-
Introduction
-
We know that you place a great deal of trust in us when you provide information on and through our platform, and we will always treat the information in a careful and responsible manner. To be able to provide our services we need to process certain data about you. Our privacy notice explains, among other things, which of your personal data we process, why we process it, how we collect it, on what basis we support the processing and for how long we save the data.
KnownID provides a platform for sharing and managing KYC information and documentation (the “Platform”). When we refer to "we", "us", "our", and "KnownID" we are referring to KnownID AB, a limited company incorporated under the laws of Sweden with registration number 559432-3924 and registered office at Drottning Kristinas väg 53, 114 28 Stockholm, Sweden.
If you have any questions about KnownID’s processing of your personal data or if you wish to exercise your rights described below, please contact us at privacy@knownid.io. You can also call us on +46 70 813 90 60.
We will update this privacy notice from time to time to reflect changed legal requirements or our processing. This privacy notice was last updated on 22 August 2024.
-
-
Responsibility for the processing of your personal data
-
General
KnownID processes personal data both as a data controller and as a data processor on behalf of others. This privacy notice is applicable to the situations when KnownID processes your personal data in its capacity as a data controller. In general, KnownID is the controller for the processing of the personal data that you share with us when you:-
represent an organisation which is a prospective, current or former Business User (as defined below) or supplier of KnownID
-
use the Platform in the capacity as a Personal User (as defined below)
-
visit our website or social media, or when we send newsletter or other information to you
-
participate in surveys, events or provide feedback
-
contact us
In relation to the usage of the Platform, the role of KnownID depends on what type of user you are, a Business User or a Personal User (both as defined below).
-
-
Business User
“Business User” means a company, organisation or other entity who creates a business account on the platform provided by KnownID.
Within a Business User’s use of the Platform, the Business User is the data controller for the processing, and KnownID is the data processor to such Business User. If you would like to know how your personal data is processed by a specific Business User, we refer you to the applicable Business User’s privacy notice. -
Personal User
“Personal User” means a private person who creates a personal account on the platform provided by KnownID for the purpose of sharing KYC information and/or answering KYC queries.
Within a Personal User’s use of the Platform, KnownID is the controller of the processing of personal data. This means that even though the Personal User is in control of what information that is saved on the platform, KnownID is responsible for the processing of the personal data on the platform.If a Personal User would choose to share certain personal data with a specific Business User through the Platform (for example by responding to a KYC query from such Business User), the specific Business User becomes an independent data controller of the information they have received. This means they are responsible for their own use and protection of that data, in accordance with their privacy notice. We will act as a data processor to the Business User for the shared data, meaning we will only handle the shared data on the Business User’s instructions and for the purposes of providing the platform services. This, however, only applies to information that has been shared, KnownID continues to be the controller for the information on your personal profile.
If you as a Personal User would like to know how your personal data is processed by a specific Business User, we refer you to the applicable Business User’s privacy notice. -
Detailed information
In Appendix 1 you can read detailed information about what personal data we process about you, why we process your personal data, how long we save your personal data, what lawful basis we have for our processing, and where your personal data is stored.
-
-
How we share information with others
-
General
Your personal data can be shared with others to fulfil the agreement we have with you or to the extent we are under a statutory obligation to do so. We may disclose your personal data to other Business Users, suppliers and authorities as set out below and further detailed in Appendix 1. -
Other Business Users
With your permission, e.g. when you ask us to do so, we disclose personal data to Business Users of the Platform. For example, when you respond to a KYC query from a specific Business User, we will share your response with such Business User. -
Suppliers
We may enter into agreements with selected suppliers to provide the best possible service and product and these suppliers may be engaged to process personal data on behalf of us. Below the categorises of suppliers that we may share information with are set out.-
IT and Infrastructure Services: Service providers involved in hosting, cloud storage, and IT security such as cloud service providers, data centers, and security monitoring services.
