Biometrics Notice

This Biometrics Notice was last updated on 06 November, 2026

Our Biometric Notice governs the collection, use, safeguarding, handling, storage, retention, disclosure or transmission, redisclosure, and destruction of biometric data in accordance with applicable laws relevant to the biometric Services we provide to GBG customers.

GBG customers are responsible for developing and complying with their own biometric data practices and privacy policies in accordance with applicable laws, including obtaining your affirmative express consent and/or informed written consent on behalf of GBG and our third-party vendors (“GBG Technology Vendors”) before the collection, use, safeguarding, handling, storage, retention, disclosure or transmission, and redisclosure of your biometric data (or personal data utilized for biometric processing).

Please note, GBG’s Customer decides whether to allow you access to their goods or services. GBG does not have control or visibility over whether our Customer’s pass or fail you, and there may be other elements or factors influencing their decision. Thus, for specific requests with regards to your identity verification check being denied or accepted, please reach out directly to the organisation you are doing business with. Additionally, as covered in this Biometrics Notice, GBG does not retain your image for longer than it takes to process the identity verification check. However, GBG’s Customer may have GBG retain a copy of your image on their behalf, for which they set their own retention period. GBG is unable to access this image, therefore please contact the organisation you are doing business with directly regarding any requests associated with the processing of your data.

BIOMETRIC DATA DEFINED

The term “biometric data” as used in this Biometric Notice has the meaning provided under relevant and applicable comprehensive data protection and biometric laws, and includes “biometric identifiers” and “biometric information.”


OUR SERVICES

Why We Collect Your Personal Data for Biometric Processing.

We collect your personal data to provide biometric Services to our GBG customers with whom you are transacting with. Depending on the Service selected by the GBG customer you are transacting with, we may use biometric data to authenticate or verify an individual, identify potential indicators of fraud, and reauthenticate individuals for log-in and account purposes.


Our Biometric Services Explained:

Methods of Collection

How we collect your facial images for the biometric processing depends on the specific biometric Service that our GBG customer you are transacting with is using and it also depends on how that customer chose to configure that Service. We can collect the data directly from you, such as when you use a GBG application, or we can collect the data indirectly through our GBG customer’s application or platform with which you directly interact.


Facial Images Sources

Our Services may utilize the facial images collected from one or both of the following sources: (1) an identity document (e.g., driver’s license, passport, etc.), and (2) a selfie.


GBG Technology Vendors

Some of our biometric Services may use external service providers (“GBG Technology Vendors”), all of which are listed at the end of this Biometric Notice.

Our Processing and Information provided to GBG Customers

  1. We take your identity document image and your selfie image (collectively, your “facial images”) and compare the two using facial recognition technology to see if the facial images you submitted belong to you.
  2. We do this by using facial recognition technology, either internally or through a GBG Technology Vendor, to extract biometric data by scanning or digitally mapping an individual’s facial features or facial geometry, such as the distance between the eyes or the forehead and chin.
  3. These measurements are then used to create a mathematical algorithm or formula known as a ‘facial template’ or ‘facial signature’ of the extracted data, which is deemed to be biometric data.
  4. An algorithm then compares the biometric data extracted from your facial images to authenticate or verify that the person on the identity document image is the same person on the selfie image.
  5. This process then generates a numerical ‘face match score,’ which we provide to our GBG customer that you are transacting with so they can assess their confidence level in determining whether the facial images collected belong to the same person.

Biometric Velocity

A GBG customer may enable our Document Velocity and Facial Matching services (“Biometric Velocity”) to help identify potential fraud based on repeated or potentially repeated use of the same or similar faces within that customer’s transactions, as well as for reauthentication for log-in and account purposes. Biometric Velocity is separate from the face-match process used for identity verification purposes which compares a document portrait and a selfie to determine whether they appear to belong to the same individual.

A facial template or vector (“biometric representation”) is derived from the document portrait and/or selfie. The biometric representation collected during your current processing is then compared against the other biometric representations we store in the network we maintain on behalf of the GBG customer you are transacting with. The network will only contain that GBG’s customer’s data and is logically segregated from other customers’ networks and data. The comparison may indicate that the same face has appeared in other transactions for that GBG customer and provide a fraud indicator for our GBG customer to review, or it may be used for the purposes of reauthenticating you.


Passive Liveness

Our GBG customers may also purchase our Passive Liveness Service, which detects whether the selfie image is a photo of an actual live person instead of a photo of a non-living person or spoof (e.g., a recording, another picture, a mask, a mannequin, etc.) by analyzing the features of the selfie image. When GBG customers use our Passive Liveness Services they are asking the question “is this a representation of a live person?” instead of “is this the person who they say they are?”. The selfie images are instantly purged when the processing using our Passive Liveness Service has been completed.

BIOMETRIC DATA DISCLOSURE

We may disclose or transmit your personal data (i.e., your facial images) to our GBG Technology Vendors, such as, when we utilize their cloud hosting or facial recognition technology to facilitate the provision of our Services to GBG customers.

We and our GBG Technology Vendors will not sell, lease, trade, or otherwise profit from a person’s biometric data that we may possess as a result of our GBG customer’s use of our Services.

We prohibit any further disclosure or re-disclosure of your biometric data not covered under this Biometric Notice, unless:

  1. You consented;
  2. We are required to do so under state or federal law, or municipal ordinance; or
  3. We are required to do so under a valid warrant or subpoena issued by a court.

