Recertification: 10/2017
Initial Certification: 08/2014
ValidSoft proved that its IT-based service ZLC facilitates its privacy-compliant use. Banks and payment processors may use the service as a tool that assists them in identifying suspicious credit- and debit card “card-present” transactions. ZLC verifies, with the help of a mobile phone application, whether the card that is being presented at an ATM or POS-terminal is, or is not, in the same country as the mobile phone that the card owner has registered with the bank. Banks and payment processors can be sure that processing of personal data of their customers is in line with the demanding provisions of EU data protection law if they use the service as specified in ValidSoft’s respective conditions of use.
Product/Version
VALid-ZLC® v2
Function as provided in October 2017
Qualification: IT-based service
View the VALid-ZLC Certificate (201710)
Cert. No.
EP-S-K8LJ52
Version of Certification Criteria
11/2011 (95/46/EC)
Gültigkeit
05/10/2017 – 31/10/2019
Initial certification on August 12, 2014
Monitoring
06/2018 (O.K.)
02/2019 (O.K.)
Public report
2017 recertification VALid-ZLC public report [PDF] 
2014 VALid-ZLC – Short Public Report [PDF]
Manufacturer/Provider
VALIDSOFT LIMITED
Arthur Cox Building
Earlsfort Terrace
Dublin 2
Ireland
BEST
VALid-ZLC® sticks to the principle of data avoidance and minimisation by keeping the personal data processed to the minimum. In addition, information will only be disclosed to ZLC when certain specific events occur. When ZLC receives the information that the country information about a bank customer’s mobile phone has changed, the previous country entry is deleted (i.e., no history is kept). Customers of ValidSoft are comprehensively informed about their data protection obligations and contractually bound to ensure compliance with the applicable data protection law when making use of VALid-ZLC.
ATTENTION:
ValidSoft offers ZLC as an SaaS (“Software-as-a-Service”) solution. The service is not yet in any actual deployment (Update: This is still true in October 2017). Thus, neither an actual online banking app that has been amended by the ZLC code nor any processing by ValidSoft on behalf of banks or payment processors when providing the ZLC service could be evaluated by the EuroPriSe experts. Rather, only a test implementation was examined during the evaluation. In addition, the appropriateness of technical and organisational measures that had been stipulated by ValidSoft for any future service provision was verified. As soon as there will be any actual deployments, additional checks will be conducted by the experts.
Summary
Valid-ZLC® verifies, with the help of data previously obtained from the data subject’s mobile phone, whether the debit or credit card that is being presented is, or is not, in the same country as the mobile phone that the card owner has registered with the bank. This data is sent to Valid-ZLC® as a result of the inclusion of certain ZLC code snippets into the software code operating a client’s device such as, typically, the relevant bank’s mobile banking application. ZLC’s conditions of use make it compulsory for users of the service to obtain the entirely free and fully-informed consent of the data subjects (bank customers) for the use of ZLC.
Details
Recert 201710
The target of evaluation has not changed.
Initial Cert 201408
Valid-ZLC® is a software program installed on a dedicated carrier or server installed at and operated by ValidSoft in the UK. The software is a proprietary database, to and from which data are sent and managed. Specifically, this database, on the one hand receives data from mobile phones enlisted to the service by the user of Valid-ZLC®, and on the other hand is linked to the user’s own computers. ZLC will be provided by ValidSoft as “Software-as-a-Service”. A mobile banking app that is amended by certain ZLC code snippets will pass on to the ZLC database the country code of the country where a mobile phone is, and even that only if this information changes (or has not changed for some 12 hours). Moreover, the data that is made accessible to the user of the product is restricted to no more than a simple “result”: “Confirm” (the mobile phone is in the same country as the country in which the bank card is being presented) or “Refute” (the phone is not in the same country), with a Probability Score (or a „Fail“ in case the check was unsuccessful).
The evaluation covered the following:
- the specifications for the bit of software (the “ZLC snippet”) that banks should use to instruct the app that is installed on their enrolled customers’ mobile phones to send country information to the ZLC database operated by ValidSoft in certain specified instances. Since the product is not yet in any actual deployment, the experts could not evaluate any actual app. However, they did evaluate a test version of the app.;
- the parameters (security/encryption specifications) specified by ValidSoft for the data flows to and from the ZLC database (i.e., for the sending of the mobile phone country information from the app to the database; the sending of the card country information from the bank to the database; and the returning of a “result” from the database to the bank); and
- all the processing within the ZLC database, i.e., the receiving of the above-mentioned country information from, respectively, the app and the bank; the correlation of those data within the database, leading to the creation of “results” (in the format “Yes” [mobile phone is in the same country as the card], “No” [mobile phone is not in the same country as the card], or “Fail” [when for some reason the check could not be performed], with a “confidence score”).
Technical Evaluator
Javier Garcia-Romanillos Henriquez de Luna
Ernst & Young (Spain)
Calle Zurbarán 7, 6B
28010 Madrid
Spain
Legal Evaluator
Prof. Douwe Korff
Wool Street House
Gog Magog Hills
Babraham
Cambridge CB22 3AE
UK
Formerly Certified Versions
n.a.