-
Technology Tooling: Service providers used to automate and manage platform-related tasks, such as email automation for login notifications, system-triggered messages, and other operational workflows.
-
Product Development and Support: Service providers that assist in the development, maintenance, and support of the platform, such as development agencies, software testing partners and customer support platforms.
-
Marketing and Communication Services: Service providers that handle marketing campaigns, communication tools, and customer engagement, such as email marketing platforms, CRM systems, and advertising partners.
-
Analytics and Performance Monitoring: Service providers that help analyse user behaviour, application performance, and business metrics, such as web analytics tools, business intelligence software, and monitoring services.
-
Payment Processing and Financial Services: Service providers managing billing, invoicing, and financial transactions, such as payment gateways, invoicing platforms, and accounting services.
-
Legal and Compliance Services: Service providers assisting with legal matters, compliance requirements, and GDPR-related audits, such as law firms, GDPR compliance consultants, and auditing services.
-
Product Partnerships: External systems or applications integrated into the Platform for additional functionality, such as PEP and sanctions screening providers, and ID verification providers.
-
-
Authorities
We disclose personal data to authorities to the extent we are under a statutory obligation to do so. Such authorities include law enforcements authorities and supervisory authorities in relevant countries, e.g. in connection with a request for information based on a search warrant or similar legal procedure or a request from the Swedish Authority for Privacy Protection to review how KnownID has handled your personal data in any respect. In addition, we would share information about you with public authorities when we believe we have a legitimate interest in doing so, such as for KnownID to establish, enforce or defend its legal claims.
-
-
Your rights related to personal data
-
General
You have several rights in relation to our processing of your personal data. To exercise your rights, you are welcome to contact us. Our contact details are provided at the beginning of this privacy notice. -
Right of access
You have the right to receive confirmation of whether we process your personal data and the right to access information about how the personal data is processed, such as the purposes of the processing and what categories of personal data the processing applies to. You also have the right to a copy of the personal data we process about you. -
Right to rectification and right to object to processing
You have the right to have inaccurate personal data corrected without undue delay (for example, if you have changed contact details) and the right to have incomplete personal data supplemented. You can object to personal data processing based on a balancing of interests at any time. If we can demonstrate that our legitimate interests in the processing outweigh your interests and fundamental rights and freedoms or if our processing is for the determination, exercise, or defence of legal claims, we may continue our processing despite your objection. -
Right to rectification and right to object to processing
You have the right to have inaccurate personal data corrected without undue delay (for example, if you have changed contact details) and the right to have incomplete personal data supplemented. You can object to personal data processing based on a balancing of interests at any time. If we can demonstrate that our legitimate interests in the processing outweigh your interests and fundamental rights and freedoms or if our processing is for the determination, exercise, or defence of legal claims, we may continue our processing despite your objection. -
Right to restriction of processing
You have the right to request that the processing of your personal data be restricted if:-
you dispute the accuracy of the personal data (however, the limitation only applies during the period we verify the accuracy of the personal data);
-
the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead;
-
you need the personal data for the establishment, exercise, or defence of legal claims even though we no longer need the personal data for the stated purpose of the processing; or
-
if you have objected to the processing and we have not verified whether our legitimate interest in processing your personal data overrides your legitimate interest in restricting the processing of your personal data.
-
-
Right to erasure (right to be forgotten)
You have the right to request erasure of your personal data if:-
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
-
you withdraw the consent on which the processing is based and there is no other legal ground for the processing;
-
you object to the processing and there are no legitimate grounds for continuing our processing;
-
the personal data have been unlawfully processed; or
-
the personal data must be erased for compliance with a legal obligation to which we are subject.
-
-
Right to withdraw consent
If you have given your consent to a particular processing of your personal data, you can withdraw all or part of your consent at any time. -
Right to data portability
You have the right, under certain conditions, to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format and the right to transmit these to another data controller (data portability). -
Right to complain
You have the right to complain about our processing of your personal data to a competent supervisory authority. The competent supervisory authority in Sweden is the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten). You may access their details at https://www.imy.se.
