MyFaceGuard is a digital platform that helps organisations manage photos and information related to their use, including sending photo use requests, recording and managing people's choices, and storing and tracking information related to the use of photos.
When an organisation uses MyFaceGuard to manage its photos and the processes related to their use, that organisation usually decides for what purposes and how the personal data of the people concerned are processed. In such cases the organisation is the controller of personal data, and MyFaceGuard processes personal data on its behalf as a processor.
At the same time, in certain cases MyFaceGuard processes personal data for its own specific purposes and acts as a controller, for example when operating User Accounts, providing authentication, keeping the Platform secure and communicating with Users.
This Privacy policy explains when MyFaceGuard acts as a controller and when it processes personal data on behalf of a Client, what personal data we process, why and for how long, to whom the data may be disclosed or transferred, whether they may be transferred outside the European Union and the European Economic Area, and what rights you have regarding the processing of your personal data.
Platform – MyFaceGuard, a digital solution intended for managing photos and information related to their use, available on the website https://www.myfaceguard.com/.
MyFaceGuard – SIA "MyFaceGuard", which operates the Platform and the services available on it.
Terms of use – the MyFaceGuard Platform terms of use, which govern the use of the Platform and the related relationship between MyFaceGuard, the Client and the User.
Client – a natural or legal person in whose name a Client Account has been created and who uses the Platform in accordance with the Platform terms of use.
User – a natural person who has registered on the Platform and uses it in their own name or on behalf of a Client in accordance with the rights granted to them.
Album – a set of photos created in a Client Account in which the Client, using the Platform, manages photos and information related to their use. Each Album has a unique name that describes the set of photos and distinguishes it from other sets of photos created in the Client Account.
Photo use request – a request prepared on the Platform to find out the position of a person shown in a photo on the use of that photo.
Personal data – any information relating to an identified or identifiable natural person.
Data subject – an identified or identifiable natural person to whom the Personal data relate.
Controller – a person or organisation which, alone or jointly with others, determines the purposes and means of the processing of Personal data.
Processor – a person or organisation which processes Personal data on behalf of the Controller.
Processing of personal data – any operation or set of operations performed on Personal data, including collection, recording, organisation, structuring, storage, use, disclosure, transfer, restriction or erasure.
Consent – any freely given, specific, informed and unambiguous indication of the Data subject's wishes regarding a specific processing of Personal data, insofar as that processing is based on the Data subject's Consent.
Biometric data – Personal data obtained on the Platform by technically processing an image of a person's face and determining its characteristic geometric points and other facial features, on the basis of which a mathematical representation of facial features (a biometric template) is created that allows the person to be uniquely distinguished from other people and recognised in photos.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation)¹.
Other terms used in this Privacy policy that are defined in the Platform terms of use have the meaning given to them in the Platform terms of use, unless this Privacy policy provides otherwise.
¹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Available at: http://data.europa.eu/eli/reg/2016/679/oj
This Privacy policy provides information about the processing of Personal data in connection with operating and using the MyFaceGuard website and the Platform.
The most typical situations in which Personal data are processed are when you:
This Privacy policy also covers Personal data that MyFaceGuard processes on behalf of a Client, to the extent needed to explain MyFaceGuard's role and how the Platform works. The purposes, legal basis and other essential conditions of such processing are determined by the Client where the Client is the Controller of that processing.
If you receive a Photo use request from a Client through MyFaceGuard, you should also read the information about the processing of Personal data provided by that Client.
For the processing of Personal data whose purposes and means are determined by MyFaceGuard, the Controller is: SIA "MyFaceGuard" Registration No. 40203708503 Registered address: Kaivas iela 31 k-5 – 117, Riga, LV-1021, Latvia General enquiries: hello@myfaceguard.com Privacy and compliance enquiries: Eva Luksa, compliance@myfaceguard.com
MyFaceGuard usually acts as the Controller for the processing of Personal data needed for:
MyFaceGuard does not always act as the Controller for all Personal data processed on the Platform.
When a Client uses the Platform to manage its photos and related information, the Client is the Controller, because it determines the purposes and means of that processing of Personal data, including deciding which photos are placed on the Platform and for what purposes they are used.
In such cases MyFaceGuard acts as a Processor, insofar as it processes Personal data on behalf of the Client to technically provide the Platform features the Client has chosen and uses.
