Privacy Policy

We are CitizenCard Limited. We issue the Post Office PASS Cards.

We are committed to safeguarding the privacy of our website visitors. This Privacy Policy describes the ways we collect information from and about you, and what we do with the information, so that you may decide whether or not to provide information to us. By accessing postoffice.citizencard.com website or purchasing our services you agree to this Privacy Policy in addition to Post Office PASS Card Terms and Conditions.

1. Our Collection of your Personal Data

If you act as our customer, the information we collect may include your title, full name (given names and surname), date of birth, signature, photo, a copy of document(s) confirming your identity, gender, address, email address, phone number, mobile number, login credentials, transaction information, IP address, product and service selections. We collect personal data from you at several different points, including but not limited to the following:

• when you visit our site
• when you correspond with us as a customer or prospective customer
• when you register as a user of our services and an account is created for you at postoffice.citizencard.com
• when you use our services and apply for a Post Office PASS Card using a postal (paper) form or using our online application process for individuals at postoffice.citizencard.com
• when you contact us via email
• when the site sends us error reports or application analytics data
• when we attempt to verify that a card has been issued by us at pocardverify.citizencard.com or using the PoA Card Verify app available on the Google Play Store and the Apple App Store
• when you use our e-IDVT (Electronic ID Validation Technology) service you will have to agree to your data (photo ID document, liveness check and selfies) being assessed by Yoti Identity Verification for the purpose of document and identity validation.

If you act as a referee to support an application for a Post Office PASS Card, the information we collect may include your title, full name (given names and surname), your signature, job title, professional registration number (if any), name of original document(s) you have seen to confirm applicant’s identity (if any), applicant’s given names, surname and date of birth according to the documents you have seen or records you hold, information confirming whether you know the applicant, how you know them and how long have you known them, any concern you might have regarding the application, business address, email address, phone number, mobile number and IP address. We collect personal data from you at several different points, including but not limited to the following:

• when you visit our site to complete the Digital Referee Declaration Form or the Statement of Truth to support an online application
• when you support and countersign a postal(paper) application
• when you correspond with us as a referee or prospective referee
• when you contact us via email
• when the site sends us error reports or application analytics data
• when we contact you to verify the information provided

2. Our Use of your Personal Data

CitizenCard may use information that we collect about you to:

• deliver the products and services that you have requested as our customer e.g. verify your identity to issue you with a Post Office PASS Card or confirm applicant’s identity if you acted as a referee to support an application
• confirm that you are a legitimate cardholder if a retailer or other organisation needs to verify your card as valid or confirm your age and likeness at pocardverify.citizencard.com or using the PoA Card Verify app available on the Google Play Store and the Apple App Store
• manage your customer relationship and provide you with customer support
• help improve our products and services and customise user experience
• perform research and analysis about your use of, or interest in, our products, services, or content
• communicate with you by email, postal mail, phone or mobile devices about our products or services that may be of interest to you
• develop and display content tailored to your interests on our site
• manage our business including but not limited to: accounting, statistics etc
• enforce our Terms and Conditions.

3. Our Disclosure of your Personal Data to Third Parties

We may share your personal data with third parties only in the ways that are described in this Privacy Policy:

• we provide the Post Office and Yoti, a digital identity company, with the ability to confirm electronically the validity of a cardholder provided that the cardholder has given the Post Office or Yoti their consent to so doing
• we use Yoti Identity Verification software to power our e-IDVT (Electronic ID Validation Technology) service which enables Yoti to submit the ID documents and selfies of suspected fraudsters to law enforcement bodies to help authorities in detection and prevention of fraud
• we provide contact details you have selected (email, letter and/or SMS) using Communications Preferences (see point 9) in your account at postoffice.citizencard.com or on a paper application form to Yoti who may communicate with you (under licence from the Post Office) to: provide information about the Post Office PASS Card, including information about Post Office PASS Card Scheme developments, programme and initiatives, conducting market research; and any other purpose which is obvious or is communicated to you.
• we provide retailers and other organisations with the ability to confirm that you are a legitimate cardholder at pocardverify.citizencard.com or by using the PoA Card Verify app available on the Google Play Store and the Apple App Store, provided that you have given them your consent either by sharing your card details with them, letting them scan the QR code on your card reverse or take a photo of the front of your card
• we use Google Cloud Vision API together with our own machine learning technology to make sure a photo you upload to support your online application complies with passport quality standards; Google does not use an anonymous photo it receives for any other purpose nor share it with third-parties and the photo is deleted right after the processing is done
• we use Google Cloud Vision API to extract full card details from photos taken by the PoA Card Verify app to verify whether the card is genuine or not; Google does not use a photo of a card it receives for any other purpose nor share it with third-parties and the photo is deleted right after the processing is done
• we share your full name and address with our delivery provider, Royal Mail, who deliver your card to you
• we may disclose your personal information to law enforcement agencies to the extent that we are required to do so by law

Post Office PASS Card data is not used for any other purpose.

