Servco SecuritySECURE ACCESS
Privacy Policy
Controller and contact
The controller of the personal data described here is Servco Security, owned and operated by Amir Taghavi, established at Laipu iela 6, LV-3001 Jelgava, Latvia. For any privacy question, or to exercise any right below, write to tem@fl.llcservco.org. We answer within one month.
Where a business uses our services to check its own staff or visitors, that business is the controller of those checks and we act as its processor.
What we collect, and why
| Data | Why | Lawful basis |
|---|---|---|
| IP address, and the technical characteristics of the connection it arrives on | To produce the assessment that is the service itself, and to protect the site from automated abuse | Contract; legitimate interest in securing the service |
| Device characteristics your browser or our app reports | To recognise the same device across sessions, which is how account takeover is detected | Contract; legitimate interest in preventing fraud |
| Identity document images and a short live face capture, when you start a verification | To confirm that the person presenting the document is its holder | Explicit consent, given on the verification screen before the camera opens |
| Name, e-mail address, and the content of support messages | To operate your account and answer you | Contract |
| Orders, invoices and payment references | To take payment and to keep the accounting records we are required to keep | Contract; legal obligation |
A facial image is biometric data. We ask for it only for a verification you started, we tell you before the camera opens what it is used for, and you can refuse -- refusing ends that verification and nothing else.
How long we keep it
- Identity document images and live captures: deleted once the verification reaches a decision, and in any case within one year. They are never sent to the organisation that requested the check unless you tick the box that says so.
- Assessment records and device signatures: kept while your account is open, so a later session can be compared with an earlier one.
- Support conversations: two years.
- Invoices and accounting records: as long as tax law requires.
Who else sees it
We do not sell personal data and we do not share it for anyone else's marketing.
Assessment draws on public reputation sources for the address being assessed. Those queries carry the address and nothing about the person.
Where a business asked for a verification, it receives the outcome and the reasoning. It receives the images only if you agreed to that on the verification screen.
Our servers are in the European Union. Where a supplier is outside it, the transfer is covered by the European Commission's standard contractual clauses.
Where the enhanced check is part of what you bought, we compare your name against lists that their publishers issue for exactly this purpose: sanctions designations, published wanted notices, and terrorism and fraud designations. Today those are the European Union consolidated list, the United Nations list, the United States OFAC list and the OpenSanctions aggregation of published sources.
Nothing about you is sent to those publishers. We read what they publish; we file nothing with them, we ask them nothing about you, and we report you to no authority or agency. The purpose is to protect our own customers from fraud.
Your photograph is examined here and is not handed on. Where a business commissioned the verification it receives the outcome and the reason for it, including the reason for a refusal; it receives the images themselves only if you agreed to that on the verification screen. Your rights over that decision are unaffected: you can ask for a person to review it and for the reasoning behind it.
Your rights
You have the right to a copy of your data, to correction, to erasure, to restriction, to portability, and to object to processing based on legitimate interest. Where processing rests on consent you can withdraw it at any time, and withdrawal does not affect what was lawful before it.
Write to tem@fl.llcservco.org. If you believe we have handled your data wrongly you may complain to your national data protection authority; in Latvia that is the Data State Inspectorate.
Automated decisions
An assessment is produced by measurement and weighting, without a person looking at every case. A result that refuses or restricts something is not final on its own: you can ask for it to be reviewed by a person, and the review reads the same evidence the engine used.
A similarity between your name and a name on a published list is never a decision by itself. Names repeat, spellings vary between alphabets, and a transliteration can collide with a stranger. Such a similarity only marks the case for a person to read; it cannot refuse you, and nothing about your case is decided by it alone.
Cookies
We set a session cookie so that a signed-in page knows it is you, and nothing else. There is no advertising cookie, no analytics cookie and no third-party tracker on this site.