Terms and Conditions for Samleikin

Approved - Version 3.0

Dear User of Samleikin:

When you create Samleikin, you simultaneously adopt and accept the terms and conditions governing the use of Samleikin. The terms and conditions for use are set forth in this document. Please read it carefully.

Kind regards, Gjaldstovan

1. Brief Background on Samleikin

• Samleikin is an IT system designed to identify people (electronic identification) and sign documents.
• Samleikin can be used for public and private services.
• Samleikin can be used via an Samleikin App on your smartphone or computer, or via a Samleikin USB flash drive that is connected to a computer.

Samleikin has a self-service web portal on the Internet. The address is www.vangin.fo.

2. Personal Information

2.1. Processing of personal information when you register with Samleikin.

When you register and create Samleikin, you are asked to provide us certain personal information. With this information, we know that someone is impersonating you. This is necessary to make sure that the system can operate securely.

You must provide the following personal information to us:

• Government-issued identity number (p-tal),
• Full name,
• Email address,
• Mobile telephone number,
• Proof of identity (passport or driver’s licence),
• Photograph of your passport or driver’s licence (only for online Samleikin registration),
• Photograph of yourself (only for online Samleikin registration)

When you register for a Samleikin digital ID, you agree to permit Gjaldstova to:

1. Obtain your personal information from the government resident registry (Landsfólkayvirlit).

2. Investigate to determine if your passport or driver’s licence is current/valid via the Faroese Vehicle Registry Office and the Danish national police.
   1. The Faroese Vehicle Registry Office provides the following: your name, photo, signature, birthdate, birthplace, driver’s licence number, issue date, validity. Only the driver’s licence number is stored by Gjaldstovan.
   2. The Danish national police provides the following: your name, birthplace, nationality, passport number, driver’s license number, issue date, validity, possible national identity number. Only your passport number or driver’s licence number is stored by Gjaldstovan.
3. Compare your self-portrait (selfie) with the photograph on your passport or driver’s licence to determine validity of your self-portrait. This is only applicable if you create Samleikin via the Internet.
   1. This comparison is carried out by a subsupplier of Gjaldstovan, which maintains a datacentre in Ireland, and that is where your information is sent.
   2. The respective information is limited to your self-portrait and the information that stands on your passport or driver’s licence.
   3. The information is encrypted before it is sent. The information is deleted by the subsupplier after thirty (30) days.
   4. Gjaldstovan stores the result of the validity comparison.

4. Create a data action log of the use of Samleikin. See more on this in Section 2.2: “Processing of personal information regarding electronic identification”.

5. Submit certain information to a third-party if the third-party uses Samleikin as part of its digital services. The term “third-party” herein shall mean a Service Provider, e.g., the Faroese Tax Authority (TAKS), financial institutions, etc. See more on this in Section 2.5: “Personal information that is transferred to a third-party”.

2.2. Processing of personal information regarding electronic identification

When you use Samleikin, Gjaldstovan processes the following personal data about you:

• Name,
• National identification number (P-number),
• Email address,
• Telephone number,
• Nationality,
• The IP address you use to indicate your geographical location at an overall level, i.e. the country or region in which you are located, but not your exact location,
• Technical information about the device using Samleikin, including serial number, operating system, version number, and browser.

Data action logging

When you use Samleikin, Gjaldstovan maintains logs of the following events:

• Date and time of the event,
• Type of event,
• The third party with whom the event takes place,
• The IP address from which the event takes place,
• Technical information about the device from which the event takes place.

“Event” means: application for Samleikin, renewal of Samleikin, use of Samleikin, and changes to personal data.

Gjaldstovan does not maintain logs of the content of the services you log into.

You can view a log of your events on the self-service portal at www.vangin.fo.

2.3. Processing of personal information regarding electronic signature

When you sign a document using electronic signature with Samleikan, personal information will be attached to the document. This is:

• Full name,
• P-tal,
• Birthday,
• Nationality.

Technically, the electronic signature with Samleikin is produced by a subcontractor of Gjaldstovan in a datacenter in Norway. All communication is encrypted during transfer.

Neither Gjaldstovan nor the subsupplier store copies of the signed document.

A technical log regarding the signature, is stored for one year. The purpose of this is to use as evidence for a specific signature, or to solve any dispute that could occur after the signature is produced.

2.4. Processing of personal information regarding transaction signature

When you sign a transaction (e.g. a money transfer) using Samleikin, personal information will be attached to the transaction. This is:

• Name,
• P-tal,
• Transaction identifier (unique id of specific transaction that is compounded of two letters and four numbers, e.g. QB 5378),
• Your Samleikin certificate,
• The IP address you use to indicate your geographical location at an overall level, i.e. the country or region in which you are located, but not your exact location,
• Technical information about the device using Samleikin, including serial number, operating system, version number, and browser.

