The privacy statement below is intended as a plain english statement that QikID adheres to. Please see here for the full QikID privacy policy.
QikID is an innovative, privacy sensitive solution to promotion and identity management, currently applied to clubs, pubs and other venues which need to market their services and to control patron access in the interests of safety and security. In this application, it would only be available to venues which had a legal right to deny access. QikID provides venue operators with the ability to identify and communicate with patrons without having to record their names or contact details, with the accompanying risk of misuse of customer records (this has become a sensitive and high profile privacy issue). With QikID, venues can quickly and efficiently process entrants at the door, while flagging patrons for special treatment – either positively, such as VIP or favoured status, or negatively – to identify and potentially exclude those with a record of antisocial behaviour.
Individuals enrol with QikID and receive a Qikpass token (card), which they can then present at participating venues. Using a mobile phone application, venue staff can scan a patron’s Qikpass and take their photo, confirming their identity by use of facial recognition technology.
When an individual enrols, either at a venue or on the QikID website, QikID will collect a photo, their name, email address, date of birth, mobile phone number, suburb and postcode (not street address). The applicant also nominates a username which can be anything they choose. On first visit, the patron will need to show evidence of identity (EoI - typically a drivers licence or equivalent) that first and last names and date of birth on which matches the enrolled details – venue staff will only need to sight (not record) the EoI details in order to confirm them and activate and issue a Qikpass. QikID assigns a unique identifier (a lengthy alphanumeric ‘QR code’) to each new individual as they are enrolled. This code has no meaning related to the user , and is not revealed to the client account holders. The QR Code character string does not appear on the Qikpass, which shows only an encrypted ‘pattern’ version of the code, together with the nominated username. If a token/card is lost, enrolled individuals would be assigned a completely new and unrelated QR code, and issued with a new Qikpass.
All that venue staff operators see, when they scan the patron’s Qikpass and take their photo, is a screen which displays any matching records showing enrolment photo, and the matching username, gender and age bracket (e.g. thirtyish), together with an indication of how many lists of each type the individual is on (e.g. one VIP list, no bans or warnings). A confidence level for any match is displayed (e.g97%). Experience suggests that the face recognition function will rarely display ‘alternatives’ but if it does, operators can question the patron to choose the ‘correct user’ – most commonly by reference to their username. The operator then makes a decision whether to admit the patron – this is recorded on the QikID system as accept/reject(decline) QikID will store both the image (photo) taken at the venue, and the date/time/result of each scan, creating a record of each user’s history of venue visits.
Venues may want to identify patrons after they have been admitted (or declined) - for instance in the event of trouble, or lost property. Operators can search for recent authorisations at their own venue – entering either the username or the gender/age range (e.g. male, thirtyish). The system will display matching records, and the operator will typically identify the patron of interest from the displayed photo, which would be the latest image resulting from a scan. They can then request further information about the patron by entering a reason code. QikID rules determine which reason codes will trigger release of which information, and to whom – i.e. to the account holder or to the police. The most common release of enrolment information is of name only, where there is a good reason for the account holder needing it. QikID will notify users by email whenever their Qikpass is scanned, they are added to a list or details are requested. Another use of the enrolment information is for marketing – account holders/venues can ask QikID to send an email (and potentially an SMS) to any patrons that have used that venue(s), but QikID will not release real names, email addresses or phone numbers to account holders for marketing purposes. QikID’s business model relies on this ‘host mailing’ use of the information on behalf of third parties, but it is entirely consent-based, which is also consistent with the Spam Act – every email sent out will contain an ‘unsubscribe’ option.
The QikID system is designed to allow account holders (who may operate multiple venues) to be able to share limited information about each others’ patrons – in the form of indicators that a patron is on one or more lists (favourable such as VIP or negative – banned or warning). However, an account holder could not see which other venue had listed a patron, or any detail of listings, other than their own. Account holders (QikID’s customers) can have multiple venues, and multiple authorised operators (e.g. door staff), each of whom will have a unique logon ID. Only nominated account holder managers are able to manage the patron lists for their account/venues; i.e. banning someone or adding them to a VIP or warning list. QikID maintains a log or audit trail of all transactions, so that it will always be possible to identify which operator is responsible for which transaction e.g. scan/accept/reject, search for recent authorisations or listing.
Individuals who have enrolled with QiKID are entitled to see all the personal information held about them, subject to some limited exceptions, such as if they are being actively investigated for wrongdoing. A web portal will allow QikID token holders to see both their enrolment information and any transactions including authorisations (scan/accept/reject) and listings. QikID goes well beyond this legal requirement for access on request and automatically notifies individuals by email whenever their token has been used, and whenever an account holder/venue has requested further details about them. There are exceptions to the latter type of notification where an account holder, or the police, request that the user not be notified because of a current investigation.
Users can seek correction of personal information about them if they consider that it is not accurate, complete or up-to-date. QikID makes provision in its contract with account holders for appropriate resolution of any challenges to the factual status of any of the information held about users and their transactions.
QikID has designed a high level of security into its system. All data and communications are encrypted (the latter using SSL protocols). All transactions are logged, providing an audit trail which would for instance enable qikID to identify which authorised operator had scanned a user’s token; searched for a username, and /or requested further information about a user, with the time/date of each transaction.
QikID retains both enrolment and transaction information for as long as it is reasonably required for the operation of the system. Our data deletion policy is available here.
 |
 |
 |
 |