Privacy policy

You should consider updating your privacy policy to tell users about the Yoti IDV service. This will help you meet the general obligation of transparency to your users. We recommend your Legal Council or Data Protection Officer writes the section, below are examples on suggested paragraphs to be used as a starting point:

Disclaimer: This is placeholder text and should be reviewed by your DPO or relevant privacy and legal teams.

_ _

"To help establish your identity we use Yoti Limited (Yoti USA Inc in the USA) to check your identity. When you submit your ID document Yoti extracts data from it. If you are asked to submit a selfie then Yoti uses biometric technology to check that the selfie is of a real person and that your selfie matches the photo on the ID document. Yoti then sends us the results of the checks. Yoti does not do anything else with the data and Yoti deletes it [after 28 days OR [insert the data retention period you configure on integration]]. We keep the data [for as long as you have an account with us, plus X years]."

"We need to ask you to provide your ID documents to us online because we need to check your identity. We use a provider called Yoti to take your identity information from your ID document and to check that your selfie matches the photo on the ID document. We will use the identity information from your ID document to check your account information. Yoti will not use the data for any other purpose at all, and Yoti deletes your data from their systems once it is no longer required for compliance purposes."