Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms & Conditions between SPRK10 B.V., KVK number 98888625 (“Processor,” “LiveVerify”) and the business customer identified on the LiveVerify account (“Controller”), and applies to Processor's processing of personal data on Controller's behalf in connection with the Service.

1. Roles of the parties

1.1 As between the parties, Controller is the controller (the customer) and LiveVerify is the processor, with respect to personal data of End Users processed through the Service. Controller determines the purposes for which its End Users are directed into a verification check; LiveVerify processes that data only to deliver the Verification Result and as otherwise instructed under this DPA.

1.2 For personal data of Controller's own Account Contacts and customer signing contacts, including where LiveVerify verifies the identity of those contacts, LiveVerify is an independent controller, governed by the LiveVerify Privacy Policy rather than this DPA.

2. Scope and duration of processing

2.1 Subject matter, duration, nature and purpose of processing, categories of data subjects, and types of personal data are set out in Annex 1.

2.2 Processing continues for the term of the Terms & Conditions and ends on the earlier of termination or the date LiveVerify completes deletion or return of personal data under Section 9.

3. Processor obligations

• Process personal data only on Controller's documented instructions — including with regard to international transfers — unless required to do otherwise by EU or member-state law, in which case LiveVerify will inform Controller before processing, unless that law prohibits such notice on important grounds of public interest.
• Ensure persons authorised to process the data are subject to confidentiality obligations.
• Implement the technical and organisational measures set out in Annex 2.
• Respect the conditions in Section 5 for engaging sub-processors.
• Taking into account the nature of the processing, assist Controller by appropriate technical and organisational measures with responding to data subject requests under Chapter III of the GDPR.
• Assist Controller with its obligations under Articles 32–36 (security, breach notification, DPIAs, prior consultation), taking into account the nature of processing and the information available to LiveVerify.
• At Controller's choice, delete or return all personal data at the end of the provision of services, and delete existing copies, except where EU or member-state law requires storage.
• Make available to Controller all information necessary to demonstrate compliance with Article 28 and allow for, and contribute to, audits including inspections conducted by Controller or an auditor mandated by Controller — subject to reasonable notice and confidentiality.

4. Controller obligations

• Ensure it has a valid legal basis (and, where required, valid End User consent) before directing an End User into a verification check.
• Provide End Users with any privacy notice required under applicable law before initiating a check; LiveVerify's own disclosures do not substitute for Controller's own notice obligations.
• Provide instructions to LiveVerify that are lawful and do not put LiveVerify in breach of applicable data protection law.

4.1 Before initiating a verification check, Controller must obtain the End User’s explicit consent for biometric processing under Article 9(2)(a) GDPR, or rely on another condition under Article 9(2) GDPR that it has documented and can demonstrate to LiveVerify on request.

4.2 Customer acknowledges that it is solely responsible for determining whether the Verification Result constitutes an automated decision within the meaning of Article 22 GDPR in the context of Customer’s own use case, and for providing any required human-review mechanism. Until LiveVerify makes available its own human-review mechanism, Customer must not direct End Users into a LiveVerify Session unless Customer itself provides a human-review route that satisfies Article 22(3) GDPR.

5. Sub-processors

5.1 Controller gives LiveVerify general written authorisation to engage the sub-processors listed in Annex 3. LiveVerify will inform Controller by email to the account’s contact address of any intended addition or replacement of a sub-processor, giving Controller the opportunity to object on reasonable data-protection grounds within 14 days.

5.2 LiveVerify will impose data-protection terms on each sub-processor no less protective than this DPA, and remains liable to Controller for a sub-processor's performance of its obligations.

6. International transfers

6.1 Each sub-processor listed in Annex 3 is a US-incorporated company hosting the relevant data in the EU. Because a US parent can be subject to US legal process, this is treated as a restricted transfer under Chapter V GDPR. LiveVerify has entered into Standard Contractual Clauses (Module 3, processor-to-sub-processor) with each of these sub-processors.

7. Personal data breach

7.1 LiveVerify will notify Controller without undue delay, and in any event within 24 hours of becoming aware, of a personal data breach affecting personal data processed under this DPA, and will provide the information Controller needs to meet its own 72-hour notification obligation under Article 33.

