Promotion Banner

Notice of Automated & Autonomous Systems Operations

This AI Transparency Notice (the “Notice”) is provided by Taptap Send (DIFC) Limited in accordance with Regulation 10 of the DIFC Data Protection Regulations (“DIFC DPR”) and applies to all autonomous and/or semi-autonomous systems (referred to as the “Systems”) used by the Firm that involve the Processing of any information referring to an identified or identifiable natural person (“Personal Data”).

This Notice is intended to provide a comprehensive, true, and plain description of how Personal Data is Processed by the Systems, the purposes of such Processing, the design principles governing those Systems, and the safeguards in place to ensure compliance with DIFC Data Protection Law (DIFC Law No. 5 of 2020) (“DIFC DPL”). Capitalised terms used in this Notice have the meanings given to them under the DIFC DPL and the DIFC DPR.

The Processing of Personal Data by the Systems does not impact the exercise of certain rights available to you under the DIFC DPL, including in relation to automated decision-making. We have implemented appropriate measures to support your rights, and you may refer to section 16 of Global Privacy Policy for details. Where a System produces an output that affects your application on an automated basis, you have the right to information about that processing and to challenge the outcome by contacting us. We will assess your request in accordance with applicable law.

Intended Purposes of the Systems

The Systems we use do not autonomously determine why Personal Data is Processed. They function within the purposes determined by the Firm prior to the deployment and/or use of the relevant System.

The System we use Processes Personal Data for the purpose of capturing and validating identity documents and biometric information, including image quality assessment and liveness detection, and to support subsequent identity verification against a government database.

Defined Principles or Limits of the Systems

The Systems we operate have been developed by providers in accordance with industry standards and where possible, configured by us to ensure compliance with DIFC DPL and Regulation 10. Where we have not built the Systems, we apply strict governance and oversight to their use. The Systems operate within fixed settings and defined limits, and the behaviour is designed to be consistent and predictable.

We ensure that the following principles are embedded into the Systems we use:

  • the Systems do not have authority to independently define, approve, or implement new or incompatible purposes for Processing Personal Data;
  • The Systems are restricted to Processing only Personal Data that is authorised, relevant, and proportionate to their defined purpose;
  • the Systems do not automatically share Personal Data with any third parties or government authorities, upon their request;
  • the Systems are not authorised to take decisions that produce legal effects or similarly significant impacts on individuals without appropriate human involvement;
  • the Systems operate within an established governance framework that monitors and prevents misuse, bias, drift, or function creep;
  • Personal Data is encrypted in transit and at rest, and is subject to strict access controls;
  • the Systems apply data minimisation principles and adhere to retention limits aligned with legal requirements, where possible.

Output Produced by the Systems we Use

The AI System provides a liveness detection result indicating whether the captured biometric sample is likely to originate from a live individual and an image quality assessment result indicating whether the captured image meets the minimum quality requirements for processing. Where the image does not meet the required threshold, the user is prompted to recapture the image. These outputs are used to determine whether the onboarding process can proceed to the next stage.

The AI outputs are used solely to support the capture process and fraud prevention measures. The AI Systems does not independently verify identity, perform profiling, assign risk scores, or make decisions regarding an individual's eligibility, rights, or access to services. Following successful capture validation, the biometric data is transmitted to the relevant government database where the authoritative identity verification process is performed and a match/no-match result is returned.

The System Design and Governance Principles

The Systems developed and utilised within our products, services, or other use cases is designed and operated in accordance with the following AI principles of design, as required under the DIFC DPR:

  • Ethical and Fair Use: Systems are designed to promote ethical outcomes and to treat individuals fairly. We take reasonable steps to identify and mitigate potential bias that could lead to unfair or discriminatory outcomes.
  • Transparency: Where AI is used to Process Personal Data, we aim to ensure that such Processing is explainable in clear, non-technical terms to data subjects.
  • Security: Appropriate technical and organisational measures are in place to protect Personal Data processed by AI Systems and to prevent unauthorised access or Personal Data Breaches.
  • Accountability: We maintain oversight and governance measures to ensure responsibility for the development, deployment, and outcomes of our AI Systems.

Codes and Regulatory Standards

Although we are not the developer of the tool, we require that its design and operation align with recognised AI ethics and compliance frameworks, including, but not limited to:

  • Dubai Digital Authority Ethical AI Toolkit (fairness, accountability, transparency)
  • OECD AI Principles (human-centricity, robustness, accountability)
  • UNESCO Recommendation on the Ethics of AI (human rights, oversight)
  • NIST AI Risk Management Framework (risk identification and mitigation)
  • UAE Guidelines for Financial Institutions Adopting Enabling Technologies (biometrics and AI governance)
  • DIFC Regulation 10 Accreditation and Certification Framework, where applicable

Adherence to these frameworks is proportionate to the nature, context, and risks associated with each AI System.

We monitor updates to these frameworks and any additional codes or certifications designated by the DIFC Commissioner and adapt our governance accordingly.

Ongoing Review

This Notice is reviewed periodically and updated as necessary to reflect changes in the Systems, regulatory expectations, or organisational practices.

Contact Us

You may contact the Firm at the contact details mentioned below for further information about the use of AI Systems and the Processing of Personal Data, or to exercise your rights under the DIFC DPL.

Taptap Send (DIFC) Limited
Email: privacy@taptapsend.com