Biometrics policy

Created: 19th April 2025
Last Updated: 6th June 2025

1. Introduction

1.1.  This Policy describes how SALT processes Data where that Data may include Biometric Identifiers or Biometric Information, including the retention, collection, disclosure, and destruction of any images of the face taken for age estimation of identity verification purposes.

1.2.  This Policy is to be read with our existing SALT Privacy Policy and Terms and Conditions that can be found on www.be-SALT.com.

1.3.  Without limitation, this Policy applies where US laws relating to Biometric Identifiers or Biometric Information may apply, including in the state of Illinois, Texas or Washington and is in compliance with the *Illinois Biometric Information Policy Act *(“BIPA”), 740 ICLS § 14/1, et seq.

2. Definitions

2.1.  ‘Biometric Identifiers‘ and ‘Biometric Information‘ have the same meaning as given to them under BIPA.

2.3.  ‘Data‘ means the personal data collected by SALT, that may include (in certain circumstances and depending on legal interpretation in the relevant jurisdiction) Biometric Identifiers and Biometric Information, if any, collected for the purposes described in clause 3.

2.4.  ‘Digital Map‘ is a map of the face which is created for the uses described under clause 4.

2.5.  ‘Liveness Test‘ is the process carried out to determine if the person subject to the age or identity verification check is a real person.

2.6.  ‘Policy‘ means this SALT Biometric Policy.

2.7.  ‘Selfie‘ means an image of your face submitted by you to SALT.

2.8.  ‘SALT‘, ‘we’ or ‘us’ means the SALT Group, including SALT Ltd.

3. Purpose of Data Collection

3.1.  SALT carries out age estimation and identity verification by using third party software to analyses photographs, stills from videos and/or Selfies while performing Liveness Tests; and/or facial age estimation to determine a person’s age; and/or to create and compare a Digital Map of a face to that in a corresponding image on ID documents. During that process, to achieve these purposes, it is possible that Data may be collected and used by SALT.

4. Product Specific Summary

| Product Name | Collection and Usage | | :---- | :---- | | Age Estimation | We collect and image of your face to enable us to estimate your age and perform a Liveness Test. | | Identity Verification | We collect and use the Selfie and your ID Documents (including the image in the ID Document): to create a Digital Map of the Selfie and the image on the ID document; to compare the Digital Maps to ensure nobody is trying to use your ID documents without your permission. to perform a Liveness Test; to detect fraud by comparing it to other images submitted by you. |

5. Data Storage

5.1.  SALT maintains a reasonable standard of care to store, transmit, and protect from disclosure of any Data collected.

5.2.  We ensure that the Data is collected, stored, transmitted and protected from a disclosure in a manner that is the same as or more protective than how we handle other confidential and sensitive information.

6. Retention of Data

SALT respects and protects every person’s confidential and sensitive information. As part of these protections,

6.1.  SALT retains the Data as per its Data Retention Policy.

6.2.  If SALT ever ceases to supply the above-listed services, all Data ever collected from any person, if not already done, will be permanently destroyed.

6.3.  Absent a valid warrant or subpoena issued by a court of competent jurisdiction, SALT will comply with this retention schedule and the below destruction guidelines.

7. Disclosure Guidelines

7.1.  SALT does not sell, lease, trade, or otherwise profit from any Data and, expressly, biometric information and/or biometric identifiers.

7.2.  Unless there is a valid warrant, subpoena or other similar notice issued by a court of competent jurisdiction or other competent authority, SALT will not disclose, redisclose, or otherwise disseminate any Data collected or otherwise obtained from a person’s photograph, video and/or selfie.

8. Destruction Guidelines

All Data is destroyed as per SALT’s Data Retention Policy.