Privacy Policy

Welcome to the Didimo privacy policy.

Didimo respects your privacy and is committed to protecting your personal data.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We ask that you read this privacy policy carefully as it contains important information on who we are, how and why we collect, store, use and share personal information, your rights in relation to your personal information and on how to contact us and the supervisory authorities in the event you have a complaint.

Who we are

We are a technology company called Didimo, which, through our services, allows you to create a lifelike digital version of yourself to use as an interface with technologies of all sorts. Using our services means that you can experience a new level of ownership and responsibility of your online identity. For more information about our services, please visit: https://didimo.co/.

The Didimo Group is made up of different legal entities, which are as follows:

• Didimo, Inc., a company registered in Delaware, USA, having its office at: 4500 140^th Avenue North, Suite 101, Clearwater, Florida, FL33762. Didimo, Inc., is our parent company.
• Didimo Tech Hub Canada Ltd, a company registered in Canada, having its registered office at: c/o McCarthy Tetrault LLP, Suite 2400, 745 Thurlow Street, Vancouver, BC V6E 0CS.
• Didimo SA, a company registered in Portugal, having its registered office at: Avenida da Liberdade, UPTEC Pólo do Mar, Sala E2/E3, 4450-718 Leça da Palmeira, Portugal.
• Mydidimo UK Ltd., a company registered in the UK, having its registered office at: 8 Andover Road, Southsea, Hampshire, PO4 9QG. Company number: 13074234

This privacy policy is issued on behalf of the Didimo Group so when we mention “Didimo”, “we”, “us” or “our” in this privacy policy, we are referring to the relevant company in the Didimo Group responsible for processing your data.

Because we collect, use and are responsible for certain personal information about you, we are regulated under the General Data Protection Regulation (often called the GDPR) which applies across the European Union (and the United Kingdom). We are responsible as a data controller of that personal information for the purposes of those laws when we are processing personal information about European data subjects (individuals) or when are offering our services to European data subjects. We will let you know which Didimo entity will be the controller of your personal information when you enter into an agreement with us to use our services.

When we are processing personal data on behalf of our corporate customers, we are acting as a data processor. If you are using our services via one of our customers or via a third party, then please check the privacy policy of that third party.

As some of the entities in the Didimo Group are based outside of the European Economic Area (EEA), Didimo has appointed Didimo SA, in Portugal, to be its representative in the EEA. We have also appointed a Data Protection Officer, Anna Fraser-Harris, who is responsible for overseeing questions in relation to this privacy policy. Anna can be contacted by email at: [email protected].

Whilst the GDPR does not apply to non-European individuals, we are committed to privacy rights and have extended our data protection practices across our entire business.

If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us using the details set out below.

Our website and services

This privacy policy relates to your use of our website, www.didimo.co and our services.

Throughout our website we may link to other websites, APIs and mobile apps (“third-party platforms”) which are owned and operated by third parties. This may be to refer you to products and services offered by these third-party companies, or to refer you to our customers who have used our services. These other third-party platforms may also gather information about you in accordance with their own separate privacy policies. For privacy information relating to these other third-party websites, please consult their privacy policies as appropriate. We are not responsible for the content on such third-party platforms nor for their handling of your personal data.

Our collection and use of your personal information

We collect personal information about you when you access our website, register with us, contact us, send us feedback, use our services or purchase or subscribe to services via our website and complete customer surveys.

We collect this personal information from you either directly, such as when you register with us, contact us use our services or purchase or subscribe to services via our website or indirectly, such as when you are an authorised user of one of our customers or from your browsing activity while you are on our website and customer portal, or when you use our app, Didimo Showcase (see ‘Cookies’ below).

The information we collect about you depends on the particular activities carried out through our website and whether you use our services. This information includes:

