Pemberitahuan Privasi Verifikasi

This Verification Privacy Notice explains how Didit processes personal data, including biometric data, when Didit provides an identity verification, fraud prevention, authentication, or compliance workflow on behalf of one of its customers.

This notice supplements our Privacy Policy and our End User Terms for Identity Verification.

1. Scope

This notice applies when you interact with a verification flow, hosted page, SDK, API-based journey, mobile flow, or white-label experience powered by Didit for a Customer.

It covers the processing of:

• identity and contact data;
• documents and files you submit;
• selfies, face images, videos, and liveness captures;
• biometric data derived from those submissions;
• device, IP, location, and anti-fraud telemetry;
• verification results, risk signals, and audit records; and
• related support, compliance, and security records connected to the verification session.

2. Who are the parties and what are their roles?

If the verification journey is white-labeled or uses a custom domain, Didit may still be the technology provider processing your data behind the branded interface. If the Customer enables retained biometric templates, Didit processes them only as a processor or service provider on that Customer's documented instruction inside that Customer's tenant.

3. Categories of data used in verification

Depending on the configured workflow, Didit may process:

• Identity data, such as name, date of birth, address, phone number, email, nationality, and other identifying details.
• Document data, such as passports, ID cards, residence permits, driver's licenses, proof-of-address documents, and data extracted from those materials.
• Biometric and liveness data, such as face images, selfie images, videos, liveness captures, anti-spoofing signals, and data derived from scans of facial geometry used to compare your face to the identity document or to confirm that a real person is present.
• Technical and fraud-prevention data, such as IP address, browser, device data, timestamps, session data, geolocation inferred from network data, and similar integrity or risk signals.
• Questionnaire and workflow data, such as declarations, answers, uploaded files, consent records, and status transitions.
• Verification outputs, such as match scores, warnings, fraud indicators, review outcomes, and audit evidence.

4. Purposes of processing

Didit may process the data above to:

• verify identity and authenticate a person;
• check document authenticity and completeness;
• detect spoofing, manipulation, fraud, or abuse;
• comply with legal, regulatory, sanctions, Anti-Money Laundering (AML), Know Your Customer (KYC), and risk-management requirements configured by the Customer;
• secure the verification flow and underlying infrastructure;
• support manual review, resubmission, escalation, and audit processes;
• respond to lawful requests and defend legal claims; and
• maintain service integrity, troubleshoot incidents, and perform quality and security monitoring.

Where law permits and appropriate controls are in place, Didit may also use anonymized or pseudonymized verification-related data for service testing, quality assurance, fraud-model training and validation, and security improvement. Where a separate notice, consent, or additional legal basis is required for a secondary use, Didit will obtain it or refrain from that use.

Model training is allowed by default. An owner or administrator of the Customer's organization may opt the organization out directly in the Business Console, under Organization Settings → Account → Privacy and data use, by turning off Allow Didit to use my organization's verification data to improve models. The opt-out takes effect immediately and excludes the organization's historical and newly collected verification data from future model training, fine-tuning, evaluation, validation, dataset curation, and training-data exports. It does not affect the verification or fraud-prevention service, change retention, or reverse updates already incorporated into a model. You may object to model-training processing for a specific verification by contacting the Customer or emailing privacy@didit.me with the relevant session identifier. A retained biometric template is not used for model training or cross-customer fraud processing. A privacy-erasure instruction separately purges it.

Didit fraud network

A Customer can choose to join the Didit fraud network, which helps participating Customers recognize identifiers that another participating Customer has reported as linked to fraud. Only Customers that have joined the network in the Didit Business Console, while their plan includes it, add to it or receive its results. Didit runs the network as an independent controller for fraud prevention (see section 2), based on its legitimate interest in preventing fraud.

