VeriFLY Data Retention Schedule

Registration Data

• First name
• Last name
• Picture
• Email Address
• Public keys (large random numbers - no linkage to the person)
• Device information (make, model and OS version of device)
• Consent to the terms of service and registration privacy notice
• Notification token associated with the device to allow a push notification to be sent to the user

Daon AWS server in EU

Excluding picture which is stored on user’s device

Account Data

The user may explicitly delete their account from within the app, in which case all account data (including Registration data) is immediately deleted from the system.

If the user has not interacted with VeriFLY for 12 months, VeriFLY will delete all account data.

Transaction Data

Anonymous transaction data is retained for analytics.

Strong Association Transaction Data

If a user has consented in the app to having a "strong association" with a service provider.  The user’s personal data (first name, last name and email) will be sent to the service provider with their transaction data.

Strong Association Transaction Data is anonymized within VeriFLY after 3 months and the personal data is deleted.

Trip Data

(not all data is required by all countries)

• Flight details:
  • Departure airport.
  • Departure date and time.
  • Flight number.
  • Carrier.
  • Arrival airport.
• Nationality
• Proof of COVID-19 test:
  • Picture(s) of report and/or PDF(s) of report
  • Test Date.
  • Test Time.
  • Laboratory or prescribing physician
  • Type of Test.
  • Result of Test - (positive / negative) - we will not allow the account holder to upload a positive test.
• Consent to the processing of the health data.
• Travel document number (only required for Brazil).
• Country specify pre-flight registration:
  • If destination countries require the user to complete an on-line form. We ask the user to:
    • Scan the QR code if the country provides one and we store the decoded information.
    • Enter the number if the country provides one and we store the number.
    • Send us the email from the country, if there is no QR code or number and we extract the number from the email, store the number.
• US Attestation (only required for trips into the US).
• Traveler confirmation that they have all the required information to be presented at the airport.
• •  

Daon AWS server in EU

Daon AWS server in EU

Trip Data

The account holder may delete a trip from within the app at any time, in which case all trip data (except for the US CDC Attestation Data) is deleted from the server.

After 30 days, all PII in trip data is removed from VeriFLY (except for the US CDC Attestation Data). 

US CDC Attestation Data

US CDC Attestation data is retained for 2 years as required by the US CDC.

Health Review Partners

Health review partners delete Health Review Data on completion of review and within 30 days of receipt.

Transaction Data

Anonymous trip data (no PII) is retained for analytics.

Pass Data

• Event/Location information
• Name
• Date
• Location
• Nationality
• Health Information:

Consent to the processing of the health data.

• For COVID-19 test:
  • Picture(s) of report and/or PDF(s) of report
  • Name
  • DOB
  • Test Date
  • Test Time
  • Laboratory or prescribing physician
  • Type of Test
  • Result of Test (positive / negative) - we will not allow the account holder to upload a positive test

• For Covid-19 Vaccines:
  • Picture of vaccination certificate
  • Name
  • DOB
  • Vaccine type
  • Dates of Vaccine(s)

• For Digital Vaccination Certificate:
  • COVID-19 Test data OR
  • COVID-19 Vaccine data OR

COVID-19 Medical certificate including name, DOB, date of illness

Daon AWS server in EU

Pass Data

The account holder may delete the Event Pass from within the app at any time, in which case all pass data is deleted from the server.

After 3 months, all PII in pass data is deleted.

Health Review Partners

Health review partners delete Health Review Data on completion of review and within 30 days of receipt.

Transaction Data

Anonymous pass data (no PII) is retained for analytics.

Personal data necessary to manage  electronic commerce platform and to process payment transactions such as:

• Cardholder name
• Email address
• Unique Customer
• Identifier
• Order ID
• Bank Account Details
• Payment Card Details
• Card Expiration Date
• CVC Code
• Date/Time/Amount of Transaction
• Merchant ID
• Location

Stripe Payments Europe Ltd’s Server

Daon AWS Server in EU

Payment Card Details

Payment card details are stored only as long as is necessary to process the payment.

Record of Transactions:

The user may explicitly delete their account from within the application, in which case all such data is immediately deleted from the system, with the exception of such information as Daon is required to keep for legal and accounting purposes.

If the user has not interacted with VeriFLY for 12 months, VeriFLY will delete all such data with the exception of such information as Daon is required to keep for legal and accounting purposes.

Unless deleted as set out above, Daon shall retain such information indefinitely or for as long as Daon requires such information for legal or accounting purposes.