As the Controller, the Client is responsible for:
The relationship between MyFaceGuard and the Client regarding the processing of Personal data, insofar as MyFaceGuard acts as a Processor, is governed by the Data Processing Agreement provided for in the Terms of use or by other personal data processing terms separately agreed between MyFaceGuard and the Client.
| Data category | What Personal data may be processed | Why we process them | Legal basis | Retention period |
|---|---|---|---|---|
User Account and authentication data Information about the processing of Personal data by eID Easy is available in the eID Easy privacy policy². | First name, last name, email address and, if the User provides it, phone number; User Account identifier, the User's role and link to the Client, account status, settings and preferences, and other information needed to create, manage and authenticate the User Account. The eID Easy solution is used to verify the User's identity and to authenticate the User; through it MyFaceGuard receives the User's first name, last name, personal identification number, country and information about the result of the identity check or authentication. | Verifying the User's identity, creating and managing the User Account, authentication, providing Platform features and Access rights. | Entering into and performing the contract under the Terms of use (GDPR Article 6(1)(b)); MyFaceGuard's legitimate interests (GDPR Article 6(1)(f)) — keeping the Platform and the User Account secure, verifying the User's identity and preventing unauthorised access. | User Account data are kept while the User Account is active and for up to 12 months after it is deleted or deactivated, unless longer retention is needed to comply with a legal obligation or to establish, exercise or defend legal claims. Data processed by eID Easy during identity verification and authentication are kept in line with the retention periods applied by eID Easy. |
Communication data | First name, last name, email address, optional phone number, name of the Client or organisation, content of the communication, time and history of the communication, submitted documents or other attachments. | Answering questions and requests, providing information and enabling communication. | Depending on the situation — entering into or performing a contract (GDPR Article 6(1)(b)), a legal obligation (GDPR Article 6(1)(c)) or MyFaceGuard's legitimate interests (GDPR Article 6(1)(f)) in enabling communication. | Until the matter is resolved and for 12 months after the last communication about it. Data may be kept longer if needed to comply with a legal obligation or to establish, exercise or defend legal claims. |
Biometric data Information about the Amazon Rekognition solution used to process Biometric data, and about its processing of personal data, is available in the Amazon Web Services (AWS) documentation³. | Biometric data obtained by technically processing an image of a face and creating a mathematical representation of the face (a biometric template). | Providing the Biometric search feature to help the User find photos in an Album in which they may appear. | Consent (GDPR Article 6(1)(a) and Article 9(2)(a)). | Biometric data are kept for as long as the User uses the Biometric search feature and their Consent to the processing of Biometric data remains valid. If the User withdraws Consent or stops using the Biometric search feature, the Biometric data are deleted, unless there is another legal basis for keeping them. |
Technical support data | First name, last name, email address, optional phone number, information about the User Account, a description of the technical problem or request, screenshots, technical and error logs, information about actions on the Platform related to the matter, communication history, and documents and other attachments submitted by the User, insofar as they are needed to provide technical support. | Providing technical support, identifying and fixing problems, ensuring the quality and security of the Platform. | Performance of the contract (GDPR Article 6(1)(b)); MyFaceGuard's legitimate interests (GDPR Article 6(1)(f)) in keeping the Platform operational and secure. | Until the support matter is resolved and for 24 months after it is closed, unless longer retention is needed to comply with a legal obligation or to establish, exercise or defend legal claims. |
Technical, security and audit data | IP address, sign-in and authentication events, device and browser information, action timestamps, access and audit logs, error and diagnostic records, information about security incidents and possible breaches of the Platform's terms of use. | Protecting the Platform and Personal data, identifying and preventing unauthorised access and misuse, investigating incidents and ensuring the integrity of the Platform. | MyFaceGuard's legitimate interests (GDPR Article 6(1)(f)) in keeping the Platform, Users and Personal data secure; a legal obligation (GDPR Article 6(1)(c)), where applicable. | Depending on the type of technical record – usually 6 to 24 months. Some data may be kept longer if needed to investigate a security incident, comply with a legal obligation or establish, exercise or defend legal claims. |
