Authenticate Biometric Data Terms

Part of the Authenticate Customer Agreement between Authenticating.com LLC and its customer (Customer Agreement, Section 1.2). Capitalized terms not defined here have the meanings given in the Customer Agreement. Prior versions are archived on this page.

These Biometric Data Terms apply whenever the Services involve the collection, capture, use, storage, transmission or destruction of Biometric Data.

1. Roles. Customer controls the End User relationship and the point at which Biometric Data is collected. Authenticating processes Biometric Data on Customer's behalf in accordance with the Data Processing Agreement and Authenticating's published Biometric Information Retention and Destruction Policy, available at authenticate.com/biometric-policy.

2. Customer Consent Obligations. Before initiating any Service involving Biometric Data with respect to an End User, Customer will:

1) present the End User with a written disclosure, in the form supplied by Authenticating and without alteration, stating that Biometric Data is being collected or stored; the specific purpose for collection; and the length of term for which the Biometric Data will be collected, stored and used;

2) obtain from the End User a written release, executed by the End User or their legally authorized representative, expressly authorizing the collection, storage and use of the Biometric Data, presented as a separate, affirmative and unbundled action rather than as a term within general terms of service;

3) retain records evidencing the disclosure and release for five (5) years from the date of the End User's last interaction, and produce those records to Authenticating within ten (10) business days of written request;

4) not initiate any Service involving Biometric Data with respect to an individual Customer knows or reasonably should know is under eighteen (18) years of age without first obtaining verifiable consent from a parent or legal guardian; and

5) where required by applicable law, offer the End User a reasonable alternative verification method that does not involve Biometric Data.

Where Customer uses Authenticating's hosted interface, the disclosure and release in items 1 and 2 above are presented by Authenticating on Customer's behalf, and Authenticating retains the records described in item 3. Customer will not alter, suppress or bypass that screen.

3. Restrictions. Customer will not:

1) sell, lease, trade or otherwise profit from any End User's Biometric Data;

2) disclose or disseminate Biometric Data except as permitted by BIPA § 15(d), CUBI, or other applicable law, or as necessary to complete a transaction the End User requested, or as required by a valid warrant or subpoena;

3) use Biometric Data for any purpose other than the identity verification or fraud prevention purpose disclosed to the End User; or

4) use Biometric Data, or permit its use, to train any machine learning or artificial intelligence model.

4. Retention and Destruction. Authenticating retains and destroys Biometric Data in accordance with its published Biometric Information Retention and Destruction Policy, which forms part of these Terms by reference. Under that Policy:

• facial geometry and biometric templates are not stored — they are computed for the comparison and discarded; and
• photographs and identity document images from which facial geometry is derived are permanently destroyed within eleven (11) months of the verification;

and in no case does Authenticating retain biometric identifiers or biometric information for more than three (3) years following the End User's last interaction. Customer will destroy any Biometric Data in its own possession in accordance with the same schedule.

5. Security. Each Party will store, transmit and protect Biometric Data using a reasonable standard of care within its industry, and in a manner at least as protective as that used for its other confidential and sensitive information.

6. Customer Indemnity. Customer will indemnify, defend and hold harmless Authenticating and its employees, officers, agents, affiliates and representatives from all claims, damages, statutory damages, penalties, costs and expenses, including reasonable attorneys' fees, arising from or relating to Customer's breach of these Terms, including any failure to obtain a valid written release under Section 2. This indemnity is an Excluded Claim under Section 8.2 of the Customer Agreement.

7. Suspension. Authenticating may suspend Services involving Biometric Data immediately on a reasonable belief that Customer has failed to comply with these Terms, and will notify Customer of the basis for suspension.

8. Survival. These Terms survive termination with respect to any Biometric Data collected during the Term.

Prior versions

This is the first published version of this document. When it is updated, prior versions will be archived here.