This Privacy Policy explains how CBiBank IDMe collects, uses, discloses, and safeguards your personal information when you use our identity verification and electronic Know Your Customer (eKYC) services (the "Service").

1. Information we collect

To verify your identity we may collect:

• Identity details — name, date of birth, national identifier, and contact information.
• Identity documents — images of government-issued IDs and the data extracted from them.
• Biometric data — a selfie image and facial-liveness signals used to confirm a live person. See our Data Protection & Biometric Notice.
• Technical data — IP address, device and browser information, and audit logs of actions taken.

2. How we use your information

• To verify your identity and prevent fraud.
• To meet legal and regulatory obligations, including Know Your Customer (KYC) and Anti-Money-Laundering (AML) requirements.
• To operate, secure, and improve the Service.

3. Legal basis for processing

We process personal data where processing is necessary for compliance with a legal obligation, for the performance of a contract, on the basis of your consent (for example, biometric processing), or for our legitimate interests in preventing fraud.

4. Service providers and disclosures

We use trusted third-party identity-verification, document-OCR, and electronic-signature providers to deliver the Service. These providers process data on our behalf under appropriate contractual and security safeguards. We do not sell your personal information.

5. Data security

Personal information is encrypted in transit and at rest. Access is restricted to authorized personnel, and all sensitive actions are recorded in an audit trail.

6. Data retention

We retain personal data only as long as necessary to fulfil the purposes described here and to satisfy legal, accounting, or reporting requirements, after which it is securely deleted or anonymized.

7. Your rights

Subject to applicable law (including the GDPR and CCPA/CPRA), you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing or withdraw consent. To exercise these rights, contact us at your support team.

8. International transfers

Where data is transferred across borders, we use appropriate safeguards such as standard contractual clauses.

9. Changes and contact

We may update this Policy from time to time. Questions or requests can be directed to your support team.