-
-
Protecting your personal data
-
Keeping your personal data safe and secure is at the centre of how we do business. We use appropriate technical, organisational, and administrative security measures to protect any information we hold from loss, misuse, and unauthorised access, disclosure, alteration, and destruction.
-
-
Appendix 1
Detailed information about the processing of your personal data
In the tables below, you can read more about what personal data we process about you, why we process your personal data, how long we save your personal data, what lawful basis we have for our processing, and where your personal data is stored.The lawful basis for our processing will be either of “balancing of interests”, “performance of a contract”, “consent”, or “legal obligation”, an explanation of these lawful bases are set out below:
-
-
Performance of a contract: when we need to process certain personal data to enter in to or fulfil our contractual obligations with you
-
Compliance with legal obligations: when we have a responsibility to collect, store or disclose your personal data pursuant to law
-
Balancing of interests: when the processing of your personal data is necessary for purposes related to our legitimate interests, however, our legitimate interests will only constitute a lawful basis for the processing of your personal data if your interests and fundamental rights and freedoms do not outweigh our legitimate interests
-
Consent: when we ask you to actively provide your consent for us to use your personal data for a specific purpose.
-
-
The platform
Below, you will find information about how we process your personal data when you create an account on the Platform and become a user – either on behalf of the organisation you represent or on behalf of yourself as a Personal User. This includes details on how personal data is handled when you use the Platform and other related processing activities surrounding it.Becoming a customer
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
To share relevant information with the organisation you represent in its capacity as customer.- Name
- Email address
- Phone number
Balancing of interestsOur legitimate interest is to be able to communicate with the organisation in its capacity as customer.This information may be shared with the type of suppliers:- Marketing and Communication Services
Retention period: We will stop processing your personal data for this purpose when the agreement with the organisation you represent has expired or if we learn that you are no longer a contact person for the organisation.Creating an account for the Platform
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
As a Business UserTo ensure that you will be able to create an account and use the Platform on behalf of the organisation you represent.- Name
- Email address
- User ID
- Personal identity number
- IP address
Performance of a contractThis information may be shared with the type of suppliers:- IT and Infrastructure Services (server location EEA, certain sub-suppliers global)
- Technology Tooling (U.S.)
As a Personal UserTo ensure that you will be able to create an account and use the Platform on behalf of yourself.- Name
- Email address
- User ID
- Personal identity number
- IP address
Performance of a contractThis information may be shared with the type of suppliers:- IT and Infrastructure Services (server location EEA, certain sub-suppliers global)
- Technology Tooling (U.S.)
Retention period: We will stop processing your personal data for this purpose when you stop being a user.Logging in to your account
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
As a Business UserTo ensure that you will be able to login and use the Platform on behalf of the organisation you represent.- Name
- Email address
- User ID
- Personal identity number
- IP address
Performance of a contractThis information may be shared with the type of suppliers:- IT and Infrastructure Services (server location EEA, certain sub-suppliers global)
- Technology Tooling (U.S.)
As a Personal UserTo ensure that you will be able to login and use the Platform on behalf of yourself.- Name
- Email address
- User ID
- Personal identity number
- IP address
Performance of a contractThis information may be shared with the type of suppliers:- IT and Infrastructure Services (server location EEA, certain sub-suppliers global)
- Technology Tooling (U.S.)
Retention period: We will stop processing your personal data for this purpose when you stop being a user.Using the Platform as a Personal User
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
As part of our service offering, allow you to store, manage your KYC information on the Platform.Any information that you may submit to the Platform, such as:- Name
- Address
- Email address
- Phone number
- Personal identity number
- Place of birth
- Date of birth
- PEP status
- Tax residency
Performance of a contractThis information may be shared with the type of suppliers:- IT and Infrastructure Services (server location EEA, certain sub-suppliers global)
- Technology Tooling (U.S.)
- Product Partnerships (server location EEA, certain sub-suppliers U.S.)