• Identity Data includes first name, last name, username or similar identifier - this data will be supplied by you directly or where you are an end user, by our customer or where you have downloaded the Didimo Showcase app, from the application store based on information you input to that store.
• Contact Data includes billing address, email address and telephone numbers - this data will be supplied by you directly or where you are an end user, by our customer or where you have downloaded the Didimo Showcase app, from the application store based on information you input to that store.
• Likeness Data includes photographs or video images of your face and likeness which will also include digital depth perception markers to allow us to create your likeness in a 3D format, as well as the ‘Didimo’ virtual self that is created of you through use of our services – this data will be supplied by you directly or where you are an end user, by our customer.
• Application Store Data includes data that we obtain about you when you download the Didimo Showcase app from an application store, such as the AppStore or Google Play. Such data may include Technical Data, Identity Data, Profile Data and Usage Data – this data will be supplied by the application store based on information you input to that store.
• Financial Data includes limited payment information (such as the last 4 digits of your payment card and the expiry date) provided to us by our payment provider, Stripe - for more information, see the section below ‘External Third Parties’. This data will be supplied by you directly where you have subscribed to our services through our portal.
• Transaction Data includes details about payments to and from you and other details of services you have purchased from us or we have provided to you – this data will be supplied by you directly or where you have downloaded the Didimo Showcase app, from the application store based on transactions you have had in respect of our app in that store.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our services – this data will be obtained by us directly from your device (including where you have consented to cookies where this Technical Data is not essential data for us to provide you the services). Where you are an end user, this information may be sent to us by our customer (to the extent we need such Technical Data to provide the services to you) and where you have downloaded the Didimo Showcase app, from the application store based on information that the store sends to us.
• Profile Data includes your username and social media ID (such as when you log-in to our services via Google or Facebook), purchases or orders of our services made by you, your interests, preferences, feedback and survey responses you give us by phone, email, post or via social media – this data will be collected by us directly when you choose to log into our portal or the Didimo Showcase app using your social media or other online account. Where you are an end user, this information may be supplied by our customer if you use your social media account to access their services, or where you have downloaded the Didimo Showcase app, this may be shared with us by the application store based on your profile or log-in options with that store.
• Usage Data includes information about how you use our website, customer portal, Didimo Showcase app, products and services and information about the services we provide to you – this data will be obtained by us directly from your device (including where you have consented to cookies where this Usage Data is not essential data). Where you are an end user, this information may be sent to us by our customer (but this is most likely to be in an aggregate and anonymous format or for the purposes of resolving technical issues you have) and where you have downloaded the Didimo Showcase app, Usage Data will be sent to us from the application store.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences – this data will be obtained from you directly, based on your consent and our records of the marketing and communications that have been sent to you by us or by third-parties we authorise and you have opted into.

We use this personal information to:

• create and manage your account with us
• verify your identity
• provide our services to you so that we can create and process your digital self
• customise the content and the way it is presented to your particular preferences
• notify you of any changes to our website or to our services that may affect you
• improve our services
• obtain information about your use of our services (including the Didimo Showcase app)

Our website and services are not intended for use by children under the age of 16, and we do not knowingly collect or use personal information relating to children.

Information we do not collect

We do not collect or store payment information, including credit/debit card details or billing information. However, we facilitate the transfer of your payment information to third-party payment processor gateway using our service provider, Stripe. All payments are handled by Stripe, as our third-party secure payment provider. For details about how Stripe processes your information, please visit their privacy policy. For more information generally about our use of third-party providers, please see the section below: ‘Who we share your personal information with’.

Sensitive data

We do not actively collect any sensitive data about you (also known as special categories of personal data), such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership or information about your health or genetic data, nor do we collect any information about criminal convictions and offences, however such matters may become apparent to us when you voluntarily share your Likeness Data with us or when you have shared this with a third party company using our services.

Indeed, we process your biometric data (which is limited to photograph and video footage of your face and likeness) and which will also include digital depth perception markers based on the facial photograph and video footage you supply to us, to allow us to create your likeness in a 3D digital and non-photographic format (which we call “Depth Markers”) which ultimately form the basis of your Didimo creation when the Didimo lifelike facial graphic is added to it) for two reasons.

Firstly, for the provision of our Didimo services when you have expressly and explicitly consented to share this this information with us (or you have expressly consented that a third party provides that information to us) – for example when you sign up to, and/or use our services directly or via a third party (one of our customers). You can withdraw consent which you give for use of the Didimo services at any time.

Secondly, we also collect and process your biometric data (which is still limited to photograph and video footage of your face and likeness, the Depth Markers and the ultimate Didimo creation based on your Likeness Data) when you supply it to us (or when it is supplied to us from one of our customers, being a third party company using our services) for the purpose of scientific research. Scientific research means the technological development and demonstration, (including algorithm and AI development and machine learning) that we undertake to research improvements for, and to develop our technology. In this second case, we are able to process your personal data - strictly for this purpose - without your consent and for as long as we need to do so, in order to carry out development of our technology. In respect of the Depth Markers, these markers are essentially millions of small dots that are applied to the facial image or video footage that you supply to us, which when taken together, allow us to build a digital framework of your likeness which is then processed via our technology to create your virtual self. The data we use is very similar to the data that you might supply for FaceID when using your iPhone or other Apple device. For more information about the data collected via Depth Markers and how it works, please feel free to visit Apple Inc.’s website which sets out their TrueDepth technology. We do use Apple Inc.’s TrueDepth integration, so this is only an example since we also use other equivalents depending on the relevant operating systems and devices that you use.

