AgeGO’s Privacy Policy for End Users

At AgeGO, your privacy and security are at the core of what we do. Our Age Verification Services are designed to confirm or estimate your age, not your identity, using the least amount of personal data possible. We never collect more than necessary, AgeGO only keeps the limited data needed to operate its services, such as your Account Data if you choose to create one, as explained in this Privacy Policy.

We apply strict technical and organizational safeguards to protect your data and maintain compliance with EU, UK, and US privacy standards. Your verification result is used only to determine access to age-restricted content, and we never share your personal data with unauthorized third parties.

This Privacy Policy explains how we handle your information and your rights in this process. We encourage you to read it carefully.

DEFINITIONS

For the purpose of this Privacy Policy, the following key terms apply:

• We, Us, Our, AgeGO: Refers to Age Verification Technology, S.L., the company providing age verification and estimation services to End Users.
• You, Your: Refers to the individual who uses AgeGO’s services to verify his/her age.
• End User: A natural person who uses AgeGO’s Age Verification Services to confirm that they meet the minimum age requirement set by a Business Customer, typically to access age-restricted content or services.
• Business Customer: An entity that integrates AgeGO’s services into its website or platform to verify the age of its users. The Business Customer determines the purpose of age verification and acts as the Data Controller in that context.
• Age Verification Services: The technical solution provided by AgeGO to determine whether an End User meets the required age threshold. This may include verification or estimation processes using various Verification Methods.
• Verification Method or Estimation Method: A specific process or technology selected by the End User to complete the age check (e.g., selfie scan, ID upload, digital ID, credit card, mobile phone number, etc.).
• Verification Result: The outcome of the age check, indicating whether the End User meets the required age (e.g., verified as 18+, not verified, or verification failed). This result (and only this result) is shared with the relevant Business Customer.
• Account: An optional user account created by the End User on the AgeGO platform that allows them to store and reuse their Verification Result for future verifications, avoiding the need to repeat the age verification process.
• Account Data: Data associated with the End User AgeGO Account, including encrypted email address and/or the Passkey Data; account creation date; verification method used; Verification Result; and verification and access history, including Cross-Site Verification Data where applicable.
• Personal Data: Any information that relates to an identified or identifiable natural person, such as email addresses, biometric data, or identification document images.
• Data Controller: The entity that determines the purposes and means of processing personal data. In most cases, this is the Business Customer that requires age verification from the End User.
• Data Processor: An entity that processes personal data on behalf of the Data Controller. AgeGO typically acts as a Data Processor when providing its services to Business Customers.
• Third-Party Providers: External vendors engaged by AgeGO to deliver specific technical components of the Age Verification Services (e.g., biometric processing, ID authentication). These providers process data under strict contractual and security obligations.
• Liveness Detection: Technical process used to confirm that a facial image or video originates from a real, live person in real-time. This security measure prevents fraud and is performed transiently by AgeGO or by a Third-Party Provider without creating a permanent biometric profile.

1. Who Is Responsible For Your Data?

In the context of the Age Verification Services, AgeGO primarily acts as a Data Processor on behalf of the relevant Business Customer, who determines the purpose and legal basis for verifying your age. AgeGO, through its Third-Party Providers (sub-processors), processes your personal data in these cases solely under the Business Customer’s instructions and does not retain or determine how your sensitive data, such as biometric or ID information, is used. For the Cross-Site Verification feature (described in Section 4 bis below), AgeGO continues to act as a Data Processor on behalf of each participating Business Customer (the originating site and the destination site).

However, if you create an Account with AgeGO, AgeGO becomes a Data Controller only in relation to your Account Data. This limited processing is necessary to allow you to reuse your verified status securely in future sessions, and to ensure proper functioning of your log in and account access features.

AgeGO has appointed a Data Protection Officer (DPO). Any question concerning the processing of your personal data under this Privacy Policy, including requests directed to our DPO, can be sent to privacy@agego.com.

2. Applicability of This Privacy Policy

This Privacy Policy applies exclusively to the processing of personal data in connection with AgeGO’s Age Verification Services provided to End Users. It also applies when an End User chooses to create and use an Account with AgeGO to store or reuse his/her Verification Result for future verifications. In such cases, AgeGO may act as an independent data controller for limited purposes directly related to account management.

