This Privacy Notice explains how personal data is processed in connection with the GO.CAM Age Verification Solution. It is intended to provide clear and transparent information in accordance with applicable data protection laws, including the EU GDPR, UK GDPR, the UK Online Safety Act (2023), and French Law No. 2020-936.

This notice applies to End Users undergoing age verification via GO.CAM, as well as Business Customers integrating the solution. It does not apply to any data processing carried out independently by the Business Customer on its own platform.

For the purposes of data protection, the Business Customer (Information Society Service) acts as the Data Controller, as it determines the purpose of requiring age verification. GO.CAM acts as a Data Processor, processing data strictly on documented instructions from the Business Customer. However, GO.CAM may act as an independent Data Controller for strictly limited technical or security-related processing where necessary to ensure service integrity, prevent fraud, or comply with legal obligations.

Where GO.CAM acts as an independent Data Controller, the legal bases relied upon under Article 6 UK GDPR are:

• Article 6(1)(f) – Legitimate Interests, for ensuring service security, fraud prevention, business customer account management, supplier and sub-processor management, and certain customer support activities where appropriate.
• Article 6(1)(c) – Legal Obligation, where processing is necessary to comply with applicable legal or regulatory requirements.

GO.CAM has been designed following a privacy-by-design and data minimisation approach. The solution operates primarily through local processing on the End User’s device and does not create user profiles, track individuals, or build any form of behavioural database. GO.CAM does not store or retain identifiable personal data of End Users beyond what is strictly necessary for the operation, security, and compliance of the service.

Depending on the verification method used, certain data may be processed temporarily during the session. This may include a selfie image, an identity document image, partial card information, or an email address used for one-time verification.

When the email-based verification method is used, GO.CAM processes the email address solely for the purpose of sending a one-time verification code. GO.CAM does not store plaintext email addresses. Where technically required, only an irreversible hash may be processed. Plaintext email addresses are neither stored nor logged, whether temporarily or permanently.

These elements are processed locally on the End User’s device or used transiently for verification purposes and are not stored by GO.CAM after the session.

In addition, GO.CAM may process limited technical and non-identifying data strictly necessary for the operation and security of the service. This may include limited device and browser metadata, verification outcome (such as confirmation that the user is above the required age threshold), and anonymised or pseudonymised technical logs. IP addresses may be processed transiently for security and operational purposes but are not stored or retained by GO.CAM.

GO.CAM may rely on a limited number of third-party service providers strictly for technical support functions. For example, during the Email + Code verification method, a partial hashed representation of an email address may be transmitted using a k-anonymity model to a third-party service (HaveIBeenPwned) to assess exposure to known data breaches. No full email address is transmitted, and no personal data is stored by GO.CAM in this process. Where such services involve transfers outside the European Economic Area, appropriate safeguards such as Standard Contractual Clauses (SCCs) are implemented, and only pseudonymised or hashed data is transmitted.

Personal data is processed solely for the purpose of verifying that the End User meets the applicable age requirement, preventing fraud or circumvention of the system, and ensuring the security and reliability of the service. GO.CAM does not use personal data for marketing, advertising, analytics unrelated to security, or any form of user profiling.

GO.CAM applies strict data minimisation and retention principles. Images and identity documents are not retained and are deleted immediately after processing within the session. Email addresses used for verification are not retained. The age verification result may be stored for a limited period where necessary (typically up to 30 days), and anonymised technical logs may be retained for security and audit purposes for a limited duration (typically up to 12 months). All data is automatically deleted or anonymised in accordance with internal retention policies.

End Users may exercise their data protection rights, including the right of access, rectification, erasure, restriction, or objection, either through the Business Customer or directly by contacting [email protected]. However, due to the privacy-preserving architecture of GO.CAM, in most cases no identifiable personal data is retained by GO.CAM, and therefore no data can be retrieved or deleted by GO.CAM.

GO.CAM implements appropriate technical and organisational measures to ensure a high level of security, including local-first processing, encrypted communications (TLS), strict access controls, and the absence of any centralised storage of biometric data.

GO.CAM may use a strictly necessary technical cookie (such as "isAgeVerified") to remember the outcome of a verification session and avoid repeated checks. This cookie does not contain personal data and is not used for tracking or advertising purposes.

For any questions or requests related to this Privacy Notice or data protection, GO.CAM can be contacted at [email protected].

Date of last update: June 2026