• When entries are added. Only when a participating Customer adds an email address, phone number, IP address, device, or document number to its blocklist; when one of its verifications is declined and Didit's checks raised a fraud warning on it, such as a presentation or injection attack, a manipulated document, or a tampered or emulated device; or when it resolves a case as a valid threat. Nothing else adds an entry, and test (sandbox) verifications never do.
• What is added. For a blocklist entry, the blocklisted identifier. For a verification or a case, each of these identifiers it holds: document number (with its issuing country and document type), email address, phone number, IP address, device identifier, and the address shown on the identity document. The network never holds an identifier itself, only a keyed hash: a code computed from it with a secret key that only Didit holds. The same identifier gives the same code at every Customer, and the code cannot be turned back into the identifier. Because Didit holds the key, these codes are pseudonymized personal data, not anonymous data. Each entry also records the type of report (blocklisted, declined for fraud, or case resolved as a valid threat), when it was made, and which Customer made it. Faces, selfies, other biometric data, biometric templates, images, names, and documents are never added to the network.
• What a participating Customer sees. Didit computes the same codes for a participating Customer's verifications and checks them against the entries of other participating Customers. When one matches, the Customer sees a warning with the type of identifier, how many other organizations reported it, the type of report, how recently (for example, in the last 30 days), and, where known, the industry of the organizations that reported it. It never learns which organization made a report and receives no other data from that organization. What a match does depends on the Customer's settings (see section 10).
• How long entries are kept. An entry is kept for 24 months from the Customer's latest report of that type for the same identifier. It then stops being used and is permanently deleted 30 days later. If the verification, user record, or blocklist entry an entry came from is deleted, including at the end of the Customer's retention period, Didit promptly and permanently deletes that entry, unless another of that Customer's live verifications or blocklist entries still reports the same identifier; the entry then goes when that verification or blocklist entry is deleted, or when it expires. If a Customer leaves the network, its entries stop being used at once and are permanently deleted 30 days later.
• Records of network checks. To detect misuse of the network, such as an organization checking lists of identifiers, Didit records each check: the Customer that made it, the verification it was made for, the code checked, and the result. These records are kept for 24 months and then deleted, even if the verification they relate to is deleted earlier.
• Safeguards and your rights. Didit limits how many checks each Customer can make, and it can stop using a Customer's reports, or close its access to the network, if it finds inaccurate reports or misuse. You can object to this processing, or ask for an entry to be corrected or deleted, as described in section 11.

5. How Didit handles biometric data

For purposes of this notice, biometric data includes data derived from scans of facial geometry or similar biometric characteristics extracted from images or video, where that data is used to verify identity, confirm liveness, or prevent fraud.

When a workflow includes face verification or liveness, Didit may:

• capture or receive selfie images, face images, and/or video;
• extract facial characteristics from those submissions and from the portrait on your identity document;
• compare those signals to verify that the person presenting the document is the same person shown on the document;
• analyze liveness and anti-spoofing indicators to confirm a real person is present; and
• generate verification results, confidence indicators, and fraud or review signals.

Didit:

• uses biometric data only for the lawful purposes described in this notice, the Customer's instructions, and applicable law;
• applies safeguards designed for sensitive data, including access controls, monitoring, and secure handling practices;
• does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information; and
• expects Customers using API or white-label journeys to clearly disclose Didit as the verification provider and to obtain any notice or consent required by law before biometric capture begins.

If the Customer opts in to retention after an operational session deletion, Didit may keep one separately managed biometric template anchored to that Customer's User record. The template is image-free and tenant-scoped; it does not contain the selfie, liveness video, identity-document media, verification decision, or copied profile fields. It remains biometric data, requires a finite expiry, and is independently deletable.

6. Additional U.S. biometric privacy disclosures

If you are located in Illinois, Texas, Colorado, Washington, or another jurisdiction with biometric privacy requirements, the following additional points are important:

• Biometric data may include data derived from scans of face geometry, selfie images, liveness video, or similar identity-verification media.
• You may be asked to provide explicit electronic or written consent before biometric data is captured or uploaded.
• The Customer should identify Didit as a verification provider or processor when presenting the required notices in white-label or API-based journeys.
• Didit uses biometric data to perform identity verification, liveness, anti-spoofing, fraud prevention, security, and related compliance operations requested by the Customer.
• Didit retains biometric data only for as long as needed to provide the service, follow lawful Customer instructions, satisfy legal obligations, resolve disputes, or defend claims, and in no event longer than applicable law permits or our Biometric Data Retention and Destruction Policy allows.
• Didit uses a reasonable standard of care designed for sensitive data and does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.

Our Biometric Data Retention and Destruction Policy is the public written retention schedule for biometric data. Under it, biometric data of people covered by Illinois, Colorado, or Texas law is deleted no later than 3 years, 24 months, or 12 months, respectively, after their last verification with the Customer. If a jurisdiction requires a shorter retention period or additional disclosures, Didit and the Customer will apply the shorter or stricter requirement that governs the relevant verification flow.

Other jurisdictions with biometric privacy requirements. The points above apply, with appropriate adjustments, to any other state, province, country, or jurisdiction with biometric privacy requirements, including (without limitation) the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) treatment of sensitive personal information, the Colorado Privacy Act (CPA), the Virginia Consumer Data Protection Act (VCDPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), New York's biometric privacy proposals, the European Union's General Data Protection Regulation (GDPR) Article 9 framework for biometric data, the United Kingdom GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25, Brazil's Lei Geral de Proteção de Dados (LGPD), and any future biometric privacy law that applies to the relevant verification flow.

