Privacy Notice

1. Who provides IdCheck

Noviqent Ltd provides the Noviqent IdCheck technology. In most customer-initiated verification journeys, the business that asked you to complete the check decides why the check is required and is the data controller. Noviqent Ltd normally acts as that business's data processor when operating IdCheck on its instructions.

Before you submit information, the verification screen should identify the business that requested your check and provide or link to its privacy information.

2. Information processed

• A live selfie where facial comparison or age estimation is requested.
• A photograph or scan of an identity document, which may contain your name, date of birth, nationality, photograph and document number.
• Proof-of-address evidence, which may contain your name, address and document date.
• Information extracted from documents using OCR.
• Verification results, confidence/status information, timestamps and security/audit information.

3. How the information is used

We use the information to operate the verification selected by the requesting business, protect the service from abuse, return the result and authorised evidence to that business, and maintain appropriate security/audit records. Facial comparison is automated and may produce a confidence/result that the requesting business uses in its own process.

Automated extraction or matching can be inaccurate. The requesting business should provide a route for human review or correction where a result is disputed or has a significant effect.

4. Biometric processing

Where IdCheck compares facial features to verify identity, facial data is technically processed as biometric data. The requesting business is responsible for identifying the lawful basis and any special-category condition that applies to its use of biometric verification. IdCheck should not be used where that business cannot justify the processing.

5. Retention

The live selfie is designed to be discarded immediately after the relevant processing operation. Raw ID and proof-of-address document images are not intended to be retained by default. A requesting business may configure document retention where it has a justified need; the verification journey should tell you when this applies and the applicable period or criteria. Extracted information, results and audit records are retained according to the requesting business's configured and documented retention policy.

6. Sharing and international transfers

Verification information is made available to the business that requested the check and may be processed by service providers that support Noviqent's hosting, communications, security or operations. Noviqent maintains a sub-processor register. Where personal data is transferred outside the UK, appropriate transfer safeguards must be used where required.

7. Your rights

Depending on the lawful basis and circumstances, you may have rights of access, rectification, erasure, restriction, objection and data portability, and rights relating to certain automated decisions. For information processed for a customer verification, you should normally contact the business that requested the check first. Noviqent will assist that controller with valid requests.

You may complain to the Information Commissioner's Office (ICO) if you are unhappy with how your personal data is handled.

8. Contact and updates

Data protection contact: Noviqent Ltd, hello@noviqent.co.uk.

This notice is reviewed whenever IdCheck changes its data categories, verification methods, retention, sub-processors, hosting locations or automated-decision functionality.

9. Where your verification data is processed

The core IdCheck service and its private AI/OCR/biometric processing are hosted on infrastructure controlled by Noviqent Ltd at premises in the United Kingdom. The private AI verification environment does not require outbound internet access to process your identity documents or facial data. Identity documents and facial images are not sent to third-party AI providers.

A transactional email provider may receive only the information needed to deliver a verification invitation or notification, such as an email address and limited delivery/link metadata. Noviqent's design is that the email provider does not receive your identity document, proof-of-address document, selfie, biometric template or OCR-extracted identity information.

10. More detail about deletion

Your live selfie is not kept as a stored verification record. The facial representation used to perform the match is calculated for the check and is not maintained as a persistent biometric database.

The business requesting your check can choose whether ID-document and proof-of-address images are retained. This is off by default. If it is off, the service hashes the document for audit purposes and discards the raw image after the required matching/extraction processing. If retention is enabled, the requesting business must have a justified retention period and the verification journey/privacy information should explain it.

Some verification information, such as the result, extracted fields and document hash, may be retained for the requesting business's justified recordkeeping period. Your right to erasure can be limited where the requesting business is legally required to retain particular records.