Data Processing Agreement (DPA)

1. Roles and subject matter

The Client is the controller and LegitFlash is the processor (Article 28 GDPR). We process personal data of the Client's applicants only to provide the identity-check service described in the Terms: hosting the capture flow, storing the evidence, running automatic non-biometric pre-checks, making it available to human reviewers and returning the result to the Client.

The service is for non-regulated sectors. The Client does not use it for onboarding that is regulated by anti-money-laundering law, and does not rely on it for eIDAS trust services. Face recognition is not used: the selfie is compared by a person, never by software.

2. Duration

This agreement lasts as long as the Client has an account and until all personal data has been deleted under section 11.

3. Documented instructions

We process personal data only on the Client's documented instructions: this agreement, the Terms and the configuration of the Client's verification flows (steps, retention, result detail, purpose text). If we think an instruction breaks data-protection law, we will tell the Client.

We never use the Client's data for our own purposes, for another client, or to build matching or reference data across clients. Duplicate detection works inside one Client only.

4. Confidentiality

Everyone who can access personal data on our side (reviewers and administrators) is bound by a written confidentiality agreement, signs in with two-factor authentication, and every viewing of evidence is logged.

5. Security

We apply the technical and organisational measures in Annex II. We review them regularly and may update them as long as the level of protection does not fall.

6. Sub-processors

The Client gives general authorisation to use the sub-processors listed on the sub-processor page. We bind each of them to obligations equivalent to this agreement and remain responsible for them.

We announce any addition or replacement at least 30 days in advance by email to the account owners. The Client may object on reasonable data-protection grounds within that period; if we cannot offer a solution, the Client may terminate the affected service.

7. International transfers

Applicant data is stored and processed in the European Union. Sub-processors outside the EU/EEA receive no applicant data (Pumble receives operational alerts without personal data; Stripe receives billing data of the Client's account users only). If this changes, section 6 applies and a valid transfer mechanism will be put in place first.

8. Data-subject requests

The dashboard and the API let the Client export and erase the data of a verification. If an applicant contacts us directly we will not answer on the merits; we will pass the request to the Client without undue delay. We help the Client answer requests with the means in the previous sentence and, on request, with reasonable additional help.

9. Assistance with other obligations

We help the Client meet its obligations on security, breach notification, data-protection impact assessments and prior consultation (Articles 32 to 36 GDPR), taking into account the nature of the processing and the information we have. We provide a DPIA support document on request.

10. Personal data breaches

We notify the Client without undue delay after becoming aware of a personal data breach affecting its data, with a target of 24 hours, and give the information we have so that the Client can notify the supervisory authority within 72 hours. We then keep the Client updated and send a post-incident report.

11. Deletion and return

Evidence (images and video) is deleted automatically at the end of the media retention period set in the flow (30 days after the decision by default). The minimal record of the result is deleted at the end of the record retention period (5 years by default). The Client can shorten both periods and can erase any verification at any time.

When the agreement ends, the Client can export what it needs; we delete the remaining personal data within 30 days, except what the law requires us to keep.

12. Audits

We give the Client the information needed to show compliance and allow audits, including inspections, by the Client or an auditor it appoints, with reasonable notice, during business hours and without affecting other clients. The Client bears the cost of its audits.

13. Liability and governing law

Liability under this agreement follows the limits in the Terms of Service. [Governing law and venue: to be confirmed by the lawyer.]

Annex I. Description of the processing

Purpose

Identity checks of the Client's applicants, as set by the Client in each flow (purpose text).

Nature

Collection, storage, automatic pre-checks (image quality, machine-readable-zone parsing and check digits, expiry, age, duplicates inside the Client), human review, return of the result.

Data subjects

People the Client asks to verify (applicants).

Categories of data

Identity data (names, date of birth, nationality, document type, country, expiry, last four characters of the document number and a keyed hash), images of the identity document, selfie, a short liveness video, proof of address (image or PDF), the address on it, contact email when the Client invites by email, technical data (IP address in security logs, device binding).

Special categories

None are intentionally processed. No biometric templates or similarity scores are created.

Retention

Evidence: set per flow, 30 days after the decision by default (platform maximum 90). Minimal record: 5 years by default. Abandoned evidence: 72 hours.

Annex II. Technical and organisational measures

• Encryption in transit (TLS) and at rest: every evidence file is encrypted by the application with a per-file key, wrapped by a master key kept outside the database. Deleting the key makes a file unrecoverable.
• Evidence is never served from a public disk. Every view by the Client, a reviewer or an administrator goes through an authorised, logged request.
• Access control by role: Client members see only their own account; reviewers see only the submission they have claimed; administrators need two-factor authentication and a typed justification to open evidence outside a review.
• Two-factor authentication is mandatory for reviewers and administrators. Staff access ends immediately when a person is deactivated.
• Audit log of sensitive actions (decisions, evidence views, erasures, exports, settings), kept without applicant personal data.
• Automatic purge of evidence and records on the retention schedule; verification that the purge ran.
• Document numbers are stored only as the last four characters plus a keyed hash per Client.
• Encrypted backups, tested restores, hosting in the European Union.
• Personal data is kept out of logs, error reports and chat notifications.
• Confidentiality agreements and training for staff; incident response runbook with a 24-hour target to notify the Client.