Service communication data | Email address, User Account identification information, the content of the notice and information about its sending/delivery. | Sending notices about the User Account, authentication, security, Access rights, material changes to the Platform or the terms, and the operation of the Platform. | Performance of the contract (GDPR Article 6(1)(b)); MyFaceGuard's legitimate interests (GDPR Article 6(1)(f)) in a secure and working Platform; a legal obligation (GDPR Article 6(1)(c)), where applicable. | Until the matter is resolved and for 24 months after the last communication about it, unless longer retention is needed to comply with a legal obligation or to establish, exercise or defend legal claims. |
Payment and billing data Information about the Stripe solution used for payment processing, and about Stripe's processing of Personal data, is available in the Stripe privacy policy⁴. | Information about the Client, the invoice and the payment made, including first name, last name or company name, email address, billing address, invoice details, payment amount and currency, payment date and status, transaction identifier, and other information needed for payments, billing and accounting. Payments are processed using the Stripe payment solution. Depending on the payment method chosen, Stripe may also process payment instrument details, such as payment card or bank account data, and other information needed to make the payment, for authentication and to prevent fraud. | Administering payments, preparing invoices, meeting accounting and tax obligations. | Performance of the contract (GDPR Article 6(1)(b)) and a legal obligation (GDPR Article 6(1)(c)). | Data needed to process payments and billing are kept for as long as needed for that payment and billing. Accounting records and records evidencing transactions are kept for the period required by law, which, depending on the type of document, may be at least 5 years. Some data may be kept longer if needed to comply with a legal obligation or to establish, exercise or defend legal claims. Retention periods for data processed by Stripe are set by Stripe in line with the legal and regulatory requirements that apply to it. |
Marketing data | Email address, name if provided, marketing preferences and information about giving or withdrawing Consent. | Sending MyFaceGuard news, product information and other marketing communication. | Consent (GDPR Article 6(1)(a)) or another basis permitted by applicable law. | Until Consent is withdrawn or another legal basis for the processing ends. Minimal information about the opt-out may be kept to make sure it is respected. |
Cookies Further information is available on the Platform and may be updated or changed. | Depends on the type of cookie. Information is available on the Platform, and a general explanation is in section 8 of this Privacy policy. | Necessary cookies – to operate the Platform, keep it secure, authenticate users and maintain user sessions. Functional cookies – to provide additional features and to save user choices and personalisation settings. Analytics / statistics cookies – to compile usage statistics, analyse visits and user interaction, and assess and improve how the service works. Marketing cookies – for advertising and marketing purposes, including user profiling, measuring advertising effectiveness and tracking user activity on other websites. | Depends on the type of cookie. Necessary – performance of the contract or MyFaceGuard's legitimate interests (GDPR Article 6(1)(b) or (f)), depending on the purpose of the cookie. Functional, analytics, marketing – consent (GDPR Article 6(1)(a)). | In line with the configuration of the specific technology and the User's choices. |
Information about the processing of Personal data by eID Easy is available in the eID Easy privacy policy².
Information about the Amazon Rekognition solution used to process Biometric data, and about its processing of personal data, is available in the Amazon Web Services (AWS) documentation³.
Information about the Stripe solution used for payment processing, and about Stripe's processing of Personal data, is available in the Stripe privacy policy⁴.
Further information is available on the Platform and may be updated or changed.
² eID Easy OÜ – a company registered in Estonia. Privacy policy: https://www.eideasy.com/legal/privacy-policy
³ Amazon Rekognition overview – https://aws.amazon.com/rekognition/ Data protection in Amazon Rekognition – https://docs.aws.amazon.com/rekognition/latest/dg/data-protection.html
⁴ Stripe Payments Europe, Limited – a company registered in Ireland. Privacy policy: https://stripe.com/en-lv/privacy
By using the Platform and its features, a Client may place Personal data on the Platform and initiate further processing of them. MyFaceGuard, as a Processor, processes such Client data on behalf of the Client to provide the Platform features the Client has chosen and uses. Depending on the Platform features used, Client data may include:
As the Controller, the Client determines the purposes and the applicable legal basis for processing Client data and is responsible for the lawfulness of that processing, including informing Data subjects and meeting other data protection requirements that apply to the Client as the Controller.
As a Processor, MyFaceGuard processes Client data on behalf of the Client and only to the extent and in the way needed to provide the Platform features the Client has chosen and uses.
The Platform may offer an optional Biometric search feature that lets a User, using Biometric data, find photos in which the User may appear.
