These Sumsub ID User Terms and Conditions (“T&C”), as may be amended by us from time to time, form a legally binding agreement between:
The date you express your consent to be bound by these T&C shall be the “Effective Date”.
Please read these T&C carefully. These T&C include provisions on how you and Sumsub resolve disputes hereunder and the rules may be different depending on your location. These T&C include an agreement to arbitrate. It means that disputes, with limited exceptions, are resolved through binding arbitration by a neutral arbitrator. There is no judge or jury in arbitration, and court review of an arbitration award is limited. This arbitration is mandatory, which means that disputes must go to arbitration and not to court. These T&C also contain a class action waiver. This means that any claims you have against Sumsub are resolved individually and cannot be a part of a class or collective action.
Sumsub is a global provider of identity verification and fraud prevention solutions, which our clients use to facilitate their Know-Your-Customer (“KYC”) processes. At this point, multiple individuals have passed KYC (or may wish to do so) for at least two companies that benefit from our services. To make onboarding easier for both such individuals and those entities (“Participants”) that have acceded to our Sumsub ID Client Terms and Conditions (“Client T&C”), we have introduced Sumsub ID, a feature working as follows:
While initially passing KYC for any Participant, you may be given an option to (i) accede to these T&C or, alternatively, to allow Sumsub to retain either (ii)(a) your email address or phone number or (ii)(b) a “cookie” file associated with you;
If you accept 1(ii)(a) or 1(ii)(b), we will use the corresponding data solely to identify you once you start passing KYC for any other Participant and re-offer the option specified under 1(i);
If you accept 1(i), we will transfer all or some of the personal data you provide to any Participant as part of Sumsub-powered KYC after the Effective Date to a dedicated storage space (“Data Pool Key”) managed and operated by Sumsub (or one of our affiliate entities) and, upon your instructions, use the transferred personal data for Re-Verifications as described below for as long as these T&C are in effect between you and Sumsub;
A Re-Verification consists of the following steps:
(i) once you start passing KYC for any Participant (“Recipient”), we will (a) ask you to provide a verification code sent to your previously validated email address and/or other data allowing Sumsub to reasonably confirm your identity and, subsequently, (b) attempt to locate you on the Data Pool Key;
(ii) if we manage to locate you on the Data Pool Key, we will, upon your confirmation, share with the Recipient whichever of your data is (a) stored on the Data Pool Key at the relevant time and (b) required by the Recipient as per its commercial agreement with Sumsub (or its affiliate);
(iii) if we fail to locate you on the Data Pool Key, you will be requested to complete KYC for the Recipient without a Re-Verification.
Please note that using Sumsub ID does not always guarantee you will be successfully onboarded by any Participant or will not have to undergo additional KYC procedures. This will be determined separately by each Participant at its sole discretion. Likewise, we cannot guarantee any specific number of Participants or that any of our counterparties will be (or remain) a Participant.
Alternatively to the mechanism set out in this section 1, you may also generate a Sumsub ID Account as described in section 2 below at https://id.sumsub.com. In this case, you will be prompted to (i) confirm your email address by providing us with the verification code we will have sent you; and (ii) provide us with your identity document and perform a “liveness check”, with all the corresponding personal data being analyzed by Sumsub for authenticity and subsequently transferred to the Data Pool Key.
By (i) clicking the button “Create Sumsub ID account” or marking the checkbox “Speed up your verifications with Sumsub ID” accompanied with the text “I agree to Sumsub ID Terms” and subsequently providing your personal data to Sumsub; or (ii) otherwise explicitly expressing your consent to be bound by these T&C, you confirm that:
you have read and accepted these T&C. In case you do not fully understand or disagree with any provisions of these T&C, please do not use Sumsub ID;
you are an individual of sufficient age and have full legal capacity as per the laws of the jurisdiction(s) where you reside or maintain citizenship to enter into these T&C personally;
you are entering into these T&C on your own behalf and in your own name.
Once you have accepted these T&C, you will be prompted to confirm your email address by providing us with the verification code we will have sent you. You may subsequently use the same email address to log into your Sumsub ID Account at https://id.sumsub.com.
Your Sumsub ID Account may contain:
(i) the logs of all substantial actions performed in respect thereof and your personal data as recorded by Sumsub, which you can view;
(ii) copies of your identity documents (and other documents, if any) stored on the Data Pool Key at the respective time, which you can instruct us to delete (in that case the corresponding data will also be removed from the Data Pool Key);
(iii) an option to permanently delete your Sumsub ID Account (should you execute it, we will consider these T&C terminated as between you and Sumsub); and
(iv) other relevant information.