As part of our service offering, allow you to store and manage a proof of your verified identity on the Platform.- Identity verification data
Performance of a contractThis information may be shared with the type of suppliers:- IT and Infrastructure Services (server location EEA, certain sub-suppliers global)
- Technology Tooling (U.S.)
- Product Partnerships (server location EEA, certain sub-suppliers U.S.)
In relation to the ID verification tool Veriff, please note that you may transfer biometric data to Veriff as part of the ID verification process, but that such data is not processed by KnownID.Retention period: We will stop processing your personal data for this purpose when you delete your data or 30 days after you terminate your account.Sharing information as a Personal User
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
As part of our service offering, allow you to share your KYC information to selected Business Users within the Platform.Any information that you may submit to the Platform, such as:- Email address
- Address
- Email address
- Phone number
- Personal identity number
- Place of birth
- Date of birth
- Nationality
- PEP status
- Tax residency
- Identity verification data
Performance of a contractThis information will be shared with a Business User upon your request.
Once the information has been shared, the Business User becomes an independent data controller of the data received and KnownID will act as a data processor to the Business User for such data.
This, however, only applies to the shared data, KnownID continues to be the controller for the data on the personal profile.Retention period: We will stop processing your personal data for this purpose when the sharing is completed.To analyse how our Platform is used
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
To analyse user data for the purpose of generating insights that help improve service performance and enhance overall platform functionality.- IP address and other technical information about your device
Balancing of interestsOur legitimate interest is to identify issues, optimise performance, and introduce enhancements that create a more efficient, user-friendly experience for you and other users.This information may be shared with the type of suppliers:- IT and Infrastructure Services (server location EEA, certain sub-suppliers global)
- Technology Tooling (U.S.)
- Product Development and Support
- Analytics and Performance Monitoring
Retention period: We will stop processing your personal data for this purpose when the sharing is completed.Error reports, questions & other matters
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
To administer and manage your error reports and questions as well as other matters or complaints that you report to us.- Name
- Email address and/or phone number
- Information that you or others in the organisation provide us in the matter
- Email address and/or phone number
Balancing of interestsOur legitimate interest is to maintain our customer service and answer your questions.This information may be shared with the type of suppliers:- IT and Infrastructure Services (server location EEA, certain sub-suppliers global)
- Product Development and Support
Retention period: We will stop processing your personal data for this purpose 6 months after the matter has been handled.Non-marketing communication & mailings
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
To communicate or share relevant information regarding your agreement or the Platform with the organisation you represent in its capacity as customer.- Name
- Contact details
Balancing of interestsOur legitimate interest is to be able to communicate with the organisation in its capacity as customer.This information may be shared with the type of suppliers:- IT and Infrastructure Services (server location EEA, certain sub-suppliers global)
- Technology Tooling (U.S.)
To communicate or share relevant information regarding your agreement or the Platform with you in your capacity as a user.- Name
- Contact details
Balancing of interestsOur legitimate interest is to be able to communicate with the organisation in its capacity as customer.This information may be shared with the type of suppliers:- IT and Infrastructure Services (server location EEA, certain sub-suppliers global)
- Technology Tooling (U.S.)
Retention period: We will stop processing your personal data for this purpose when the agreement with you or the organisation you represent has expired or if we learn that you are no longer a contact person for the organisation.Payment and invoices
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
To manage and administer payments and invoices.- Name
- Email address
Balancing of interestsOur legitimate interest is to fulfil the agreement.This information may be shared with the type of suppliers:- Payment Processing and Financial Services
Retention period: We save your personal data until the payment is completed.