Biometric search is carried out only in Albums to which the Client has given the User access.
If the User chooses to use the Biometric search feature, the Platform processes the User's facial image and its features to create a biometric representation of facial features and compare it with the facial features found in the photos in the Album.
As a result of this processing, the Platform may automatically select photos in which the User may potentially appear.
The Biometric search feature is voluntary. The User is not required to activate it, and declining to use it does not limit the availability of other Platform features that do not depend on the use of Biometric data.
Before the Biometric search feature is activated, the User is given information about the processing of Biometric data and is asked for Consent to the processing of Biometric data to provide the Biometric search feature.
Where Biometric data are processed for the purpose of uniquely identifying a person, the GDPR requirements for processing special categories of Personal data apply.
The result of automated photo selection is a technical estimate and not a final confirmation of a person's identity. A photo may be selected by mistake, or a photo in which the User actually appears may not be selected. The User can review the selected photos, confirm that they appear in them, or reject photos selected by mistake.
Using the User's Biometric data, the Platform performs automated analysis and selection of photos to find photos in which the User may appear. The result of automated selection is not final, and the User can review the selected photos, confirm that they appear in them, or reject photos selected by mistake.
Depending on how the Platform is used, MyFaceGuard may obtain Personal data:
Where Personal data have been placed on the Platform by a Client, information about the original source of the data and the legal basis for the processing is primarily provided by the Client as the Controller.
MyFaceGuard may disclose Personal data to third parties only to the extent needed to achieve the purpose of the processing or to comply with a legal obligation.
Depending on the Platform infrastructure and features used, recipients of Personal data may include:
Personal data are disclosed to service providers only to the extent needed to provide the relevant service and, where required, appropriate data protection obligations are set.
MyFaceGuard does not use photos placed on the Platform by a Client, or the related Personal data, for its own advertising or marketing purposes, unless there is a separate legal basis for such processing.
Personal data, including their storage, are processed within the Platform in the territory of the European Union (EU) and the European Economic Area (EEA). Processing of Personal data outside the EU/EEA is not currently planned.
If in the future Personal data are transferred or otherwise processed outside the EU/EEA, MyFaceGuard will ensure that such processing and transfer comply with the GDPR by using an appropriate transfer mechanism, for example a European Commission adequacy decision or standard contractual clauses approved by the European Commission, and, where needed, by applying additional safeguards.
MyFaceGuard keeps Personal data only for as long as needed to achieve the purpose of the processing, in line with applicable law. The retention periods for specific categories of Personal data, or the criteria for determining them, are set out in section 5 of this Privacy policy.
When setting the retention period for Personal data, MyFaceGuard takes into account the type and volume of the Personal data, the purpose of the processing, applicable legal obligations, possible risks to the Data subject, and the need to protect the rights and legitimate interests of MyFaceGuard or other persons.
Personal data may be kept longer than the period stated in section 5 of this Privacy policy if there is another legal basis and a defined purpose for keeping them, including where retention is needed to comply with a legal obligation or to protect MyFaceGuard's rights and legitimate interests.
When the retention period ends, Personal data are deleted or anonymised. Technical deletion or anonymisation of Personal data is completed no later than one month after the end of the retention period.
Personal data that MyFaceGuard processes on behalf of a Client are kept and managed according to the Platform features and settings chosen by the Client, which, depending on the features chosen, may also provide automated retention and deletion of Personal data. The Client is responsible for choosing retention periods that match the purpose of the processing, applicable law and the storage limitation principle, ensuring that Personal data are not kept longer than needed to achieve the purpose of the processing, unless there is another legal basis for longer retention.
Deleting a User Account does not always mean that all Personal data related to the User are deleted. Processing of certain Personal data may continue after the User Account is deleted if there is another legal basis for it, for example where retention is needed to comply with a legal obligation or to establish, exercise or defend legal claims. Deleting an account also does not affect Personal data that MyFaceGuard continues to process on behalf of a Client according to the Platform features and settings chosen by the Client.
MyFaceGuard applies appropriate technical and organisational measures to protect Personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Depending on the nature of the Personal data and the processing, such measures may include access control, role-based Access rights, authentication, activity logs, encryption, backups, incident management measures and other information security solutions.
Access to Personal data is given only to persons who need it to perform their duties.
