This Biometric Information Policy and Consent (“BIPC”) explains how Gygler, LLC (“Gygler,” “we,” “our,” or “us”) collects, uses, stores, and destroys biometric identifiers and biometric information in connection with our website, mobile application, and related services (collectively, the “Platform”).
Purpose of Collection
Gygler may collect biometric identifiers and biometric information, including facial geometry scans, voiceprints, or fingerprint-based identifiers, solely for the following purposes: (a) identity verification; (b) secure check-in, check-out, and attendance validation; and (c) fraud prevention and account security related to identity verification and Gyg attendance. Biometric data is used only to confirm that the individual accessing or checking in through the Platform is the authorized account holder. Biometric data is not used for marketing, profiling, general screening, “attractiveness” or aesthetic filtering, or analytics unrelated to identity verification and security.
Biometric Data
“Biometric Data” means collectively biometric identifiers and biometric information associated with an identified or identifiable individual. “Biometric identifiers” may include fingerprints, voiceprints, and scans of hand or face geometry, as defined under applicable law. “Biometric information” means any information, regardless of how it is captured, converted, stored, or shared, that is based on a biometric identifier, as defined under applicable law.
Storage and Security
Biometric data is converted into an encrypted mathematical template and stored in secure cloud infrastructure utilizing industry-standard encryption at rest and in transit (for example, secure key-management and enclave services such as Microsoft Azure). Gygler does not store raw fingerprint images or raw facial images for identification purposes; only encrypted biometric templates are retained for one-to-one verification. Access to biometric data is limited to authorized personnel and service providers who require such access to perform services for Gygler and who are bound by confidentiality and data protection obligations. Gygler uses a reasonable standard of care, at least as protective as the measures used to safeguard other confidential and sensitive information, to store, transmit, and protect biometric data from unauthorized access, disclosure, or misuse. These safeguards are designed to meet or exceed industry standards for the protection of sensitive personal information.
Retention and Destruction
Gygler retains biometric data only for as long as necessary to fulfill the specific purpose for which it was collected. Biometric data will be permanently destroyed at the earliest of (a) when the initial purpose for collection has been satisfied; (b) thirty (30) days after account closure; or (c) three (3) years after last interaction, whichever occurs first, unless earlier destruction is requested and legally permitted. Destruction is performed using commercially reasonable methods designed to permanently delete the biometric template from active systems, subject to any legal holds or retention obligations under applicable law.
Disclosure Restrictions
Gygler does not sell, lease, trade, or otherwise profit from an individual’s biometric identifiers or biometric information. Biometric data will not be disclosed to third-parties, except (a) to service providers performing identity verification, hosting, or security services for Gygler under written data protection or service agreements, provided such service providers are contractually prohibited from retaining, using, or disclosing biometric data for any purpose other than providing services to Gygler and are required to implement reasonable security measures and to comply with applicable biometric privacy laws, including restrictions on retention and disclosure; (b) when required to comply with a valid warrant, subpoena, or other applicable law or legal process; or (c) with the individual’s express written consent. Biometric data is not disclosed to Clients. Clients may receive only non-biometric confirmations such as attendance status or successful check-in.
Voluntary Use and Alternatives
Biometric verification is used solely for identity verification and secure attendance features. If biometric verification is required by a specific location or enterprise client, alternative verification methods may be made available where reasonably feasible and consistent with security and operational requirements.
Written Consent
Where required by applicable law (including the Illinois Biometric Information Privacy Act in scope situations), Gygler will obtain an individual’s informed, written consent before collecting or using biometric identifiers or biometric information.
By using the Platform, by selecting “I Agree” and providing an electronic signature, or otherwise affirmatively indicating your acceptance of this BIPC within the Platform, you acknowledge that you have read and understand this BIPC and provide your informed, written consent for Gygler to collect, use, store, disclose, and destroy your biometric identifiers and biometric information as described in this BIPC. This consent is separate from and in addition to your acceptance of Gygler’s Terms of Service and Privacy Policy and is intended to constitute written consent for the collection of biometric identifiers as required by applicable law. Upon receipt of a valid revocation request, Gygler will cease collection and will delete biometric data in accordance with this BIPC, subject to legal obligations.