Not sure which eID setup you need? Find out in a few clicks →

Not finding, what you're looking for?
See more at our Trust Center

Privacy Notice

This privacy notice will inform you as to how Idura ApS (‘Idura’, ‘we’ and ‘us’) collect, process and share your personal data when:

  • we deliver our authentication and verification services,

  • we administer our relation to customers,

  • you visit our website,

  • you participate in events,

  • you communicate with us,

  • we market our services

This privacy notice will also tell you about your privacy rights and how to exercise such rights.

1. Who is data controller?

The data controller for the processing described in this notice is:

Idura ApS
Gammel Kongevej 3E
1610 København V
Denmark
CVR no. 35142207

If you have questions regarding this Privacy Notice, please contact us by email at privacy@idura.eu.

2. Our core services

Idura is an electronic identity broker that provides authentication and verification services to our customers. We do not have a direct contractual relationship to the individuals we authenticate and verify when they engage with a service provider who is a customer of Idura.

When you use your local eID solution to log in to the services of one of our customers, we will process your personal data. To authenticate and verify your identity, we will receive authentication responses from an eID provider in your jurisdiction. Based on this information, we will determine, through automated decision-making, whether we can validate your identity., and we will disclose the relevant information to the service provider associated with your transaction. Our processing of authentication responses may also be enriched with other data we have collected about you. The data with which the authentication response can be enriched can, for example, be your social security number or postal address used to identify you to the service provider's digital self-service solution.

3. For some processing we are a data processor

When we deliver our Idura Signatures Service we will process the document(s) you are signing. Such documents may include other information on you or other individuals than your identity. We do not process this other information for our own purposes. We exclusively process the information included in such documents on behalf of and under the instruction of the customer using our service. For the information included in these documents we are a data processor and not a data controller. Please refer to the privacy notice of the customer using our Idura Signature Service to seek information on the processing of personal data included in documents submitted for signature.

4. Information we collect as a data controller

The types of personal data we may collect about you depends on the purpose for collecting it and the jurisdiction of our customer. This Privacy notice specifically relates to the following purposes:

  • Providing our authentication and verification services

  • Administration of customer relations

  • Providing our website

  • Coordination of events

  • Communication

  • Marketing

In the table below we have for each purpose explained the types of data we process on which types of data subjects and the lawful basis we rely on.

In most situations the information is collected directly from you or the organisation you represent.

When we authenticate and verify your identity, we will receive authentication responses from an eID provider in your jurisdiction.

We may enrich responses from the eID provider with data collected from public registers and customer controlled data sources.

We may also receive information from the customer to whom we provide the authentication service.

As you interact with our website or services, we may automatically collect technical data and usage data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and similar technologies. We may also receive technical data about you if you visit other websites employing our cookies. We will only apply cookies – other than strictly necessary technical cookies - if you have provided your consent. Please see our cookie policy in our Idura Trust Center for further details.

Purpose of Processing
Type of Data Subjects
Type of Data
Lawful Basis
Provision of our Services: eID authentication and verification of individuals (identity, signatures, legal address and age) to providers of digital solutions (Idura customers)
Individuals to be authenticated and verified in relation to e.g. log in to a digital solution or service, document signing, and other identity or age verification.

Name,
Age
Address
E-mail
CPR/Social security no.
IP address
The organisation you represent

Aggregated Risk data (meta data related to the device you use for log-in and network information)(Denmark only)

Enrichment data including but not limited to postal addresses, phone numbers, email addresses, information retained about you by our customers including your right to access the customer’s service.

In some countries our processing activities and lawful basis is based on national law that establishes the legal basis to collect and process your data and to disclose the authentication response to the relevant service provider, (cf. GDPR art 6(1)(c)  or (e))

In Denmark our processing as broker is set out in the Danish Mit-Id act section 13, and in Finland the Finnish Traficom Recommendation 216/2022 S.

In countries where our processing as broker is not based on national law our lawful basis for processing is our legitimate interest (GDPR art 6(1)(f)) to provide services ensuring reliable identity verification and preventing unauthorized access to our customers services, our customers legitimate interest to ensure that only authorized users gain access to their services, and your interest to have secure access to digital services. 

If you allow us to retain your national social security number, to reduce the need to enter personal details on subsequent authentication events, we rely on your  consent (GDPR art 6(1)(a)). (Denmark only)

Customer and supplier administration
Contact persons with our customers, suppliers and other business partners
Name, e-mail, job title and the organisation you represent
Our legitimate interest to communicate with our customers in relation to sale and administration (GDPR art 6(1)(f))
Customer Surveys: Feedback on our products and onboarding procedure for the purpose of improving and developing our products and onboarding procedure.
Contact persons with our customers, suppliers and other business partners

Name, e-mail, job title and the organisation you represent.

Responses to surveys and statements in interviews.

Our legitimate interest in measuring customer satisfaction and opinions in order to improve our products and services (GDPR art 6(1)(f)).

Images and recordings will only be processed with your informed consent (GDPR art 6(1)(a)).

Coordinating events
Participants and potential participants
Full name, email, dietary or other requirements, payment information, job title and city/country of origin
Our legitimate interests to develop, promote, invite to and coordinate and hold events, including to cater for your dietary or other requirements when attending the event (GDPR art 6(1)(f)).
Marketing: To send you newsletters or other marketing
Contact persons with our customers and potential customers.
Name, e-mail, job title and the organisation you represent. Your preferences in receiving marketing from us [and our partners] and your communication preferences.

Our legitimate interest in marketing our services (GDPR art 6(1)(f)).