4. Our Security Measures to Protect your Personal data

We take all reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information. We store all the personal information you provide on our secure password and firewall protected servers in world-class UK data centres. Any personal details you provide via online forms on our website are encrypted with SSL technology to secure the communication between your browser and our servers.

We use Braintree and PayPal to process transactions made at postoffice.citizencard.com so your debit or credit card details are always secure. We do not store credit card or debit card details of our customers. Information about PayPal security can be found at www.paypal.com/uk/​webapps/mpp/paypal-safety-​and-security and details about Braintree security can be found at www.braintreepayments.com/​gb/features/data-security.

5. Our Use of Cookies and Web Analytics Services

Cookies

Cookies are necessary for the full functioning of this site. By using postoffice.citizencard.com and pocardverify.citizencard.com you are providing implied consent to the use of cookies on these sites in accordance with the terms of this policy. You can disable cookies (further information below), but if you do, you may find that parts of our sites will not function correctly for you and we may not be able to complete requests on your behalf such as the online Post Office PASS Card application process. If you do not consent to the use of cookies and wish to disable cookies resulting in impaired website functionality, you should discontinue use of the sites.

Cookies are small text data files that some websites place on your computer or other device when you visit them. They're used by many if not the majority of modern websites. Cookies are linked to the machine you use to visit our sites and not to you as an individual so they are not 'personal' in that sense. Unless you login or provide personal data through your use of our sites, no personal information is collected.

Cookies are commonly used by websites to remember some aspect of your current or previous visit. This could include things like the choices you've made or preferences you've chosen during your visit. Websites commonly do this in order to improve or tailor your current and future visits to that site or other related sites.

Cookies on postoffice.citizencard.com and pocardverify.citizencard.com are also necessary for the correct functioning of some aspects of our sites such as the application process for an identity card. We may use both "session" cookies and "persistent" cookies on our sites. Session cookies will be deleted from your computer when you close your browser. Persistent cookies will remain stored on your computer until deleted, or until they reach a specified expiry date.

The information stored in a cookie can only be read by the website that placed the cookie or other sites that it has agreed to share information with.

We are committed to protecting your privacy and security to ensuring that we meet all regulations. Our policy is to use cookies only to improve your user experience and the way we do business with you, and when they are essential to the practical and technical functioning of the website(s).

We may use cookies to:

• store details that help you apply for and manage your Post Office PASS Card application online which are strictly necessary to the process
• store details that enable us to apply discounts and commission to you
• find out how people use our sites, such as how often they visit, which web browsers and screen resolution they use, which pages they go to, and which links they click on, so that we can improve our sites. For this purpose, we use Google Analytics to provide insight on user visits patterns (such as the most popular pages, or most searched for terms), and cookies stored on your computer will contribute to that data which is collated from all visitors (with cookies enabled).

We do not use cookies to serve you any targeted advertising.

How to turn off cookies:

You can turn off cookies in your browser settings (usually Tools, Options or Privacy Settings). See allaboutcookies.org for more info or consult the 'Help' section of your browser. If you do turn off cookies, please be aware we may not be able to process your online application and other functions on our sites may not work for you.

Web Analytics Services

We use Google Analytics, a service for the marketing analysis of our sites provided by Google, Inc. Google Analytics uses cookies to allow us to see how you use our sites so we can improve your experience. Google’s ability to use and share information collected by Google Analytics about your visits to our sites is restricted by the Google Analytics Terms of Use available at http://www.google.com/analytics/terms/us.html and the Google Privacy Policy available at http://www.google.com/policies/privacy/. You can prevent Google Analytics from recognising you on return visits to our sites by disabling cookies in your browser. If you prefer to not have data reported by Google Analytics, you can install the Google Analytics Opt-out Browser Add-on available at https://tools.google.com/dlpage/gaoptout.

