We process your personal information for the following purposes:

• Provide, operate and maintain the Website and SELF Products. For such processing, the legal basis is our own legitimate interest.
• Respond to your inquiries and fulfill your requests, such as to send you requested materials and newsletters. For such processing, the legal basis is our own legitimate interest or your consent.
• Conduct our own marketing activities and communicate with you about SELF Products and our other services, events and Promotional Offers. For such processing, the legal basis is your consent.
• Send administrative information to you which includes, for example, information regarding our Website and changes to our terms. For such processing, the legal basis is our legitimate interest.
• Provide, operate and maintain SELF Products, including in the provision of customer or technical support that you request. For such processing, the legal basis is our legitimate interest.
• Process certain payment information where required based on your use of SELF Products.
• Improve SELF Products and our other services, including diagnosing and/or fixing technical issues or problems with SELF Products and detecting, preventing and investigating security incidents or similar behaviors or events.
• To comply with our legal obligations.
• To establish, defend, or enforce our legal rights.
• With your consent and at your direction, to certain third parties and our service providers in order to maximize your user experience.

We disclose your personal information we collect (as described in Section 2.2 of this Policy) for our business purposes only. We disclose your personal information to our service providers and other parties only as necessary for the provision of SELF Products. Accordingly, your personal information will only be disclosed to:

• Affiliates of SELF ID, to the extent that the transfer is necessary to process your communication and inquiries that you have requested through the Website or other means of communication (for example, social media platforms), or in the provision of SELF Products.
• Service providers in countries where we operate, to the extent the transfer is necessary to provide the Website and SELF Products, IT, system administration and hosting, analytics, marketing and other business operations in accordance with those set forth in section 3.1 of this Policy.
• In cases where we are legally obliged to do so or where there is a legally binding judgment, as well as in cases where we enforce our rights or defend ourselves against claims.

All of our service providers are contractually obligated to process personal information only on our instructions. The service providers are not permitted to use personal information for their own purposes without our approval or as otherwise permitted by applicable law.

Anytime you enter into an Engagement wherein money is exchanged using SELF Mobile Apps, the transaction is administered either by Apple (when using an iOS device) or Google (when using Android) (collectively, “In-app Purchases”). When you use In-app Purchases, you are disclosing your information directly to either Apple or Google and SELF ID plays no role in the transaction, nor do we have any visibility into your personal information disclosed (financial or otherwise). For the avoidance of doubt, the terms and conditions and privacy policy of the respective entity administering the transaction apply to any such In-app Purchase.

Self ID uses Hyperswarm, a shared global registry, to publish all DID operations. Hyperswarm is an open source data distribution protocol that operates on a peer-to-peer model, with more information available here . All data uploaded to Hyperswarm is encrypted so that only the parties to the transaction can access the underlying data. When you use SELF Products, your User Data is uploaded to Hyperswarm and may include the following:

• Personal identifiers (examples include name, address, social security number or other unique government identifying numbers contained on images of government identification documents)
• Customer records (examples include bank account numbers)
• Biometric data (examples include fingerprints, voice recordings, and face recognition or identification)
• Sensory data (if you send us any videos that contain audio)
• Geolocation data (examples include location history and IP address)
• Educational information (examples include admissions and graduation history, test scores, and degrees earned)
• Professional or job-related information (like employment history, job title and other employment records)

Hyperswarm operates largely as a blockchain, meaning that the data uploaded to it is immutable, or permanent (for more information, see Section 4 of this Policy). This means that individual nodes on the Hyperswarm network may retain copies of your data, even if you’ve initiated data deletion. Self ID is not responsible for your data on the Hyperswarm network.

SELF ID serves entirely as a conduit of your personal information. We do not control any of your disclosures of personal information to Third Parties in using SELF Products and are not in a position to assist you in the event of your inadvertent disclosure. Your disclosure of such personal information to Third Parties is subject to the privacy policies of such parties, the nature of the services that those Third Parties provide, and such parties are solely responsible for processing your personal information.

We retain personal information we collect from you where we have an ongoing legitimate business need to do so. When we no longer have a legitimate business need to process your personal information, we will either delete or anonymize such data.

