Objectives
idwall believes in trusting relationships for everyone, and trust means transparency and security, both of which are central principles for idwall. The purpose of this Privacy Policy is to clarify for You the processing of your personal data and the personal data of your customers.
Definitions
Here you will find some of the expressions we use in this Policy to make it easier to understand the content presented.
Anonymization
Use of technical means, reasonable and available at the time of processing personal data, using which a piece of data loses the possibility of association, directly or indirectly, with an individual. Anonymized data is not considered personal data for the purposes of the LGPD (Brazilian General Data Protection Law).
National Data Protection Authority ("ANPD")
The public administration body responsible for ensuring, implementing and monitoring compliance with the LGPD (Brazilian General Data Protection Law) throughout the country. The ANPD was established by the LGPD as a body of the federal public administration with technical autonomy, part of the Presidency of the Republic," currently, due to Provisional Measure No. 1,124/2022, the ANPD enjoys the status of an entity of the indirect federal public administration, subject to a special autarchy regime.
Background Check ("BCG")
It is an idwall solution that provides information on the natural or legal persons ("Query Target") consulted by You, using search in databases available for online consultation maintained by public and private institutions in Brazil and abroad ("Sources").
Customers
Legal entity with which idwall has established a commercial relationship supported by a contract signed by both parties.
Personal Data Controller
Natural or legal person, public or private, who is responsible for decisions regarding the processing of personal data.
Personal Data
Information relating to an identified or identifiable natural person. Also considered personal data are those used to form the behavioral profile of a given natural person.
Sensitive Personal Data
Personal data on racial or ethnic origin, religious conviction, political opinion, membership of a trade union or religious, philosophical or political organization, data relating to health or sex life, genetic or biometric data when linked to a natural person.
Documentscopy
The documentscopy service is an analysis of identification documents, such as ID cards and driver's licenses, carried out by a team of idwall fraud prevention specialists dedicated to determining the veracity of these documents.
Data Protection Officer ("DPO")
Natural or legal person appointed by the Processing Agent to act as a communication channel between the Controller, the data subjects and the National Data Protection Authority.
Extracting Data from Documents with OCR
This is an idwall solution that assesses the legibility of the image of documents such as ID cards, driver's licenses and CRLVs (Vehicle Registration and Licensing Certificate) of natural or legal persons and extracts the information contained in these documents through a digital and automated process based on idwall's own confidential algorithms.
Facelink
It is a solution from idwall that provides an analysis, through biometric checks, of the compatibility between the image of the user's face, sent through an instant photo of the face ("Selfie"), and the identification document data provided by the user, such as the CPF (Individual Taxpayer Registration).
Face Match
It is an idwall solution that provides the similarity index between faces, based on the comparison of two images, using idwall's own and confidential algorithms, as well as third-party software at specific stages of the evaluation.
Suppliers
Suppliers are other third-party contractors and subcontractors, whether natural or legal persons, who do not qualify as Partners.
Brazilian General Data Protection Law ("LGPD")
Law 13.709 of August 14, 2018, which provides for the processing of Personal Data, in physical or digital media, by natural or legal persons.
Liveness
Liveness Solution provides an analysis of the face images captured. This analysis is carried out using algorithms that seek to determine whether the user is who they claim to be, or whether they are just an image manipulated as a representation of a person to defraud the process ("Liveness Process" or "Proof of Life").
Workflow Manager and ID Manager
Workflow Manager ("WM") and ID Manager ("IDM") solutions are idwall's self-service platforms that make it possible to manage and build validation flows on a single platform. WM focuses on flow management and IDM on profile management.
My ID
It is an idwall product that aims to provide its Users with a digital identification wallet solution that centralizes and verifies their personal data, facilitating their identification and access to services offered by idwall or third parties.
Partners
Natural or legal persons with whom idwall establishes commercial relations, on a partnership basis, to offer products and services.
Idwall Platform
idwall's proprietary platform that offers onboarding solutions, identity validation, risk analysis and process automation through a graphical dashboard with complete visualizations of the main performance and usage indicators of the idwall solutions contracted by You.
Index Platform
idwall's proprietary platform that offers users an analytical and comparative view of the performance of various financial market institutions, which guarantees access to data from the Idwall Ranking, data on the evaluation of institutions by the regulator and the market in general, when available, as well as references to relevant content.
idwall Products
idwall products include Background check (BGC), document data extraction (OCR), Facelink, Documentscopy, FaceMatch, Liveness, Workflow Manager, ID Manager, Professional Services, MyID and the SDK.
B2B Products
idwall products, apart from MyID, will be referred to as "B2B Products" when used by our customers via the Dashboard or API provided by idwall.
Professional Services
Professional Services is a form of specialized service provided by idwall in the form of consultancy, governed by a Service Agreement, which helps companies to achieve excellence in their registration and validation processes.
Software Development Kit ("SDK")
It is an idwall solution that enables greater quality control when capturing images of documents and selfies, by analyzing the position, lighting conditions, sharpness and reflection. When the four conditions mentioned above meet the established parameters, the image will be captured automatically.
