# NOTICE TO RESIDENTS OF THE EUROPEAN UNION AND UNITED KINGDOM

ID.me is committed to protecting your Personal Information in its role as a Data Controller of the Personal Information we collect from and about our users. This Notice, in conjunction with the general [ID.me Privacy Policy](https://id.me/privacy), explains how we process, disclose, transfer, and store your Personal Information in accordance with the General Data Protection Regulation (“GDPR”).

Your use of ID.me’s Services demonstrates your review and acceptance of the [ID.me Terms of Service](https://id.me/terms) and [Privacy Policy](https://id.me/privacy).

## 1. Purposes of Processing:  
We collect and process your Personal Information for the following purposes:

- Identity verification  
- Community affiliation verification (e.g., status as a student, veteran, etc.)  
- Detection and prevention of identity theft and fraud on the ID.me platform

## 2. Types of Personal Information ID.me May Collect:  
We may collect the following types of Personal Information:

- First and last name  
- Date of birth  
- Social security number and/or other government issued identification numbers  
- Email address  
- Phone number  
- Mailing address  
- Photographic images (e.g., copy of qualifying government issued identification card)  
- Biometric data (e.g., facial geometry)  
- Community affiliations (e.g., Military, First Responder, Student, Veteran, etc.)  
- Educational degrees  
- Professional certifications  
- Personal preferences.

## 3. Lawful Basis for Processing:  
We rely on the following legal bases for processing your Personal Information:

- Your consent to the processing of your Personal Information for one or more specific purposes.  
- ID.me also maintains a legitimate interest in the processing of the Personal Information of individuals who use, or have previously used, the ID.me platform for verification of identity or group affiliation.

## 4. International Data Transfers:  
ID.me complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF. ID.me has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles with regard to the processing of Personal Information received from the European Union and the United Kingdom.

ID.me may transfer your Personal Information to carefully selected service providers, business partners, and other third parties for the purposes described in the [ID.me Privacy Policy](https://id.me/privacy).

## 5. Data Retention:  
We will retain your Personal Information and account history for up to 3 years following account closure for the detection and prevention of fraud on the ID.me platform.

## 6. Your Rights:  
Under GDPR, you have the right to:

- Access your Personal Information  
- Rectify inaccurate or incomplete Personal Information  
- Erase your Personal Information under certain circumstances  
- Restrict or object to the processing of your Personal Information  
- Access a transferable file of certain Personal Information.

## 7. Withdrawal of Consent:  
You have the right to withdraw your consent at any time by closing your ID.me account.

## 8. Complaints:  
ID.me takes your concerns and rights very seriously. If you believe your rights have been infringed, you have the right to lodge a complaint with the relevant supervisory authority.

## 9. Contact Us:  
If you have any questions or concerns about your Personal Information or this notice, please contact our Data Protection Officer at [privacy@id.me](mailto:privacy@id.me).  
**Corporate Address.**  
ID.me, Inc. 8280 Greensboro Drive, Suite 800 McLean, VA 22102

**For Users and Customers.**  
Member Service Inquiries may be directed to our [support team](https://help.id.me/hc/en-us).

**For Legal Notices.**  
Legal notices may be directed to [legal@id.me](mailto:legal@id.me).