Gjaldstovan has no access to the content (e.g. amount or recipient of the money transfer) of the transaction that you sign.

A technical log regarding the transaction signature is stored. The purpose of this is to use it as evidence for a specific signature, or to solve any dispute that could occur after the signature is produced.

2.5. Personal information that is transferred to a third-party

When you use Samleikin to access the services of a third-party, e.g., TAKS or a financial institution, Gjaldstovan submits certain personal information to the third-party. We do this so that you can use Samleikin to access the services of a third-party and so that we can ensure that no one is attempting to impersonate you.

We supply a third-party with this personal information about yourself:

• Full name,
• Government-issued identity number (p-tal),
• Birthdate,
• eID-number (a unique electronic ID number associated with your use of Samleikin and which differs from third-party to third-party),
• Nationality,
• The IP address you use to indicate your geographical location at an overall level, i.e. the country or region in which you are located, but not your exact location,
• Technical information about the device using Samleikin, including serial number, operating system, version number, and browser.

The national identification number (P-number) is disclosed to all service providers that, pursuant to Sections 4 and 5 of the Act on Digital Identity, use Samleikin for electronic identification.

2.6. How long does Gjaldstova store your personal information?

After you have deleted yourself as a user of Samleikin, Gjaldstovan stores your personal information for a period of seven (7) years. Subsequently, your personal information is deleted. The personal information referenced herein refers to the personal information you provided when you created your Samleikin and the data action log generated relative to the events that occurred while you used Samleikin.

3. General Terms and Conditions

The respective rights you have relative to the use of the services provided by a third-party are between you and the third-party. Gjaldstovan only verifies to the third-party that you are the individual you claim to be.

Gjaldstovan is a validating authority and maintains Samleikin and related certificates. Gjaldstova shall carry out its responsibilities pursuant to this agreement and the certification policies of Samleikin. The certification policies can be found here: https://repository.samleiki.fo.

3.1. Provision of correct information

When you create a Samleikin account, you shall provide the relevant and correct information.

3.2. Be careful

Please be careful that you:

• do not share your access code to the Samleikin App or the Samleikin USB flash drive,
• do not let others see your access code when you log-in,
• do not write down your access code so that others can access Samleikin,
• do not download the Samleikin App to another’s smartphone or computer,
• do not let others use your Samleikin USB flash drive or your smartphone or computer that has your Samleikin App on it.

3.3. Stay alert for misuse

You shall immediately delete Samleikin account if you learn or suspect that:

• Samleikin is being misused,
• Samleikin contains incorrect or incomplete information.

3.4. The responsibility of you and Gjaldstovan to delete Samleikin

3.4.1. Your responsibility

You have the responsibility to delete Samleikin if:

• you lose your Samleikin USB flash drive, smartphone, or computer that contains the Samleikin App,
• someone gains knowledge of what your access code is.

You can delete Samleikin via:

• the Samleikin App, or
• by calling 1881 (which is available normal workdays between 08:00 and 16:00), or
• by emailing 1881@talgildu.fo.

When you shall delete Samleikin, for security purposes, you shall provide your name and government-issued identity number (p-tal). You shall also possibly answer other security control questions. This is to ensure that no one is attempting to impersonate you.

3.4.2. Responsibility of Gjaldstovan

Gjaldstovan has the responsibility to delete a Samleikin account if it:

• suspects or otherwise learns that someone other than you gains knowledge of your access code,
• suspects or otherwise learns that your device that contains the Samleikin App has been hacked or has had a significant security breach,
• suspects or otherwise learns that you are not complying with the terms and conditions stipulated in this term sheet,
• suspects or otherwise learns that you have not provided the requisite or correct information when you established your Samleikin account,
• receives notice from the relevant government authority that you are deceased,
• has lost the authority to issue an attest (Samleikin certificate) pursuant to legislation or certification policies,
• believes that deletion is authorized based on the circumstances around the event or situation, e.g., if you are placed on a blacklist of banned individuals.

3.5. If you want to cancel your Samleikin account

You can cancel your Samleikin account at any time. Please note that once you cancel your account, you can no longer gain access to services that require a Samleikin.

You may cancel your Samleikin account via:

• the Samleikin App, or
• calling 1881 (available normal workdays from 08:00 to 16:00), or
• emailing 1881@talgildu.fo.

3.6. Renewal

For security reasons, your Samleikin account shall be renewed periodically. A notice reminder will be sent out via email one month before you should renew.

You can always renew your Samleikin account via your Samleikin App. If you have the Samleikin USB flash drive, you must personally visit the Service Centre at Staravegur 9 in Tórshavn.

If you do not renew your Samleikin account by the specified deadline, you must register again to Samleikin.