Biometric Information Retention and Destruction Policy

1. What we collect and why.

To verify that a person creating an account is who they say they are, our identity verification provider compares a photograph of a government-issued identity document with a photograph the person takes at that moment. That comparison uses a facial geometry scan, which is biometric information. We collect it for one purpose only: to confirm identity at account creation and, where required, to re-confirm it, including checking that the same face does not appear in another identity verification for us. We do not use it to identify anyone in any other context.

2. We do not sell it or profit from it.

JobsWorkers does not sell, lease, trade or otherwise profit from biometric information.

3. We do not disclose it

We do not disclose it except: with the individual’s consent; where required by law, subpoena or warrant; or to the identity verification provider that performs the comparison on our behalf, under contract. That provider, Stripe, keeps the biometric identifiers it creates for up to one (1) year. While it keeps them for us, it uses them only for the purpose in Section 1, in our identity verifications. It also keeps them as an independent controller, under its own privacy notice and the consent it asks for in its verification flow, to detect and prevent fraud and, where the person agrees, to improve its verification technology (Privacy Policy, Sections 3 and 6.2).

4. How long we keep it — retention schedule.

(a) Biometric information is destroyed when the purpose for collecting it has been satisfied. JobsWorkers never receives or stores biometric information. What our identity verification provider keeps for us, including from a verification that fails, it keeps only for the purpose in Section 1, and that purpose is satisfied when the person’s account is deleted. To delete an account, we ask the provider to delete the verification data it keeps for us, and the deletion of the account is complete only when the provider has done so, which can take up to four (4) days; if an identity security review of the account is open, we ask when the review closes. If none of this has happened sooner, the provider deletes the biometric identifiers within the one (1) year described in Section 3. Any copy the provider keeps as an independent controller is governed by its own privacy notice, as described in Section 3; the provider states that it removes the biometric identifiers it creates from its systems within one (1) year.

(b) In no case is biometric information retained more than one (1) year after the date on which the purpose for collecting it is satisfied.

(c) Where an individual has not interacted with JobsWorkers for twenty-four (24) months, any biometric information is destroyed no later than the end of that period, if it has not already been destroyed under (a) or (b).

(d) The earliest applicable date governs.

5. The only exception.

Destruction is suspended only where a legal hold applies — where JobsWorkers is required to preserve the information by a warrant, subpoena, court order, or a legal claim or investigation that is pending or reasonably anticipated. The suspension is limited to what the obligation requires and ends when the obligation ends, at which point destruction occurs immediately.

6. What is not covered.

A photograph, on its own, is not biometric information under this policy where no facial geometry is derived from it. Identity documents and their images are retained under our general retention schedule, not under this policy.

7. How to ask.

Write to privacy@jobsworkers.com.

8. If biometric information is compromised.

JobsWorkers maintains an internal protocol for responding to any data security incident that may compromise the security of biometric identifiers or biometric data, including those our identity verification provider processes for us. Under it, we contain the incident, find out what information and which people were affected, require our provider to do the same, and notify affected individuals and public authorities as the law requires.