Biometric Information Policy

1. Purpose, Scope, and Incorporation

This Biometric Information Policy (“Policy”) explains how Watch Systems LLC (“Company,” “we,” “us,” or “our”) collects, uses, discloses, protects, stores, and destroys Biometric Identifiers and Biometric Information in connection with OffenderWatch^® Remote Express (“Remote Express”) and other Company Applications. It applies to every User who accesses or uses Remote Express, no matter where the User lives. This Policy is part of the Watch Systems LLC Registrant Terms of Use (“Registrant Terms of Use”). The Registrant Terms of Use, this Policy, the Privacy Policy, and the SMS Terms & Conditions (together, the “Agreement”) govern the User’s access to and use of Company Applications. If this Policy conflicts with the Agreement, this Policy controls with respect to treatment of a User’s Biometric Identifiers and Biometric Information only. This Policy applies only to the collection, use, disclosure, protection, storage, and destruction of Biometric Identifiers and Biometric Information. All other personal information collected by Company, including Registration Information, is governed by the Privacy Policy.

As of the effective date of this Policy, the United States does not have a single, comprehensive federal law that generally regulates biometric privacy. Federal rules for specific industries or types of information may still apply. These include the Federal Bureau of Investigation Criminal Justice Information Services (“CJIS”) Security Policy when Company handles Criminal Justice Information. Company bases this compliance program on the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (“BIPA”), which requires a written policy when handling biometric information. 

2. Definitions

“Biometric Identifier” means data generated by automatic measurements of an individual’s biological characteristics. It includes a retina or iris scan or image, fingerprint, voiceprint, palm or hand geometry, facial geometry, facial map, facial template, face embedding, vein pattern, gait, and any other unique biological, physical, or behavioral pattern or characteristic. It does not include data created from a Photograph, video, or audio recording, unless the applicable law expressly treats such data as biometric.

“Biometric Information” means any information, no matter how it is captured, converted, stored, or shared, that is based on, comes from, or is linked to a Biometric Identifier and is used or intended to be used to identify, authenticate, or verify an individual. Biometric Information includes a Face-Geometry Template, facial map, facial template, face embedding, match score, or other representation derived from a Biometric Identifier. It also includes “biometric data” as that term is used in applicable Biometric Laws.

“Biometric Laws” means all applicable federal, state, and local statutes, ordinances, regulations, rules, and binding government requirements that govern Biometric Identifiers, Biometric Information, or related privacy, notice, consent, collection, use, disclosure, sale, security, retention, destruction, breach response, automated decision-making, or profiling. Biometric Laws include, without limitation, the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq.; the Texas Capture or Use of Biometric Identifier Act, Tex. Bus. & Com. Code § 503.001 (“CUBI”); Washington’s biometric identifier statutes, RCW 19.375; and comprehensive state privacy laws that address biometric data or sensitive data, including those of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, New York, Oregon, Tennessee, Texas, Utah, Virginia, and Rhode Island, as amended or replaced. Biometric Laws also include applicable future amendments, replacement statutes, local ordinances, and federal sector-specific requirements, including the CJIS Security Policy where applicable. Whenever an applicable Biometric Law requires or allows them, Company follows the separate consent, notice, security, retention, destruction, and incident-response practices in this Policy.

“Company Applications” means the applications that User can access through or that Company makes available through its website at www.offenderwatch.com, including Remote Express.

“Face-Geometry Template” means a mathematical, algorithmic, or machine-readable representation of a face’s geometry or other distinctive features. It is generated to compare one face image with another for identity verification and includes a facial map, template, embedding, or similar representation.

“Photographs” means digital images of an individual, including a selfie submitted through Remote Express and any mugshot kept by a registering law enforcement agency. As of the current date of this Policy, Photographs are not Biometric Identifiers and not Biometric Information under Biometric Laws and the processing of Photographs is addressed in the Privacy Policy.

