Facia

GDPR overview

GDPR handling is concrete but incomplete. Facia publishes a GDPR compliance certificate and a CCPA certificate as PDFs, states that it processes personal data under Article 28 of the EU and UK GDPR, and names a data protection officer reachable at dpo@facia.ai. The privacy policy lists the full set of rights, access, rectification, erasure, objection, portability, withdrawal of consent and restriction, with a one-month response target, and points complainants to the UK Information Commissioner's Office. Transfers outside the EEA are covered by standard contractual clauses, and Schedule 5 of the terms doubles as a data processing agreement. Two gaps matter: no Article 27 representative in the European Union is named anywhere, and no sub-processor list is published, despite sub-processing being contractually allowed.

Who owns the data?

The terms set up a classic processor arrangement: the client acts as controller, Facia as processor under Article 28 of the EU and UK GDPR, and Facia may only handle client data on documented instructions and for the purposes listed in Schedule 5 of its terms. The client warrants that it has the right to disclose the personal data it sends, and keeps ownership of its own brand assets, which Facia may nevertheless reuse for promotion. Facia can refuse an instruction it judges unlawful. What the documents never state in so many words is who owns the biometric data itself, so ownership is inferred from the processor role rather than declared.

Reuse rights

Reuse by the client is explicitly fenced in rather than free. Under the credential-use restrictions, verification data may only serve the specific purpose disclosed to the end user; it must not be kept longer than necessary, must not be combined with unrelated datasets, and must not be used to build an independent identity database without a lawful basis. Downstream use must comply with data protection law, and the client is responsible for notifying third parties and obtaining permissions, including for transfers outside the EEA. In the other direction, Facia grants itself a broad right: using the service is treated as explicit consent for Facia to use that data to optimise, improve and train its AI models, with anonymisation applied only where required. Facia may also engage sub-processors, subject to notification and a right to object.

Data retention & training

Hosting summary

Facia never names a hosting country or region. The terms of service say only that it maintains servers in multiple locations with automatic failover and a backup strategy, and that hosting and server infrastructure are delegated to an unnamed third-party provider whose downtime, outages and security failures Facia explicitly disclaims. The privacy policy adds that data may be transferred outside the United Kingdom, with a similar degree of protection promised, and the terms allow transfers beyond the European Economic Area under standard contractual clauses, with the client responsible for obtaining the necessary consents. On security, Schedule 5 commits to SSL and TLS in transit, AES 256-bit encryption or SHA-256 hashing at rest, and storage in repositories described as SSAE-compliant and ISO-accredited. The only configuration where the customer controls the jurisdiction is the on-premises deployment, where the software runs behind the customer's own firewall. Any buyer with a data-residency obligation should get the locations in writing before signing.