Fenergo respects your privacy and is committed to protecting personal data in accordance with applicable data protection laws. This Privacy Notice explains how Fenergo processes personal data in connection with the provision and operation of its Software-as-a-Service (SaaS) solutions, primarily as a Data Processor on behalf of its Clients and, in limited circumstances, as an independent Data Controller.
This Notice applies to personal data processed through Fenergo's SaaS solutions, including the Fenergo Portal and Identity Verification (ID&V) capabilities where enabled by Clients as part of their onboarding and verification processes. This includes the processing of identity documents, biometric information and associated verification results.
Fenergo provides SaaS solutions to regulated financial institutions and other organisations (“Clients”), acting primarily as a Data Processor on their behalf. Clients may act as Data Controllers or Data Processors depending on their relationship with the individuals whose personal data is processed. Fenergo processes customer personal data in accordance with the documented instructions of its Clients.
Fenergo's SaaS solutions are hosted on AWS infrastructure managed by Fenergo, while Clients retain control over their customer personal data and the configuration and use of the platform, including Identity Verification (ID&V) capabilities where enabled. Clients are responsible for determining the lawful basis for processing customer personal data and meeting any additional legal requirements applicable to biometric or other special category personal data. Fenergo does not ordinarily access customer personal data within Client tenancies unless authorised for support or maintenance purposes.
Customer personal data processed within the SaaS solution may include identification and contact data (e.g., names, email addresses), regulatory and compliance data, and transaction or onboarding-related information. This information is provided by Clients, their authorised users or individuals interacting with Fenergo's SaaS solutions on behalf of the Client and is processed in accordance with the Client's documented instructions.
Fenergo does not independently collect customer personal data for its own purposes. Where personal data is collected directly from individuals through Fenergo SaaS, including ID&V, this processing is undertaken on behalf of the Client. Where ID&V functionality is enabled, personal data may also include identity-document information, document images, facial images, biometric data used for identity verification, verification outcomes, matching scores and associated audit records.
Fenergo may also process limited pseudonymised cookie, telemetry, log and analytics data generated through the operation of its SaaS solutions for system security, performance monitoring, service reliability and operational administration. Where Fenergo independently determines the purposes and means of such processing, it acts as an independent data controller and relies on its legitimate interests in maintaining the security, integrity, performance and reliability of its SaaS services, except where another lawful basis applies. This processing is distinct from customer personal data processed on behalf of Clients, for which Fenergo acts as a data processor.
Fenergo processes customer personal data solely on behalf of its Clients and in accordance with their documented instructions, for the purposes of providing its contracted SaaS services, including onboarding, identity verification, regulatory compliance and related business processes.
Fenergo does not use customer personal data for its own marketing or profiling purposes, or to train AI models. Any operational reporting is limited to supporting the provision, security and performance of the SaaS services.
Clients retain control over their customer personal data, user permissions, and the configuration and use of Fenergo's SaaS solutions, including identity verification settings, workflows and how verification results are used within their business processes.
Fenergo manages the underlying SaaS infrastructure and does not ordinarily access customer personal data except where authorised by the Client and in accordance with its documented instructions. Where exceptional access is required, it is managed through controlled procedures, including appropriate authorisation, access restrictions, logging and monitoring.
Fenergo uses approved subprocessors, including Amazon Web Services (AWS), to support the provision and operation of its SaaS solutions. These subprocessors are subject to appropriate contractual data protection obligations and are listed on the Fenergo Third Party List, available through the Fenergo SaaS Document Portal. Clients may subscribe to notifications of changes to the list through the Fenergo Webform.
Where ID&V involves approved third-party technology providers, their role and applicable processing arrangements are governed by the relevant service architecture, contractual terms and data protection requirements.
Fenergo may provide AI-enabled capabilities within its SaaS solutions to support automation, efficiency and accuracy. These capabilities are developed and managed in accordance with Fenergo's AI governance framework and applicable legal requirements, with appropriate transparency, explainability, human oversight and client-defined controls.
Fenergo does not use customer personal data to train AI models or independently make business or regulatory decisions on behalf of Clients.
Customer personal data is hosted in the AWS region selected by the Client. International transfers may occur in limited circumstances, including where approved subprocessors operate in different jurisdictions. Where customer personal data is transferred internationally, appropriate safeguards are applied in accordance with applicable data protection laws, including adequacy decisions or standard contractual clauses where required. Further information about applicable transfer safeguards may be requested through Fenergo's Data Protection Officer. All approved subprocessors are listed on the Fenergo Third Party List available on our Fenergo SaaS Document Portal.
Fenergo implements appropriate technical and organisational security measures, including encryption, access controls and continuous monitoring, supported by its ISO 27001 certification and SOC 2 Type 2 assurance report.
Security follows a shared responsibility model. Fenergo is responsible for securing and operating the SaaS infrastructure, while Clients are responsible for managing user access, configuring available security controls and managing the protection, retention and deletion of customer personal data within their tenancy.
Clients are responsible for responding to data subject rights requests relating to customer personal data processed through Fenergo's SaaS solutions.
Individuals may submit privacy requests, concerns or complaints, including those relating to Identity Verification (ID&V) services, directly to the relevant Client or through the Fenergo Privacy Portal. Fenergo will review and appropriately route requests or complaints, including ID&V-related concerns, and work with the relevant Client to support their resolution in accordance with applicable contractual and data protection obligations.
Individuals also have the right to lodge a complaint with the relevant data protection supervisory authority.
Customer personal data processed within Fenergo's SaaS solutions is retained in accordance with applicable legal, regulatory and contractual requirements.
Our clients are responsible for determining the appropriate retention periods for customer personal data processed within their tenancy, including identity verification data and records, and managing its deletion using the functionality available within the platform.
Certain technical, audit and backup records may be subject to separate retention periods where necessary for security, compliance and operational purposes.
Upon termination of services, customer personal data is securely deleted or disposed of in accordance with applicable contractual obligations and established retention and deletion procedures.
For privacy-related questions, please contact:
Attn: Data Protection Officer
Fenergo Limited
Email: DataProtection@fenergo.com
Privacy Portal: Submit a Privacy Request or Complaint
This Privacy Notice will be reviewed periodically to reflect changes to our SaaS services and applicable data protection requirements. Any updates will be published on this page, with the effective date updated accordingly. Individuals and Clients are encouraged to review this page periodically for the latest version.