Privacy notice: identity verification

Version 2026-10-12

Who we are

[Company name], [registered address], is the controller of your personal data. Our Data Protection Officer can be contacted at [dpo@example.com].

What we collect

• Identity details: name, date and place of birth, nationality, document numbers, tax identification number.
• Contact and address details, and a proof-of-address document.
• Images of your identity document, and photos and short frames of your face.
• Information about the purpose of your account, your income, wealth and the source of your funds, and whether you or people close to you hold prominent public functions.
• Device information: IP address, browser type, language, time zone and screen size.
• Results of checks against sanctions and politically exposed persons lists.

Why we use it and our legal basis

• Customer due diligence under the Prevention of Money Laundering and Funding of Terrorism Regulations (S.L. 373.01) and the FIAU Implementing Procedures: verifying your identity and address, understanding the purpose of the relationship, screening, and assessing risk. Legal basis: legal obligation (GDPR art. 6(1)(c)).
• Automated comparison of your face with your document (biometric data): your explicit consent (GDPR art. 9(2)(a)). You can choose a video call instead, and you can withdraw consent at any time by contacting us; this does not affect processing already carried out. From 10 July 2027 this processing may instead rely on Regulation (EU) 2024/1624, art. 76.
• Device information (IP address, browser, time zone): used to corroborate your identity as part of customer due diligence (legal obligation, GDPR art. 6(1)(c)), and to protect our service against impersonation and fraud (legitimate interest, GDPR art. 6(1)(f)). You can object to processing based on legitimate interest.

You must provide the information we ask for so that we can meet our legal obligations. If you do not, we cannot open your account.

Automated checks and human review

Software reads your document, checks it for consistency, compares your face with the document photo and screens your name. A member of our compliance team reviews every application and makes the decision. You can ask us to explain a decision and to have it reconsidered.

Information we obtain from other sources

We check your name and date of birth against sanctions lists published by the United Nations, the European Union and Malta's Sanctions Monitoring Board, and against politically exposed persons data from [screening data provider].

Who receives your data

• Our compliance staff, and the Financial Intelligence Analysis Unit and other authorities when the law requires.
• [Screening data provider], [hosting provider] and [other processors], under contracts that protect your data.
• When the verification page loads, your browser downloads software components from [jsDelivr CDN] unless we host them ourselves; this provider sees your IP address. [Remove this line once components are self-hosted.]

Transfers outside the European Economic Area

[State whether any provider processes data outside the EEA, and the safeguard used, e.g. an adequacy decision or standard contractual clauses. If none: "We do not transfer your personal data outside the EEA."]

How long we keep it

We keep your records for 5 years after our business relationship ends, or 5 years after we decline or close your application. We then delete them, unless the law requires us to keep them longer (for example, at the request of the FIAU or during an investigation).

Your rights

You can ask for access to your data, correction, deletion or restriction, object to processing based on legitimate interest, and receive the data you gave us with your consent in a portable format (art. 20), within the limits of anti-money laundering law. To withdraw consent to automated face matching, contact our Data Protection Officer; we will record it and verify you by video call instead. Some rights may be restricted where telling you would prejudice the prevention of money laundering. You can complain to the Information and Data Protection Commissioner (idpc.org.mt).

Contact

[support@example.com] · [+356 0000 0000]