Biometric Data Notice
Specific transparency for optional facial identification and image processing.
Customer-specific agreements, order forms and mandatory law may override these general provisions.
Optional feature
DoorAPI facial identification is optional and is not required for use of the platform. QR codes, RFID, mobile credentials, wallet credentials and other identifiers may be used instead.
Data and operation
Where enabled, a customer may upload a photograph or a configured terminal may capture a webcam image to enable identification. Images may be stored in encrypted object storage and locally on a terminal for fallback operation.
Roles
The customer generally determines whether and why facial identification is used and is responsible for the legal basis, notices, DPIA and alternatives. Doorsecure usually processes the data on the customer’s instructions, but may be controller for a direct Doorsecure-managed Identity journey where it determines the purpose and essential means.
Special-category data
Facial data used for uniquely identifying a person may be biometric special-category data under GDPR. It requires an Article 6 basis and an applicable Article 9 condition.
Retention and rights
Retention is controlled according to customer configuration and agreement. Data subjects should contact the relevant customer for processor deployments or Doorsecure for direct controller processing.