This Policy further applies to any personal data exchanged in communications between the End User and AgeGO, including queries sent via email, to our AI Assistant, or contact forms concerning the verification services or account functionality.

However, this Privacy Policy does not apply to the websites, services, or platforms of Business Customers. Nor does it apply to any third-party websites not controlled by AgeGO, or to AgeGO’s general corporate or marketing website, which is subject to separate privacy terms.

3. What Personal Data Do We Process & How Have We Obtained It?

As part of providing Age Verification Services to End Users, AgeGO only processes the minimum data necessary. The categories of personal data involved may vary depending on the age verification or estimation method used, and whether the End User creates an account to reuse a prior verification. Only the Verification Result, which does not contain personal data, is shared with the Business Customer.

Except for the Account Data, Contact Data and, if applicable, our internal Liveness Detection processing, all personal data is handled directly and exclusively by trusted Third-Party Providers under strict contractual safeguards. The categories of personal data processed are (when applicable):

• Email Address: retained only when the End User creates an account to reuse a previously verified status. In such a case, the email address is immediately encrypted.
• Passkey Data: the public key generated by your device and a credential ID used to recognize your Account. The private key is generated and stored on your device (protected by facial recognition, fingerprint, or device PIN) or with your passkey provider (e.g., iCloud Keychain, Google Password Manager), and is never transmitted to, or accessible by, AgeGO. Any biometric data or PIN used to unlock the passkey is verified locally by your device and is never shared with AgeGO.
• Biometric Data: facial image or video stream processed by Third Party Providers or, if applicable, internally by AgeGO for Liveness Detection.
• Document Data: photo of an ID document (e.g., passport, driver’s license) processed exclusively by Third-Party Providers and not retained by AgeGO.
• Financial Data: credit card number, expiration date, CVC processed exclusively by PCI-compliant payment providers and not retained by AgeGO.
• Digital ID Data: government-issued ID and phone number provided directly to the Third-Party Provider and not retained by AgeGO.
• Contact Data: name and email address, where the user contacts AgeGO for support or inquiries through our forms, by email, or when using our AI Assistant. End Users are advised not to share sensitive or unnecessary personal information when using the AI Assistant.
• Cross-Site Verification Data: when you click a link that takes you from one AgeGO-enabled site to another, we process a temporary, single-use token (ag_token), along with basic technical data such as when it was created and checked and which two sites were involved. If you’re signed in to an AgeGO Account, this data is linked to your Account; otherwise, it isn’t linked to you. See Section 4 bis for more detail.

For cookies and related technologies, please consult our Cookies Policy.

4. Why Do We Process Your Personal Data?

We process your personal data to verify your age and enable access to age-restricted content or services, based on the instructions of the Business Customer who integrates AgeGO’s Age Verification Services. In doing so, AgeGO primarily acts as a Data Processor. If the verification process determines that you do not meet the required minimum age, AgeGO only retains a non-identifiable outcome (e.g., underage) for the duration strictly necessary to inform the Business Customer and prevent repeated or fraudulent attempts. No personal data is stored in this case unless otherwise required by law.

However, in certain cases, AgeGO also processes limited data as a Data Controller, such as when you choose to create an Account, or when we implement necessary technical safeguards to ensure service integrity.

Legal bases for processing include:

• Contractual necessity: AgeGO processes your data to provide the age verification service as required by the Business Customer. This is based on the underlying contract between AgeGO and the Business Customer, and in some cases, between AgeGO and you when you choose to create an Account.

• Legal obligation and public interest: In certain jurisdictions (especially within the EU, the UK, and the US), website operators are legally required to verify users’ age before granting access to specific types of content. Processing your data is necessary to fulfill that legal or regulatory requirement on behalf of the Business Customer.

• Consent: When biometric data is processed (e.g., facial images, ID scans), or when optional cookies are used, we request your explicit consent.

• Legitimate interest: AgeGO may rely on its legitimate interest to ensure the proper functioning and security of the interface or to prevent misuse of the verification system. Also, AgeGO may process End Users’ data to operate its AI Assistant, which provides an interactive experience for Age Verification Services and related inquiries. In such cases, AgeGO acts as a Data Controller for this minimal technical data, and processing is strictly limited to what is necessary to improve its services and security. If AgeGO processes data under the legal basis of legitimate interest, it does so only when acting as a Data Controller and ensures that your fundamental rights and freedoms are not overridden.