No information system can fully exclude all security risks. MyFaceGuard regularly reviews and, where needed, improves the Platform's security measures.
Under the GDPR and other applicable law, depending on the specific processing of Personal data, you may have the right to:
Withdrawing Consent does not affect the lawfulness of processing based on Consent before its withdrawal.
Data subject rights are not absolute and may be restricted in the cases provided for by the GDPR or other applicable law.
Where MyFaceGuard is the Controller of the processing of your Personal data, you can send a request to exercise your rights to: compliance@myfaceguard.com.
To protect Personal data against unauthorised disclosure, MyFaceGuard may ask for information needed to verify the identity of the person making the request.
MyFaceGuard responds to a Data subject's request without undue delay and within the period set by the GDPR. If the request is complex or a large number of requests has been received, the period may be extended as provided for by the GDPR.
Where MyFaceGuard processes the Personal data concerned on behalf of a Client as a Processor, you should primarily contact that Client as the Controller to exercise your rights. MyFaceGuard helps the Client respond to Data subjects' requests in line with the applicable data processing terms.
If it is not clear which Client is the Controller of the processing, you can contact MyFaceGuard, and we will, as far as possible and legally permitted, help identify the Controller or forward the request to the appropriate person.
Where the processing of Personal data by MyFaceGuard is based on your Consent, you can withdraw it at any time using the option provided for the relevant feature or by contacting MyFaceGuard.
Where Consent has been given to a Client in connection with the Client's use of a photo, to withdraw Consent or change your choice you should contact that Client or use the feature available on the Platform, if it allows the choice to be changed.
A change of a User's choice on the Platform does not in itself mean that MyFaceGuard is the Controller for the further use of the photo. The Client is responsible for taking the necessary action in line with the legal basis for the processing of Personal data.
Automated technical processes may be used to operate the Platform and provide its features, including for processing and organising information, recording actions and statuses, and automatically performing certain Platform functions. The use of such processes does not in itself mean automated decision-making about Users.
One type of automated processing of Personal data used on the Platform is the processing of Biometric data and automated photo selection, where the User chooses to use the Biometric search feature. More information about the conditions of such processing and the choices available to the User is given in section 7 "Biometric data and automated photo selection".
MyFaceGuard does not make decisions based solely on automated processing of Personal data that produce legal effects for the User or similarly significantly affect them. If such automated decision-making is carried out on the Platform, the User is informed accordingly and the applicable GDPR requirements and safeguards are respected, including, where applicable, human involvement in reviewing the decision and the User's opportunity to express their point of view or contest the decision, so that the result of automated processing is not the only basis for a decision that significantly affects the User.
The Platform is intended for Users who are at least 18 years old.
This does not prevent a Client from processing photos on the Platform that show minors, where the Client has an appropriate legal basis and all requirements that apply to such processing are met.
Where a Client processes Personal data of minors on the Platform, the Client as the Controller is responsible for the lawfulness of such processing, determining an appropriate legal basis, providing the necessary information and, where needed, obtaining the Consent of a legal representative or another required confirmation.
If you have questions or concerns about the processing of Personal data by MyFaceGuard, please contact MyFaceGuard first: compliance@myfaceguard.com.
If you have concerns about the processing of your Personal data or believe it does not comply with applicable data protection requirements, you have the right to lodge a complaint with the competent data protection supervisory authority, in particular in the EU/EEA country where you live or work or where the alleged infringement took place.
The competent data protection supervisory authority in Latvia: Data State Inspectorate (Datu valsts inspekcija) Elijas iela 17, Riga, LV-1050, Latvia Email: pasts@dvi.gov.lv Phone: +371 67223131
Information about data protection supervisory authorities in other EU/EEA countries and their contact details is available on the website of the European Data Protection Board (EDPB): https://www.edpb.europa.eu/about-edpb/our-members_en.
MyFaceGuard may amend this Privacy policy where needed because of changes to the Platform or its features, changes to the processing of Personal data, legal requirements, security considerations or other justified reasons.
The current version of the Privacy policy and the date of its last update are published on the MyFaceGuard website and/or the Platform.
MyFaceGuard informs Users about changes to the Privacy policy using one or more suitable means of communication, including publishing information on the Platform, sending it to the email address the User has provided for communication, or using another means of communication provided on the Platform.