Holder of Personal Data ("Holder")
The natural person to whom the personal data being processed refers. The data subject is only a natural person, not a legal person.
Processing of Personal Data ("Processing")
Any operation carried out with personal data, such as those relating to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation, information control, modification, communication, transfer, dissemination, or extraction.
Users and Customers ("You")
The term "You" means natural Persons accessing the idwall website or Customers of the Products or the idwall Platform or the Index Platform.
Who does this policy apply to?
This Policy applies to different types of people, including both idwall Website Users and idwall Customers who access the idwall Platform, use idwall products and/or the Index Platform. This policy does not apply to Users of MyID, a product with its own policy available on the idwall website. Below, we have broken it down by type of User so that You understand which treatments apply specifically to You.
Users accessing idwall website
When You, the user, access the idwall website or idwall subdomains, some of your personal data will be processed by us.
idwall Customers
idwall Customers are all persons who use the idwall Platform and the contracted products and/or the Index Platform. When you access the idwall Platforms or our service channels, we will process your personal data.
MyID users
This policy does not apply to MyID Users. MyID Users are all natural persons with a profile on MyID. When you create your account and use MyID, we also process your personal data. To find out more about MyID, visit the specific Privacy Policy for this product at meuid.com.br.
What data is processed
This Policy applies to different types of people, including both idwall Website Users and idwall Customers who access the idwall Platform and/or use idwall products. This policy does not apply to Users of MyID, a product with its own policy available on the idwall website. Below, we have broken it down by type of User so that You understand which treatments apply specifically to You.
B2B Products
In the majority of B2B Products, idwall acts as an Operator in data processing, which means that we do not directly collect the personal data of Data Subjects who are customers of idwall Customers, therefore we are not responsible for the legal basis applied to the data collection made by our Customers.
In each of our B2B Products, idwall Customers will share with us the personal data provided for in the signed Contract, which depends on the Products and the extent of the contracted functionalities. Therefore, the processing of personal data for B2B Products is governed by contractual clauses and is classified as idwall Confidential Information.
Website Users
| ORIGIN | DATA TYPE | GOAL | LEGAL BASE | |
|---|---|---|---|---|
| Access and navigation on the idwall website | Navigation: IP, date and time, time spent on the page, search terms to access the website, cookies and geolocation Device data: Device type, operating system, and browser | Website functionality Analytics Marketing | Legitimate interest, legal obligation or consent | |
| Registration on the business contact form | Name, corporate email, cell phone, company, position, market segment, how many CPFs (Individual Taxpayer Registrations) and CNPJs (Company Registration Numbers) the company analyzes per month, where did you find out about idwall | Commercial prospecting | Legitimate interest, legal obligation, or consent | |
| Newsletter Registration | Sending idwall Newsletter | Legitimate interest, legal obligation, or consent | ||
| Registration on the Dashboard | Dashboard name, email and password | Dashboard Access | Contract Execution | |
| Service Channels | Dashboard name, email and password | Contact Support | Contract Execution |
idwall Customers
| ORIGIN | DATA TYPE | GOAL | LEGAL BASE | |
|---|---|---|---|---|
| Registration on the idwall Platform or Index Platform | Platform name, email, login and password | Access to the Platform | Contract Execution | |
| Service Channels | Name, email, customer ID and cookies | Contact Support | Contract Execution | |
| Data entered into the idwall Platform during the use of the Products | Name, CPF (Individual Taxpayer Registration), ID, CNH (Driver's License), photo of identification document, etc. | Improving idwall solutions | Legitimate interest |
Finally, it is worth mentioning that, from time to time, idwall may use personal data for purposes not expressly provided for in this privacy policy, if it is within the scope of idwall's preponderant activity and in compliance with data protection legislation.
| TREATMENT AGENTS | SHARED DATA | GOAL |
|---|---|---|
| Customers | idwall shares with its Customers the results of consultations carried out on the contracted Products, which are regulated by the Terms of Use and by contract with each Customer. | Provision of Services established in Contract |
| Partners | idwall shares data with suppliers whenever necessary to provide the contracted service. | Services Provision |
| Suppliers | Sending idwall Newsletter | |
| Public Authorities and Legal Obligations | idwall may share personal data and information with the ANPD (National Data Protection Authority) and other Public Authorities, upon requests through notifications or court orders. | Compliance with Legal or Regulatory Obligation |
It is important to mention that idwall takes all necessary precautions when sharing personal data so that it is done safely and in compliance with the requirements set out in the General Data Protection Law. However, idwall is not responsible for the processing of personal data carried out by third parties (not subcontractors) due to the use of their own systems, applications, websites, and platforms in general. Treatments carried out by third parties will be governed by their respective Privacy Policies.
International Transfer
idwall concentrates the majority of its databases on servers located in Brazil, including all processing operations carried out for our Customers who are financial institutions, considering contractual limitations in compliance with BACEN Resolutions 4,893/2021 and 85/2021. However, some specific operations still have servers abroad, which are in the USA.
Furthermore, some idwall sub-operators maintain cloud storage servers outside Brazil, the majority in the USA and Europe. All idwall sub-operators are subject to strict data protection clauses to guarantee the application of the protection mechanisms of art. 33 of the LGPD (Brazilian General Data Protection Law) for carrying out international transfers.
