Privacy Policy

Last updated 23 September 2020

Banuba Limited incorporated and registered in Hong Kong with company number 2360577 whose registered office is at Office A, 16/F Heng Shan Centre 145 Queen’s Road East, Wan Chai, Hong Kong  together with companies in the same corporate group, take your privacy seriously. Please, read carefully this Privacy Policy as it sets out our data processing practices with respect to your data collected via SDK. 

This Privacy Policy refers to Banuba SDK, operated by Banuba Limited, hereinafter – the “SDK”. SDK is delivered to operators of mobile and/or desktop applications, which You installed on Your devices. This privacy policy doesn’t cover any of the products of Operators and refers to operation of Banuba SDK on your iOS devices only. Because we do not collect any data which may be treated as Your (personal) data being associated, linked, derived from your Android devices, this Privacy Policy refers to data processed via iOS devices as described herein.


Apple Identifier for Advertisers (“IDFA”) on Apple is a unique identifier for a mobile device that advertisers use for personalized advertising. It is consistent across all mobile applications and thus allow cross-app tracking. Advertising IDs are non-permanent, non-personal identifiers, which are uniquely associated with your device.
Apple Identifier for Vendor (“IDFV”) means an identifier, which is linked to the vendor od the application and a device where the application is installed. The value of this identifier is the same for apps that come from the same vendor running on the same device. A different value is returned for apps on the same device that come from different vendors, and for apps on different devices regardless of vendor. 
“Your (personal) data” in this Privacy Policy shall mean any data regarding You or users of the SDK, which identifies or allows to identify You.
“Operator” – legal owner of the Product who operates, publishes or makes available Product for general public.
“Product” – certain mobile/desktop applications, which you installed, use, exploit for any purpose and which contain Banuba SDK as an integral part.
“SDK” - software that implements interfaces for face recognition, face tracking in real time and rendering effects, built into Products.

Unless the context otherwise requires: (a) words in the singular shall include the plural and in the plural shall include the singular; (b) any words following the terms “including”, “include”, “in particular”, “for example” or any similar expression shall be construed as illustrative and shall not limit the sense of the words, description, definition, phrase or term preceding those terms.


1.1 By using certain Products you express your acceptance of this Privacy Policy, as such Policy may be amended from time to time. Each time you use Products, you agree to our collection, use, storage, transfer and disclosure of the information that you provide as described in this Policy. 
1.2 If you do not agree to be bound by this Privacy Policy then, please, do not use Products. 


2.1 When you use the Product  we shall automatically collect from you and/or your device certain information, e.g. your IDFV and IDFA, which are combined. In the result we will operate a unique ID, which we may not hack and restore your initial IDFVand IDFA. Without this unique ID we are not able to provide services to Operators. We shall not associate collected IDFA or IDFV with other information about you, as your e-mail, address or other identifying data. As well as we won’t have pure IDFV and IDFA in our systems, only a combined ID is available to us. We can not restore the initial IDFA and IDFV as soon as we possess a combined ID only.  
2.2 As Banuba SDK functionality is fully based on face detection, in order to use the Product Operator shall request a permission to process your images taken by the device camera. However, all images taken by your mobile phone camera shall not be sent to our servers, i.e. we do not have access to such images (we will not collect, share or store them). You should ask Operators if they process your images, what in any event may be dome upon your explicit permission. 
2.3 When using the Products we do not collect information, which identify or allows to identify you, unless Operator voluntarily provides us with such data (in particular, when communicating you right to erase your data).
2.4 In case we start collecting other categories of your personal data, we shall first explain why we collect it and (if applicable) ask for your express consent for such collection and further processing.


We collect your data:
 - When it is provided from the Operator (e.g. when we need to process your request on data erasure).
 - When you install, start or use the Product, where SDK is integrated.


4.1.  The legal bases that we rely upon when processing your personal data are as follows: 
4.1.1. Processing of your personal data as described in Clauses 2.1.1. (collecting of a unique ID, which is a combined IDFA and device ID) is our legitimate interest to improve the performance of our business and provide Operators (and consequently, you) with services Operators/ you request. We pay special attention to your data protection rights making sure that your data protection rights are not overridden by our legitimate interests. These legitimate interests are: (a) to ensure effective administration and management of Banuba SDK use, including ; (b) to understand how you use our Services and how we can improve the customers usage experience; (c) to prevent, detect, or investigate unauthorised use of our services; (d) manage any disputes and accidents and take legal or other professional advice; and (e) anti-fraud reasons.
4.1.2 Contractual necessity covers information that is processed by us in order to provide Operator and, consequently, you with service that Operator has requested – and that we have agreed – to provide to Operator. If Operator decides not to provide access to this data. We will not be able to provide support of SDK in cases of malfunction and invoice the Operator in a timely manner.
4.1.3 Legal obligation covers information that is processed by us to comply with a legal obligation.


4.1 We will process data collected under this Privacy Policy for the purposes of: 
 - delivering the Services to Operator (and consequently, to you), including but not limited to maintenance and monitoring of the proper operation of Banuba SDK, fixing any problems in its operation, administering of Banuba SDK, including troubleshooting, dealing with your enquiries, complaints and requests addressed to Operator in connection with SDK performance and operation);
 - ensuring and protecting the safety and security of Banuba SDK, antifraud purposes, protecting our Intellectual Property Rights;
 - conducting statistical and analytical surveys and researches, in particular, crashes analysis, bug fixing, automation of billing, improving the services and consequently your user experience.
4.2 In case you voluntarily provide us with any additional personal data, we shall process these data solely for the purposes for which they were provided to us and for no longer they are needed to fulfil such purposes.
4.3 We limit access to data we hold about you to employees who we believe reasonably need to come into contact with that information to provide Services to Operators (and consequently, you) in order to fulfil their official duties. These employees are bound by confidentiality obligations and may be subject to liability, if they fail to meet these obligations. We will take all steps reasonably necessary to ensure that your data are treated securely and in accordance with this Privacy Policy.