“Privacy Policy” means Company’s privacy policy for collecting and using personal data, including the Photographs, which is part of the Agreement, and can be accessed at https://www.offenderwatch.com/privacy-policy

“Registration Information” means personal information that a User provides through Company Applications as required by applicable sex-offender registration laws. It includes the User’s name, username, address, email address, password, vehicle, and other required information.

“SMS Terms & Conditions” means Company’s governing the transmission of SMS texts to Users, which is part of the Agreement and can be accessed at https://www.offenderwatch.com/sms-terms-and-conditions

“User” means you, the individual who accesses or uses Remote Express. “You” and “your” refer to the User.

3. What We Collect and Use

Remote Express is a Company Application that lets eligible Users who are subject to sex-offender registration obligations submit registration updates remotely. To verify the identity of the User who submits an update, Remote Express creates a Face-Geometry Template from the User’s submitted selfie and compares it with a Face-Geometry Template created from the mugshot kept by the User’s registering law enforcement agency.

This Policy applies only to the Face-Geometry Template. Processing of Photographs and all other personal information collected and used as part of the registration update is addressed in the Privacy Policy. 

4. Purpose and Limited Use

Company generates and uses Face-Geometry Templates only to verify the User’s identity when the User submits a registration update through Remote Express. Company provides the result to the reviewing officer of the registering law enforcement agency as decision support. The reviewing officer makes the final approval decision after reviewing the User’s Photograph, the mugshot on file, the match score, and other submission information side by side.

Company does not use Face-Geometry Templates or other Biometric Information for advertising, improving products, training models, marketing, research, sale, or any purpose unrelated to identity verification. COMPANY DOES NOT USE BIOMETRIC INFORMATION FOR AUTOMATED DECISION-MAKING OR PROFILING BEYOND THE LIMITED IDENTITY-COMPARISON FUNCTION DESCRIBED IN THIS SECTION. A biometric comparison result alone does not determine the User’s legal registration status or obligations.

5. Retention and Destruction Schedule

Company maintains this written schedule for retaining and destroying Biometric Information as a baseline under the Biometric Laws, including BIPA. 

a. Company does not store or retain the Face-Geometry Template generated to verify your identity. Company generates the Face-Geometry Template in volatile computer memory only for the duration of that comparison event. Company Applications do not keep the generated facial-geometry data.

b. Company performs all identity verification entirely within its own security-controlled infrastructure. Company processes Face-Geometry Templates and Photographs on servers it owns and controls. Company never transmits them to, or receives them from, Paravision or any other third party.

c. Company destroys Face-Geometry Templates immediately after each comparison event ends. Company deletes any temporary match score or other biometric output at the same time and does not include it in audit records that it keeps.

Company may keep audit records of verification events, including timestamps, the verification outcome, submission-location metadata, and the reviewing officer’s identity, for as long as the registering law enforcement agency and applicable law require. Audit records do not contain the Face-Geometry Template or temporary match score. Audit records are not Biometric Information, and their retention and destruction are governed by the Privacy Policy.

Company keeps a record of the User’s separate biometric consent. The record includes the timestamp, the version of this Policy in effect when the User consented, and the consent language presented. Consent records do not contain the Face-Geometry Template, are not Biometric Information, and their retention and destruction schedule are governed by the Privacy Policy.

Photographs, including a selfie that an authorized officer promotes to the current mugshot of record, are records of the registering law enforcement agency. That agency keeps them as required by its applicable statutory and regulatory records-retention obligations, which may require keeping them indefinitely. The Privacy Policy governs Photographs separately, and they are not Face-Geometry Templates.

6. No Sale, Lease, Trade, or Profit

COMPANY DOES NOT AND WILL NOT SELL, SHARE, LEASE, TRADE, RENT, MONETIZE, OR OTHERWISE PROFIT FROM a User’s Face-Geometry Template or other Biometric Identifier or Biometric Information. Any Agency Fee is charged only for the identity-verification and remote registration service offered through Company Applications. It is not payment for, and is not charged in exchange for, any Biometric Identifier or Biometric Information. No separate amount is assigned to biometric data, and the Agency Fee does not give a User any ownership interest in biometric data.