In case you no longer wish to use Sumsub ID for any reason, please inform us accordingly as described in section 10 or delete your Sumsub ID Account as set out in section 2. Upon receipt of, respectively, your request or notification of your Sumsub ID Account being deleted, we will consider these T&C terminated as between you and Sumsub with immediate effect and:
unless you explicitly authorize us otherwise, stop using your data (as may be stored on the Data Pool Key at the respective time) for Re-Verifications, starting from the following business day; and
within 3 business days, delete all of your data from the Data Pool Key and not transfer any of your data to the Data Pool Key subsequently (unless you re-enter into these T&C). Please note this will not affect any data processing as may be carried out by Sumsub (i) when such processing is required under the applicable laws and regulations, (ii) for the purposes of product and service development, fraud detection and prevention (including profiling, statistical analysis, and analytics), or (iii) for any Participant under a contractual arrangement other than the Client T&C. In case we have reasonable doubts as to whether you are the actual sender of the request, we may postpone the deletion of your data as described above until we have (in our determination) confirmed your identity.
We do not charge you for your usage of Sumsub ID; in particular, any Re-Verifications are at present paid for by Recipients as specified in the Client T&C.
However, we reserve our right to impose any fees associated with your usage of Sumsub ID (or any of its special features) in the future. We will notify you of our decision to do so: (i) in case the fees are payable for a special feature you were not using before they were imposed – before you have signed up for this feature; (ii) in all other cases – at least 2 calendar months before the fees become effective.
We strive to ensure that you can access and use Sumsub ID without hindrance and at all times whenever you attempt to pass KYC for one of the Participants.
However, Sumsub ID may be occasionally rendered unavailable for undefined periods of time due to scheduled or emergency maintenance, technical disruptions, information security reasons, or other circumstances, including those beyond our control. While we will make efforts to notify you of such unavailability as soon as possible once we become aware of it, we do not guarantee we will always be able to do so and we will not be liable for any consequences resulting from it. Likewise, we do not warrant that Sumsub ID will always be free of errors, malfunctioning, or technical defects or that it will be suitable for your personal purposes.
We may, at any time and without prior notice, issue updates, amendments, or modifications to Sumsub ID or any adjacent functionality (including the introduction or removal of certain features) without any ensuing responsibility or liability; where necessary, such developments will be reflected in these T&C.
We reserve our right to stop providing Sumsub ID altogether (or any constituent parts thereof) for any reason, in which case we will notify you accordingly.
By acceding to these T&C, you agree not to (nor to attempt to):
modify, translate, adapt, merge, make derivative works of, disassemble, decompile, reverse compile, or reverse engineer any part of Sumsub ID or any adjacent functionality;
use Sumsub ID or any adjacent functionality to build similar or competitive technologies, products, or services;
use Sumsub ID or any adjacent functionality for commercial and other non-personal purposes;
license, lease, sell, redistribute, transfer, or otherwise make Sumsub ID (or any adjacent functionality) or your access thereto available to a third party;
remove or conceal any copyright notices or trademarks displayed by Sumsub in connection with your usage of Sumsub ID or any adjacent functionality;
use Sumsub ID or any adjacent functionality in a manner that (i) is non-compliant with any applicable laws or regulations; (ii) infringes Sumsub’s or any third party’s intellectual property rights; (iii) breaches any legal or contractual duty owed to a third party; (iv) constitutes impersonation of another individual or otherwise serves to conceal or disguise your identity; (v) is offensive, threatening, abusive, unethical, deceitful, or otherwise likely to cause harm to another person; (vi) interferes with or compromises its integrity, security, or operability; or (vii) could be reasonably expected to bring Sumsub, its affiliates, or their counterparties into disrepute;
willingly or negligently allow a third party to use or otherwise access Sumsub ID on your behalf or using your credentials;
disclose to a third party any information received from Sumsub that was explicitly designated as “confidential” (or could be reasonably deemed confidential) at the time of receipt without Sumsub’s prior written consent (unless you are under a legal obligation to do so); or
assist or aid a third party in doing any of the above,
while these T&C remain in effect between you and Sumsub and at any time thereafter.
