How Сan I Request Deletion of My Personal Data

Data deletion refers to the permanent removal of personal data from our systems at the request of users. If you are concerned about your personal data and want to have it deleted, this guide will provide you with all the necessary information.

What is personal data?

Personal data is any information that relates to an identifiable individual, whether directly (for example, name or document number) or indirectly (for example, by combining several data points such as IP address and location data). Personal data may include:

• Name
• Date of birth
• Email address
• Home address
• Phone number
• Document number
• IP address
• Cookie IDs
• Device identifiers
• Biometric data

Who should I contact to have it deleted?

In most cases, the companies you verify with (the platforms where you create an account or use services) act as data controllers. They determine the purposes and means of processing personal data, collect personal data from their customers, and decide how long the data must be retained. These companies also decide how to respond to requests related to data subject rights, including deletion requests.

In such situations, Sumsub acts as their data processor, processing personal data on behalf of these companies and strictly according to their instructions. Sumsub can only act according to the instructions established by these companies.

If you would like your data deleted in this context, you should contact the platform where you completed verification and submit your data deletion request directly to that company. Otherwise, you may contact us via chat on this website or via privacy@sumsub.com, mention the data controller with whom you would like to have your data deleted, and we will make sure to pass your request to them.

In certain situations, Sumsub may also act as a data controller, for example when processing personal data for its own legitimate purposes such as maintaining the security and integrity of verification systems, fraud prevention, improving the services, or complying with legal obligations.

When Sumsub acts as a controller, it independently determines certain purposes and means of processing. In these cases, data subjects may submit requests directly to Sumsub to exercise their data protection rights, including requests for access, correction, or deletion of personal data, subject to applicable legal and regulatory retention requirements. Please direct your requests to privacy@sumsub.com or chat on this website.

Response Time

Under the GDPR and similar privacy laws, organizations must respond to a request for deletion without undue delay and within one month of receiving the request.

If the request is complex or multiple requests are submitted by the same individual, the response period may be extended by up to two additional months. In such cases, the organization must inform the requester of the extension and explain the reasons for the delay.

Please note that receiving a deletion request does not automatically result in immediate deletion. Personal data may need to be retained where processing is required to comply with legal obligations, resolve disputes, enforce agreements, or meet regulatory requirements such as anti-money laundering (AML) or counter-terrorist financing (CFT) laws.