01Data controller and contact
The controller is ID-ware Group B.V., Rhone 30, 2491 AP The Hague, The Netherlands, telephone +31 70 337 15 00. Questions about personal data, and any request to exercise a right under data protection law, go to the data protection officer at privacy@id-ware.com. General enquiries: info@id-ware.com; UK enquiries: enquiries@id-ware.co.uk.
02Scope of this statement
This statement covers this website, id-ware.co.uk. It is adapted from the ID-ware Group Privacy Statement (version 1.1, last reviewed 14 May 2026), published at www.id-ware.com/privacy. Processing carried out on the production ID-ware platforms is governed by the contract with each customer and by the full platform privacy notice, available on request. ID-ware does not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. The automated AI check used by the Photon demo is described below.
03What we process on this site
Site operation. The hosting infrastructure records standard access and security logs - IP address, user agent, requested URL, timestamp and response status - used solely for security monitoring and operations (Article 6(1)(f)).
Enquiries and free trials. If you submit the enquiry form, we process your name, work email, company and message in order to respond. We use the staging record to respond and, when configured, send an internal notification to sales@id-ware.co.uk. The record expires 90 days after collection and is then queued for automatic deletion by AWS; physical removal may complete shortly after expiry. Legal bases: Article 6(1)(b) (steps prior to a contract) and Article 6(1)(f) (responding to enquiries).
Chat assistant. Messages you type to the on-site AI assistant are processed transiently via Amazon Bedrock to generate a reply, and are not stored by us. Processing runs in AWS regions in the UK and the European Union (London, Ireland, Frankfurt, Paris, Milan, Spain or Stockholm). Please do not include personal data in chat messages; use the enquiry form or email instead.
Photon demo. If you try the Photon demo, your photo is processed only with your consent, given through an explicit tick-box before any processing starts (Article 6(1)(a)). The photo is sent over an encrypted connection to the Photon API, processed transiently using AI to run the automated quality and composition checks and background removal, and is never stored or logged. The check uses face detection only - it does not identify anyone and creates no biometric template - and neither the photo nor the result is used to train or improve any AI or machine-learning model. The check is fully automated; no person reviews your photo. If your photo is rejected and you would like a human review, contact our Data Protection Officer at privacy@id-ware.com.
Checkout. Purchases and free trials are handled by Stripe on Stripe-hosted pages. Card details go directly to Stripe and never touch ID-ware infrastructure; see the Stripe privacy policy. We receive from Stripe the subscription details needed to provision the service (Article 6(1)(b)).
Correspondence. If you email us, we process your contact details and the content of your message in order to respond.
04Hosting and third parties
Amazon Web Services. This site runs in containers on AWS in eu-west-2 (London), delivered through Amazon CloudFront. AWS processes your IP address in standard access logs in order to deliver the pages; operational logs are retained for up to 90 days.
Typefaces. The Poppins typeface is self-hosted: the font files are served from the same origin as the rest of the site, so your browser makes no request to Google and no font-related data is sent to Google.
Analytics and advertising. This site runs no advertising and does not follow you to other websites. It does use Leadfeeder to identify which organisation a visit comes from, and - if you agree - one analytics cookie so a repeat visit is recognised. Both are described in the cookie policy, along with the grounds we rely on.
05Legal bases
Processing is based on one or more of: Article 6(1)(b) GDPR - performance of a contract or steps prior to a contract, such as responding to enquiries; Article 6(1)(c) - compliance with legal obligations; Article 6(1)(d) - protection of vital interests (rare cases); and Article 6(1)(f) - legitimate interests, such as operating and securing this site, provided these do not override your interests, rights and freedoms. Where none of these applies, we obtain consent (Article 6(1)(a)). The same bases apply under the UK GDPR.
06Processors, sharing and transfers
ID-ware entrusts some processing to data processors - for example hosting, email delivery and payment services - under strict data processing agreements that bind them to our instructions and to confidentiality and security measures. Beyond that, personal data is shared only with your consent, where laws or authorities require it, with ID-ware affiliates for specific and legitimate purposes, or with business partners such as payment providers where necessary to deliver a service you have requested. Before any such sharing, ID-ware performs a security assessment of the sharing and of the recipient, and signs a data protection agreement or a strict non-disclosure agreement requiring them to abide by this statement and to take appropriate confidentiality and security measures when processing your personal data. Data processed by this website is hosted in the UK (AWS eu-west-2, London); where a provider such as Stripe processes data outside the UK or EU, that processing is covered by recognised transfer safeguards under the UK GDPR and EU GDPR.
07How we protect personal data
We collect the minimum personal data needed and retain it no longer than necessary; use encryption for data in transit and at rest; restrict access to authorised personnel through hierarchical, logged and regularly reviewed permissions; select service providers carefully and bind them contractually to data-protection requirements; train employees in security and privacy; and review this statement and the underlying processing at least annually. No system is absolutely secure: where a personal data incident occurs, we notify affected people and the supervisory authorities in line with local legal requirements.
08Retention
Personal data is retained no longer than necessary for the stated purpose, or for as long as a legal retention period requires, and is then deleted. For this website: operational logs are kept for up to 90 days; enquiry staging records expire 90 days after collection and are then queued for automatic deletion by AWS, which may complete physical removal shortly after expiry; correspondence is kept for as long as needed to handle the enquiry and any follow-up.
09Your rights
Under the UK GDPR and the EU GDPR you have the rights of information, access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time where processing is based on consent. Submit requests in writing to privacy@id-ware.com with enough information for us to verify your identity. We aim to respond within one month; where a request is complex the period may be extended, and we will tell you why.
10Complaints
If you believe we have processed your personal data unlawfully, you may complain to the UK Information Commissioner's Office at ico.org.uk, to the Dutch Autoriteit Persoonsgegevens, or to the supervisory authority of your EU member state. We would welcome the chance to address any concern first via privacy@id-ware.com.
11Changes to this statement
This statement is reviewed at least annually by the data protection officer and updated when processing activities, applicable law or business operations change. Minor clarifications update the last-reviewed date in the document header above; where changes are material and affect your rights or our obligations, you are notified in advance by email to the address associated with your account or relationship with us and/or by a prominent notice on this website.
This statement is adapted for id-ware.co.uk from the ID-ware Group Privacy Statement v1.1; the group statement at www.id-ware.com/privacy governs where they differ. Data-protection questions: privacy@id-ware.com.