Privacy Policy

X-Faces Kft. ("X-Faces", "we", "us", "our") respects the right to privacy and strives to ensure lawful, fair and transparent processing of personal data.

This Privacy Policy applies to visitors of the X-Faces website, representatives of clients and partners, users of our products and other persons who interact with us.

We process personal data in accordance with the European Union General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), applicable national law and, where processing falls under UK jurisdiction, the UK Data Protection Act 2018 and the UK GDPR.

Depending on the nature of the interaction, we may process the following categories of data:

• Contact and business data: name, job title, company, email address, phone number and the content of your inquiry.
• Identification data: age or date of birth, gender and other information required for the selected verification procedure.
• Verification materials: document images, a photo or selfie, recognition and matching results, authenticity and liveness indicators — where such data is required to provide the service.
• Technical data: IP address, browser type and version, operating system, device identifiers, event logs, date and time of access.
• Usage data: pages visited, interface actions, referral source and parameters of interaction with the website or service.
• Risk and verification data: statuses, risk signals, matches and other results generated as part of KYC and anti-fraud processes.

We receive data directly from you, from our clients when they use X-Faces services, automatically through the website and devices, and from lawfully available sources and registries — where permitted by applicable law.

We use personal data only for specified and lawful purposes, including:

• providing, configuring, supporting and improving X-Faces products and services;
• performing identification, KYC and anti-fraud checks on behalf of the client;
• detecting suspicious activity, multi-accounting, forged documents and other risks;
• responding to inquiries, arranging product demos and business communication;
• ensuring security, preventing abuse and investigating incidents;
• analyzing the performance of the website and services, fixing errors and developing functionality;
• fulfilling contractual, accounting, tax and other legal obligations;
• marketing communications and personalization — subject to the necessary consent or another lawful basis.

The legal basis depends on the purpose and context of processing. We may rely on the following bases:

Where processing involves special categories of personal data or biometric data within the meaning of the GDPR, we ensure that a separate applicable condition provided by law is in place.

We retain personal data no longer than necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

When determining the retention period, we take into account:

• the nature and volume of the data, the purposes and legal bases of processing;
• contract terms and client instructions where X-Faces acts as a processor;
• mandatory retention periods for accounting, contractual and other documents;
• risks to the rights and freedoms of data subjects;
• the need to protect legal claims and resolve disputes.

After the applicable period ends, data is deleted, anonymized or securely isolated from further use if its retention is required by law.

We apply risk-appropriate technical and organizational measures to protect data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

Such measures may include access control, authentication, encryption in transit and at rest, event logging, backups, monitoring, vulnerability management, staff training and incident response procedures.

No method of data transmission or storage provides absolute security. We regularly review our protection measures in light of technological developments, the nature of processing and the level of risk.

In cases provided by law, you have the right to:

• obtain confirmation of processing and access to your personal data;
• request correction of inaccurate data or completion of incomplete data;
• request erasure of data;
• restrict processing;
• object to processing based on legitimate interest, as well as to direct marketing;
• receive data in a structured, commonly used and machine-readable format and transmit it to another controller;
• withdraw consent at any time without affecting the lawfulness of prior processing;
• not be subject to a decision based solely on automated processing where such a decision produces legal or similarly significant effects, except in cases provided by law;
• lodge a complaint with a competent data protection supervisory authority.

To exercise your rights, contact us at the address below. We may request reasonably necessary information to confirm your identity and protect your data from unauthorized disclosure.

We may share personal data only to the extent necessary for the stated purposes with the following categories of recipients:

• cloud infrastructure, hosting, communications, analytics, security and technical support providers;
• professional advisers, auditors and contractors bound by confidentiality obligations;
• companies within our corporate group — where there is a lawful basis and appropriate safeguards;
• X-Faces clients, where data is processed as part of the service provided to them;
• courts, government and law enforcement authorities — where disclosure is required by law or necessary to protect legal rights.

International transfers

If data is transferred outside the European Economic Area to a country without a recognized adequate level of protection, we use safeguards provided by law, such as the European Commission’s Standard Contractual Clauses, and apply additional protective measures where necessary.

We do not sell personal data.

The website may use strictly necessary cookies for correct and secure operation, as well as functional, analytics and marketing technologies — taking into account your chosen settings and the requirements of applicable law.

Optional cookies are set only with the required consent. You can change your choice via the cookie settings on the website or in your browser. Restricting cookies may affect certain features.

For questions about personal data processing, to exercise your rights or to submit a complaint, contact X-Faces Kft. We will try to respond within the time limits set by applicable law.

Document updates

We may update this Policy from time to time, for example when laws, technologies or our processes change. The current version is published on this page with the date of the update. Material changes may additionally be communicated in an accessible and appropriate way.