For questions about this Privacy policy, the processing of Personal data or exercising Data subject rights, please contact: SIA "MyFaceGuard" Registration No. 40203708503 Kaivas iela 31 k-5 – 117, Riga, LV-1021, Latvia Privacy and personal data protection enquiries: compliance@myfaceguard.com
All versions of this document, with the dates they took effect.
Updated: 16.09.2026.
MyFaceGuard helps organisations and other clients manage photo-use requests and people’s responses. The client determines the purposes and legal basis for processing its photos. MyFaceGuard provides the platform and processes data on the client’s behalf in line with its documented instructions.
Managing your individual account, identity verification, optional biometric search and the decision about photo use are separate actions. Creating an account, signing in or recognising yourself in a photo is not, in itself, permission to publish the photo.
You can write to compliance@myfaceguard.com about your data and your rights even if you have no account or no longer have access to one.
The platform is provided by MyFaceGuard, SIA, registration No. 40203708503, registered address: Kaivas iela 31 k-5 - 117, Riga, LV-1021, Latvia.
General enquiries: hello@myfaceguard.com. Technical support: support@myfaceguard.com. Privacy and data protection matters: compliance@myfaceguard.com.
This policy applies to website visitors, users, client representatives, recipients of photo-use requests and other people whose data is processed on the platform. It explains how data is processed; reading the policy is not a general consent to all processing purposes.
MyFaceGuard is the controller for processing whose purposes and essential means we determine ourselves: administering individual accounts, the identity verification we provide, managing the biometric template of an individual profile, website operation, security, communication, marketing and compliance with our own legal obligations.
The client is the controller to the extent it determines the purposes and means of processing its albums, contacts, photo-use requests and responses. MyFaceGuard stores and manages that data on the client’s behalf as a processor, under a data processing agreement and the client’s documented instructions. The role in any specific processing is determined by the actual circumstances.
The client is responsible for the lawfulness of uploading photos, granting access and any further use, for informing the people concerned and for an appropriate retention period. This policy does not replace the privacy information provided by the client. If a client acts on behalf of another controller, it must have the corresponding authorisation and contractual arrangements in place.
The client’s administrators and editors act on the client’s behalf within their access rights. These roles do not give the right to access another person’s individual account or to make decisions about the use of that person’s photos.
From you we receive registration and profile information, contact details, settings, responses to requests, support correspondence and, if you choose biometric search, the face photos you submit for it.
From the client or its authorised users we receive album photos, contacts including imported contact lists, event information, request purposes, channels, deadlines and the access rights granted. Receiving a request does not mean that you are a registered user or that you are necessarily shown in the photo.
From authentication and identity verification services we receive the information needed to carry out the particular sign-in or verification.
Technical data and an activity history arise on the platform: sign-in and security events, IP address, device and browser information, the time of requests and responses, statuses, changes and withdrawals. During biometric search, a face template and possible match results are generated.
If your contact details were submitted by a client, that client provides the information about their origin and the basis for the specific request. MyFaceGuard helps you find out which client sent the request.
To create an account, authenticate you, store settings and provide the core functions you request, we process account and access data in order to perform the contract with the user — Article 6(1)(b) of the General Data Protection Regulation (GDPR). The mandatory fields in registration are necessary to create the account; without them we cannot provide the relevant function. Additional profile fields are voluntary.
We respond to your pre-contractual enquiry on the basis of Article 6(1)(b) GDPR. For general business communication and communication with client representatives we rely on our legitimate interest in maintaining and administering client relationships — point (f). A contract with a legal entity is not, in itself, a basis under point (b) for processing the data of all its employees.
To provide support we use your correspondence and the technical data needed to resolve the issue: to perform the contract or on our legitimate interest in keeping the service running. We process security events and logs on our legitimate interest in preventing unauthorised access, fraud and incidents, assessing the impact on your rights.
Data needed to comply with legal obligations, such as accounting requirements and data subject requests, is processed under Article 6(1)(c) GDPR. We may keep the limited information required to establish or defend specific legal claims on the basis of legitimate interests.
We send newsletters and optional marketing messages with your consent — point (a). You can opt out through the unsubscribe link in each message. Opting out does not affect your account or the necessary service notifications.
Biometric search requires separate, explicit consent — Article 6(1)(a) and Article 9(2)(a) GDPR. Its conditions are described in section 7.