• If you elect to receive notifications about SELF Products from us, or subscribe to our newsletter, SELF ID will store the relevant information until you unsubscribe.
• A different personal data retention period may apply in connection with legal claims that could be made against SELF ID. In such circumstances, the personal data will be deleted after the relevant periods have expired or the relevant process has been completed.

Please see Section 4 for additional privacy considerations regarding blockchains.

If you use any Netki, Inc. attestation services, Netki shall retain your data for one (1) year after the issuance of the attestation. At the end of the one (1) year period, Netki, Inc. will automatically delete your data.

Distributed ledger technology, commonly known as “blockchains”, provide you with powerful controls over your personal information. Permissionless blockchains operate on global networks of “nodes”, or servers, that are independently managed according to the blockchain's protocols, or rules. This means that no one party controls the entire system of nodes on which the subject blockchain operates. But, it also means that data you upload to the blockchain can be distributed globally, as the network of nodes is not limited to any one geographic location. Due to this distribution and the permanence of blockchain data, you must be careful when you upload any of your information to a blockchain because it is immutable, meaning it can never be removed. For this reason, when you create a digital wallet using SELF Products, your underlying personal information is not uploaded onto a blockchain, but only pseudonymous information outlined in Section 4.3 below.

SELF Products interact with blockchains through the Multidimensional Identity Protocol (or “MDIP”). MDIP uses blockchain networks as immutable ledgers where the existence of a DID is included in a blockchain transaction. MDIP refers to these peer-to-peer networks as “Registries”. The purpose of the Registry is to witness the existence of a DID at a point in time, and MDIP records the minimal amount of personal information possible, namely the DID itself.

The following data is typically uploaded onto a blockchain when you use SELF Products. This information is pseudonymous, meaning that it can only be attributed to you with the use of additional information that is typically not available in the blockchain itself:

• Your Decentralized Identifiers (“DIDs”), which is a globally unique identifier made up of a string of letters and numbers that act like an identifying address on a verifiable data registry and are independent of any organization.
• Each such DID’s Documents, which are generally the metadata for the DID, and include the verification methods (including your public key).
• Your public key, which is a cryptographic address derived from your digital wallet's private key. It acts as your address on the relevant blockchain.
• Transaction history, which consists of the transaction details regarding your wallet. This includes the DID of the document being certified, blockchain witness signatures, the recipient's public key, and the timestamp of the transaction. This is immutable once added to the blockchain. Digital signatures, which is a recording of your transactions that you have verified using your private key, which only you know.
• Digital signatures, which is a recording of your transactions that you have verified using your private key, which only you know.
• State changes, which reflects any changes in the state of the blockchain ledger, or record. This includes new registrations of your DIDs.

Your personal information is not automatically stored directly on the applicable blockchain. Rather, it is stored in your digital wallet, which is local on your device or in another off chain location that you designate. Always exercise caution when you interact with blockchains as they are immutable, and any data you post cannot be removed.

Pursuant to California law, SELF ID does not have actual knowledge that it sells or shares the personal information of consumers under 16 years of age.

If you are under 13 years of age (or 16 in certain EEA jurisdiction) and any processing by SELF ID of your personal information is based upon consent, consent must be given or authorized by your parent or legal guardian. SELF ID does not knowingly process the information of natural persons below the aforementioned ages, nor does SELF ID direct its Website or any SELF Products to children.

If we are to discover that we are processing information of children below the aforementioned ages without appropriate consent, we will purge said information from our systems

We, and our service providers, use commercially reasonable practices to safeguard and secure your personal information.

SELF Products may contain links to, or integrations with, other products and services providers (“Third-party Websites and Applications”). Where you access or use such Third-party Websites and Applications, be advised that such third-parties maintain their own privacy policies and personal information processing practices. We are not responsible for the information practices of such third parties and encourage you to review those subject policies prior to sharing your personal information.

SELF ID will review and update this Policy periodically and will note the date of its most recent version above. If we make material changes to this Policy, we will notify you either by prominently posting a notice of such changes prior to implementing or directly sending you a notification.

Up until the Effective Date of this Policy, SELF ID has not received any requests from government agencies, including but not limited to the United States Federal Bureau of Investigation (FBI), in the form of a National Security Letter or an order under the Foreign Intelligence Surveillance Act (FISA).

If you have questions or suggestions regarding this Policy, please contact us at privacy@selfid.com