Legal
Data Processing Agreement
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Securely Verify (“Processor”) and the Customer (“Controller”). It applies to personal data that Securely Verify processes on the Customer’s behalf through the Service (“Customer Personal Data”).
1. Roles
The Customer is the controller (or “business”) and Securely Verify is the processor (or “service provider”) for Customer Personal Data. Each party will comply with the data protection laws that apply to it.
2. Instructions
Securely Verify processes Customer Personal Data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use and configuration of the Service, unless the law requires otherwise. We will tell the Customer if we believe an instruction breaks the law.
3. Details of processing
| Subject matter | Providing identity verification, document collection and related review tools |
|---|---|
| Duration | The term of the Terms, plus the retention periods in Section 9 |
| Purpose | Verifying the identity of End Users, collecting documents they provide, detecting fraud, and providing results to the Customer |
| Data subjects | The Customer’s End Users (people asked to verify their identity or provide documents) and the Customer’s authorized users |
| Personal data | Name, email and contact details; identity document images and the data on them; selfies, liveness video frames and face templates (biometric identifiers); documents the End User uploads; device, browser and network information; verification results and audit records |
4. Confidentiality and personnel
Only personnel who need access to provide the Service may access Customer Personal Data, and they are bound by confidentiality obligations.
5. Security
Securely Verify maintains appropriate technical and organizational measures, including encryption in transit and at rest, role-based access control, two-factor authentication for dashboard access, audit logging of access and decisions, unique expiring verification links, signed webhooks, separation of the verification platform from our marketing website, backups, and automated deletion under defined retention periods.
6. Subprocessors
The Customer authorizes the subprocessors listed on our Subprocessors page. We impose data protection obligations on each subprocessor that are no less protective than this DPA and remain responsible for their performance. We will give at least 15 days’ notice of a new subprocessor; the Customer may object on reasonable data protection grounds, and if we cannot resolve the objection, the Customer may terminate the affected Service.
7. Assistance
Taking into account the nature of the processing, we will help the Customer respond to requests from data subjects and meet its obligations relating to security, breach notification and data protection assessments. If we receive a request directly from an End User, we will direct it to the Customer.
8. Security incidents
We will notify the Customer without undue delay, and in any event within 72 hours, after confirming a security incident affecting Customer Personal Data, and will provide the information reasonably needed for the Customer to meet its obligations.
9. Retention, deletion and return
Customer Personal Data is deleted under our retention schedule, which the Customer can shorten in its settings, and in line with our Biometric Data Policy. After the Terms end, the Customer may export its data for 30 days, after which we delete it, unless the law requires us to keep it.
10. U.S. state privacy laws
Securely Verify will not sell or share Customer Personal Data, will not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service, and will not combine it with personal data from other sources except as permitted by law. We will notify the Customer if we can no longer meet these obligations.
11. Biometric data
The Customer is responsible for having a lawful basis for collecting End Users’ biometric identifiers and for any notices and written releases required by law. The Service presents a consent step to every End User before biometric data is collected and records that consent.
12. Information and audits
On request, we will provide information reasonably necessary to show compliance with this DPA, including answers to security questionnaires.
13. General
Liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms, this DPA controls for the processing of Customer Personal Data. Questions: support@securelyverify.io.