We will only send you marketing by e-mail or other means of electronic communication if you have given us your consent or we are otherwise allowed to under applicable law.

Website: To enable you to access and interact with our website
Visitors to our website(s)
IP address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
Our legitimate interest to provide you access to our website (GDPR art 6(1)(f)).
Cookies: To improve and customize your browsing experience, to personalise content and ads, to provide social media features and to analyse our traffic
Visitors to our website(s)
Usage data including information about how you use and interact with our website, products and services
We will only apply cookies – other than strictly necessary technical cookies - if you have provided your consent.

To the extent that we have referred to our legitimate interest as the legal basis for the processing of personal data specified above, we have conducted a balancing test for those interests to ensure that our interest is not overridden by your interests or fundamental rights and freedoms. Please contact us if you wish to receive more information on the balancing test.

5.  Automated decision making

When you use our service to access a digital service, we carry out fully automated processing of your personal data to verify your identity and determine our authentication response to our customer who determines whether access should be granted or denied. No human is involved in this decision. We process your identity credentials and authentication data and, in some jurisdictions, aggregated risk data solely for the purpose of verifying your identity in real time. Our customer processes your data and our authentication response to determine if your access should be granted or denied. In countries where our processing as broker is based on national law our lawful basis for automated decision making may be found in National Law (In Denmark our lawful basis is the Danish Mit-Id act section 13(2)).

In other countries our lawful basis relies on that decision-making is necessary for the performance of a contract to which you are party, or is carried out with your explicit consent, in accordance with Article 22(2) GDPR.

You have the right to request that the decision be reviewed by a person; to provide additional context or information relevant to the decision; and to challenge a decision that you believe has been made incorrectly. To exercise any of these rights, please contact us at privacy@idura.eu.

6. Sharing of information collected

We may disclose personal data to third parties:

  • Authentication responses which may include enrichment data and aggregated risk data will be shared with the specific customer whose services you try to access

  • At our website cookies may be set and data collected or transferred to 3rd. parties. We may share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. Please make sure to consult our Cookie settings and our Cookie Policy (Idura cookie policy) available at the website to find information of these third parties and the purposes for which data is collected. We will only apply cookies – other than strictly necessary technical cookies - if you have provided your consent.

  • We may assign your personal data, to any person or entity that acquires all or substantially all of our business, stock or assets, or with whom we merge.

  • when we believe in good faith that disclosure is necessary to establish or exercise our legal rights or defend against legal claims, protect your safety or the safety of others, investigate fraud, or respond to a government request.

  • when required by law we may disclose your personal data to public authorities such as law enforcement authorities

We share information, including personal information, with our trusted third-party service providers that we use to provide services to us and process your data on our behalf and under our instruction, e.g. hosting of data and maintenance IT-systems, analytics and other services for us. These third-party service providers may have access to or process your personal information for the purpose of providing these services for us. We do not permit our third-party service providers to use the personal information that we share with them for any other purpose than in connection with the services they provide to us. We have entered into data processor agreements with our data processors.

7. Transfer to third countries

We will not transfer your personal data to recipients outside EU or EEA unless we have ensured compliance with GDPR Chapter V. 

Some of our third-party service providers are established outside the EEA so their processing of your personal data will involve a transfer of data outside the EEA. However, to ensure that your personal information receive an adequate level of protection we have ascertained that sufficient safety measures have been implemented to allow for the transfer, including where the European Commission have deemed the country to provide an adequate level of protection for personal data; or by use of specific contracts approved by the European Commission (Standard Contractual Clauses) which give personal data essentially equivalent protection as it has in Europe. 

If you require further information about on our current data processors established outside the EEA and the safety measures in place to allow for the transfer of personal data, you can request it from us – please send your request to us by email at privacy@idura.eu.

8. Data retention

We retain the personal information we collect where we have an ongoing legitimate need to do so. When we have no ongoing legitimate need to process your personal information, we will either delete or anonymize it.

Data collected for the purpose of our authentication purposes is generally deleted within minutes after the authentication and verification process is completed.

If you have consented to our retention of your Social Security number, we will retain it for up to 1 year.

We will retain information on contact persons with our customers, suppliers and other partners for as long as the contractual or other relation is in force or until we have been informed that the contact is no longer relevant.

Information on participants to events will be retained for 2 years. Payment and billing information is retained for bookkeeping and tax purposes for 5 full fiscal years after the expiry of the year in which the transaction relates cf. chapter 4 of the Danish Bookkeeping Act.

Technical and usage data will be retained for 1826 days from the collection of data.

Data may be retained for a longer period if we are legally obliged to do so, or if retention is necessary to establish, exercise or defend legal claims.

9. How to exercise your data protection rights

You have certain choices available to you when it comes to your personal information. Below is a summary of those choices, how to exercise them and any limitations.

Under certain circumstances, you have the right to:

  • Request access to your personal information. This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. 

  • Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

  • Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. 

  • Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes. 

  • Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

  • Where processing is based on consent or contract and carried out by automated means you may request the transfer of your personal information to another party (also known as data portability).

  • Where our processing is solely based on your specific consent you have the right to with-draw your consent at any time. Such withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.

If you wish to exercise any of the data protection rights that are available to you then please send your request to us by email at privacy@idura.eu and we will action your request in accordance with applicable data protection laws.

You have the right to complain to your local data protection authority if you are unhappy with our data protection practices. [     In Denmark you can lodge a complaint with Datatilsynet.

10. Changes to this privacy notice

This privacy notice may be updated from time to time to reflect changing legal, regulatory, or operational requirements. We encourage you to periodically consult our website for the latest information on our privacy practices.