We reserve the right to suspend or terminate your access to and/or usage of Sumsub ID indefinitely or, in our sole determination, for a limited period of time:
with immediate effect – (i) when we know or reasonably believe that you are in breach of any provision of these T&C; or (ii) when you have objected to any changes to these T&C as per section 9; or (iii) when the way you wish to exercise your data subject rights makes us unable to provide you with the full functionality of Sumsub ID as per these T&C or to perform Re-Verifications for Participants using your data as per the Client T&C; or (iv) when, in our reasonable opinion, it is necessary for the protection of the rights, legitimate interests, or business reputation of Sumsub or any third party or mitigation of any risks related to data privacy or information security;
with a prior notice of at least 30 calendar days – at any time and in our sole discretion.
The foregoing does not limit any other rights or remedies we may be legally entitled to. In particular, in case we reasonably believe you are in breach of any applicable law or regulation, we may have to report you to the competent authority or take such other action as we in our discretion consider necessary.
In relation to and for the purpose of providing you with Sumsub ID as described in these T&C, Sumsub processes your personal data as a data controller (as defined in the Regulation (EU) 2016/679, or the “GDPR”). Sumsub ID allows you to:
as described in section 1 of these T&C.
Participants receiving your personal data from Sumsub based on your instructions act as separate and independent data controllers. The processing of your personal data by Participants is not governed by these T&C, and we encourage you to refer to such Participants’ terms of use, privacy notices, and other relevant documentation for more information about how they process your personal data and what the purposes and lawful basis of such processing are.
Sumsub may also process your personal data for the following purposes:
(a) identifying and flagging potentially fraudulent patterns and other signs of suspicious behaviour that could lead to or signal any illicit activity, carrying out profiling and calculating risk scores based on the said factors, and notifying our counterparties in the framework of higher-risk applicant control and alert functionality. Such processing is required to prevent and detect fraud and other illicit activity as part of substantial public interest; it also allows us to safeguard your personal and financial information, ensure that transactions and interactions are legitimate and secure, detect unusual behaviour early, and provide an additional layer of security to our solution overall. Profiling may also be necessary for Participants’ identity verification and fraud prevention activities, so that Participants can comply with their anti-money laundering and other legal obligations;
(b) developing and testing new and existing products and services of Sumsub to (i) improve their functionality as may be required for fraud detection and prevention, including by means of artificial intelligence (e.g. machine learning models), or to (ii) fulfil our commitments under these T&C and provide you with competitive service;
(c) producing anonymised and/or aggregated statistical reports and research; and
(d) producing and storing audit log records and reports based on information security and personal data protection requirements applicable to Sumsub.
By accepting these T&C, you instruct Sumsub:
The categories of personal data to be processed by Sumsub under these T&C are based upon the data categories used by Recipients for their KYC purposes and include at least the following data categories:
The processing of all other personal data categories is optional and based upon your request and type of checks required by Recipient according to their KYC procedure. All categories of personal data that can be processed by Sumsub can be found in the privacy notice available at: https://sumsub.com/privacy-notice.
The lawful basis for processing of your personal data is specified in the table below:
| Purpose of processing | Personal data categories | Legal basis for processing |
|---|---|---|
| Provision of Sumsub ID under the T&Cs | All categories of your personal data that are not special categories of personal data (including without limitation personal data from the ID document and other personal data excluding biometric data) | Necessity for the performance of a contract with you (Article 6 para. 1 letter b) of the GDPR) |
| Provision of Sumsub ID under the T&Cs | Biometric data: facial features, including photos and videos of your face when they are processed as biometric data | Explicit consent (Article 9 para. 2 letter a) of the GDPR) |
| Product and service development | All the categories of your personal data which are not special categories of personal data | Sumsub’s legitimate interests (Article 6 para. 1 letter f) of the GDPR) |
| Product and service development | Biometric data: facial features, including photos and videos of your face when they are processed as biometric data | Substantial public interest (Article 9 para. 2 letter g) of the GDPR) |
| Fraud detection and prevention, including profiling, statistical analysis, and analytics | All the categories of your personal data which are not special categories of personal data (including without limitation personal data from the ID document and other personal data excluding biometric data) | Sumsub’s legitimate interests (Article 6 para. 1 letter f) of the GDPR) |
| Fraud detection and prevention, including profiling, statistical analysis, and analytics | Biometric data: facial features, including photos and videos of your face when they are processed as biometric data | Substantial public interest (Article 9 para. 2 letter g) of the GDPR) |
Consent to the processing of biometric data
Prior to us beginning the processing of your biometric data, you will be asked for your explicit consent to such processing. While the provision of consent is voluntary, Sumsub will not be able to provide you with Sumsub ID without your explicit consent as the nature of Sumsub ID functionality necessarily requires biometric data collection and further processing.