Aggregated data

We also collect, use and share aggregated data such as user, statistical or demographic data for any purpose. Aggregated data could be derived from your personal information but is not considered as personal information for the purposes of the law, as this data will not directly or indirectly reveal your identity. For example, we may aggregate your user data to calculate the percentage of users accessing a specific feature of our services or to enable us to improve our technology. However, if we combine or connect aggregated data with your personal information so that you can be directly or indirectly identified, we treat the combined data as personal information which will only be processed in accordance with this privacy policy. For more information, please see the section below entitled ‘Data retention’.

Our legal basis for processing your personal information

When we use your personal information, we are required to have a legal basis for doing so. There are various different legal bases on which we may rely, depending on what personal information we process and why.

The legal bases we may rely on include:

• consent: where you have given us (our our customer if you are an authorised user) clear consent for us to process your personal information (including your biometric data) for a specific purpose
• contract: where our use of your personal information is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
• legal obligation: where our use of your personal information is necessary for us to comply with the law (not including contractual obligations)
• legitimate interests: where our use of your personal information is necessary for our legitimate interests or the legitimate interests of a third party (unless there is a good reason to protect your personal information which overrides our legitimate interests)
• scientific research: where our use of your personal information (including biometric or Likeness Data) is necessary to allow us to carry out research and development into our machine learning processes, our development and improvement of our AI and algorithms, provided that we implement all relevant and legally required safeguards.

Further information: The personal information we collect, when and how we use it

For further details on when we collect personal information, what we collect as well as how we use it, please read the following table:

For further details on when and how we use personal information for marketing purposes, please see the section ‘Marketing’ below.

Who we share your personal information with

So that we are able to provide you with our services and access to this website, we routinely share your personal data with the following third parties:

• Internal Third Parties:

For example, all of the companies in the Didimo Group and who are based in Portugal, the USA and Canada and who provide IT and system administration services, development of our technology services and website and who also carry out administration and management of our business.

• External Third Parties:

For example:

Service providers acting as processors based inside and outside of the EEA who provide IT and system administration services, cloud hosting and storage services, HR services, product development, financial services, payment providers, operations and software development. In respect of the Depth Markers, we also use providers which supply us with the technology to enable us to create the 3D digital outline which serves as the basis for your Didimo creation, based on your Likeness. An example of such service providers is Apple Inc., with their TrueDepth camera system (more information is available here https://support.apple.com/en-us/HT208108 ), but please note that we also use similar depth services offered by other technology providers (such as the Android or Huawei equivalents).

Customers in the event that you benefit from our services via a third-party business (which may be based inside or outside of the EEA), who is acting as one of our customers. In this case, your personal data would be collected and processed and shared with us in accordance with that third party’s privacy policy. However, to the extent that we process your personal data, this is processed in accordance with this privacy policy. As part of the services the third party provides you, we will share the completed digital self with them, which contains your Likeness Data.

Professional advisers including lawyers, bankers, auditors and insurers based inside and outside of the EEA who provide consultancy, banking, legal, insurance and accounting and tax services.

Regulators and other authorities based inside and outside of the EEA who require reporting of processing activities in certain circumstances – for example, in relation to tax returns and tax declarations.

A list of these third parties is available on request.

We may also share personal information with third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. For example, in respect of the Depth Markers, any data gleaned from this is only used to calculate your 3D image as part of your Didimo creation based on your Likeness Data. All this data is captured in your camera and then it is sent and stored on our secure server – it is never transferred outside of the Didimo server.

We will share personal information with law enforcement or other authorities if required by applicable law.

As you can see, some of the third-party recipients of your personal information are based outside the EEA. For further information including on how we safeguard your personal data when this occurs, see ‘Transfer of your information out of the EEA’.

Whether information has to be provided by you, and if so why

We require you to provide certain information about you – for example, your likeness or proof of your identity, to enable us to safeguard your rights and provide our services and create your digital self. We will inform you at the point of collecting information from you whether you are required to provide the information to us.

Transfer of your information out of the EEA

We may transfer your personal information to the following which are located outside the EEA to allow us to run our business and to provide our services and this website to you, or indeed when you are based outside of the EEA. We also share your personal data within the Didimo Group which involves transferring your data from the EEA to the USA and Canada.

Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries. This is the case when we transfer personal personal information from the EEA to Didimo Tech Hub Canada Limited when we rely on the EU-Canada Adequacy Decision.
• Where we use certain service providers or when we transfer personal information from the EEA to Didimo, Inc., we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.
• Where we use providers based in the USA, since invalidation of the Privacy Shield mechanism following Schrems 2.0, we ensure that all transfers of personal information from the UK or Europe to the US is carried out on the basis of the European Commission Contracts. For further details, see see European Commission: Model contracts for the transfer of personal data to third countries.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

Cookies and other tracking technologies

A cookie is a small text file which is placed onto your device (e.g. computer, smartphone or other electronic device) when you use our website or services. We use cookies and other similar technologies such as web beacons, action tags, single-pixel gifs on our website and within our services. These help us to recognise you and your device and store some information about your preferences or past actions, which in turn helps us to improve our website and services.