If the organisation has debts that are sent to debt collection, we generally delete your personal data for this purpose three years after the debt is settled. In certain cases, we cease to process the personal data for this purpose if we learn that you are no longer a contact person for the organisation. -
Suppliers
Below, you will find information about how we process your personal data when you represent one of our suppliers.Contact with suppliers
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
Communicate with you who represent an organisation that is a potential, existing, or former supplier to us.- Name
- Title
- Email address
- Telephone number
Balancing of interestsOur legitimate interest is to maintain existing partnerships as well as evaluate new partnerships to improve our business.This information may be shared with the type of suppliers:- IT and Infrastructure Services (server locationEEA, certain sub-suppliers global)
Retention period: We will stop processing your personal data for this purpose when the agreement with the organisation you represent has expired or if we learn that you are no longer represent the organisation in question. If we have concluded an agreement with your organisation, we save your contact details in accordance with what is stated below under "Agreements with suppliers".Agreements with suppliers
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
Negotiate, conclude, and administer agreements with the organisation you represent.- Name
- Title
- Email address
- Telephone number
- Personal identity number if you operate as a sole trader to ensure that we enter into an agreement with the right party
Performance of a contractThis information may be shared with the type of suppliers:- IT and Infrastructure Services (server locationEEA, certain sub-suppliers global)
- Legal and Compliance Services
Retention period: We will stop processing your personal data for this purpose when the agreement with the organisation you represent has expired or if we learn that you are no longer represent the organisation in question. If your personal data in the form of your signature is included in the agreement, it will generally be deleted after ten years from the expiration date of the agreement. However, your information may be stored longer for other purposes, such as accounting purposes, see more below.Manage invoicing
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
To manage and administer invoicing.- Name
- Title
- Email address
- Telephone number
- Personal identity number if you operate as a sole trader to ensure that we enter into an agreement with the right party
Balancing of interestsOur legitimate interest is to fulfil our agreement. If you are a sole trader, we process your personal identity number to ensure that you are the correct contracting party.This information may be shared with the type of suppliers:- Payment Processing and Financial Services
Retention period: We save your personal data until the payment is completed. We will stop processing your personal data based on this purpose seven years after the end of the calendar year in which the financial year ended. The data is saved for this period due to our accounting obligation. -
For our communication
Below you will find information about how we process your personal data when you contact us, visit our website or social media, when we send marketing to you, or if we consider that you are a potential user whom we want to contact.When communicating with you
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
Communicate with you who contact us via email, telephone, our website, or social media.- Name
- Title
- Email address
- Telephone number
- Social media username (only for communication via social media)
- Other information you choose to provide us with
Balancing of interestsOur legitimate interest is to communicate with you and maintain our customer service and answer your questions.This information may be shared with the type of suppliers:- Marketing and Communication Services
To share relevant information with you or the organisation you represent.- Name
- Email address
- Phone number
Balancing of interestsOur legitimate interest is to be able tocommunicate with you or the organisation you represent to grow and sustain our business.This information may be shared with the type of suppliers:- Marketing and Communication Services
Retention period: We will process your personal data for this purpose for as long as our legitimate interest remains after we have completed our communication, however no longer than 5 years.
On social media, your comments and our communication remain until you delete the comments and/or communication yourself. Materials that may be perceived as inappropriate or offensive will be removed earlier than this on a regular basis.To send newsletters
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
Sending newsletters with offers and information via email that you have announced that you want.- Email address
ConsentWe obtain your consent to provide you with relevant information about KnownID and our Platform through our newsletters.This information may be shared with the type of suppliers:- Technology Tooling (U.S.)
- Marketing and Communication Services
Retention period: We will process your personal data for this purpose and continue to send you newsletters until you unsubscribe or otherwise ask us to stop sending newsletters.
You can decline marketing from us at any time. If you decline, your personal data will be stored in our deregistration register until further notice. You can read more about this processing below.If you have asked us to stop sending marketing
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
If you have announced that you do not wish to receive our marketing, we will store a notice to that effect in a "deregistration register" to ensure that we do not market ourselves to you.- Email address
Legal obligatoinWe have an obligation under the Marketing Act to ensure that you do not receive marketing that you have requested not to receive.This information may be shared with the type of suppliers:- IT and Infrastructure Services (server location EEA, certain sub-suppliers global)
- Technology Tooling (U.S.)