Signing in with an email address or an available external account, such as Google or Microsoft, gives access to the account. Such a sign-in is not, in itself, equivalent to verifying a person’s identity with an electronic identification means.
For identity verification we use eID Easy and the electronic identification service you choose. Depending on the method and the scope of the check, identity attributes are processed, such as first name, surname, personal identifier, as well as the verification result, time and transaction reference. The exact amount of data is determined by the chosen method and by what the verification requires.
The purpose of this processing is to link platform activity to a verified person. The basis is the performance of the identity verification service provided to the user; for fraud prevention measures it is our legitimate interest in providing a trustworthy service. If a required verification is not completed, the function that depends on it may be unavailable. This does not remove your right to contact the controller and exercise your data protection rights.
The retention period of the identity service is not the retention period of the verification record kept by MyFaceGuard. We keep the necessary verification evidence for the traceability of the account and its activity in accordance with section 10.
The client determines which photos it wants to use, for what purpose, in which channels and for how long. The platform records the request, your response and the history of changes to it.
Confirming “This is me” concerns whether the person in the photo is you. Permission to use the photo is a separate decision. Not responding, creating an account or consenting to face recognition is not permission to use a photo.
If the use is based on consent, you can withdraw it on the platform or by contacting the client. Withdrawal does not affect processing carried out lawfully beforehand. The client must stop any further use based on the withdrawn consent and assess the deletion steps required.
If the client relies on another legal basis, such as legitimate interests, it informs you of that basis and assesses your objection in line with the applicable requirements. The response status on the platform does not, in itself, determine the lawfulness of the processing.
MyFaceGuard records your decision; changing it does not, in itself, delete photos on the client’s website, on social networks, in printed materials or in other systems. The relevant controller is responsible for the follow-up actions.
The client’s authorised users can see the request, the response linked to the person, the status and the necessary history of changes in line with their access rights. Other album users may be able to see photos according to the album access settings, including where several people appear in them.
If a client asks its own employee for consent, it must ensure a genuinely free choice. Refusing or withdrawing consent must not lead to detriment in the employment relationship; the validity of consent has to be assessed in the light of the employer–employee relationship.
Biometric search helps find photos in which you may appear. It is an optional feature. Without it you can still use the functions available to you that do not require biometric data.
The face photos submitted for this feature are used to create a face template — a mathematical representation of facial features. The template is compared with the face data technically derived from the photos in the relevant album. The result is a prediction of a possible match, not an infallible proof of identity. You can review the result and indicate that the person in the photo is not you.
Separate, explicit consent is required before biometric data is processed. Accepting the terms of use does not replace it. Consent covers the stated search purpose and scope; it does not allow a client to use your biometric data for other purposes. Where permission is requested for a search in a specific client’s albums, you manage that separately from storing the face template.
The original photos submitted to create the biometric template are deleted after processing. This does not apply to photos uploaded to a client’s album. The stored biometric template is protected with encryption and access restrictions; it is not anonymous information.
You can withdraw biometric consent and request deletion of the template in your profile settings or by writing to compliance@myfaceguard.com. Withdrawal stops any further search based on that consent. Deletion of the template must also be ensured at the biometric processing service provider involved. A minimal record of the fact of consent and withdrawal may be kept as evidence, without keeping the template itself for that purpose.
Withdrawing biometric consent does not, in itself, change your responses about photo use; those are managed separately. Likewise, withdrawing permission to use a photo is not, in itself, deletion of the face template.
One person’s consent does not cover the processing of the biometric data of other people appearing in an album. Processing for album searches must have an appropriate legal basis in respect of every person whose data is processed. Transient technical processing is also processing.
MyFaceGuard does not use client photos, responses or biometric templates for its own marketing or for purposes unrelated to providing the requested service.
Data is received, to the extent necessary, by the client’s authorised users, our authorised staff and service providers: cloud infrastructure and storage providers, including AWS; the biometric search provider AWS Rekognition; the identity verification provider eID Easy and the provider of the chosen identification means; authentication, email delivery, including Brevo, and technical support providers.
Depending on your choices, data may be shared with cookie management, analytics and advertising services. Where necessary, data is received by legal and accounting advisers or by competent authorities on the basis of a lawful request.