This Policy applies to Remote Express and all biometric processing through Company Applications. Company will not start new biometric processing or materially change the purpose, retention, disclosure, or technology used for existing biometric processing without updating this Policy and the applicable consent flow as required by Biometric Laws.

7. Disclosure Restrictions and Vendor Management

Company will not disclose, redisclose, or otherwise disseminate any Biometric Identifier or Biometric Information, including a Face-Geometry Template, unless applicable Biometric Laws expressly permit it, the User authorizes it, or valid legal process requires it. Company does not disclose the Face-Geometry Template to the registering law enforcement agency. The Agreement and Privacy Policy govern any verification outcome or Photograph, shared with that agency. None of those items is the Face-Geometry Template. Company cannot disclose a Face-Geometry Template after the comparison event ends because it does not store Face-Geometry Templates after the event.

Company licenses its facial-recognition software from Paravision, Inc. Company deploys and operates the software entirely within its own security-controlled infrastructure. Company processes Face-Geometry Templates and Photographs on servers it owns and controls. Company never transmits them to, or receives them from, Paravision or any other third party. Paravision does not access, receive, keep, or use any Face-Geometry Template or other image generated in connection with Remote Express. This is a software license, not a data-sharing relationship. Law enforcement agency customers may request a written summary of the Paravision arrangement.

8. Security and Standard of Care

Company stores, transmits, and protects Biometric Information with the same or a higher level of care it uses for other confidential and sensitive information, consistent with applicable Biometric Laws. Company performs all identity verification entirely within its own security-controlled infrastructure. Because Company does not store or keep Face-Geometry Templates, its security program focuses on protecting the Remote Express session, Photographs, consent records, audit records, other personal information collected, including Registration Information, and the systems that generate and destroy Face-Geometry Templates.

a. Transport-layer encryption for all data sent between the Remote Express mobile application and Company platform services;

b. Encryption of all data, including Photographs, consent records, and audit records while they are stored, together with strong key-management practices;

c. Role-based access controls, access limited to what each person needs, and multi-factor authentication for the Company platform and Remote Express agency review interface;

d. Auditing and logging access to all data, including Photographs, consent records, and audit records, along with periodic risk assessments, vulnerability assessments, penetration testing, and reviews of unusual activity; and

e. Administrative, physical, and technical safeguards designed to keep temporary biometric processing separate, prevent unauthorized access or disclosure, and ensure the immediate destruction of Face-Geometry Templates and other temporary biometric outputs.

9. Rights of Users

Because Company does not store or keep Face-Geometry Templates after comparison, the no-retention and destruction practices in Section 5 above fulfill any request to delete a Face-Geometry Template and other rights, such as access or correct, may not be possible. Subject to Biometric Laws, other applicable law, and the Agreement, Users have the following rights regarding their Biometric Information.

a. Receive a copy of this Policy when you give separate biometric consent and later upon request;

b. Withdraw consent to future biometric processing at any time. Withdrawal will stop future biometric comparisons through Remote Express and may require the User to complete registration in person;

c. Request information about the types of Biometric Information disclosed, why it was disclosed, and the types of recipients, to the extent applicable law requires; and

d. Submit a complaint or privacy request to Company using the contact information in Section 11 below and seek any remedies available under applicable law.

Users may have other rights with respect to Photographs, consent records, audit records, and other personal data under the Privacy Policy. 

10. Updates to This Policy

Company may update this Policy from time to time. For a material update, Company will revise the effective date and version number for this Policy and notify Users before materially different biometric processing begins. Company will require a new separate biometric-consent step when applicable law requires it. Historical versions are available upon written request.

11. Contact

Send questions or requests about this Policy to Company at:

Watch Systems, LLC
4 Sanctuary Blvd, Mandeville, LA 70471
Email: privacy@offenderwatch.com