Identity Verification Notice

1. Controller

The controller is Elene Malakmadze, who operates BeFrie (the “Controller”). This notice is given in accordance with the Law of Georgia on Personal Data Protection (the “Law”). BeFrie carries out the verification itself: no identity verification provider takes part in it.

2. What you need

A Georgian passport or identity card with a chip, and an iPhone capable of reading it. Documents issued by other states are not yet accepted.

3. Processing on your device

The camera reads the machine-readable lines printed on your document, and your iPhone then reads the chip of the document: your name, document number, personal number, nationality, sex, date of birth, the expiry date of the document, your photograph and the electronic signature of the State.

You then look at the camera. Your iPhone establishes that a real person is in front of it and compares your face with the photograph from the chip and then with your profile photo. Comparing faces involves measuring them, and the results of these measurements are biometric data.

The camera images, the photograph from the chip and the measurements are used only in the memory of your iPhone, for the few seconds the check takes, and are then deleted. They are not stored and do not leave your iPhone.

Start the check only if you consent to this processing.

4. Data transmitted to the server

If your face matches the photograph from the chip, the application transmits to the Controller’s server the text record of the chip (the data listed above, without the photograph) and its signature record: the electronic signature of the State, the certificate with which it was made, and checksums of the contents of the chip.

The server verifies that the signature is genuine and belongs to the State of Georgia, that the document has not expired, and that you have reached the age of 18. This takes a few seconds, after which the server deletes the data received, apart from the data listed below, and does not record them in its logs.

The application also informs the server whether your profile photo matched your face: only “yes” or “no”. To ensure that these answers can be relied on, your iPhone confirms through Apple’s App Attest service that they originate from the genuine BeFrie application. Nothing about you or your document is transmitted to Apple for this purpose.

5. Data that is stored

The following is stored:

• the fact and date of verification;
• your date of birth, which you can no longer change in your profile afterwards;
• the version of this notice to which you agreed, and the time of your consent;
• whether your profile photo matched;
• a one-way code derived from your personal number with a secret key. The personal number cannot be recovered from this code. It makes it possible to refuse the verification of a second account with the same document, and to exclude from BeFrie a person whose account has been suspended for safety reasons;
• the public part of the key that identifies the application on your iPhone;
• for one day, the times of your verification attempts.

The following is not stored: your document number, your personal number, your name as stated in the document, your nationality or sex, any image of the document, the photograph from the chip, any camera image or video, or any facial measurements.

6. Storage period

These data are stored for as long as your account exists and are deleted when you delete it. There is one exception: if the account is suspended for safety reasons at the time of deletion, the one-way code is stored until the suspension ends or, where the suspension has no end date, for two years, so that a suspension cannot be evaded by opening a new account.

7. Purposes, legal ground and consent

Identity verification is required before you host or join a plan (a meeting arranged through BeFrie). Its purposes are to enforce the minimum age of 18, to ensure that each person has only one account, and to reduce impersonation and unsafe accounts among persons who meet in person.

Your biometric data is processed only on the basis of your written consent (Article 6(1)(a) and Article 9 of the Law), which you give in electronic form in the application before the check begins. You may withdraw your consent at any time and without explanation, by writing to [email protected] or by deleting your account. Withdrawal does not affect checks already carried out, but plans and their chats will no longer be available to you.

8. Automated individual decision-making

The decision is taken solely by automated means: your iPhone determines whether the faces match, and the server determines whether the document is genuine and valid and shows that you are of full age. If the check cannot be completed, or you consider its result to be incorrect, write to us: a person will examine the matter together with you, and you may express your point of view and contest the decision.

9. Your rights

Your rights, including the right to apply to the State Audit Office of Georgia, are described in the Privacy Policy.

10. Contact

For questions concerning identity verification or personal data, write to [email protected].