Biometric Data Policy and Retention Schedule

• Off by Default
• What We Collect
• Purpose and Term
• Retention Schedule
• Destruction
• No Sale, No Profit
• Disclosure
• Consent Is the Operator’s Duty
• Your Rights
• Contact

Off by Default

Argus does not collect biometric identifiers unless a store operator affirmatively turns a biometric feature on. Loss prevention runs without them. Where no biometric feature is enabled, Argus performs object and pose detection and does not create or store a template used to identify a particular person.

This policy applies only where an operator has enabled such a feature. If you are a shopper or an employee and want to know whether a specific store has, ask that store, or contact us using the details below and we will tell you who to ask.

What We Collect

Where a biometric feature is enabled, Argus may create and store biometric identifiers and biometric information as those terms are defined by the Illinois Biometric Information Privacy Act (740 ILCS 14/10), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001), and comparable state laws.

We do not collect voiceprints, retina or iris scans, fingerprints, or hand or palm geometry.

Purpose and Term

Biometric data is collected and used for one purpose: to provide the loss-prevention, labor, and operational features the store operator has enabled, on that operator’s instructions. We do not use it for any other purpose.

We do not use biometric data to train or improve our models.

The term of collection and use runs for as long as the operator keeps the feature enabled and the individual continues to interact with that operator’s locations, subject to the schedule below.

Retention Schedule

We permanently destroy biometric identifiers and biometric information at the earliest of the following, whichever occurs first:

• When the initial purpose for collecting it has been satisfied.
• Within three years of the individual’s last interaction with us.
• Within 30 days of the store operator disabling the biometric feature, closing its account, or instructing us to delete it.
• Within 30 days of an individual withdrawing consent, where consent was the basis for collection.
• Any shorter period the store operator configures, or that applicable law requires.

A store operator may set a shorter retention period than the ones above. It may not set a longer one.

Destruction

Destruction means the record is deleted from our production systems and is not recoverable through ordinary means. Encrypted backups are cycled on a rolling basis and any copy in a backup is destroyed when that backup expires.

We may suspend destruction of a specific record where a legal hold, a court order, or an active investigation requires it, and only for as long as that requirement lasts. We destroy the record when the hold lifts.

No Sale, No Profit

We do not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information. Not to advertisers, not to data brokers, not to anyone.

Disclosure

We disclose biometric data only:

• To the store operator whose location collected it.
• To a subprocessor that hosts or processes it for us under written terms at least as protective as this policy.
• Where the individual, or their legally authorized representative, consents.
• Where a valid warrant or subpoena requires it, or where federal, state, or local law otherwise requires it.

Argus does not proactively provide biometric data to law enforcement. We do not match a person against any watchlist, and we do not share biometric data between store operators.

Consent Is the Operator’s Duty

The store operator, not Argus, has the relationship with the people in its locations. Before any biometric identifier is captured, the operator must give written notice that it is being collected, state the purpose and the term, and obtain a written release, where the law requires it. Our agreement with operators requires this, and requires them to post notice.

If we learn that an operator is capturing biometric data without the notices and consents it is required to obtain, we may suspend the feature for that operator.

Your Rights

If you believe a store using Argus has collected your biometric data, you can ask us what we hold and ask for it to be deleted. Write to privacy@useargus.co with the store location and an approximate date so we can find the record. We will respond within 30 days.

Because we hold this data on the store operator’s behalf, we may need to direct part of your request to them, and we will tell you when we do.

Contact

Questions about this policy: privacy@useargus.co, or Argus Vision, Inc. See also our Privacy Policy, our Data Processing and Consent Agreement, and the full legal index.