Some verification methods, such as facial analysis or document matching, involve automated decision-making to determine whether you meet the required age threshold. These systems operate under strict oversight and are limited to age estimation or matching purposes. No decisions are made that produce legal or similarly significant effects beyond age eligibility. You may contact us if you believe an error has occurred and wish to request a review by a human.

4 bis. CROSS-SITE VERIFICATION (AG_TOKEN)

AgeGO offers an optional feature (enabled by a Business Customer), called Cross-Site Cross-Site Verification is an optional feature that lets you move from one AgeGO-enabled site (Site A) to another (Site B) without repeating the age check, if you’ve already verified on Site A. We do this with a short-lived, single-use token (ag_token) added to the link to Site B, which AgeGO checks when you arrive.

The token itself isn’t proof of your age — it’s a secure, single-use pass that lets Site B confirm your verified status with AgeGO. None of your original verification evidence (biometric data, ID documents, financial data, digital ID data) is sent again through this feature..

Lawful basis. Each Business Customer relies on its own lawful basis for verifying your age — typically a legal obligation to do so, or another basis set out in its own privacy notice. AgeGO processes your data for this feature as a data processor, acting on each Business Customer’s instructions.

Data generated by the feature. When Cross-Site Verification is used, we process a limited set of data:

• the verification token itself;
• a reference number already used for your original verification — not linked to you if you’re not signed in, linked to your Account if you are;
• when the token was created and used, and whether it worked; and
• which two sites were involved.

We don’t collect anything you view on either site, and we don’t use third-party cookies or save the token in cookies or local storage.

Retention. The token is valid for five (5) minutes and stops working the moment it’s used. Because it travels as part of the web address, it may remain in your browser history and the destination site’s server logs — but it can’t be reused once it’s expired or been used.

We also keep a limited amount of technical data to operate this feature securely: records of when tokens were created and checked, kept for approximately seven (7) days and then deleted (a small portion of these is kept to monitor and troubleshoot the features performance), along with a verification and access history — a record of when you moved between two AgeGO-enabled sites and whether it succeeded. If you’re not signed in, this history can’t be traced back to you. If you are signed in, it stays linked to your Account for as long as the Account exists.

Some verification methods, such as facial analysis or document matching, involve automated decision-making to determine whether you meet the required age threshold. These systems operate under strict oversight and are limited to age estimation or matching purposes. No decisions are made that produce legal or similarly significant effects beyond age eligibility. You may contact us if you believe an error has occurred and wish to request a review by a human.

5. Third Party Service Providers Processing Your Personal Data

To provide our Age Verification Services, AgeGO relies on trusted Third-Party Providers to carry out certain technical functions, such as facial recognition, document verification, liveness detection, ID wallets, or payment validation.

This means that AgeGO performs the age check using the Verification Method or Estimation Method selected, involving Third-Party Providers. It ensures that such processing takes place directly between the End User and the Third-Party Provider. Therefore, AgeGO does not retain access to the full dataset involved, and the Third-Party Provider is not able to know which website you are seeking access to.

All such Third-Party Providers are bound by written data processing agreements or equivalent contractual instruments. These agreements require them to:

• Act only on documented instructions;
• Implement appropriate technical and organizational security measures;
• Ensure confidentiality and lawful processing under applicable EU, UK, and U.S. privacy laws.

These providers are selected through a due diligence process, and we ensure that data transfers, where applicable, are covered by appropriate safeguards (e.g., Standard Contractual Clauses, adequacy decisions, or certification under the EU-U.S. Data Privacy Framework).

6. Who Can Be The Recipients Of Your Data?

AgeGO does not share End Users’ personal data with third parties except in the following cases:

• Where such third parties act on our behalf and under our instructions, for example, when we use specialized service providers to support the technical operation of the Age Verification Services. These recipients act either as our Data Processors or as sub-processors when AgeGO itself acts as a Data Processor for the Business Customer.

• For the operation of the AI Assistant, queries may be processed by OpenAI (ChatGPT).

All such recipients are contractually bound to comply with strict data protection and confidentiality obligations in accordance with applicable data protection laws, including the GDPR and relevant U.S. data protection frameworks.

