1. Purpose
ZKTeco USA LLC d/b/a Armatura Global Solutions (“ZKTECO USA”) is committed to protecting the privacy and security of biometric data entrusted to us. This Biometric Data Privacy Policy describes how ZKTeco USA collects, stores, uses, protects, retains, and destroys biometric data when providing biometric-enabled hardware, software, and cloud services. This Policy also describes how ZKTECO USA handles the biometric data of its own employees and contractors.
This Policy is intended to comply with applicable federal, state, and local biometric and privacy protection laws, as amended from time to time.
ZKTECO USA reviews this Policy periodically as new state or local biometric privacy laws take effect and updates it as described in Section 17 below.
2. Scope
This Biometric Data Privacy Policy (“Policy”) applies to all biometric-enabled products, services, websites, software applications, cloud platforms, hardware devices, mobile applications, and related solutions provided by ZKTECO USA LLC d/b/a Armatura Global Solutions (“ZKTECO USA,” “Company,” “we,” “our,” or “us”), including, but not limited to, MySmartGuardPlus, Cielo365, and Atlascloud, and any current or future products, services, or solutions offered by the Company that collect, process, store, transmit, or otherwise handle biometric identifiers or biometric data.
This Policy applies to:
- ZKTECO USA employees, contractors, and other individuals whose biometric data ZKTECO USA collects directly;
- Customers and authorized users of ZKTECO USA biometric products, software, cloud services, and related solutions;
- Individuals whose biometric identifiers or biometric templates are processed through ZKTECO USA products or services; and
- Third parties authorized to receive biometric data maintained by ZKTECO USA.
3. Definitions
Biometric Identifier
A biological characteristic used to identify an individual, including but not limited to:
- Fingerprint
- Facial geometry
- Finger vein
- Palm vein
- Iris
- Retina
- Other unique biological characteristics recognized under applicable law
Biometric Data (Template)
A mathematical or encrypted representation generated from a biometric identifier for authentication or identification purposes.
A biometric template is not an image and, as implemented in ZKTECO USA products, is not designed to be used to reconstruct the original biometric identifier.
4. How Technology Works
ZKTECO USA biometric devices use biometric technology to authenticate individuals.
During enrollment:
- The device temporarily captures an image of the individual’s biometric identifier.
- The device converts the captured image into a mathematical biometric template.
- The original biometric image is generally deleted following template generation, unless retained based on the applicable product configuration.
During authentication:
- A temporary biometric scan is compared with the stored template.
- Authentication occurs only if the templates match.
- Temporary images used during authentication are generallydeleted promptly after processing, subject to the applicable product configuration.
5. Images Are Not Stored by Default
By default, ZKTECO USA products do not permanently store fingerprint, facial, palm, iris, or other biometric images. Only the biometric template is retained for authentication purposes.
Images may only be retained if:
- expressly enabled by the customer,
- permitted under applicable law, and
- supported by the specific product configuration.
Where images are retained, they are treated as biometric identifiers and are subject to the same security, retention, and destruction commitments in this Policy.
6. Collection and Use of Biometric Data
ZKTECO USA collects, processes, and stores biometric templates solely for the following purposes:
- Identity verification
- Physical access control
- Time and attendance
- Logical access authentication
- Security monitoring
- Customer-requested authentication services
ZKTeco USA does not use biometric data for marketing, advertising, profiling, or inferring characteristics such as age, gender, race, or health, and does not use biometric data to train or improve algorithms or models, except where separately authorized by the individual or required by applicable laws and regulations.
7. Storage of Biometric Templates
Depending on the customer’s system configuration, biometric templates may be stored:
- on the biometric device;
- within the customer’s own infrastructure;
- within ZKTECO USA-hosted cloud services when subscribed to by the customer; or
- in encrypted backup systems necessary for service continuity, which may be operated by ZKTECO USA, its affiliates, or its service providers.
Templates are not publicly accessible.
Where biometric templates are stored in ZKTECO USA-hosted cloud services on a customer’s behalf, ZKTECO USA acts as the customer’s service provider or data processor, processes such biometric templates in accordance with applicable contractual arrangements and legal requirements.
Where applicable, ZKTeco USA stores and processes biometric data through cloud-based services on behalf of its customers. ZKTeco USA may engage affiliates and third-party service providers to provide hosting, maintenance and technical support services, subject to applicable contractual and security safeguards.ZKTECO USA does not collect, store, or access biometric data collected and stored by customers on their own devices or infrastructure, except (i) temporary access during a remote troubleshooting session initiated and authorized by the customer, which may be performed by ZKTECO USA or affiliate support personnel, and (ii) biometric data that the customer elects to store in ZKTECO USA-hosted cloud services, which is governed by this Policy.
8. Security Measures
ZKTECO USA uses commercially reasonable administrative, technical, and physical safeguards designed to protect biometric data, including, where appropriate:
- encryption during transmission;
- encryption at rest;
- access controls;
- role-based permissions;
- authentication controls;
- audit logging;
- secure hosting environments;
- network monitoring; and
- periodic security reviews.
Biometric templates receive protection appropriate to their sensitivity and applicable legal requirements.
In the event of a security incident involving biometric data stored in ZKTECO USA-hosted cloud services, ZKTECO USA will provide notifications and assistance as required by applicable law and contractual obligations.
9. Disclosure of Biometric Data
ZKTECO USA will not disclose biometric identifiers or biometric templates except:
- with the individual’s or customer’s authorization;
- to ZKTECO USA’s affiliates and service providers acting on ZKTECO USA’s behalf under confidentiality and security obligations, and, where required by applicable law, with the individual’s consent;
- when required by applicable law, subpoena, or court order;
- to complete a customer-authorized transaction; or
- as otherwise permitted under applicable law.