Public and Private Data Source
idwall uses public and private data sources to comply with contractual obligations with its Customers and Users, to perform the services available on the idwall Platform and other solutions provided in the MyID product.
All sources of information that are publicly and freely accessible are considered public sources, such as websites of government bodies in the Executive, Legislative and Judiciary branches.
Private sources are all those whose access is not free, and it is necessary to contract their use, such as private data bureaus.
Duration of Data Processing
The Processing of personal data carried out by idwall will last if the purpose for which the data was collected or for the reasons set out in article 15 of the LGPD (Brazilian General Data Protection Law), and there may be exceptions under the terms of article 16 of the aforementioned law. Personal data processed by idwall in its capacity as operator to provide services to idwall Customers will be governed by contractual provisions in compliance with articles 15 and 16 of the LGPD.
Right of Holders
idwall may act as both an operator and a data controller, depending on the existing relationship as clarified in item 04.
When acting as an operator, it will execute the controller's requests in support of its obligations under data protection laws. Whenever the return or transfer of personal information shared by the controller with idwall in applicable B2B products is requested, idwall will execute the request allowing the extraction of data through the idwall Platform itself. In these cases where idwall acts as an operator, it is necessary for holders of personal data to contact the controller responsible for the processing.
idwall will only be able to directly respond to requests related to holders' rights when acting as controller.
According to articles 18 of the LGPD (Brazilian General Data Protection Law), the Data Subject's rights are:
I. Confirmation of the existence of personal data processing
You may ask idwall whether we carry out any processing of your personal data. To do this, we will request confirmation of your identity before sharing any information with You.
II. Access to processed data
You have the right to access your personal data that we have in our databases. To do this, we will request confirmation of your identity before sharing any information with You.
III. Correction of incomplete, inaccurate, or outdated data
You may request the correction or update of your data via the email available in item 12 of this policy.
IV. Anonymization, blocking or deletion of irregularly processed data
At any time, You may request the anonymization, blocking or deletion of your personal data, as long as it has been recognized by a competent authority as unnecessary, excessive or treated in non-compliance with the provisions of the LGPD (Brazilian General Data Protection Law).
V. Deletion of Personal Data
Whenever your data is processed based on your consent, You can request its deletion at any time, except for the exceptions in article 16 of the LGPD (Brazilian General Data Protection Law).
VI. Sharing Information
You may request information about the entities, public or private, with which your personal data has been shared.
VII. Revocation of consent, under § 5 of art. 8th of the LGPD (Brazilian General Data Protection Law)
Furthermore, whenever data processing is based on consent, You have the right to revoke this at any time. It is worth noting that the revocation will not affect any treatment already carried out and may prevent the continued use of the product or service in question, in which case the user will be duly informed.
Duties of Holders
The duties of personal data holders:
I. Do not provide untrue or incomplete information when registering for the newsletter and on the idwall Platform.
II. Inform idwall of any changes to your personal data so that we can keep your data up to date and correct.
III. Do not share logins and passwords with third parties, as well as use strong passwords in your registrations, this way, the owner also does its part to guarantee the security of its data.
IV. Analyze this Privacy Policy carefully and, where necessary, only give your Consent when You agree to the use of your personal data described here.
Information Security
Information security standards and prevention of personal data incidents are contained in idwall's Information Security Policy and internal regulations. idwall is committed to employing appropriate technical and organizational measures when processing personal data.
idwall has appropriate security measures in place to: (i) protect against unauthorized access to stored data and backups made; and (ii) prevent unauthorized changes, disclosures and/or destruction of information held by idwall. The collected data is stored under the strictest information security practices in the idwall database. Our database is strictly supervised and protected, so that only qualified employees have access, who are contractually obliged to the duties of secrecy and confidentiality.
Furthermore, idwall has ISO 27001 certification, which certifies that we comply with the requirements of the International Organization for Standardization (ISO) for information security management and implementation of a robust information security program. idwall works continuously to protect your privacy and maintain the security of your data and the data of your customers. All of our products are developed with solid security features, and we follow good security, privacy, data protection and governance practices for our services, including the security requirements set out in current legislation.
We adopt preventive and appropriate measures to avoid and minimize risks related to the processing of personal data. We present below the technical and administrative measures for data protection adopted by idwall:
- Internal information security and data protection standards, policies and procedures, which aim to ensure information security and adequate processing of personal data.
- Training and awareness of our employees.
- Restriction of access to personal data by our employees and third parties who need this information to process the data.
- Storage of personal data in the cloud, following the security protocols of our cloud providers and international best practices.
- Use of encryption techniques for data stored in databases and for data transferred internally and externally.
- Use of secure tools to transfer information.
Our measures are continually reviewed and monitored, in accordance with the most current organizational and technological resources.
Despite all the measures presented above, idwall, as well as any companies or public bodies that process personal data, are not exempt from the actions of malicious third parties. In the event of an information security incident that could result in significant risk or damage to data subjects, we will notify the National Data Protection Authority (ANPD), Customers and other necessary stakeholders.