You may withdraw your consent to the processing of biometric personal data by Sumsub at any time by sending a request to the following address: [email protected]. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Upon receiving the withdrawal of your consent to the processing of biometric personal data by Sumsub, we will consider these T&C terminated with immediate effect.
Data sharing with Participants and other third parties
Your personal data will be shared with Recipients only upon your confirmation. Such confirmation is expressed by you selecting Sumsub ID as the verification option while passing KYC for a Recipient and, where applicable, personal data to be shared during the KYC procedure with the respective Recipient.
Sumsub may engage third parties for data processing activities, which include the following categories:
Where it is required by law, Sumsub may also have to provide personal data to the following third parties:
Data retention
Your personal data will be processed by Sumsub for as long as these T&C are in effect between us or until you withdraw your consent for the processing of biometric data. You can also instruct us to delete the data stored (at the respective time) on the Data Pool Key as described in section 2 above. Upon termination of these T&C or the withdrawal of your consent to the processing of biometric data, Sumsub will delete your personal data that was processed for the purposes of providing Sumsub ID as described in section 3 above.
Data subject rights
You have the following rights as a data subject:
To ask Sumsub to execute the rights mentioned above, you should send a free-form email to [email protected]. The information on actions taken in response to any request is provided to you within one month following its receipt. That period may be extended by two further months where necessary, considering the complexity and number of the requests. In this case, we will inform you of any such extension and the underlying reasons within one month of receipt of the request.
Please be kindly aware that when you ask us for the execution of the rights as stated above, we may have to take steps to verify that you are the legitimate data owner and/or authorised to make the request.
Sumsub guarantees that making a request for receiving personal data is free unless a reasonable cost is to be charged where requests are unfounded, excessive, or repetitive in character.
Processing after termination of T&C
Withdrawal of your consent to Sumsub processing your biometric personal data or termination of these T&C will not affect any data processing as may be carried out by the Participants with which your personal data had already been shared by Sumsub upon your request or by Sumsub for the purposes indicated in section 8 (a) - (d), where your personal data is stored according to Sumsub’s retention period.
Nothing in these T&C excludes or limits our liability for: (i) our fraud or fraudulent misrepresentation (meaning we have knowingly made a false statement without belief in its truth or recklessly as to its truth); or (ii) any matter for which the applicable law explicitly prohibits exclusion or limitation of liability.
Other than that, our total aggregate liability to you under these T&C and any collateral contract (regardless of the number of claims or causes of action) shall not exceed 500 EUR. In addition, Sumsub will not, under any circumstances, be liable for:
any consequential damages, however caused, including, without limitation, loss of income, profit, goodwill, or anticipated savings; loss or corruption of data; loss of business; or loss of business opportunity;
any actions of third parties (including, without limitation, Participants) not directly engaged by Sumsub to perform any of its obligations under these T&C.
Please note that you are solely responsible for:
your usage of Sumsub ID and any ensuing consequences;
making informed decisions about entering into a binding arrangement and/or sharing any information with any third party (including, without limitation, any Participant). Please note Sumsub has no control or oversight over such third parties (in particular, the way they handle your personal data or provide you with their products or services, the content of their websites or other resources, etc.), and therefore disclaims all responsibility and liability for their performance or actions in general;
ensuring that any data you provide to Sumsub or any third party (including, without limitation, any Participant) is accurate and up to date.
While we may modify, amend, or otherwise change these T&C from time to time in our sole discretion, we will notify you at least 14 calendar days before the changes are intended to take effect. In case you do not object to the changes as described in section 11, we will assume you have accepted them. Please note that, if you do object, you might not be able to further access or use Sumsub ID as per section 7.
If you have an inquiry or would otherwise like to contact us in relation to these T&C, please email us at [email protected]. In case we have reasonable doubts as to whether you are the actual sender, we may postpone our response until we have (in our determination) confirmed your identity.
Any notices or other messages sent by Sumsub to your email address that you specified immediately upon acceptance of these T&C (or subsequently communicated to us as per this section 11) shall be regarded as properly delivered under these T&C.
Unless as otherwise stated in these T&C, should any provision of these T&C be held invalid or unenforceable for any reason or to any extent, the remaining provisions of these T&C will not be affected, and the application of that provision shall be enforced to the extent permitted by law.
13.1. Governing Law
Unless the local laws of your jurisdiction explicitly prescribe otherwise (to the extent such prescription would override this section 13), the laws of England and Wales govern these T&C and apply to any dispute or claim arising from these T&C or your use of Sumsub ID.
