Policy: Biometric Data Privacy Policy for Residents of Illinois
Effective date: January 1, 2023

The following outlines the biometric data privacy policy of Comoto Holdings Inc. and its affiliated and subsidiary companies (collectively “Comoto”) relating to team members in Illinois (“covered team members”):

Biometric Data Defined  

As used in this policy, biometric data of covered team members includes “biometric identifiers” and “biometric information” as defined in the Illinois Biometric Information Privacy Act, 740 ILCS § 14/1, et seq.“Biometric identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color.  Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.

“Biometric information” means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual. Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers.

Purpose for Collection of Biometric Data

Comoto, directly and/or through its vendors including the licensor of Comoto’s point of sale software (collectively, “Vendors”) collect, store, and use biometric data solely for team member identification, fraud prevention, and pre-employment hiring purposes.  

Disclosure and Authorization

To the extent that Comoto or its Vendors collect, capture, or otherwise obtain biometric data relating to a covered team member, Comoto will first:

1. Inform the covered team member in writing that Comoto or its Vendors are collecting, capturing, or otherwise obtaining the team member’s biometric data, and that Comoto is providing such biometric data to its Vendors; 
2. Inform the covered team member in writing of the specific purpose and length of time for which the team member’s biometric data is being collected, stored, and used; and 
3. Receive a written release signed by the covered team member (or his or her legally authorized representative) authorizing Comoto and its Vendors to collect, store, and use the covered team member’s biometric data for the specific purposes disclosed by the Company, and for Comoto to provide such biometric data to its Vendors.

Comoto will not, and will not permit its Vendors to, sell, lease, trade, or otherwise profit from covered team members’ biometric data; provided, however, that Comoto’s Vendors may be paid for products or services used by Comoto that utilize such biometric data.

Disclosure

Comoto will not disclose or disseminate any biometric data of covered team members to anyone other than Vendors providing products and services using biometric data to Comoto without/unless:

1. First obtaining written covered team member consent to such disclosure or dissemination; 
2. The disclosed data completes a financial transaction requested or authorized by the covered team member;
3. Disclosure is required by state or federal law or municipal ordinance; or 
4. Disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction. 

Retention Schedule

Comoto shall retain team member biometric data only until, and shall request that its Vendors permanently destroy such data when, the first of the following  occurs:

• The initial purpose for collecting or obtaining such biometric data has been satisfied, such as the termination of the covered team member’s employment with Comoto, or the team member moves to a role within the  Company for which the biometric data is not used; or 
• Within 3 years of the covered team member's last interaction with Comoto. 

Data Storage

Comoto shall use a reasonable standard of care to store, transmit and protect from disclosure any paper or electronic biometric data collected. Such storage, transmission, and protection from disclosure shall be performed  in a manner that is the same as or more protective than the manner in which Comoto stores, transmits and  protects from disclosure other confidential and sensitive information, including personal information that can be  used to uniquely identify an individual or an individual’s account or property, such as genetic markers, genetic  testing information, account numbers, PINs, driver’s license numbers and social security numbers

Exclusivity

This Policy only covers biometric data of covered team members.  It does not apply to any other information or to persons outside Illinois.  

Updates

Comoto may update this Policy from time to time as required by applicable law or changes to its business practices.