AgeGO’s core infrastructure is hosted within the European Union. When we engage service providers, we prioritize those located within the European Economic Area or jurisdictions recognized by the European Commission as providing an adequate level of data protection.

In cases where data needs to be transferred outside the EU/EEA to jurisdictions not recognized as offering adequate protection, AgeGO ensures such transfers are carried out with appropriate safeguards, including but not limited to: Standard Contractual Clauses (SCCs), adequacy decisions, Binding Corporate Rules (BCRs), or any other legal mechanism authorized by data protection authorities. These measures aim to ensure the continued protection and lawful processing of your data in cross-border contexts.

Finally, we may disclose personal data where required to comply with a legal obligation, court order, or binding request from a competent authority, including regulators, courts, or law enforcement agencies. Any such disclosure will be limited to what is strictly necessary and in accordance with applicable legal requirements.

7. How Long Will We Store Your Data?

AgeGO does not retain personal data collected during the age verification process, such as identity documents, facial images, or credit card information. These are processed by Third-Party Providers, who are bound by strict confidentiality and data protection agreements, and deleted once the verification process is completed. When Liveness Detection is performed internally by AgeGO, facial images or video streams are also deleted upon completion.

AgeGO, as the Data Controller, may retain the End User’s Account Data for as long as the Account remains active.

The private key associated with a passkey is never stored by AgeGO; it remains on the End User’s device(s) or with the passkey provider used (e.g., iCloud Keychain, Google Password Manager), and removing it from there is a separate action the End User must perform.

Upon deletion of the Account, the identifying elements of the Account Data — the encrypted email address, or the passkey’s public key and credential ID, as applicable — are permanently and irreversibly deleted. Because these are the only elements capable of linking the remaining Account Data (account creation date, verification method used, Verification Result, and verification and access history, including Cross-Site Verification Data where applicable) to the End User, once they are deleted such remaining data can no longer be associated with an identified or identifiable individual and therefore ceases to constitute personal data under applicable data protection law.

For all other data processing related to age verification, AgeGO acts as a Data Processor on behalf of the Business Customer. As the Data Processor, AgeGO processes personal data strictly in accordance with the instructions provided by the Business Customer, who is the Data Controller for the End User’s data. Therefore, the Business Customer may retain and process data necessary for their own legal or regulatory compliance, which is beyond AgeGO’s scope of control.

8. What Are Your Rights?

We inform you that, in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), and relevant state laws in the United States, you have certain rights regarding your personal data. However, it is important to note that the Business Customer (the website or service operator that utilizes AgeGO for age verification) is the Data Controller for the personal data that is processed in relation to age verification. This means that, for the vast majority of situations, the Business Customer determines the purpose and means of processing your data and, therefore, is primarily responsible for handling your data rights requests.

AgeGO, as the Data Processor, processes your data solely on behalf of the Business Customer, following their instructions, particularly in relation to the age verification process. AgeGO does not make decisions regarding the use or processing of your personal data, except where explicitly stated in this Privacy Policy (e.g., in relation to your Account Information, as explained below).

However, if you choose to create and maintain an Account with AgeGO, AgeGO will assume the role of Data Controller specifically for the personal data associated with your account (Account Data). In this case, you can directly exercise your data rights concerning the information stored by AgeGO, such as the right to access, correct, delete, or restrict processing of this data.

Your rights include:

• Right to access: You can request a copy of the personal data that AgeGO holds about you in relation to your Account (Account Data) to verify that we are processing it lawfully.
• Right to rectification: You have the right to correct any inaccurate or incomplete personal data held by AgeGO.
• Right to erasure: You have the right to request the deletion of your personal data if it is no longer necessary for the purposes for which it was collected or processed, or if you withdraw consent, where applicable.
• Right to restrict processing: You may request that we restrict the processing of your personal data under certain conditions, such as if you contest its accuracy or if you believe the processing is unlawful.
• Right to object: You can object to the processing of your personal data, particularly where the processing is based on legitimate interests or carried out in the public interest.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and transfer it to another service provider, if applicable.
• Right to file a complaint: If you consider that the processing of your personal data violates the regulation or your rights to privacy, you have the right to file a complaint to AgeGO and to the relevant data protection authority in your jurisdiction.
• Right to withdraw consent: Where processing is based on your consent (e.g., biometric verification, use of optional cookies), you may withdraw your consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.

