Privacy policy for the Sistec - Verify app

1. About the app and who this policy applies to

Sistec - Verify is a work app for Sistec’s customers. Authorised users at the customer photograph identity documents, read the document’s chip and send the scan to the customer’s Sistec account. The app can only be used with a Sistec account that has permission to use the scanning app, and accounts cannot be created in the app.

This policy applies to two groups:

• checkyou who use the app, that is, employees of Sistec’s customers who sign in to scan documents
• checkyou whose identity document is scanned, for example in recruitment, site enrolment or a right-to-work check

For everything else, Sistec’s privacy policy applies.

2. Who is responsible for the data?

Sistec AB is the controller for the data about you who use the app: sign-in, user account, security logging and troubleshooting of chip reading.

When an identity document is scanned, Sistec processes the data on behalf of the customer, under the agreement and the data processing agreement with the customer. The customer, that is, the organisation that has the document checked, is the controller and decides the purpose, the legal basis and how long the scan is kept. This is the same division of roles as in Sistec’s Right to Work services.

3. Data about you as an app user

Username, password and two-factor code

Sent to Sistec at sign-in for verification. The password and the code are not stored in the app.

Sign-in with Microsoft

If you choose it, you sign in with Microsoft in a secure browser window. The app receives an access token from Microsoft and sends it to Sistec, which verifies who you are. The app never sees your Microsoft password.

Session token

Stored in the app on your phone until it expires or you sign out.

Failed sign-in attempts

Recorded with username and time to protect the account against guessed passwords. If the account is locked after too many attempts, the IP address is saved in the account’s event log.

Scans you have made

Each saved scan is linked to your user account.

Chip reading diagnostics

After each attempt to read a chip, the phone model, iOS version, app version, error code, how long the read took, the document type and the last two characters of the document number are sent to Sistec. The data is logged with your username.

Technical logs

Sistec’s servers log the requests from the app, including time and IP address, for operation and security.

Sistec processes this data on the basis of legitimate interest (Article 6(1)(f) GDPR): ensuring that only authorised users can access the service, protecting the accounts and keeping chip reading working and secure.

4. Data about you whose document is scanned

Photographs of the document

Front and back, including the facial image and signature if they appear on the document. Taken with the phone’s camera.

Data from the document

Name, date of birth, sex, nationality, personal identity number or equivalent, document type, number and issuing country, dates of issue and expiry, and the machine-readable zone. Extracted from the photographs by Sistec.

Contents of the document’s chip

The same data in digital form, the facial image stored in the chip and the chip’s security data (certificates and signatures). Read with the phone’s NFC reader.

Result of the check

Including whether the document is assessed as genuine and whether the facial image on the document matches the image in the chip. Created by Sistec.

The facial image on the document is compared by machine with the image in the chip to assess whether the document is genuine. The result is a basis for assessment by a person at the customer. The app makes no automated decisions about you.

As the controller, the customer decides why the check is carried out and on what legal basis, including for the comparison of facial images.

5. Data the app does not collect

The app does not use location, contacts, the photo library, the microphone, the advertising identifier or any other device identifier. It contains no advertising, analytics or tracking tools.

Photographs are not saved to the phone’s photo library, and the app keeps neither photographs nor chip data on the phone once the scan has been sent.

6. Phone permissions

• photo_cameraCamera is used only while you photograph a document in the app.
• nfcNFC is used only while you read a chip. You can skip the chip reading.

You can withdraw the camera permission at any time in Settings. Scanning will then not work.

7. Who receives the data?

The data is not sold and is not disclosed for anyone else’s own purposes. It is processed by:

• arrow_rightThe customer, the organisation that has the document checked. Authorised users at the customer see the scan and the result in Sistec.
• arrow_rightMicrosoft, as hosting provider for Sistec’s servers and storage (Microsoft Azure) and as sign-in service if you sign in with Microsoft.
• arrow_rightRegula, whose document verification software is included in the app and runs on Sistec’s own servers. The app downloads Regula’s document database from Regula’s servers, and Regula then sees the phone’s IP address but no data about users or documents.

8. Where is the data processed?

Sistec’s servers, databases and storage are located in Microsoft Azure data centres within the EU.

9. How long is the data kept?

Session token in the app

Until it expires or you sign out. It is also removed if the app is uninstalled.

Photographs and chip data in the app

Only while the scan is in progress.

Failed sign-in attempts

Deleted automatically after just over a day.

The account’s event log, with the IP address at a lockout

For as long as the account exists, as part of the account’s history.

Technical logs and diagnostics

30 days.

Scans at Sistec (images, extracted data and results)

For as long as the customer has instructed Sistec to keep them, under the agreement with the customer.

10. How is the data protected?

All communication between the app and Sistec is encrypted (HTTPS/TLS). Sign-in can require two-factor authentication, and only users who have been granted permission to the scanning app can submit scans. Access to saved scans is permission-controlled.

11. Your rights

You who use the app can request access to your data, have inaccurate data corrected, have data erased, request restriction and object to processing based on legitimate interest. Contact dpo@sistec.se.

You whose document has been scanned should contact the organisation that had the document checked, since it is the controller. Sistec helps the customer handle your request.

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.

12. Account deletion

User accounts are created and removed by your organisation’s administrator, not in the app. To have your account or your data deleted, contact your administrator or dpo@sistec.se.

13. Changes

This policy may be updated. The current version is always available on this page, with the date of the latest change at the top.