FINGERCHECK BIOMETRIC INFORMATION POLICY

Fingercheck has instituted this Biometric Information Policy related to biometric data with respect to Fingercheck’s Customers’ and Customer’s Users’ use of Fingercheck products and services. Fingercheck’s Customers are responsible for developing and complying with their own biometric data retention and destruction policies as may be required under applicable law. This policy applies with respect to state or federal statutes that regulate biometrics, including but not limited to, the Illinois Biometric Information Privacy Act, to the extent they are consistent with those applicable laws.

• Biometric Data Defined: Under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”) the term “biometric identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color. Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996. The term “biometric information” means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual. Biometric information does not include information based on items or procedures excluded under the definition of biometric identifiers. Biometric identifiers and biometric information are referred to herein collectively as “biometric data.” Time and attendance data or information obtained by the timekeeping devices, Fingercheck, its vendors and/or its licensors shall not be considered to be biometric identifiers or biometric information under BIPA or any other applicable state or federal laws.

• • Fingercheck Platform: The devices that transmit data to the Fingercheck platform do not store raw fingerprint images. Instead, the algorithm in those devices is based on the Minutiae matching method and the device stores a template in the form of an encrypted code. The template is non-reversible to the original image thus it cannot be used elsewhere.

The face recognition algorithm used in the devices that transmit data to the Fingercheck Platform uses a combined Gabor-LDA (Linear Discriminant Analysis) based method which consist of various processes of comparing selected facial features from a given image with faces within a database. During face enrollment, the terminal will capture images of a person’s face with an infrared camera and generates a 3-dimensional template to be stored as a template for verification process. The encrypted template is non-reversible to the original image thus it cannot be used elsewhere.

• Fingercheck Mobile Application: The Fingercheck mobile application may require (based on a Customer’s settings) a User to provide a biometric facial scan to validate a User’s identity against an image of the User provided to Fingercheck by Fingercheck’s Customer as part of Fingercheck’s authentication services. Fingercheck receives a result indicating authentication success or failure upon a User’s biometric facial scan being provided. Fingercheck uses Amazon Rekognition software to provide this feature.
• Collection, Storage, Use, and Transmission of Biometric Data: Fingercheck Customers are responsible for compliance with applicable law governing any collection, storage, use, and/or transmission of biometric data they conduct or facilitate. Fingercheck and/or its vendors or licensors may collect, store, use and/or transmit biometric data during the course of providing products or services to Fingercheck Customers and Customer’s Users. With respect to biometric data collected, stored, used and/or transmitted by Fingercheck and/or its vendors or licensors, if any, to the extent required by law, Fingercheck’s Customers will obtain written consent from each individual User prior to the collection of such data.

Fingercheck and/or its vendors or licensors may collect, store, use and/or transmit any biometric data solely for identity verification for purposes of recording time and attendance. Neither Fingercheck nor its vendors or licensors will sell, lease, trade or otherwise profit from any biometric data that it receives from Customers or Customer Users, if any.

Fingercheck Customers agree that to the extent that such Customers use devices that transmit data to the Fingercheck platform they must:

• Inform the User in writing that biometric data is being collected, stored, and used;
• Indicate the specific purpose(s) for collecting biometric data and length of time for which it is being collected, stored, and used; and
• Receive a written release from the User (or his or her legally authorized representative) authorizing the Customer, Fingercheck and/or Fingercheck’s authorized vendors or licensors to collect, use, store and transmit User biometric data, and authorizing the Customer to provide such data to Fingercheck and/or Fingercheck’s authorized vendors or licensors.

• Disclosure: Fingercheck will not disclose, disseminate and/or transmit any Customer’s User biometric data to any person or entity other than the Customer and Fingercheck’s authorized vendors or licensors without/unless:
  • First having the Customer’s User’s written consent;
  • The disclosed information completes a financial transaction authorized by the Customer’s User;
  • Disclosure is required by state or federal law; or
  • Disclosure is required pursuant to a valid warrant or subpoena.

• Retention Schedule: Fingercheck may retain any Customer’s User’s biometric data in Fingercheck’s possession, if any, provided to the Fingercheck Platform until the Customer notifies Fingercheck in writing that it has terminated the User’s access or has otherwise discontinued using the Fingercheck Platform, with respect to that User or within 30 days of the User’s last interaction with the Fingercheck Platform. When Fingercheck receives notification in writing that:

• A Customer’s User’s access has been terminated;
• The Customer otherwise has discontinued using the Fingercheck Platform, with respect to that User; or
• The Customer or the Customer’s User makes a written request to Fingercheck that such biometric data be destroyed, any User’s biometric data in Fingercheck’s possession will be destroyed within 30 days.
• In any event, Fingercheck may retain any Customer’s User’s biometric data in Fingercheck’s possession: (i) until the initial purpose for collecting or obtaining such biometric data has been satisfied, or (ii) for three years offrom the date of a User’s last interaction with the Fingercheck platform and/or its Customer, whichever occurs first.

Fingercheck shall make this policy available to the public by posting it on its publicly available website

• Biometric Data Storage: Fingercheck and/or its vendors or licensors shall store, transmit and protect from disclosure any biometric data collected, and shall store, transmit, and protect from disclosure all biometric data using the reasonable standard of care in Fingercheck’s industry and in a manner that is the same as or more protective than the manner in which Fingercheck stores, transmits, and protects other personal and sensitive information.

• Written User Release: Each User of the Fingercheck platform or mobile application will be required to provide written consent along the lines of the following

By clicking “I agree” or “I consent,” “I acknowledge that I have read Fingercheck’s Biometric Information Policy, that I understand that Fingercheck, its vendors and/or licensors (including, but not limited to, Amazon for the use of Amazon Rekognition services) may collect, receive, store and use biometric identifiers and biometric information (biometric data) which may include finger scans, biometric facial scans or facial data or as otherwise described in the Illinois Biometric Information Privacy Act, 740 ILCS §14/1 et.seq. (or other similar state or federal laws) in connection with its timekeeping and attendance system. Pursuant to applicable laws governing biometric data, I voluntarily consent to the collection, receipt, storage, disclosure, and use of biometric data by Fingercheck, its vendors and/or licensors, for purposes of my employer’s or other contracting entity’s timekeeping and attendance system. I also voluntarily consent to Fingercheck providing such biometric data to its vendors and/or licensors, or as otherwise required by law. I also understand the data retention schedule as provided in Fingercheck’s Biometric Information Policy governs the retention and destruction of the biometric data by Fingercheck.”