6. Legal Basis for Processing your Personal data

With respect to personal data collected from individuals resident in the United Kingdom, our legal basis for collecting and using the personal data will depend on the personal data concerned and the specific context in which we collect it. We will normally collect personal data from you only where:

• we have your consent to do so;
• where we need the personal data to deliver the services you have requested (e.g. process your application for a Post Office PASS proof of age and ID card); or
• where the processing is in our legitimate interests (and not overridden by your data protection interests or fundamental rights and freedoms).

7. Limiting Use, Disclosure, Retention

We identify the purposes for which the information is being collected before or at the time of collection. The collection of your personal data will be limited to that which is needed for the purposes identified by our company. Unless you consent or we are required by law, we will only use the personal data for the purposes for which it was collected. We will keep your personal data only as long as required to serve those purposes.

Paper records are retained for the following maximum periods after which time they are shredded:

• Successful and failed applicant records – 3 months after an application has been received
• Pending applicant records – 12 months after the initial application has been received.

Digital records are retained for:

• Customers and their digital applications containing applicant’s personal data and their referees - 20 years after record creation so customers can apply for replacement cards without being re-verified, applicants can continue pending applications and we can verify cards as valid either at pocardverify.citizencard.com or when the PoA Card Verify app is used; after 20 years the data is moved to a Secure Archive with restricted access so we can collaborate with law enforcement agencies when necessary
• Electronic communications such as emails - 10 years following the most recent contact made by an applicant or a referee after which the data is deleted
• Photos of cards processed by the PoA Card Verify mobile app - 90 days following image creation after which the data is deleted
• Card verification web-page for a card check made at pocardverify.citizencard.com - 2 minutes following page creation after which the page is deleted
• Card Verification results for checks made at pocardverify.citizencard.com and via the PoA Card Verify app - 5 years following a check after which the data is anonymised (all personal information removed)
• Yoti Identity Verification, our Electronic ID Validation Technology supplier, retains the data for 28 days following the completion of the Identity Verification session
• Royal Mail, our delivery provider, retains the data only for as long as they need to use it to provide the service requested.

8. Your Access to and Updating of your Personal data

Reasonable access to your personal data may be provided upon request made to us via email at [email protected]. If access cannot be provided within that time frame, we will provide the requesting party a date when the information will be provided. If for some reason access is denied, we will provide an explanation as to why access has been denied.

If you are a Post Office PASS Cardholder, you can update your information e.g. address or contact details and we encourage you to do so on via email to [email protected].

If you would like us to delete any personal data held about you, we will do so on request unless we need to hold the information as part of the provision of products and services to you. Data removal requests should be sent (include your name and card number) via email to [email protected].

9. Communications Preferences

We offer those who provide personal contact information a means to choose how we use the information provided (for instance to enable us to communicate via email, letter and/or SMS). You may manage your receipt of communications by clicking on the "unsubscribe" link located on the bottom of our emails.

Users of our services registered at postoffice.citizencard.com can manage their communication preferences in the ‘Update Communication Preferences’ section of their online account.

10. Additional Rights

You may have the right to exercise additional rights available to you under UK applicable laws, including:

Right of erasure. You may have a broader right to erasure of personal data that we hold about you. For example, if it is no longer necessary in relation to the purposes for which it was originally collected. Please note, however, that we may need to retain certain information for record keeping purposes or to comply with our legal obligations.

Right to object to processing. You may have the right to request that we stop processing your personal data and/or to stop sending you marketing communications.

Right to restrict processing. You may have the right to request that we restrict processing of your personal data in certain circumstances. For example, where you believe that the personal data we hold about you is inaccurate or unlawfully held.

Right to data portability: In certain circumstances, you may have the right to be provided with your personal data in a structured, machine readable and commonly used format and to request that we transfer the personal data to another data controller without hindrance.

If you would like to exercise any of the above rights, please contact our support team via email at [email protected]. We will consider your request in accordance with applicable laws. To protect your privacy and security, we may take steps to verify your identity before complying with the request. You also have the right to complain to a data protection authority about our collection and use of your personal data. For more information, please contact your local data protection authority.

11. Changes to our Privacy Policy

CitizenCard may amend this Privacy Policy at any time by posting a new version. It is your responsibility to review this Privacy Policy periodically, as your continued use of this site and our products and services represents your agreement with the then-current Privacy Policy.

12. Contacting Us

If you have any questions about this Privacy Policy, the practices or concerns of this site, please contact our support team via email at [email protected].

Updated 19 January 2023