Loading capacity…

GDPR Policy

Effective Date: 27/08/2026

At SafeJAM Ltd, we are committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR). This GDPR Policy explains how we collect, use, and protect personal data in connection with our service. We process your data only where we have an appropriate lawful basis, as described in this policy.

1. Data Controller Information

The data controller responsible for processing your personal data is:

  • SafeJAM Ltd
  • Registered in England and Wales, Company Number 13083108
  • Registered Office: 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF

If you have any questions or concerns regarding your data, please contact us at: securityandcompliance@safejam.com.

2. User Rights

Under the GDPR, users have the following rights regarding their personal data:

  • Right of Access: You have the right to request access to the personal data we hold about you. We will provide you with a copy of your data upon request.
  • Right to Rectification: You have the right to request corrections to any inaccurate or incomplete personal data.
  • Right to Erasure: You may request that we delete your personal data under certain circumstances, including when it is no longer necessary for the purposes for which it was collected.
  • Right to Restrict Processing: You can ask us to restrict the processing of your personal data under certain conditions.
  • Right to Data Portability: You may request that we provide your data in a structured, commonly used, and machine-readable format.
  • Right to Object: You have the right to object to the processing of your personal data in certain circumstances.

To exercise any of these rights, please contact us at: securityandcompliance@safejam.com.

3. Data Processing

We only collect and process the minimum amount of personal data necessary to provide our service. This includes:

  • Email Address: We collect your email address when you sign up for our service. This is used to create your account and verify your identity.
  • Payment Information: We collect your payment details to process transactions via Stripe. All payment information is handled securely and is not stored by SafeJAM Ltd. For more details, please see Stripe's Privacy Policy.
  • Identity and Document Data: Where a product requires identity or age verification, Didit processes the identity document you submit and information shown on or extracted from it, including details such as your name, date of birth, nationality, document type and document number.
  • Biometric and Liveness Data: Didit processes selfie or liveness images/video, facial characteristics, face-match results and anti-spoofing signals to confirm that you are a real person and match the document.
  • Technical and Fraud-Prevention Data: Didit processes data such as IP address, browser and device information, timestamps, session data, network-derived location and related fraud or integrity signals.
  • Verification Outcome: SafeJAM stores whether the check is pending, successful or unsuccessful, whether the identity and over-18 requirements were met, and limited administrative metadata such as verification time and Didit session/workflow identifiers.
  • Remote-Session Security Data: We collect network requests, running software and processes, timestamps and session identifiers.

Depending on the processing, our legal bases are performance of our contract with you, compliance with legal obligations, our legitimate interests in securing the service, detecting and investigating abuse, enforcing our terms, supporting compliance and legal claims, and consent. For biometric data used uniquely to identify you, we rely on your explicit consent under Article 9(2)(a) GDPR. You may withdraw consent before or during verification, but products that require verification will then be unavailable.

We use personal data only for purposes including:

  • Providing and maintaining access to the service.
  • Managing your account and subscription.
  • Sending you service-related communications, such as updates or notifications about the status of your account. You will not receive marketing emails from us unless you have explicitly opted in.
  • Verifying your identity and that you are aged 18 or over before providing restricted products.
  • Detecting impersonation, spoofing, document tampering, fraud and abuse.
  • Monitoring remote sessions for security, investigating suspected misuse, and preserving relevant evidence where necessary and lawful.

Didit as Verification Provider

SafeJAM decides when verification is required and how the outcome is used and is generally the data controller. Didit generally processes verification data on our behalf as a processor. Didit may act as an independent controller for limited purposes such as security, abuse prevention, legal compliance, audit logging and legal claims. Didit may use automated systems to assess document authenticity, face match, liveness and fraud indicators.

SafeJAM does not store your identity-document images or details, date of birth, selfie/liveness capture, biometric template, face-match score, IP/device analysis, or Didit's full report. These are processed and held by Didit. For more information, see Didit's Verification Privacy Notice.

4. How to File Complaints

If you believe that your data has been misused or you have concerns about how your personal data is being handled, you can file a complaint by emailing us at: securityandcompliance@safejam.com.

Additionally, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe we have not complied with data protection laws:

5. Data Retention

We will retain your personal data only for as long as is necessary to provide the service or to comply with legal obligations. After this period, we will securely delete or anonymise your data.

Remote-session security data is retained only for as long as reasonably necessary for security review, abuse prevention, compliance, dispute handling or legal claims. Relevant records may be preserved for longer where an investigation or legal hold applies. Access is restricted to authorised personnel and service providers, and relevant records may be disclosed to law enforcement, regulators or courts where required by law or where otherwise lawful and necessary.

SafeJAM retains the verification outcome and limited administrative metadata for as long as needed to manage access, evidence the check, prevent fraud, resolve disputes and meet legal obligations. We configure Didit to retain the underlying verification data for one year from the verification session, subject to earlier deletion or any different period required or permitted by applicable law, a valid legal request, or dispute resolution. Rights requests concerning a Didit verification may be sent to us using the contact details below. The applicable checks and access rules are described in our Identity and Age Verification Policy.

6. Security of Your Data

We take data security seriously and implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, or destruction. This includes encryption of data during transmission and at rest.

7. Changes to This GDPR Policy

We may update this GDPR Policy from time to time to reflect changes in our data processing practices or legal requirements. Any updates will be posted on this page, and we will notify users of significant changes where appropriate.

8. Contact Us

If you have any questions or concerns regarding this GDPR Policy or how your data is being processed, please contact us at: securityandcompliance@safejam.com.