7. Disclosures and service providers

Didit may disclose verification-related data to:

• the Customer that asked you to verify;
• Didit group entities involved in delivering, supporting, or securing the service;
• providers of hosting, cloud storage, communications, identity, fraud, analytics, audit, security, and professional services;
• other Customers that take part in the Didit fraud network, which can learn only that an identifier they already hold was reported by another participating Customer, as described in section 4;
• regulators, courts, law enforcement, or public authorities where legally required; and
• transaction counterparties in a merger, acquisition, restructuring, or asset transfer, subject to lawful safeguards.

The exact recipients depend on the service, region, workflow configuration, and legal requirements.

Text messages (SMS)

When you ask for a verification code by text message, we use your mobile phone number and your consent to receive text messages only to send that code and to prevent fraud. Mobile phone numbers and text message opt-in data and consent are never sold, rented or shared with third parties or affiliates for marketing or promotional purposes. You can reply STOP to any message to opt out, or HELP for help. See the SMS section of the End User Terms for Identity Verification.

8. International transfers

Verification data may be processed in countries other than the country in which you began the verification flow. Where required by law, Didit applies appropriate transfer safeguards such as adequacy decisions, standard contractual clauses, or other recognized legal mechanisms.

9. Retention and destruction

General verification-data retention. The default retention period for verification data is indefinite ("unlimited") unless the Customer configures a shorter period or you exercise a deletion right. Customers can configure retention per application in the Business Console between 30 days and 10 years.

Biometric data. Biometric data (face geometry and templates, selfies, document portraits, and liveness video) follows our Biometric Data Retention and Destruction Policy. It is deleted when the Customer's purpose is met or the Customer's retention setting ends, and for people covered by Illinois, Colorado, or Texas law no later than 3 years, 24 months, or 12 months, respectively, after their last verification with that Customer, even if the general retention setting above is longer or unlimited.

Retained biometric templates. If the Customer enables retention after an operational session deletion, the template requires a separate finite duration. It expires at the earliest Customer instruction, configured finite period, purpose-end event, contractual or statutory deadline, privacy-erasure instruction, or termination deletion instruction. No unlimited setting authorizes indefinite biometric-template retention. The template remains biometric data, is image-free and tenant-scoped, and is not used for model training or cross-customer fraud processing.

An operational session deletion removes the session and session-owned data but may leave an opted-in retained template until expiry or earlier purge. A privacy-erasure instruction also purges every retained template attributable to you or the instruction scope. User deletion, explicit purge, expiry, purpose end, and termination where the Customer selects deletion also trigger purge. An accepted request remains `deletion requested` until every in-scope store confirms completed purge or approved beyond-use handling.

Didit fraud network. Network entries are used for up to 24 months from the latest report and permanently deleted 30 days later, and records of network checks are kept for 24 months, as described in section 4.

10. Automated processing and human review

Didit may use automated systems to review document integrity, liveness, face match, fraud indicators, and other verification signals. Some sessions may also be routed for human review, quality assurance, or escalation depending on the Customer's workflow and risk configuration.

Except where a specific service states otherwise, the Customer remains responsible for how it uses the verification result in its own business decision-making.

A match in the Didit fraud network (section 4) appears to the Customer as a warning on the verification. By default it sends the verification to manual review; the Customer can instead set a match to decline the verification or only to be recorded.

11. Rights and requests

If you want to access, correct, delete, restrict, object to, or otherwise exercise rights over data processed in a specific verification session, you should generally contact the Customer first. The Customer usually determines the main purpose of the verification and is the best point of contact for rights tied to that relationship.

If Didit receives a request directly in a processor context, Didit may forward or redirect the request to the relevant Customer where appropriate. If Didit acts as an independent controller for a limited processing purpose, you may also contact privacy@didit.me or Didit's Data Protection Officer at dpo@didit.me. A valid privacy-erasure instruction covering you purges both the verification session and any retained biometric template attributable to you; an operational session deletion may have a different retained-template outcome and must state it.

You may also lodge a complaint with a supervisory authority. Didit's lead supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos / AEPD) at `aepd.es`. You may also lodge a complaint with your local data-protection authority.

12. Security

Didit uses technical, organizational, and administrative safeguards designed to protect verification data, including sensitive and biometric data. These safeguards may include encryption, access controls, environment separation, logging, monitoring, and incident response procedures.

13. Children

Didit does not intend this verification notice to authorize unlawful collection of children's data. If a verification flow is used for age-related or youth-related checks, the Customer must ensure a lawful basis, appropriate notices, and any required parental or guardian permissions.

14. Changes to this notice

Didit may update this Verification Privacy Notice from time to time to reflect legal, operational, or product changes. When we do, we will update the effective date at the top of this notice.

15. Contact

If you have questions about this notice, contact:

• privacy@didit.me
• hello@didit.me