Retention period: We will process your personal data in our deregistration register until further notice.To analyse how our website is used
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
View and analyse visitor statistics on our website and improve the functionality on the same.- IP address and other technical information about your device
ConsentWe obtain your consent in connection with your visit.This information may be shared with the type of suppliers:- Product Development and Support
- Analytics and Performance Monitoring
Retention period: We will stop processing your personal data for this purpose 6 months from your visit. -
Carry out events and market research
Below, you will find information about how we process your personal data when you participate in our events and when we conduct market research and evaluations.Carry out events
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
Invite you to our events.- Name
- Email address
- Telephone number
Balancing of interestsOur legitimate interest is to contact a potential,existing, or previous Business Users or suppliers.This information may be shared with the type of suppliers:- Marketing and Communication Services
Organise our events.- Name
- Email address
- Telephone number
- Information about your dietary preferences if you have specified this
Balancing of interestsOur legitimate interest is to organise events.ConsentIf we process dietary preferences that can be linked to health or religion, we obtain your consentThis information may be shared with the type of suppliers:- Marketing and Communication Services
Take photos/videos at events to publish on our social media.- Photographs or videos where you appear
Balancing of interestsOur legitimate interest is to take photos at events.This information may be shared with the type of suppliers:- Marketing and Communication Services
Retention period: We will stop processing your personal data for this purpose when the event is completed. We save photographs or videos where you appear as long as the legitimate interest remains valid (unless you would object the processing).Market research and evaluations
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
Send market surveys or evaluations to you as a user of our Platform.- Name
- Email address
- Telephone number
- The answers you provide in the market survey
Balancing of interestsOur legitimate interest is to evaluate and improve the core functionality of our Platform.This information may be shared with the type of suppliers:- Marketing and Communication Services
Retention period: We will stop processing your personal data for this purpose 12 months after the survey is completed. -
Legal obligation
Below, you will find information about how we process your personal data when we must process your personal data to fulfil our legal obligations, when we or you have a legal claim or when we otherwise are in contact regarding legal matters.Accounting
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
Comply with accounting legislation in relation to incoming and outgoing invoices and payments.- Name
- Payment history, transactions, and other material that constitutes accounting records
Legal obligationThe processing is necessary to comply with the Swedish Accounting Act.This information may be shared with the type of suppliers:- Payment Processing and Financial Services
Retention period: We will stop processing personal data based on this purpose seven years after the end of the calendar year in which the financial year ended.Legal claim
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
Establish, enforce, and defend legal claims and other legal matters, such as warranties, payments, or other matters.- Name
- Address
- Information relevant to the case, such as aninspection record
Balancing of interestsOur legitimate interest is to defend ourselves against and defend our legal claims.This information may be shared with the type of suppliers:- Legal and Compliance Services
This information may also be shared with public authorities in relevant countriesRetention period: We will process your personal data for this purpose for as long as our legitimate interest remains.Other legal matters
Purpose of the processing
Personal data being processed
Lawful basis
Sharing of your personal data
We may be requested by the law enforcement to provide information based on a search warrant or similar legal procedure.- Name
- Title
- Email address
- Phone number
- Any information requested by the law enforcement
Legal obligationWe have an obligation under law to answer any information request based on a search warrant or similar legal procedure.This information may be shared with the type of suppliers:- Legal and Compliance Services
This information may also be shared with public authorities in relevant countriesWe may be requested by the Swedish Authority for Privacy Protection or other supervisory authorities to provide certain personal data.- Name
- Title
- Email address
- Phone number
- Any information requested by the law enforcement
Legal obligationWe have an obligation under law to answer any information request based on a search warrant or similar legal procedure.This information may be shared with the type of suppliers:- Legal and Compliance Services
This information may also be shared with supervisory authorities in relevant countriesRetention period: We will process your personal data for this purpose for as long as our legitimate interest remains.
-