5.1 We cannot provide all services by ourselves. We must, therefore, share collected information with third parties for the purposes as described in section 4 of this Policy. We also reserve the right to disclose your information (including personally identifiable information) when we are legally required to do so, to disclose your information in an anonymous and aggregated manner, meaning you could not be personally identified from it. 
Your information may become available for the following categories of recipients: 
- the companies being in the same corporate group with us;
- data storage, networking and security providers;
- providers assisting us with a client support;
- any other providers assisting us with delivering and improving the Services.
5.2 We may also share your data when it is required by law and/or any regulatory authority. In such circumstances, we will expressly inform the recipient of the confidential nature of the data shared. 
5.3 Our third-party providers with whom we share your data may be located in non-EEA countries, where data protection and privacy regulations may be different from your home country and offer even lower level of protection. You acknowledge such transfer and processing of your data out of EEA to the countries where data protection and privacy regulations may be different from your home country and offer even lower level of protection. To safeguard your interests when transferring your personal data out of EEA, we will conclude with all out-of-EEA recipients standard data protection clauses adopted by the European Commission or our supervisory authority.
5.4 All third parties with which We share your data only get the minimum amount of data that are reasonably required in order for them to provide their service to us and therefore to you. The use of the shared information by such third parties is strictly limited to the purposes of processing outlined in Section 4 [insert a hyperlink to the Section] and is not permitted for any other purpose. All third parties with which we share your data are required to protect such data in accordance with all relevant laws and regulations and in a manner similar to the way we protect the same. 
5.5 We will not share your data with third parties which are considered as not being able to provide its clients and potential client with the required level of protection.


6.1 We respect the privacy rights of our users, and to the extent required by applicable law, will make reasonable commercial efforts to allow you to access, correct, object to the processing of, delete or port any of your personal data, provided that we are able to properly verify your identity and link it to any personal data in our possession. With respect to your personal data we process (if any) you have the right: 
- to obtain from us the information regarding our processing of your personal data;
- to obtain from us without undue delay the rectification of inaccurate personal data concerning you;
- to obtain from us the erasure of your personal data (your ‘right to be forgotten’);
- to restrict our processing of your personal data, when it is permitted under applicable law; 
- to object processing your personal data where we are processing your personal data: based on our legitimate interests (as set out above). If you ask us to stop processing your personal data on this bases, we will stop processing your personal data unless we can demonstrate compelling grounds as to why the processing should continue in accordance with data protection laws; and for direct marking purposes. If you ask us to stop processing your personal data on this bases, we will stop.
- to obtain from us your personal data in a structured, commonly used and machine-readable format and to transmit those data to another controller without any obstacle on our side;
- to withdraw your consent, where we are relying on consent to process your personal data;
- to lodge a complaint against us with a supervisory authority for GDPR purposes.

6.2 You can always limit collection of your data and/or reset your IDFA by managing your mobile devices:
On Your iPhone, iPad, or iPod touch:

 - Go to Settings > Privacy > Advertising.
- Turn on Limit Ad Tracking and/or press Reset Advertising Identifier. 
Note: If you clear your cache, you'll lose your opt-out setting.
Once you've turned off personalization, Google will no longer use your info to personalize your ads. Ads can still be targeted with info like your general location or the content of the website you’re visiting.
Please contact us via to execute any of the rights as stated above.


7.1 We do not knowingly collect or process personal data from or with respect to children under the age of 13, and you must be 13 years of age or older in order to use Products.
7.2. If you are a parent or legal guardian and believe that your child under the age of 13 has submitted his or her personal data or other data without your consent, permission, or authorization – please let us know immediately, and we will promptly act to remove your child’s data from our database, cease the use of such data and inform any other party we suspect to have access to such data to do the same.


8.1.  Combined IDFA and device ID is retained for as long as we need to deliver services to you unless we have a bases to further process your data as described in the Section 3 of this Policy. 
8.2.  If you request erasure of your data we erase your data from our servers and request our providers to do the same within 30 days upon your request.  
8.3.  With respect to non-personal data We are not limited by any particular retention period.


9.1 We shall update this Privacy Policy from time to time. It is your responsibility to periodically review this Privacy Policy to be aware of the current changes (as we will notify you only about the material changes).
9.2 Any changes to this Privacy Policy with respect to processing of your personal data shall be subject to your prior consent, unless they are required under applicable law.
9.3 Unless otherwise required by law, any changes to this Privacy Policy with respect to processing of your non-personal data and changes with respect to processing of your personal data shall become effective immediately upon their posting on the
9.4 If you do not accept Privacy Policy following an amendment, do not start or continue to use Product.


10.1 If you have any requests concerning your personal information or any queries with regard to this Privacy Policy please feel free to contact us via
10.2 If you consider that our collection, usage, disclosure and/or storage of your personal information violate  any applicable data protection laws we are bound by, please refer your complaints to We will consider them within reasonable time and provide you with an answer.