Data protection

For information regarding the processing of personal data, please refer to our:

Privacy Policy

The processing of personal data may be subject to applicable data protection legislation, including, where applicable:

• UK GDPR ICO reference number: 00015957849
• EU General Data Protection Regulation (GDPR);
• Swiss Federal Act on Data Protection (FADP/nFADP).

Where biometric data are processed, additional information regarding the processing of biometric data, purposes, legal basis, retention periods, security measures and data-subject rights is provided in the Biometric Data & Privacy Policy.

Privacy contact: privacy@blindata.eu

Data Protection Officer (where applicable): M.E.A Zanetti
Biometric identification

Certain technologies and services provided by Blindata, including BioSIC and MyBioSIC, may use biometric technologies, including facial recognition, biometric identification and/or biometric authentication.

The processing of biometric data is subject to applicable data protection and other legal and regulatory requirements, including, where applicable, the General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection (FADP).

MyBioSIC Demonstration Environment

The MyBioSIC website may provide demonstration environments that allow users to test biometric identification and authentication functionalities. Participation in such demonstrations is voluntary and subject to the tester’s prior consent. Before initiating any biometric scan, the tester must be presented with clear information about the demonstration and must actively indicate their consent through a dedicated consent checkbox or equivalent affirmative action.

The demonstration environment is intended solely for testing and evaluation purposes. In this environment, facial photographs are not retained. Biometric processing is designed so that the resulting biometric representation cannot be used to reconstruct the original facial photograph, subject to the technical implementation of the system.

Data processed in the demonstration environment, including any temporary biometric data or representations, is subject to a retention period of no more than seven (7) days, after which it is deleted in accordance with the applicable data-retention procedures, unless a different retention period is required or permitted by applicable law.

The consent mechanism and the information provided before scanning are intended to ensure transparency and enable testers to make an informed decision before participating in a demonstration. Consent may be withdrawn in accordance with applicable law and the information provided for the relevant demonstration.

Production and Tenant Environments

When BioSIC or related biometric functionalities are deployed in a production environment for a customer or tenant, the processing of biometric data is governed by the applicable contractual arrangements, privacy notices, retention policies and legal requirements of that deployment.

The relevant customer or tenant is responsible for determining, in its capacity as applicable under data protection law, the purposes and means of processing, the appropriate legal basis, the applicable retention periods and the measures required to ensure compliance. Where the customer or tenant acts as controller, its designated Data Protection Officer (DPO), where appointed, or other responsible privacy function should assess the processing and ensure that the necessary information, safeguards and legal bases are in place.

Blindata and the relevant service providers shall act in the roles determined by the applicable legal framework and contractual arrangements, which may include processor, controller, joint controller or another legally recognised role. The respective responsibilities shall be documented in the relevant contractual and privacy documentation.

General Privacy Safeguards

Biometric data shall not be collected or processed through this website outside the expressly identified demonstration or service functionalities and their applicable privacy information. Where biometric processing takes place, the relevant information must identify the purposes of processing, the applicable legal basis, the categories of data involved, the retention period and the means of exercising applicable data protection rights.

Nothing in this section shall be interpreted as replacing a case-specific assessment of the lawfulness of biometric processing or the obligations imposed on the parties by applicable data protection legislation.