- Data Retention in Veriff’s Service
Data Retention in Veriff’s Service
Applicable privacy regulations require that personal data retention be limited to what is necessary for the purposes for which they are processed. Following this, Veriff adheres to strict data retention procedures ensuring that personal data that is no longer needed is assigned for deletion in due manner.
Veriff offers both Self-Serve and Enterprise service plans. If you signed up for one of our Self-Serve plans, please review the data retention details here under the "Overall Features" tab corresponding to your selected plan.
For our Enterprise plan customers, by default for identity verification service, Veriff retains the End User’s Personal Data on behalf of the Customer for 90 days in the Service and then for 3 years in archive, with such archived data available to the Customer upon request submitted to support@veriff.com for the shorter of (i) the period the Customer remains a customer of Veriff’s Service, or (ii) three years. The retention period may differ in case certain Services or features are enabled:
Biometrics limitation: The retention period of biometric face embeddings in active storage is set for 3 years as the maximum considering the requirements deriving from US Data Protection Laws (e.g. Illinois Biometric Information Privacy Act states that the data must be destroyed when the initial purpose for collecting or obtaining the data has been satisfied or within 3 years of the individual’s last interaction with the entity, whichever occurs first).
Upon termination, Personal Data is assigned for deletion as per the data processing addendum between Veriff and the Customer.
Changing the retention period: If the Customer wishes to adjust the default retention for identity verification, then by default the change will apply only to new sessions and will not apply to existing sessions. For more information about changing the default retention period, please see here.
Veriff's independent retention: If allowed by law and/or as mutually agreed to by Parties in the Agreement, Veriff may retain the Personal Data for its own purposes irrespective of the retention schedule implemented for the Service provision. If Veriff has the right to retain the data longer (e.g., for permitted business purposes) then the above retention periods do not apply for using the data for Veriff’s purposes.
Information about security measures (including backup) applied to retained data is available here.