ZKTECO USA does not sell, lease, trade or otherwise profit from biometric data.
10. Data Retention and Destruction
ZKTECO USA retains biometric identifiers and biometric templates only for as long as reasonably necessary to fulfill the purpose for which they were collected, to provide requested products or services, or to comply with applicable law and in no event longer than the maximum periods described below.
ZKTECO USA’s retention and destruction practices are designed to comply with applicable federal, state, and local privacy and biometric data protection laws, as amended from time to time. Unless a shorter period is required by contract or applicable law:
- Biometric templates will be deleted upon the customer’s written deletion request, as described in Section 12 below; and
- Templates associated with terminated cloud services will be deleted within thirty (30) days after service termination, subject to standard backup and disaster-recovery schedules, and archived backup copies will be securely deleted on a rolling basis consistent with the retention limits described above.
Where ZKTECO USA acts solely as a service provider or data processor and biometric templates are stored exclusively on customer-controlled devices or infrastructure, the customer remains responsible for establishing and applying a retention schedule that satisfies applicable law and for the timely destruction of biometric data on its own systems.
This retention and destruction schedule is made publicly available as described in Section 19 below.
11. Customer Responsibilities
Customers using ZKTECO USA biometric products are responsible for complying with all applicable biometric privacy laws.
Customers should, where required by law:
- provide appropriate notice before collecting biometric data;
- obtain written consent or releases from affected individuals before enrollment, and retain records demonstrating such consent;
- where required by applicable law, limit any employee, contractor, or worker consent requirement to legitimate purposes such as access control, timekeeping, or safety, and not condition employment, continued employment, or an application for employment on an individual’s consent to unrelated processing (e.g., location tracking or productivity or application monitoring) not required for the biometric product or service being deployed;
- establish publicly available retention schedules and destruction policies where required;
- respond to requests from data subjects;
- securely delete biometric data when no longer needed; and
- comply with all applicable federal, state, and local laws.
ZKTECO USA does not provide legal advice regarding customers’ compliance obligations and recommends customers consult qualified legal counsel to confirm their specific notice, consent, and retention obligations.
12. Customer Deletion Requests
Customers may request deletion of biometric templates maintained within ZKTECO USA-hosted cloud services by submitting a written request to ZKTECO USA.
Where biometric templates are stored solely on customer-controlled devices or infrastructure, customers are responsible for deleting such data.
Individuals whose biometric data is collected by a customer should direct access, deletion, or other requests to that customer. If ZKTECO USA receives such a request, it will forward the request to the relevant customer and assist the customer in responding, as required by applicable laws and regulations. Where ZKTECO USA is itself responsible for the data, such as biometric data of its own employees or data collected directly through a consumer-facing service, ZKTECO USA will respond to such requests directly using the contact information in Section 18.
13. Consent
Where required by applicable law, customers should obtain informed written consent from each individual before collecting or storing biometric identifiers or biometric templates. ZKTECO USA strongly recommends maintaining records demonstrating such consent.
In addition, where ZKTECO USA’s own hosted cloud services directly capture, receive, or store biometric identifiers or biometric templates under ZKTECO USA’s control, ZKTECO USA will, where required by applicable law, (a) provide its own notice describing the collection, storage, and retention practices applicable to that service, and (b) require confirmation – from the customer or directly from the individual – that any consent necessary under applicable law has been obtained before enrollment in that service is completed. This additional step is intended to address ZKTECO USA’s own potential direct obligations as an entity in possession of biometric data, and does not relieve customers of their independent consent and notice obligations described in Section 11 above.
Where ZKTECO USA collects biometric data from its own employees, contractors, or visitors, ZKTECO USA provides the written notice and obtains the written release required by applicable law before collection, and applies the retention and destruction schedule described in Section 10 above.
14. Third-Party Services
If customers integrate ZKTECO USA products with third-party software or cloud services, those third parties may have separate privacy policies governing biometric data.
ZKTECO USA is not responsible for the privacy or security practices of third-party providers outside ZKTECO USA’s control.
15. Compliance with Law
Nothing in this Policy is intended to replace or limit obligations imposed by applicable privacy laws.
Customers remain responsible for determining the legal requirements applicable to their operations and should consult qualified legal counsel regarding compliance.
16. Disclaimer
ZKTECO USA provides biometric hardware, software, and cloud services as technology tools.
ZKTECO USA does not control how customers collect biometric data from individuals and is not responsible for customers’ failure to comply with applicable biometric privacy laws, obtain required notices or consents, or establish legally required retention or destruction policies, except to the extent ZKTECO USA has independent obligations under applicable law.
To the maximum extent permitted by law, customers assume responsibility for their use of ZKTECO USA products and services in connection with biometric data.
17. Changes to This Policy
ZKTECO USA may update this Policy from time to time to reflect changes in technology, applicable laws, or business practices, including new or amended state and local biometric privacy laws.
Each version of this Policy will display an effective date and version number. The revised Policy will become effective upon publication unless otherwise stated, and the then-current version will supersede all prior versions.
18. Contact Information
ZKTECO USA LLC d/b/a Armatura Global Solutions
Email: privacy@zktecousa.com
Website: www.zktecousa.com
For questions regarding this Biometric Data Privacy Policy or requests concerning biometric data processed by ZKTECO USA, please contact us using the information above.
19. Public Availability of This Policy
Consistent with applicable biometric privacy laws that require public disclosure of retention and destruction practices, this Biometric Data Privacy Policy is made publicly available on ZKTECO USA’s websites at www.zktecousa.com, atlascloud.io, cielo365.com, and mysmartguardplus.com.