For further information on cookies and other similar technologies, our use of them, when we will request your consent before placing them and how to disable them, please see our Cookie Policy at the following link https://privacy.didimo.co/cookie-policy/.

Marketing

We would like to send you information about our services, our business, competitions and special offers and our details about new features and our website, which may be of interest to you. Where we have your consent or it is in our legitimate interests to do so, we may do this by post, email, telephone, text message (SMS) or automated call.

We would also like to share your information with selected third parties from time to time so that they may send you information about their products or services, depending on what you agree with us.

We will only ask whether you would like us to send you marketing messages when you tick the relevant boxes when you sign up to our services, sign up to our newsletter or make contact with us via our website for the first time.

If you have previously agreed to being contacted in this way, you can unsubscribe at any time by:

• contacting us using the details below
• using the ‘unsubscribe’ link in emails or ‘STOP’ number in texts
• updating your marketing preferences via your user profile.

It may take up to 30 days for this to take place.

For more information on your rights in relation to marketing, see ‘Your rights’ below.

Your rights

Under the GDPR, European individuals have a number of important rights. In summary, these rights include the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. Please note that where we process your personal data (including any Likeness Data) for the purpose of scientific research, then we are not legally required to delete your personal data when you request us to do so, if this means that it would likely be difficult or impossible for us to carry out this scientific research without your personal data. If we retain your data despite your request for deletion, we will only do so provided we comply with applicable laws and ensure all safeguards to protect your personal data are in place. We will inform you of this if we are unable to adhere to your deletion request for this reason.
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information in the following scenarios:
  • If you want us to establish the accuracy of the information.
  • Where our use of the information is unlawful, but you do not want us to erase it.
  • Where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims.
  • You have objected to our use of your information, but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide our services to you. We will advise you if this is the case at the time you withdraw your consent. Please note that we do not require your consent to process your personal data (including Likeness Data) where we are doing so for the purpose of scientific research, but that this will never affect your right to withdraw your consent in respect of data processing for the use of our services and the provision of Didimos on the basis of your Likeness Data, to you or our customers.

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.

If you would like to exercise any of those rights, please email or write to us using the details below.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Timeframe for responding to you

We aim to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Data retention

We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances you can ask us to delete your information: see ‘Your rights’ above for further information.

In some circumstances we will anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes or in an aggregated format for machine learning, product improvement and development of our technology, in which case we may use this information indefinitely without further notice to you.

Furthermore, as set out in the section ‘Further information: The personal information we collect, when and how we use it’, we collect your Likeness Data for the purposes of carrying out scientific research into our product and services, for machine learning, product improvement and development of our technology, in which case we may use this information for as long as is necessary to allow us to carry out that scientific research, without further notice to you. Where possible, we will ensure that such data is anonymised. Where this is not possible, we will implement pseudonymisation (such as allocating code names or numerical identifiers), and we will only process the minimum amount of data that we need to achieve our scientific research purposes. In doing so, we will safeguard the data with technical and organisational measures (ensuring security and confidentiality of the data), including by ensuring that all data processed for this purpose is stored in a separate database, accessible on a need-to-know basis.

Please rest assured that when keeping your personal data for scientific research purposes, we will never process it to support measures or decisions relating to particular individuals and we always ensure the data is not processed in such a way that substantial damage or substantial distress is likely to be caused to any individual.

How to complain

We hope that we can resolve any query or concern you raise about our use of your information.

The GDPR also gives EEA and UK users the right to lodge a complaint with a supervisory authority, in particular in the European Union (or EEA) state where they work, normally live or where any alleged infringement of data protection laws occurred. The supervisory authority in Portugal (where our European representative is based) is the CNPD – Comissão Nacional de Protecção de Dados (the Portuguese Data Protection Authority). They can be contacted by:

Telephone: (+ 351) 21 392 84 00;
Fax: (+ 351) 21 397 68 32; or
E-mail: [email protected].

You can also visit their website.

How to contact us

Please contact us if you have any questions about this privacy policy or the information we hold about you. If you wish to contact us please send an email to [email protected].

Changes to this privacy policy

This privacy policy was published on 1st April 2020 at https://privacy.didimo.co/privacy-policy/, and last updated on 15th December 2020.

We may change this privacy policy from time to time, when we do, we will inform you via this web page. Please check back regularly to ensure you are always aware of the latest version in force.