Privacy Policy for Biometric ID Verification

Please read the following Privacy Policy (“Policy”) carefully to understand U.S. Bank Europe DAC (“Elavon Merchant Services”, “we”, “us”, or “our”) approach and practices regarding the processing of our Personal Information (“information) and how we treat it. Please do not use the ID‑Pal App if you do not agree with the ways in which we will process Information. We also used to be known as Elavon Financial Services DAC.

Elavon has established this Policy for Biometric ID Verification to let you know about the processing of Information for the purposes of verifying your identity, obtaining identification documents, and otherwise meeting regulatory requirements. Elavon is the Data Controller of your information.

The processing of your Information governed by this Policy and includes processing by use of the ID‑Pal app (the “ID‑Pal App”) supplied by ID‑Pal Limited, a company incorporated under the laws of Ireland with company registration number 578727, whose registered office is at 21 Lad Lane, Dublin 2, D02 A388, Ireland (“ID Pal”). Processing of your Information by ID‑Pal is conducted as a Data Processor on behalf of Elavon. References to “we”, “us”, or “our” are to Elavon and/or ID‑Pal as the context requires.

When referring to “Information” we mean the personal and financial information we obtain from you or from third parties (such as credit reference and fraud prevention agencies, joint account holders, your employees or officers of your business, other organizations who introduced us, or act on your or our behalf) which, where you are a sole trader or partnership, may relate to you and/or your business partners and guarantors and where you are a company or limited liability partnership, may relate to your officers, shareholders, partners, owners and guarantors.

Your explicit consent to processing of “special category” biometric data

To conduct ID verification with the ID‑Pal App, we need your explicit consent to process your biometric data in the ID‑Pal App. The IP‑Pal App is offered for your convenience as a quick and efficient way to verify your identity. You are under no obligation to use the ID‑Pal App and have your biometric processed. You may withdraw your consent at any time – if you wish to withdraw your consent, please cease using the ID‑Pal App and delete it. This will not affect the lawfulness of any processing conducted before you withdraw your consent.

What information do we collect about you?

When your explicit consent has been obtained, the following information will be processed for the purpose of ID verification during the merchant onboarding process:

• Photographic and video images of you, when you provide us with a “selfie” photo, pictures of your passport and national identification card or driving license.
• Biometric data when we compare your “selfie” photo against your photographic ID.
• Details from your passport, such as your name, gender, date of birth, nationality, passport number and MRZ code.
• Details from your national identification card or driving licence, such as your name, address, date of birth and driving license number.
• Details from your proof of address documentation, such as your name, address, and account number.
• Additional information that you provide to us as confirmation of your name, gender, address, date of birth, email address and mobile telephone number.
• All information collected using cookies or similar technologies.

 How do we collect your information?

This Information will be collected directly from you, when you submit your Information through the ID‑Pal App, or if you contact us directly for any reason, for example calling us or emailing us; and from third party service providers or public sources, to conduct verification checks on the information you have provided to us.

How do we use your Information?

We use your Information for the following purposes:

How do we share your Information?

We may at any time give your Information to:

• Service providers (including ID-Pal), advisors and agents providing services to Us (including our group companies and affiliates);
• Regulatory bodies where required for regulatory purposes;
• Our professional advisors to obtain advice in relation to our relationship with you.

International transfers of your Information

We may transfer your Information to countries outside the European Economic Area (“EEA”) and/or the United Kingdom where data protection laws may not be as strict as they are in the EEA / the United Kingdom. If we do so we will put in place appropriate controls to ensure that your Information is protected adequately, through standard data protection model clauses adopted by the European Commission (including the relevant clauses adopted by the UK authorities).

For how long do we keep your Information?

We will keep your Information for as long as we need your Information for regulatory or evidential purposes after expiry of termination of your contract.

Am I subject to a decision based solely on automated processing?

Automated Processing, Including Profiling and Use of Artificial Intelligence (AI)

The ID‑Pal App conducts identification and verification checks by automated means. The results of the automated checks will verify your identity and in turn this may contribute to an overall decision made by Elavon.

These systems may include those powered by artificial intelligence (AI). That may include model training with your data. These systems are developed and operated in compliance with the EU Artificial Intelligence Act and applicable data protection regulations. As such, we implement appropriate safeguards to ensure fairness, accuracy, human oversight, and the protection of your fundamental rights.

If a decision is made solely through automated means and has legal or similarly significant effects on you, you have the right not to be subject to that decision—unless:

• the decision is necessary for entering into or fulfilling a contract between you and the data controller,
• it is authorized by Union or Member State law applicable to the controller, which also provides suitable measures to protect your rights, freedoms, and legitimate interests, or
• it is based on your explicit consent.

In cases where:

• the decision is necessary for the performance of a contract, or
• it is based on your explicit consent,

we will implement appropriate measures to safeguard your rights and freedoms, including at minimum the right to obtain human intervention, express your viewpoint, and challenge the decision.

If you wish to exercise your rights related to automated individual decision‑making, you may contact us at any time.