8. Audit rights

8.1 LiveVerify will make available a current copy of the Security Policy and, on reasonable request no more than once per 12 months, respond to a written audit questionnaire. A physical or third-party audit is available where Controller reasonably demonstrates that documentation is insufficient, on reasonable notice and subject to confidentiality and cost-allocation terms.

9. Return or deletion of data

9.1 On termination of the Terms & Conditions, LiveVerify will, at Controller's election, delete or return Customer Data (as defined in the Terms) within 30 days, except where retention is required by law. LiveVerify will provide Controller with a copy of Customer Data in a commonly used machine-readable format upon request made within 30 days of termination. Thereafter, LiveVerify will delete Customer Data in accordance with this DPA.

10. Liability

10.1 Liability under this DPA is subject to the limitations set out in Section 10 of the Terms & Conditions.

A1. Annex 1 — Details of Processing

Subject matter

Automated identity verification of individuals submitting a government identity document and a live selfie through Controller's application.

Duration

For the term of the Terms & Conditions, plus the deletion/return period in Section 9. Document images, selfie frames, and face templates exist only for the duration of a single check. The interim session record is deleted after 30 minutes. The durable record is retained for no longer than 3 years from the date of the check, unless a longer period is required by law. Document blocklist entries are retained until the end of the term, unless Controller removes them earlier.

Categories of data subjects

• End Users: individuals directed by Controller into a LiveVerify identity check.
• Where Controller uses kiosk mode with staff sign-in: Controller’s kiosk staff.
• Where Controller uses the document blocklist: individuals whose document numbers Controller chooses to block.

The Service is available only for End Users aged 18 or over, or such higher minimum age as Controller sets. If a submitted document indicates that the End User is below the applicable minimum age, the check is refused and the date of birth and decoded document text are redacted before anything is returned.

Categories of personal data

• Document image and decoded document text (name, date of birth, document number, expiry date) — held only in memory during a single check. Date of birth and document number are never stored.
• Selfie image frames — held only in memory during a single check.
• Face template derived from the above — biometric data under Article 9, held only in memory during a single check.
• Interim session record — session status, attempt count, and the name read from the document; deleted after 30 minutes. The name is returned to Controller through the LiveVerify API or webhook.
• Expected name, where supplied by Controller for name matching — deleted when the Session resolves; only the match result is kept.
• Durable record — verification status, dates, number of attempts, failure reason code, document type, name-match result, minimum age applied, the verification reason supplied by Controller, and, where the passport chip check is used, the chip-check verdict and issuing country. The durable record does not contain the End User’s name, date of birth, document number, or images.
• Where Controller enables the passport chip check (in testing): data read from the document’s chip, including the chip facial image — held only in memory during a single check.
• Document blocklist (if used) — a keyed one-way hash of each document number Controller adds; never the number itself.
• Kiosk staff (if used) — staff name, a hashed PIN, and sign-in times.

Nature of processing

Collection, automated comparison (OCR, face matching and, where enabled, passport chip verification), matching against Controller’s document blocklist, transient storage, and transmission of the verification outcome to Controller via API or webhook.

Purpose

To provide Controller with an automated pass/fail identity-verification outcome for use in Controller's own onboarding or transaction decisions.

A2. Annex 2 — Technical and Organisational Measures (Security Policy)

• Data minimisation by design: document images and selfie frames are never written to disk and exist only in memory for the life of one verification request.
• Time-boxed interim storage: the session record self-deletes after 30 minutes regardless of outcome.
• Encryption in transit (TLS) for all data in motion between the End User's device, the verification function, and downstream stores.
• Regional pinning: all server-side components are hosted in EU regions (Frankfurt / EU jurisdiction / Ireland) — see the Security Policy for the full component list.
• No third-party ML vendor ever receives a document image or selfie — verification models run inside LiveVerify's own infrastructure.
• Access to production data is limited to authorised personnel on a least-privilege basis.
• API keys, kiosk staff PINs, and blocklisted document numbers are stored only as one-way cryptographic hashes.

Further detail of these measures is in the Security Policy, which this Annex incorporates by reference.

A3. Annex 3 — Sub-processors

This list reflects the deployed configuration as of the date at the top of this DPA. Controller will be notified of changes under Section 5.1.