OUR DATA SECURITY

We store, transmit, and protect from disclosure all personal data processed under our biometric Services using a reasonable standard of care with measures that are at least equivalent to the measures that we use to store, transmit, and protect from disclosure other confidential and sensitive data, such as drivers’ license numbers and social security numbers.

OUR SERVICES RETENTION SCHEDULE

Our data retention practices vary depending on the biometric Service utilized by our GBG customers and the retention period they select for that Service. Unless otherwise required by law, once the application retention schedule no longer authorizes us to retain your personal data, we will securely and permanently destroy your data, including any biometric data. The GBG customer you are transacting with must inform you of the retention period that will apply to your biometric data before collecting your facial images, in accordance with applicable law requirements.

The table below sets out the difference between how long we retain ‘facial images’ (i.e., your identity document photo and selfie) and ‘biometric data’ (i.e., the facial template).

 

.

GBG Services

Categories of Personal Information Collected

Purposes

Facial Images Retention (as selected by GBG Customer)

Biometric Data Retention

IDScan Enterprise

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect and process your facial images using facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Up to 31 days* (GBG’s customer can reduce to 0 days)

Facial templates are immediately deleted when processing has been completed

IDScan Core**

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect and process your facial images using facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Facial images are immediately deleted when processing has been completed

Facial templates are immediately deleted when processing has been completed

ExpectID Scan Verify

·  Image from an identity document (e.g., driver’s license, passport)

and

·  Selfie, and

·  Biometric data

To collect, process and disclose your facial images to GBG Technology Vendors, which utilize facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Up to 30 days* (GBG’s customer can reduce to instant deletion when processing has been completed)  

60 seconds

ExpectID

Scan Onboard**

(if either Face Review or, Programmatic Face Compare are enabled)

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect, process, and disclose your facial images to GBG Technology Vendors, which utilize facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Up to 30 days* (GBG’s customer can reduce to instant deletion when processing has been completed)  

60 seconds

FaceID

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect, process, and disclose your facial images to GBG Technology Vendors, which utilize facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

60 seconds 

60 seconds

GBG Go**

(if Face Match is enabled)

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect and process your facial images using facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Facial images are immediately deleted when processing has been completed

Facial templates are immediately deleted when processing has been completed

ProID

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect and process your facial images using facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

12 months

Facial templates are immediately deleted when processing has been completed

Detected**

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect and process your facial images using facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

31 days

Facial templates are immediately deleted when processing has been completed

Identify

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect and process your facial images using facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Up to 31 days* (GBG’s customer can reduce to 0 days)

Facial templates are immediately deleted when processing has been completed

Cloudcheck

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect and process your facial images using facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Up to 7 days* (GBG’s customer can reduce to 0 days)

Facial templates are immediately deleted when processing has been completed

greenIDscan

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

To collect and process your facial images using facial recognition technology to authenticate or verify a suggested identity and provide a face match score to GBG Customers.

Up to 31 days* (GBG’s customer can reduce to 0 days)

Facial templates are immediately deleted when processing has been completed

Biometric Velocity

(Document Velocity and Facial Matching)

·  Image from an identity document (e.g., driver’s license, passport),

·  Selfie, and

·  Biometric data

·  To compare biometric representations within a network dedicated to the same GBG customer and identify repeated or potentially repeated use of the same or similar face as a potential fraud indicator.

· Reauthenticating a returning individual against that individuals’ previously enrolled biometric representation to identify duplicate accounts.

Images submitted for the Biometric Velocity check will not be retained in the Biometric Velocity network.

Retained for the customer-selected period that our GBG customer disclosed to you, but no longer than a maximum of 3 years.

* Our GBG customers can choose to reduce or extend the default retention period.

** Our GBG customers may use this Service without processing any biometric data. This Service will only process biometric data if our GBG customer chooses to enable biometric processing.

*** For individuals in New Zealand, a summary of the Reasonable Necessity test undertaken in relation to Biometric processing is available on request by contacting GBG via the details in our full Products and Services Privacy Policy.

GBG TECHNOLOGY VENDORS

We disclose your personal data (i.e., your facial images) to our GBG Technology Vendors, listed below, for the purposes of cloud hosting services and/or technology service providers of facial recognition technology when providing our Services to GBG customers.

 

Cloud hosting services and biometric technology service provider

Cloud hosting services and biometric technology service provider Biometric technology service provider for facial matching.

GBG Services

GBG Technology Vendors

IDScan Enterprise

ProID

Detected

Identify

IDscan Core

greenIDscan

Cloudcheck

Amazon Web Services (AWS)

Cloud hosting services

ExpectID Scan Verify

Quality Technology Services (QTS)

Data center

Acuant, Inc. (see FaceID)

Biometric technology service provider

ExpectID Scan Onboard

Quality Technology Services (QTS)

Data center

Acuant, Inc. (see FaceID)

Biometric technology service provider

FaceID

Amazon Web Services (AWS)

Cloud hosting services

Microsoft, Inc. (Azure)

Biometric technology service provider

Biometric Velocity

(Document Velocity and Facial Matching)

Amazon Web Services (AWS)

Cloud hosting services and biometric technology service provider

Realeyes

Biometric technology service provider for facial matching.

For more information on our general privacy practices, such as how to exercise your privacy rights, please see our full Products & Services Privacy Policy.