Privacy policy

This Privacy Policy describes how Soyio SpA (“Soyio”, “we”, “the Company”) collects, uses, and shares personal information collected through its platforms.

This Privacy Policy explains the information you provide, what we collect, how it is used, your rights, and how we protect it under Law No. 19.628 on the Protection of Private Life and other applicable laws. We are committed to the security of your information, which is integral to our mission.

Our company aims to bring technology to people safely through systems that enable identity verification and authentication.

We want to do things as well as possible. Send any request, suggestion, or question to privacidad@soyio.id, and we commit to responding as soon as possible.

At our core, we treat your data as if it were our own. We respect your choices and make clear how we use your data, following international guiding principles and applicable laws.

Personal Data: An identified or identifiable natural person to whom the personal data relates or refers.

Sensitive Personal Data: A special category of personal data including racial or ethnic origin, political opinions, religion, sexual orientation, health data, and others.

Consent: Any freely given, specific, unambiguous, and informed expression of wishes, through a statement or clear affirmative action, by which the data subject, their legal representative, or authorized agent, as applicable, authorizes processing of their personal data.

Biometric Data: Personal data obtained through specific technical processing relating to a person's physical, physiological, or behavioral characteristics that enable or confirm their unique identification, such as fingerprints, iris, hand or facial features, and voice.

Data Subject: The natural person whose personal data will be processed in accordance with the consent they have provided.

Data Controller: The organization, person, or entity that determines the purposes and means of processing personal data, controls it, and is responsible for it.

Data Processor: A legal entity that processes data on behalf of the controller.

We may collect the following data:

When you create a profile on our platform or website:

• —Given name(s)
• —Last names
• —Email address
• —Identity card number or valid government-issued identification

If you complete the verification process:

• —A photograph of your identity card
• —Biometric information (facial video)

Data relating to metrics, analytics, and browsing behavior.

Our website uses Fathom Analytics, a privacy-focused analytics tool, to collect metrics and trends relating to the use of our services. This helps us understand how and when users visit and use our website, always anonymously and without compromising personal data privacy.

Fathom Analytics does not track individual users or store identifiable information, complying with applicable privacy regulations such as Law No. 19.628.

Data is collected when users visit our website, register, complete a form through Typeform, respond to a survey, or interact with other activities, services, features, or resources available on our website.

In addition to data collected during profile creation and verification, we may collect further information during the contractual relationship to meet legal or contractual obligations or improve our services. This processing will always comply with current regulations and be transparent to users.

We use the personal information we collect for the following purposes:

• —Fulfill and manage the request and/or service for which the information was provided
• —Create and manage your account on our platform
• —Answer questions you may have about our services
• —Meet legal or contractual obligations.
• —Respond to requests from state bodies or government agencies and comply with court orders, provided they are lawful. We notify users in advance whenever the request permits it.
• —Improve our website based on user feedback.
• —Process transactions with our business partners.
• —Invite you to Club DPO events and activities or others you register for, and share related information of interest.

Soyio may share personal data with:

• —Technology and communications providers
• —Subsidiaries and any entity owned or controlled by Soyio SpA
• —Parties requiring disclosure of Personal Data for legal reasons, subpoenas, or other proceedings. In these cases, we will always inform you of the reason, its legal basis, and the data we have shared.

As part of authentication, consent management, and identity verification, some personal data may be transferred to our technology service providers. They act as processors and support technical functions such as identity verification, secure storage, and database management. All these providers have been assessed against security and privacy standards.

You can review their privacy policies at the following links:

• —Truora Privacy Policy
• —MongoDB Privacy Policy
• —AWS Privacy Policy
• —FaceTec Privacy Policy

Technology and communications providers. We share data with Typeform, which we use to manage forms and collect information. You can view Typeform's privacy policy here

We will not sell, exchange, or otherwise transfer personally identifiable information to third parties you have not authorized.

Our technology enables customers to verify and authenticate their users. This process follows the highest security standards and makes the described information available through an API. It compares an image, usually a person's identity document, with their face captured in a live video.

We will retain your personal data for the shortest time necessary to provide the service or fulfill the purposes for which it was collected.

We commit to deleting your information after seven (07) years if you have not requested it earlier, unless specific laws or sectoral regulations require us to retain it longer.

For marketing communications, we retain data while you wish to receive that information and do not object. You may object at any time through a request in our Privacy Center.

We implement multiple security measures to protect your personal information when you enter our platform or access your information. However, no system is infallible, and we cannot guarantee the complete security of the personal data you share with us. We will make every effort to follow the highest security standards to prevent breaches and, if one occurs, notify you as soon as possible so you can take the necessary action.

Our laws recognize rights that let you control the information we hold about you, ask how it is used, and, where applicable, request deletion.

Specifically, these are:

• —Right of access: You may ask us to confirm whether we process your personal data, access it, and receive information about its purpose, processing period, and categories.
• —Right to rectification: You may request correction or modification of personal data we hold about you and are processing.
• —Right to erasure: You may request that we delete your data from our databases. However, certain legal grounds permit or require us to retain information. Whenever you request erasure, we will explain in detail which data we will delete and which we will keep if there is a specific reason to do so.
• —Right to object: You may object to a particular way we process your data if you believe it affects your rights and freedoms, to processing solely for marketing, or to processing data obtained from publicly accessible sources. You may also object to decisions based solely on automated processing of your personal data, including profiling.
• —Right to portability: You have the right to request a copy of the information we hold about you, to be provided in less than 15 days.

This process is free for you, and we aim to make it as quick as possible.

You can exercise these rights through our Privacy Center.

Cookies are small text files sent to your computer or mobile device that enable certain Soyio functions and features. Some last only while your browser is open (session cookies), while others remain until you or your browser delete them or they expire (persistent cookies).

We use cookies only in specific, functional contexts within our services, never for advertising tracking. For example, we use them to remember preferences in our consent widgets and Privacy Portal, keep your session active, and enable personalized assistance in our documentation when you interact with our support system, Intercom.

When using our app, you must expressly accept this Notice before creating a user profile. On our website, or if you do not use our app, we do not process or use your personal data.

If you have an account in our app, we will email you about essential changes to this Notice so you can read and accept them. Changes and clarifications take effect immediately after publication on the website and your acceptance.

For essential changes, we will notify you through our app and website and will always require your consent.

If you have questions about this Privacy Policy, you can contact us using the details provided on this website:

• —Organization responsible for data protection (RPD): Soyio SpA (“Soyio”), RUT No. 77.830.754-5.
• —The Data Protection Officer (DPO) can be contacted at: privacidad@soyio.id