Biometric Data Notice

Last updated: 2026-10-11 • Contact: [email protected]

1) What this notice covers

This notice explains the conditions that must be met before SONAMAK may enable processing of biometric identifiers or information, such as facial geometry or voiceprint characteristics, for a specific project. Ordinary photographs, videos and audio are not automatically biometric data; they may become biometric data if technology is used to identify a person or derive biometric templates from them.

2) Conditions before any future collection

Before collection begins, SONAMAK must provide the affected individual with a project-specific written notice that identifies:

• the exact data to be collected or derived and the technology used;
• the specific purpose and duration of processing;
• the service providers and recipient categories involved;
• an enforceable retention and permanent-deletion schedule; and
• the person's applicable rights and how to exercise them.

SONAMAK will also obtain any written release and consent required by applicable law before collection. Consent to the general Terms, an order, or the long-form likeness terms is not biometric consent.

3) Secure intake and access

Any future collection must use a separate secure intake method with restricted access, transmission protection, appropriate vendor terms, and documented deletion testing. Government IDs and biometric information must not be submitted by ordinary email or WhatsApp.

4) Use, disclosure and sale

If enabled, biometric data may be used only for the purposes stated in the project-specific notice. SONAMAK will not sell, lease, trade or otherwise profit from biometric identifiers. Disclosure will be limited to authorized service providers or other recipients permitted by law and identified as required.

5) Retention and deletion

No fixed retention promise applies until the project-specific process is enabled. Before collection, SONAMAK will publish and operationally implement a schedule that satisfies applicable law, ties retention to the stated purpose, and includes deletion from active systems plus an appropriate backup-deletion cycle. Collection will remain disabled until that control has been tested.

6) Requests and complaints

For questions, access or deletion requests, or concerns about a request to submit identity or biometric information, email [email protected]. Do not attach an ID or biometric file to the email. We may need to verify a request using information already associated with the project and will use a secure method if additional verification is legally necessary.

7) Applicable law

Any enabled workflow must comply with the law that applies to the affected person and processing, including written-notice, consent, disclosure, security, retention and deletion requirements. Mandatory rights are not limited by this notice.