Privacy Policy

Last updated: 6 November 2026

This privacy policy explains how ID Verification Online collects, uses, shares, retains and protects your personal information, including information processed through the ID Verification Online iPhone app and electronic identity-check service.

Who we are

ID Verification Online is operated by Mr Dean Goodwin.

Organisation name: Mr Dean Goodwin
ICO registration reference: ZC151510

What personal information we collect

Depending on the service and identity document used, we may collect and process:

Your name, email address, telephone number, date of birth and current or previous addresses.
Appointment, booking, payment-confirmation and service details.
Information required to prepare ID1, ID2 and ID5 forms and related verification records.
Passport information, which may include the passport number, issuing state, nationality, sex, date of birth, expiry date and machine-readable-zone information.
Electronic passport-chip information used to authenticate the document, including DG1/DG2 integrity information, the chip portrait, EF.SOD security data, signing-certificate and revocation-check results.
Driving-licence information, which may include the holder's name, address, date of birth, expiry date, licence number, licence type and images of the front and rear of the photocard.
Facial images, liveness-session video and biometric comparison results used to confirm that a live person matches the identity-document photograph.
Verification outcomes, confidence or similarity scores, review notes, provider references, timestamps and audit information.
Messages or enquiries sent through the website.
Technical and security information such as IP address, browser or app version, device type and website usage data.

Why we use your information

We use personal information to:

Respond to enquiries and arrange or manage appointments.
Provide the identity-verification service you requested.
Read and authenticate identity documents and detect possible alteration, invalidity or misuse.
Perform liveness and facial-comparison checks and, where appropriate, conduct a human review.
Prepare and complete relevant identity-verification forms and records.
Process or confirm payment.
Maintain appropriate business, security, audit and compliance records.
Protect customers, the service and third parties against fraud or misuse.

Lawful basis and biometric information

We normally process personal information because it is necessary to provide the service you requested or to take steps at your request before providing it. Depending on the circumstances, we may also process information to comply with a legal or regulatory obligation or because we have a legitimate interest in operating and protecting the service, preventing fraud and maintaining appropriate records.

Facial liveness and face-comparison checks involve biometric data used to confirm identity. Where this is special-category biometric data, we ask for your explicit consent before the check begins. You may withdraw that consent before or during the biometric process, although we may then be unable to complete the electronic route. Contact us if you require a non-biometric or manual alternative. Withdrawing consent does not affect processing that was lawful before withdrawal.

Passport-chip verification

The iPhone or Android passport-reader app scans the passport's machine-readable zone and uses NFC to read the biometric chip. The service checks the integrity of the passport data, the signed EF.SOD security information, the document-signing certificate and available revocation information. The chip portrait is used as the reference image for facial comparison.

Raw DG1/DG2 data is used to perform the integrity and authentication checks and is not retained as a raw data file. Selected identity details and the technical verification outcomes are recorded against the secure booking so the result can be reviewed and evidenced. Encrypted temporary copies of the chip portrait and EF.SOD may be retained for up to 48 hours to complete or review the check, after which the temporary files are deleted.

Driving-licence verification

For the driving-licence route, the mobile website captures the front and rear of the photocard. Text recognition, document-data consistency checks and face detection are used to support verification. The details and images may also be reviewed by ID Verification Online. Encrypted temporary copies of the licence images may be retained for up to 14 days so the check can be completed and reviewed, after which the temporary images are deleted.

Facial liveness and AWS Rekognition

Facial liveness and comparison checks use Amazon Web Services (AWS) Rekognition in the eu-west-1 region. During a liveness check, a short video is streamed securely to AWS so that it can determine whether a live person is present. AWS returns a liveness confidence result and a reference image. The reference image is compared with the identity-document photograph and a similarity result is returned.

We configure no liveness audit images and no S3 output for these sessions. AWS liveness session data becomes unavailable after the short session-expiry period. ID Verification Online does not retain the raw liveness video on its systems and does not create or store a reusable facial biometric template. We retain the verification outcome and associated audit information needed to evidence the check. AWS processes this information as a service provider under the applicable AWS terms and data-protection arrangements.

Automated checks and human review

Automated document, liveness and face-comparison checks help identify whether a verification can pass automatically or needs further attention. A failed or uncertain automated check does not by itself make a legal or similarly significant decision about you. It may result in a retry, a manual review, a request for alternative evidence or use of another verification route.

Who we share information with

We share personal information only where necessary, including with:

AWS, which provides facial liveness, face comparison, face detection and text-recognition services.
Hosting, email, payment and other IT service providers that support the service.
Professional advisers, insurers or auditors where reasonably required.
Regulators, law-enforcement bodies, courts or other authorities where required by law.
HM Land Registry or other relevant parties where necessary for the requested service or where you ask us to do so.

We do not sell identity or biometric information and do not use it for advertising or tracking.

International processing

Some service providers may process personal information outside the United Kingdom. Where this occurs, we use providers and contractual arrangements intended to ensure an appropriate level of protection in accordance with applicable data-protection law. The AWS identity-check services used by this service are configured in the eu-west-1 region.

AI website assistant

If you use our website assistant, we record the questions you submit, the answers provided, the pages from which the assistant was opened, technical information used to prevent misuse, and any helpful or unhelpful rating you choose to give. Relevant extracts from this website and HM Land Registry Practice Guide 67 are sent with your question to our AI service provider so that an answer can be generated. Please do not enter identity-document numbers, payment information or other sensitive personal information into the assistant.

We use these records to provide the assistant, monitor its accuracy and cost, improve our published information, and protect the service from misuse. Chatbot records are normally deleted after the retention period configured by the website administrator, unless they need to be retained for longer to investigate misuse or deal with an enquiry.

How long we keep information

Encrypted passport chip portraits and EF.SOD temporary files: up to 48 hours.
Encrypted driving-licence front and rear temporary images: up to 14 days.
Raw liveness video: not retained on ID Verification Online systems.
Verification results, scores, document details, review notes, completed forms and audit records: retained only for as long as reasonably necessary to provide and evidence the service and meet applicable business, legal, regulatory, insurance or professional requirements.
Payment, tax and accounting information: retained for the period required by applicable law.

We may retain particular information for longer where reasonably necessary to establish, exercise or defend a legal claim, investigate suspected fraud or comply with a legal requirement.

Security

We use access controls, encrypted connections and encryption at rest for temporary identity-document evidence. Access to identity-check information is restricted to authorised use. No internet transmission or storage system can be guaranteed to be completely secure, but we take proportionate technical and organisational measures to protect the information we process.

Your rights

You may have rights under data-protection law to request access to your personal information, correction of inaccurate information, deletion, restriction, objection and data portability. These rights are subject to legal conditions and exemptions. You may also withdraw consent where processing is based on consent.

Complaints

If you have concerns about how your personal information is handled, please contact us first so we can try to resolve the matter. You also have the right to complain to the Information Commissioner's Office.

Contact and privacy choices

To ask a privacy question, exercise a data-protection right or withdraw biometric consent, use the details on our contact page.