Data classes
The architecture distinguishes identity attributes, document images/data, chip/eID data, biometric media, templates/features, match/PAD results, transaction metadata and evidence. It does not assume every artefact is stored.
CHECKID · TRUST
Personal Data Protection
Control identity and biometric data by purpose and applicable policy.
TECHNICAL REFERENCE
Data protection architecture: data classes, purpose and lifecycle
Collection → classification → purpose → access/share → retention → deletion/audit
Purpose boundary
Collection/use is bound to proofing, verification, authentication, identification or the relevant business purpose. Data used for one-off verification is not assumed to be reusable for enrollment.
Roles
Controller/processor or equivalent contractual roles depend on the deployment/service agreement. Public documentation does not assign a universal legal role without an approved policy source.
Access and sharing
Internal access, relying-party access and authoritative-source exchanges follow role/purpose. The public site does not expose secrets or internal access topology.
Retention and deletion
Raw media, templates, transactions, evidence and audit artefacts can have different retention. The ZIP contains no approved retention schedule, so Current documentation publishes no invented duration.
Rights and audit
Data-subject requests, deletion restrictions and audit evidence must follow approved policy/jurisdiction. The technical page describes lifecycle architecture and links to effective legal notices when available.