USER AGREEMENT (CONSENT)
By clicking the “Next Step” button, I hereby acknowledge and agree that my personal data, which I am providing or have provided to the Company (Data Controller)– the organisation with which I wish to establish a business relationship after completion of verification, will be processed by Sum and Substance LTD (hereinafter - the “Service Provider”), incorporated and registered in England with company number 09688671, whose registered office is at 30 St. Mary Axe, London, United Kingdom, EC3A 8BF in order to verify my identity for the purposes of Right to work (hereinafter referred as to RTW) and/or Right to rent (hereinafter referred as to RTR) checks in accordance with applicable legislation requirements and internal procedures and policies of the Company.
- 1. My name and other means of identification for the purposes of obtaining this Agreement shall be established in the course of the processing of my personal data carried out in accordance with this Agreement.
- 2. I hereby acknowledge and agree that processing shall be done for the purposes of Right to Work and/or Right to Rent checks determined by the Company. The RTW and/or RTR checks entails document check, biometric personal identity verification and identity fraud checks, including via fraud prevention agencies (e.g., CIFAS, for more information see: https://www.cifas.org.uk/fpn), as described in section 9 of Privacy Notice available here. Sumsub also provides activity history check (where it’s required), which is a check of records that show the person has regularly interacted with other organisations or people (e.g., Educational organisations, Financial organisations, Travel companies or border or immigration authorities, utility services, etc.).
- 3. I hereby acknowledge the delegation of personal data processing by the Company:
- 3.1. I hereby acknowledge and agree that I know the company details (including the address) of the Company, which is the Data Controller. Any orders, directions or instructions for processing, designation of the purposes of the processing, determination of personal data subject to processing and other similar matters are the responsibility of the Company.
- 3.2. I hereby acknowledge and agree that the Company may entrust the processing of my personal data to data processors (e.g. Service Provider) through which the Company collects and processes my data if it is necessary for the processing purposes as set out above; the personal data may be disclosed to entities associated with Service Provider to achieve the purpose of the processing under this Agreement. The Service Provider stores personal data in AWS Amazon, or Google Cloud (depending on the requirements of the Company on the place of data storage) and Sumsub Group of Companies that are obliged to implement appropriate technical and organisational measures to ensure the safety of the personal data. The Service Provider can engage the following third parties (subprocessores) to provide the services specified above: ComplyAdvantage for AML and PEPs screening checks, electoral roll and credit reference sub-processor, other database providers.
- 3.3. I hereby acknowledge and agree that my personal data may be disclosed to entities associated with the Service Provider to achieve the purpose of the processing under this Agreement. The Service Provider guarantees that such entities, as well as other data processors to which it discloses personal data implement appropriate technical and organisational measures to ensure the safety of the personal data.
- 4. Data processing methods
I hereby acknowledge and agree that my personal data shall be processed by means of automated text extraction, verification of authenticity/validity and other methods of automated processing of photos and scanned copies of documents.
The Agreement expressed hereby covers the following processing activities: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission to the Company or Service Provider and data processors, dissemination, transfer (including cross-border transfer, where necessary), alignment or combination, restriction, erasure and destruction.
The personal data may be checked in multiple databases, including International Politically Exposed Persons (PEPs), electoral roll and credit reference sub-processor’s databases.
I hereby acknowledge and agree that Company and Service Provider shall process my biometrics by means of automated reading, verification of the authenticity and other automated processing as stated in the Privacy Notice available here, which includes the processing of facial scan while passing liveness, video-selfie or video identification process, biometric authorisation, face comparison from the photo of an identity document and the facial image, searching of multiple identity creation, work and development of fraud control network to detect and prevent fraud and criminal activity. - 5. Types of personal data subject to processing
The Agreement for the processing expressed hereby includes the following personal data:
For RTW and RTR:- Forename;
- Middle names, if any
- Current surname
- Date of birth
- Image of the main page of the identity document, showing: the individual’s name, data or birth, nationality, and photograph; and the document’s expiry date.
- facial image data; photos of a face (including selfie images) and photo or scan of a face on the identification document, videos, and sound recordings (where applicable);
- biometrical data: facial scan(s);
- relevant publicly available data: information regarding a person being a Politically Exposed Person (PEP).
- technical data: information regarding the date, time and activity in the Services; IP address and domain name; software and hardware attributes (camera name and type); general geographic location (e.g., city, country) from Data Subject’s device;
- unique identifier (Applicant ID) created only for the association Data Subject and its personal data inside the Informational System;
- 6. Data subject rights
I hereby represent that I have been informed about my rights to:- withdraw Agreement if the processing is based on consent, not other legal basis requiring notification only;
- access and adjust personal data;
- make a justified demand in writing to suspend the processing of personal data due to a particular reason;
- object to the processing of personal data;
- object to the transfer of personal data; including the right to object to engaging any third parties to process personal data;
- object to being subject to a decision based solely on automated processing/profiling;
- make a justified demand in writing to erase personal data subject to applicable laws and regulations;
Some rights are not exclusive and may be limited to the statutory legal obligations vested in the Company or the Service Provider. - 7. I hereby represent that I have been informed that in case of the refusing user agreement, I will not be able to use the verification service for the Right to work and/or Right to rentchecks.
I hereby represent that I have been informed that in case of the withdrawal of the agreement, personal data will be deleted on the Service Provider side based on the Company decision. - 8. I hereby represent that I have been informed that my personal data will be retained and stored by Company and Service Provider and will be retained and stored by Sumsub and will be permanently destroyed based on the Company’s instructions when the Company’s initial purpose and/or retention period prescribed by applicable law expires. Where Service Provider independently defines the compatible purposes for data processing, personal data will be retained and stored as specified in Privacy Notice.
- 9. I hereby represent that I have carefully read all of the above provisions and do voluntarily and unequivocally agree with them.