13.2. Class Action Waiver
Where and to the maximum extent permitted under the applicable law, you and Sumsub agree that each may bring claims against the other or its affiliates only in your or its individual capacity and not as a plaintiff or class member in any purported class or representative action. A judge or an arbitrator may not consolidate more than one person’s claims or otherwise preside over any form of representative or class action.
13.3. Arbitration
If you are resident in the United States:
You and Sumsub agree that any dispute or controversy arising out of or in connection with these T&C including, but not limited to, legal and equitable claims, federal and state statutory claims, common law claims, and those based in contract, tort, fraud, misrepresentation or any other legal theory, shall be resolved through binding arbitration on an individual basis (except as specifically noted below).
The arbitration shall be conducted in accordance with the rules of the American Arbitration Association (“AAA”), Consumer Arbitration Rules, in effect on the date of the T&C you are currently bound by and without inclusion of any optional, non-binding, or supplementary rules. Costs of arbitration, including AAA administrative fees, shall be apportioned between you and Sumsub in accordance with the AAA Consumer Arbitration Rules, except where a party brings a claim determined by the arbitrator to be frivolous, in which case the losing party shall pay the costs of arbitration to the successful party.
In agreeing to this binding commitment to arbitrate their claims, you and Sumsub agree to waive any right to proceed in a court of law or to have their claims heard by a jury, except that where your claim is within the jurisdiction of a small claims court, you make file the claim in small claims court.
The arbitration shall: (1) be conducted by a single, neutral arbitrator in the English language; (2) be held virtually and not in person for all proceedings related to the arbitration, except by mutual agreement of all parties; and (3) be limited to one deposition per party, except by mutual agreement of all parties or upon a showing of need. Furthermore, in cases where neither party’s claim(s) or counterclaim(s) exceed $25,000, both parties agree to waive an arbitration hearing and resolve the dispute solely through submissions of documents to the arbitrator.
The AAA Consumer Arbitration Rules, as well as instructions on how to file an arbitration proceeding with the AAA, can be found at the AAA’s website (adr.org). At the time of preparing these Terms, the AAA Consumer Arbitration Rules can be found at https://www.adr.org/sites/default/files/Consumer-Rules-Web_0.pdf. You may also ask Sumsub for a copy of the current AAA Consumer Arbitration Rules.
If you wish to initiate arbitration, Sumsub will accept delivery of the Demand for Arbitration by email at [email protected]. If Sumsub does not have a physical address on file for you, it will send a Demand for Arbitration by email.
Without waiving or otherwise affecting the Class Action Waiver above, if your claim(s) in an arbitration substantially implicate or relate to the rights of, or claims by, other Sumsub counterparties who have also initiated arbitration against Sumsub, you agree that Sumsub shall have the right, but not the obligation, to join or consolidate such arbitrations into a single arbitration, in Sumsub’s sole discretion.
Confidentiality. During the arbitration, the amount of any settlement offer made by you or Sumsub shall not be disclosed to the arbitrator until after the arbitrator makes a final decision and award, if any. All documents and information disclosed in the course of the arbitration shall be kept strictly confidential by the recipient and shall not be used by the recipient for any purpose other than for purposes of the arbitration or the enforcement of the arbitrator’s decision and award and shall not be disclosed except in confidence to persons who have a need to know for such purposes or as required by applicable law.
Delegation. Any dispute between Sumsub and you regarding the construction, interpretation, or application of this arbitration provision, including the enforceability, severability, revocability, scope, or validity of this arbitration provision, shall be decided by an arbitrator and not by a court or judge.
The law governing this arbitration agreement is the law of New York.
If the class action waiver above is found to be unenforceable in arbitration or if any part of this arbitration agreement is found to be invalid or unenforceable, then the entirety of this arbitration agreement shall be null and void and, in such case, the parties agree that the exclusive jurisdiction of the courts of Cyprus. In this case you shall not be prevented from bringing proceedings at any time.
If you are resident anywhere EXCEPT the United States:
Any dispute, controversy or claim arising out of or relating to this contract, including any question regarding its existence, validity or termination and any non-contractual claims, shall be referred to and finally resolved by arbitration in accordance with the UNCITRAL Expedited Arbitration Rules, for the time being in force, which Rules are deemed to be incorporated by reference into this clause.
The arbitration shall be administered by Cyprus Arbitration and Mediation Centre (“CAMC”). The seat, or legal place of arbitration shall be London, England. The appointing authority shall be the Board of Directors of CAMC. The number of arbitrators shall be one. The language to be used in the arbitral proceedings shall be English.
The law governing this arbitration agreement is English law.
For the purposes of arbitration, Sumsub will accept documents by email at [email protected].