We apply data protection and confidentiality terms to processors. Some identity, sign-in or other service providers may act as independent controllers for their own purposes; their privacy information applies to that processing.
We do not sell personal data. You can request information about the recipients involved in a specific processing activity at compliance@myfaceguard.com.
Platform photos and related platform data are stored in the European Union. AWS infrastructure in Europe is used to provide biometric processing.
Storage in Europe does not, in itself, rule out access by a recipient or its support staff from a country outside the European Economic Area (EEA). Some authentication, communication, analytics or advertising services may involve international transfers.
A transfer outside the EEA requires an applicable legal mechanism, such as a European Commission adequacy decision or standard contractual clauses with the necessary supplementary safeguards. Information about the specific mechanism and a copy of the applicable safeguards can be requested at compliance@myfaceguard.com.
We set retention periods according to the purpose of the data and what is necessary:
Account deletion is permanent. Signing in again does not restore a deleted account, and no 12-month account recovery period applies.
Deleting an individual account does not, in itself, mean deleting all photos and decision history held by a client. A client may keep the necessary evidence of a decision and its withdrawal only where it has a separately justified need, a legal basis and a limited period. Keeping evidence does not give permission to continue using a photo after consent has been withdrawn.
Data may remain in backups until the end of the relevant backup rotation cycle, with restricted access. Backups are not intended for day-to-day use of a deleted account or for continuing a biometric search that has been withdrawn. We inform you in our reply to a request about the deletion applicable to it and any retention exceptions.
Closing a client account and deleting an individual account are different actions. Save the information you need before you lose access.
We use the cookies necessary for the website to work in order to provide core functions. We use optional analytics and advertising technologies with your consent. You can change your choices in the cookie management tool.
Detailed information about the tools, recipients and periods is in the cookie policy and the declaration. They may include Cookiebot, Google Analytics, Google Ads and Meta tools, depending on the services activated and your choices.
Account security messages, email verification and photo-use requests sent on a client’s behalf are not MyFaceGuard newsletters. A marketing subscription is not a condition for receiving these service notifications.
Subject to the conditions of the specific processing, you can request access to your data and a copy of it, rectification, erasure, restriction of processing and data portability. Portability applies to data you have provided that is processed by automated means, where the basis is consent or a contract.
You can withdraw consent at any time. You can object to processing based on legitimate interests, stating the grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons.
Write to compliance@myfaceguard.com. If a request concerns data controlled by a client, we will help direct it to that client and provide the necessary support. Creating an account is not a condition for exercising your rights.
We reply without undue delay and no later than one month after receiving the request. Because of complexity or the number of requests, the period may be extended by a further two months; we notify you of that and of the reasons within the first month.
We ask for additional identity information only where there are reasonable doubts about the requester’s identity, and to a proportionate extent. Requests are generally free of charge. A refusal or a fee may be justified only on the conditions provided for in applicable law.
Automation helps shortlist possible photo matches, manage requests and record statuses. Face comparison can be wrong. A technical match is not, in itself, a decision to publish.
MyFaceGuard does not take decisions based solely on automated processing that have legal or similarly significant effects on a person. The client is responsible for its photo-use decisions.
Under the terms of use, individual accounts are intended for people aged 18 and over. This does not mean that minors cannot appear in a client’s photos. The client must ensure the lawfulness of processing their data and the necessary representation; an adult user’s account does not automatically give the right to decide on behalf of another person. Report any possible unauthorised processing of a child’s data to compliance@myfaceguard.com.
We use technical and organisational safeguards appropriate to the risk of the processing, including access control, separation of roles, encryption and activity logs. Access to data is granted only to the extent necessary. A service provider’s certification does not, in itself, mean that MyFaceGuard is certified against the same standards.
If you suspect unauthorised access to an account or a personal data breach, contact support@myfaceguard.com or compliance@myfaceguard.com.
You can contact us about any data protection matter. You have the right to lodge a complaint with the Latvian Data State Inspectorate (www.dvi.gov.lv) or another competent EEA supervisory authority, including in the country of your habitual residence, place of work or the place of the alleged infringement. Contacting us first is not a precondition for a complaint.
The current version and the date it was updated are available on this page. We inform you of material changes in an appropriate way before the relevant new processing starts. Updating the policy does not, in itself, extend the scope of consent given earlier; where new processing requires consent, we ask for it separately.