Version 1.3 · effective 2026-10-18
Biometric Privacy Policy
BUYENJOY · PLATFORM LEGAL DOCUMENT
Biometric Privacy Policy — Retention and Destruction Schedule
Published under 740 ILCS 14/15(a) · Illinois, Texas and Washington · Applied uniformly
| DOCUMENT | Biometric Privacy Policy |
| ISSUING ENTITY | Atacama Technologies LLC d/b/a BuyEnjoy (Wyoming, USA) |
| CONSENT KEY | biometric_privacy_policy |
| CONTROLLER | Atacama Technologies LLC d/b/a BuyEnjoy (Wyoming, USA) |
| PROCESSOR | Argos — identity verification, under a data-processing agreement |
| VERSION | 1.3 |
| EFFECTIVE DATE | October 18, 2026 |
| JURISDICTION | Global · applied uniformly to every user; the Illinois, Texas and Washington statutes set the minimum standard |
| REGULATORY BASIS | 740 ILCS 14 (BIPA) · Tex. Bus. & Com. Code § 503.001 · RCW 19.375 · applicable local sensitive-data law |
| CLASSIFICATION | Public — published on the platform and furnished with the consent record |
| WHY THIS POLICY IS PUBLISHED AND NOT FURNISHED ON REQUEST. 740 ILCS 14/15(a) requires a private entity in possession of biometric identifiers to make its written retention schedule and destruction guidelines publicly available. A schedule held internally and produced when asked does not satisfy that requirement. This policy is published and is the schedule. |
I. Scope and statutes
This policy governs every biometric identifier and item of biometric information the Company collects, uses, stores or discloses, wherever the data subject resides. It is written to the strictest of the standards that apply to the Company and is applied uniformly rather than by jurisdiction, because a per-jurisdiction application would depend on residence data that is itself collected during the verification this policy governs.
The governing statutes are the Illinois Biometric Information Privacy Act, 740 ILCS 14; the Texas Capture or Use of Biometric Identifier Act, Tex. Bus. & Com. Code § 503.001; and the Washington biometric statute, RCW 19.375. Illinois provides a private right of action with liquidated damages per violation; Texas and Washington are enforced by their Attorneys General.
II. What is collected, by whom, and why
At identity verification the Company collects a facial image and the biometric identifier derived from it, together with the data on the government identity document presented. The collection is performed by Argos, which acts as processor under a data-processing agreement that restricts it to the verification purpose and prohibits retention beyond it. The Company is controller.
The specific purpose is verifying that the person presenting a government identity document is the person that document depicts. The biometric identifier is not used for any other purpose, is not used to identify a person against a population, and is not used to train a model.
III. Retention and destruction schedule
| CATEGORY | RETENTION |
| Biometric template and facial image | The earlier of (a) thirty (30) days after the verification purpose is satisfied or consent is withdrawn, and (b) three (3) years after the data subject’s last interaction with the platform |
| Verification result (pass / fail / referred) and its timestamp | The anti-money-laundering recordkeeping period: seven (7) years from the last movement on the transaction, or ten (10) years where the property is located in Ecuador |
| Identity document data (name, document type, nationality, dates) and sanctions-screening result | The anti-money-laundering recordkeeping period (seven (7) years from the last movement on the transaction, or ten (10) years where the property is located in Ecuador). The Company does not retain the identity-document images or the selfie |
| Identity document images (passport or national ID card, front and back) and selfie | Not retained by the Company. Held by Argos only until destruction on the schedule in the first row; while available, delivered inside the verification report to the notary public assigned to the transaction for the notary’s own file, with the data subject’s express consent and a logged record of each delivery |
The anti-money-laundering retention of the verification result and the identity document data is an anti-money-laundering obligation and is separate from, and longer than, the biometric retention above. It does not extend the life of the biometric identifier, which is destroyed on the schedule in the first row whatever the status of the transaction.
IV. Notice and written release
Before any capture the data subject receives written notice that a biometric identifier is being collected, of the specific purpose, and of the term of retention, and gives a written release by a separate affirmative action that is not bundled with acceptance of the terms of service. The consent record is stored with its date, time, document version and the text shown. That notice and release are the Biometric Data Collection Consent (global document 22) and its country counterparts.
V. No sale, no profit, and limits on disclosure
The Company does not sell, lease, trade or otherwise profit from a biometric identifier or from biometric information. It does not disclose either except: to Argos as processor for the verification purpose; with the data subject’s separate written consent (including the delivery of the verification report, with its images, to the notary public assigned to the transaction); where disclosure completes a financial transaction the data subject requested or authorised; where required by federal, state or municipal law or municipal ordinance; or in response to a valid warrant or subpoena issued by a court of competent jurisdiction.
VI. Storage and standard of care
Biometric data is stored and transmitted using the reasonable standard of care within the Company’s industry, and in a manner at least as protective as that used for the Company’s other confidential and sensitive information. Controls include encryption in transit and at rest, role-based access limited to the personnel who administer verification, and an access log reviewed with the compliance programme.
Where the data is held. Argos stores the data of BuyEnjoy’s verifications in its Amazon Web Services environment in the United States; it is not stored in the Republic of Korea. Authorised personnel of Argos’s affiliate ARGOS Identity Korea Inc., a sub-processor listed in the data-processing agreement, may access that environment remotely from the Republic of Korea solely to provide and support the verification service. That remote access is an international transfer of personal data and is disclosed here, in the Privacy Policy and in the Biometric Data Collection Consent for the purposes of Costa Rica’s Law 8968 and Ecuador’s Organic Law on Personal Data Protection (LOPDP).
VII. Governance
The BSA/AML Compliance Officer owns this policy and reviews it annually with the compliance programme, and on any change to the verification vendor, the retention schedule, or the statutes listed in Section I. A change to the retention schedule takes effect only when it is published in this policy and in the consent documents that reference it.
A data subject may exercise access, correction, deletion and withdrawal of consent from the platform (Settings → Data → Exercise my data rights) or by writing to support@buyenjoy.io, and receives an answer within five (5) business days. Withdrawal of consent triggers destruction of the biometric template on the schedule in Section III and does not affect records the Company is required to retain.
ADOPTION
BSA/AML Compliance Officer — signature · date
Published on the platform as of the effective date above.