Data Processing Agreement

Processing of End User personal data for identity verification, liveness detection, face matching, fraud prevention and, where enabled, sanctions and politically exposed person screening, for as long as the Terms are in force and until the data is deleted under the Deletion and return section.

• Data subjects: End Users the Controller asks to verify.
• Personal data: identity document images and chip data; extracted identity fields such as name, document number, nationality and dates of birth and expiry; selfie and liveness images; device and network data; verification and screening results.
• Special categories: biometric data processed to uniquely identify a person (face templates).

The Processor processes personal data only on the Controller's documented instructions, which consist of the Terms, this DPA, the Controller's configuration of the Services and its API calls. The Processor informs the Controller if it believes an instruction infringes data protection law and may suspend the affected processing until the instruction is confirmed or changed.

Persons authorised to process personal data are bound by confidentiality and have access only as far as their role requires.

The Processor implements the technical and organisational measures described on its Security page (Annex 2). It may update them provided the overall level of protection is not reduced.

The Controller gives general authorisation to the sub-processors listed on the Sub-processors page (Annex 3). The Processor announces new or replacement sub-processors at least 30 days in advance. The Controller may object on reasonable data protection grounds; if the objection cannot be resolved, the Controller may terminate the affected Services and receive a pro-rata refund of its unused balance for them. The Processor imposes on each sub-processor data protection obligations equivalent to this DPA and remains responsible for its performance. Announcements are published on the Sub-processors page and emailed to the Controller's administrators registered in the panel.

The Services let the Controller retrieve and delete End User data. The Processor forwards to the Controller without undue delay any request it receives directly from a data subject, does not answer it except as instructed, and gives reasonable assistance with requests the Controller cannot fulfil through the Services.

The Processor notifies the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's data, and provides the information reasonably available to help the Controller meet its own notification obligations, including the 72-hour deadline under the GDPR.

The Processor provides reasonable information to help the Controller carry out data protection impact assessments and prior consultations relating to the Services.

Personal data is deleted automatically after the retention period configured for the Controller — by default 90 days after a verification is completed — and the Controller can delete it earlier through the API or the panel. On termination, the Processor deletes the remaining personal data within 30 days unless the law requires it to be kept; the Controller can retrieve its data through the API before then.

The Processor makes available the information necessary to demonstrate compliance with this DPA. Once a year, or after a personal data breach, the Controller may audit the Processor itself or through an independent auditor bound by confidentiality, with at least 30 days' notice, during business hours and without disrupting operations. Each party bears its own costs.

Personal data is hosted in Germany (EU). Where a sub-processor processes personal data outside the UK or EEA, or where the Controller is in a third country, transfers take place under an adequacy decision or the European Commission's standard contractual clauses, supplemented where applicable by the UK International Data Transfer Addendum; these are incorporated by reference.

Liability under this DPA is subject to the limitation of liability in the Terms. If this DPA conflicts with the Terms, this DPA prevails on the processing of personal data.

• Annex 1 — Processing details: the subject matter, nature, purposes, data subjects, categories and duration set out in the first two sections.
• Annex 2 — Technical and organisational measures: our Security page.
• Annex 3 — Sub-processors: our Sub-processors page.