Privacy Notice

iProov Limited acts as a data processor under Article 28 of the UK GDPR and EU GDPR. Your organisation is the data controller — you decide which employees are managed through the Workforce service and what actions administrators take. We process personal data solely on your documented instructions.

For the portal's own operational data (session management, analytics, security logs), iProov acts as data controller with your organisation's administrators as the data subjects.

The portal is a browser-based management interface. It collects a small amount of data to keep you signed in and to help us improve the service.

Session data

When you sign in, we create a server-side session containing your Microsoft Entra ID identifiers (an opaque user ID and tenant ID), your display name, and your email address. This data is held in an encrypted server-side cache for up to 90 days and is deleted immediately when you sign out. Authentication tokens are stored server-side only — they never reach your browser.

Analytics (optional)

If you accept analytics cookies, we collect anonymous usage data — page views, navigation patterns, and performance metrics. This data is identified only by opaque identifiers, never by name or email. You can accept or reject analytics at any time; the portal works identically either way.

The Workforce API reads the following fields from your Microsoft Entra ID directory on each request. This data is streamed directly to the portal for display and is never stored in any database, cache, or log:

• Display name
• Email address
• User principal name
• Job title and department
• Account status (enabled or disabled)
• Profile photo (thumbnail)
• Assigned licence plans

Profile photos are used for display purposes only and are not used for biometric identification. We do not access passwords, sign-in activity, mailbox contents, calendar data, or device information.

When your organisation onboards, you select a deployment region. All persistent data for your tenancy — including the session cache, telemetry, and API-side metadata — stays in that region. The portal and API infrastructure are deployed per region with no cross-region data flow.

Authentication uses Microsoft Entra ID, and directory reads use Microsoft Graph. These services are operated by Microsoft under the Microsoft Products and Services Data Processing Addendum, which incorporates EU Standard Contractual Clauses and the UK International Data Transfer Agreement addendum.

Session data is retained for up to 90 days of inactivity and deleted immediately on sign-out. Analytics telemetry is retained according to the retention settings configured for your region. User-profile data from your directory (names, emails, job titles) is never stored — it is streamed on each request and discarded. API-side tenant metadata is retained until your organisation offboards. API key escrow is purged on key rotation or offboarding.

The portal uses a small number of cookies — most are strictly necessary for security and personalisation. Analytics cookies are set only with your explicit consent. We do not use any third-party trackers, advertising pixels, or social media widgets. Full details are on our cookie policy page.

All data is encrypted in transit and at rest. Authentication tokens are held in an encrypted server-side cache. The portal is hardened against common web-based attacks, and your session cannot be used by a third party. API keys are stored securely and cannot be retrieved after initial creation. Your tenant's data remains completely isolated from other organisations.

Both the portal and the API use Microsoft Azure services to operate. All sub-processors are Microsoft Corporation services governed by the Microsoft Products and Services Data Processing Addendum. These cover session caching, tenant metadata storage, key escrow, telemetry, hosting, authentication (Microsoft Entra ID), and directory access (Microsoft Graph). Each service is deployed in your selected region except Entra ID and Graph, which operate on Microsoft's global infrastructure.

Under UK and EU data protection law, you have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — your profile data originates in your Entra ID directory. To correct it, update it there; the portal reflects changes on your next sign-in.
• Erasure — signing out immediately deletes your session. Pseudonymous telemetry data can be purged on request.
• Restriction — request that we limit processing while a concern is resolved.
• Portability — your data originates in your directory, which you control. We do not create a secondary copy.
• Objection — you may object to processing based on legitimate interest (operational telemetry). You can withdraw analytics consent at any time.

To exercise any of these rights, contact us at the address below or speak to your organisation's data protection officer for directory data.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK, or the relevant supervisory authority in your jurisdiction.

If we become aware of a personal data breach affecting your data, we will notify your organisation without undue delay so you can fulfil your own obligations under Articles 33 and 34 of the GDPR. Our notification will include the nature of the breach, the categories of data affected, and the measures taken or proposed.

For data protection inquiries related to the Workforce service: iProov Limited, [DPO contact email], [Registered address]. For general data protection inquiries about iProov: [privacy@iproov.com].