when performing remote identity verification

PRIVACY NOTICE

ON THE PROCESSING OF PERSONAL DATA WHEN PERFORMING REMOTE IDENTITY VERIFICATION

This Privacy Notice explains how NEO Finance, AB processes Your personal data when You choose to verify Your identity remotely using electronic means that enable live video transmission, and where biometric personal data (facial image) are processed.

NEO Finance, AB (hereinafter – the Company, we) is Your data controller (legal entity code 303225546, address Ukmergės st. 126, Vilnius) when these data are received and processed for the purpose of remote identity verification.

What is the purpose of processing personal data?

Personal data are processed for the purpose of verifying Your identity remotely using electronic means that enable live video transmission. The Company may request You to verify Your identity in the following cases:

  • When You want to open an account;
  • If You want to change Your phone number, You have used during registration;
  • When You provide us with Your new identity document (after Your identity document expires);
  • When You want to identify as an authorized representative of legal person;
  • When You want to change Your password;
  • If You are requested to verify Your identity by Company’s representative (when we suspect that the actions are being performed by someone other than the client);
  • If re-identification is necessary;
  • When Buy Now, Pay Later (BNPL) service is used (for identity verification, signing an offer and agreement, opening a limited-use account);
  • When a co-borrower needs to be identified.

What categories of personal data will we process?

To become our client, or in the other cases indicated above, You must verify Your identity. When You choose to verify Your identity remotely using electronic means that enable live video transmission and yYu consent to live video transmission during remote identity verification, the Company will process the following personal data, including Your biometric data (facial image):

  • Your first name and last name;
  • Personal identification number / date of birth;
  • Personal data contained in Your identity document (identity document number, date of issue and validity/expiry date, photograph contained in the identity document);
  • Your facial image (captured in a photograph or video recording);
  • Biometric facial points from the photograph in the identity document and Your photo (biometric data);
  • Date of identity verification;
  • IP address.

What is the legal basis for data processing?

Your personal data are processed on the basis of:

  • Article 6(1)(c) of the GDPR (processing is necessary for compliance with a legal obligation applicable to the Company under the Law of the Republic of Lithuania on the Prevention of Money Laundering and Terrorist Financing);
  • Article 6(1)(a) of the GDPR (Your consent to live video transmission); and
  • Article 9(2)(a) of the GDPR (Your consent to the processing of biometric data (facial image)).

To whom may Your personal data be disclosed?

Your personal data will be disclosed only to the Company’s service provider, iDenfy, UAB, which provides remote identity verification services using electronic means that enable live video transmission and acts as the Company’s data processor.

What is the retention period of Your personal data?

The Company stores Your personal data only for as long as necessary to achieve the purposes of processing and/or as required by law. Your personal data collected during remote identity verification using electronic means that enable live video transmission will be stored:

  • 8 years from the date of the end of transactions or the business relationship with the client (pursuant to Article 19 (11) of the Law of the Republic of Lithuania on the Prevention of Money Laundering and Terrorist Financing);
  • Biometric data (biometric facial points) are stored only for the duration of the verification (during comparative analysis of biometric points) – up to 2 seconds – and are deleted after verification.

What are Your rights?

  • You have the right to withdraw Your consent at any time; however, please note that withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal of consent, i.e., the lawfulness of verifying Your identity using biometric data (facial image). You may withdraw Your consent by contacting the Company by email at [email protected];
  • You have the right of access – You can obtain confirmation as to whether or not Your personal data are being processed and access to the personal data;
  • You have the right to rectification – request the rectification of inaccurate personal data;
  • You have the right to erasure (‘right to be forgotten) – request the erasure of personal data;
  • You have the right to restriction of processing -of personal data;
  • You have the right to data portability – request to receive personal data and transfer those data to another data controller;
  • You have the right to lodge a complaint with the State Data Protection Inspectorate.

You may submit a request to exercise Your rights by providing Your request either verbally (by visiting the Company in person) or in writing (by sending Your request by post, or by email). More information about Your data subject’s rights and how You can exercise them is available at the Privacy Policy published on the Company’s website.

If You have any questions about this Privacy Notice or the processing of personal data, You may always contact the Company’s Data Protection Officer by email at [email protected] (we recommend indicating that the correspondence is intended specifically for the Data Protection Officer).