In order to exercise your rights, please contact us — including our Data Protection Officer directly — at privacy@agego.com, or by mail at 16 Marina, 08005 Barcelona, Spain.

9. Responsibility of the End User

By using our Age Verification Services, End Users acknowledge that the information and data they provide are accurate, complete, and truthful. End Users are responsible for completing the verification process in good faith and for following all instructions provided by AgeGO on behalf of the Business Customer.

To maintain the security and integrity of the verification process, End Users must keep all verification codes and credentials confidential. These codes are temporary and typically valid only for a limited period, designed to protect their accounts and personal data. Sharing these credentials with others is prohibited. If you use a passkey, you are likewise responsible for safeguarding the device(s) on which it is stored and for promptly removing a passkey from any device you no longer control.

It is important to note that if the verification process results in a negative outcome (for example, if the system is unable to confirm that the user meets the required age threshold), access to age-restricted content or services may be denied. However, the decision to grant or deny access to the content or services is made exclusively by the Business Customer, not AgeGO. Therefore, while AgeGO performs the verification, the final responsibility for access restrictions lies with the Business Customer.

10. Links To Other Websites

Our website may contain links to third-party websites. Please be aware that these external websites have their own privacy practices, which may differ from those outlined in this Privacy Policy. If you submit personal information to any of these external sites, your information will be governed by their privacy statements and practices. We recommend that you review the privacy policies of any website you visit to ensure you understand how your data will be handled.

11. How Do We Protect Your Data?

We take the security of your personal data seriously and have implemented technical and organizational measures to protect the confidentiality and integrity of the information we process. This includes protecting your data from unauthorized access, alteration, loss, or any unlawful processing methods.

In particular, for End Users’ personal data, we ensure that appropriate security measures are in place. These include secure data transmission and storage practices, access control systems, and contractual agreements with Third-Party Providers. We require these providers to comply with applicable data protection laws, including those of the European Union (e.g., GDPR), the United Kingdom (e.g., UK GDPR), and the United States (e.g., CCPA/CPRA), to ensure compliance with security standards and to enable sufficient auditing of data processing activities.

Additionally, we continually review and update our security measures to adapt to new risks and comply with evolving legislation globally.

12. Modification Of This Privacy Policy

AgeGO reserves the right to modify this Privacy Policy at any time to comply with future legislative, regulatory, or jurisprudential developments, including those related to privacy and data protection laws in the European Union (EU), the United Kingdom (UK), and the United States (US). Additionally, we may update the policy to reflect any changes in how we use or process personal data, whether due to new services, technologies, or other business practices.

If any modifications to this Privacy Policy result in a significant change to how we process your personal data—for example, by introducing new types of data processing or expanding the scope of data use—we will notify you accordingly. This notification may be provided through the AgeGO platform or via email, depending on the nature and extent of the changes.

It is strongly recommended that you review this Privacy Policy regularly to stay informed of any updates. By continuing to use AgeGO’s services after any modifications, you agree to be bound by the updated Privacy Policy.

13. Interrelation With Other Legal Texts

This Privacy Policy is part of a broader legal framework that governs your use of AgeGO’s platform and services. In addition to this Privacy Policy, the following documents are integral to your understanding of the terms and conditions under which AgeGO operates, and together, they form a binding agreement between you and AgeGO:

• Terms & Conditions for End Users: This document outlines the specific terms and conditions under which you are authorized to access and use AgeGO’s age verification services. It includes details regarding your responsibilities, the services provided, limitations of liability, and the rights and obligations of both parties in relation to the use of AgeGO’s platform. By using AgeGO’s services, you agree to comply with these terms. You can access the policy at: Terms & Conditions for End Users.
• Cookies Policy: This policy explains how AgeGO uses cookies and similar technologies to enhance your experience on our platform. It provides transparency regarding the types of cookies used, the purposes for which they are set, and how you can manage or control cookie settings. The Cookies Policy is important for understanding how AgeGO collects and processes data through cookies, and how you can exercise your rights in relation to cookies. You can access the policy at: Cookies Policy.

Together, these documents, including this Privacy Policy, create the full and comprehensive legal framework that governs your interactions with AgeGO. By using AgeGO’s platform, you acknowledge and agree to the terms outlined in these documents.