Demo Privacy Notice

This Notice states how Ydentifi processes personal data in the operation of the Demo. It does not apply to any deployment of the Software operated by a customer of Ydentifi.

1. Terms used in this Notice

Ydentifi is Ydentifi Ltd., a company registered in the Republic of Bulgaria under number 208962261, with its registered office at Todor Aleksandrov No. 46, floor 2, 2700 Blagoevgrad.
The Demo is the demonstration of the Software operated by Ydentifi at https://ydentifi.io/demo,

together with the server at demo.ydentifi.io.

The Software is the Ydentifi server software.
The App is the Ydentifi Authenticator application.
A Visitor is an individual who uses the Demo.
A Walkthrough is a session of the Demo started by a Visitor.
GDPR is Regulation (EU) 2016/679. Controller, processor, personal data and

processing carry the meanings given there.

2. Controller

2.1 Ydentifi is the controller of the personal data processed in the operation of the Demo.

2.2 Where a Visitor links the App to the Demo, Ydentifi is the relying party in respect of the account so linked, within the meaning of the licence under which the App is licensed.

2.3 Ydentifi may be contacted in respect of this Notice at privacy@ydentifi.io.

3. Personal data processed

3.1 Walkthrough state. Ydentifi holds the state of each Walkthrough on its server, under a random identifier contained in the address of the page.

3.2 Addresses. Where a Visitor enters an address, Ydentifi's server submits that address to the Nominatim service operated by the OpenStreetMap Foundation in order to locate it. The request is made by Ydentifi's server and contains neither the Visitor's network address nor any other information concerning the Visitor. The Visitor's browser does not contact Nominatim.

3.3 Linking of the App. Where a Visitor links the App to the Demo, the App transmits the identifier assigned by Apple to the App on the Visitor's device, the model of the device, and the public keys generated for the account.

3.4 Responses. Where a Visitor answers a request in the App, the App transmits a signed response stating:

the request answered;
whether the Visitor approved, declined or dismissed it;
that the Visitor confirmed it with Face ID or Touch ID;
whether the device has a passcode and Face ID or Touch ID set up;
whether the App is permitted to use the device's location;
the number entered by the Visitor, where the request called for one;
the reason selected by the Visitor, where the Visitor declined; and
the time on the device at which the Visitor answered.

3.5 Location. Where the Demo requests a location check, the App determines on the device whether the device is within, near or far from the designated area. The response states only that result and the precision of the reading, and never the position of the device.

3.6 Every request made by the App states the version of the App.

3.7 Requests. In serving each request, Ydentifi's server processes the network address from which it is made, the resource requested, and the identifying string supplied by the browser or the App.

4. Purpose and legal basis

4.1 Ydentifi processes the data described in clause 3 solely for the operation of the Demo, on the basis of its legitimate interest in demonstrating the Software to persons who elect to use it, under Article 6(1)(f) of the GDPR.

4.2 Ydentifi does not use that data for marketing, analytics or profiling, and takes no decision based solely on automated processing which produces legal effects for a Visitor.

5. Retention

5.1 A Walkthrough ends one hour after its last activity or six hours after it starts, whichever is earlier. The state of the Walkthrough, the demo accounts created within it, and the data described in clauses 3.3 to 3.5 are then deleted. An account linked in the App remains in the App on the Visitor's device until the Visitor removes it.

5.2 The logs of the Demo's server are deleted seven days after they are made. That period does not run while the Demo is suspended, and logs which exceed it during a suspension are deleted promptly upon resumption.

6. Cookies

The Demo sets no cookies and stores no information in the Visitor's browser.

7. Recipients

7.1 Google, which hosts the Demo within the European Union, processes the data described in clause 3 as Ydentifi's processor.

7.2 The OpenStreetMap Foundation receives the addresses submitted under clause 3.2.

7.3 Ydentifi discloses the data described in clause 3 to no other person and does not sell it.

8. Transfers outside the European Union

8.1 The pages of the Demo are delivered through Google's global network, so that a request may be answered at a location outside the European Union. Any such transfer is made subject to the safeguards required by Chapter V of the GDPR.

8.2 The OpenStreetMap Foundation is established in the United Kingdom, in respect of which the European Commission has adopted an adequacy decision under Article 45 of the GDPR.

9. Rights of the Visitor

9.1 A Visitor may request access to, rectification or erasure of, or restriction of the processing of, personal data concerning the Visitor, and may object to its processing, under Articles 15 to 18 and 21 of the GDPR. Requests should be addressed to privacy@ydentifi.io, and Ydentifi shall respond within one month.

9.2 A Visitor may lodge a complaint with the Commission for Personal Data Protection (КЗЛД) of the Republic of Bulgaria, or with the supervisory authority of the Member State of the Visitor's habitual residence, place of work or place of the alleged infringement.

10. Changes

Changes to this Notice are published on this page, with a new version number and date.