Privacy Notice

Version: 20.10.2026

Last updated: 20.10.2026

Overview

Welcome to the Privacy Notice of Verifico Ltd (“Verifico”, “we”, “us” or “our”), a company registered and incorporated in England and Wales under company number 17437921, with its registered office at 128, City Road, London, EC1V 2NX, United Kingdom. We are committed to protecting personal data and respecting privacy. As an identity verification provider, processing personal data securely, transparently, and in strict compliance with applicable privacy laws and other regional privacy standards – is at the core of our business.

This Privacy Notice explains what personal data we collect, why we collect it, who we share it with, and how long we keep it, when you visit our website, use our identity verification platform (the “Service”), or otherwise interact with us.

If you have any questions or comments about this Privacy Notice, or if you would like to exercise your data protection rights, please contact our Data Protection Officer at contact@verifico.me.

How this Privacy Notice is structured

To make it easier for you to find the parts of this Privacy Notice that apply to you, we have divided it into three sections:

• Section 1 – General: applies to everyone who visits our website, uses our platform, or otherwise interacts with us, regardless of whether you are an individual being verified or a business client.

• Section 2 – End Users: in addition to Section 1, this section applies if you are an individual who has been asked to complete an identity verification using the Service, whether at the request of an Enterprise Client or directly with Verifico.

• Section 3 – Enterprise Clients: in addition to Section 1, this section applies if you are a representative of a business, financial institution, legal practice, or other organisation that uses the Service to verify its own customers, applicants or users.

If you access the Service via one of our Enterprise Clients’ own platforms, or via a partner platform, the personal information you provide may also be subject to that Enterprise Client’s or partner’s own privacy notice, in addition to this one.

Definitions

Controller means a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

Processor means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller.

Data Providers means entities, platform vendors, or official registries from whom we may collect Personal Data for the purpose of verification.

Data Subject means a natural person or individual whose Personal Data we hold.

End User means any natural person who accesses or interacts with the Service to complete an identity assessment, upload documentation, or complete a biometric check, at the request of an Enterprise Client or directly with Verifico.

Enterprise Client means any commercial entity, legal practice, financial institution, real estate conveyancer, or other corporate partner that uses the Service to fulfil statutory Anti-Money Laundering (AML), Know Your Customer (KYC), or fraud-prevention obligations.

Identity Credentials means official government-issued documentation proving an individual’s legal identity, including but not limited to passports, national identity cards, driving licences, residence permits.

Personal Data or Personal Information means any information relating to an identified or identifiable natural person (a “data subject”).

Service means Verifico’s identity verification platform, website, and related technology made available to Enterprise Clients and End Users.

SECTION 1. GENERAL

This section applies to everyone who visits our website, uses the Service, or otherwise interacts with us.

1.1 Personal information we collect

When you visit our website, email us, contact our support team, or interact with us in general terms, we may collect:

• your name and surname;

• your email address;

• your phone number;

• your IP address;

• any additional information you choose to share with us.

We process this information to respond to your enquiries, provide you with information about the Service, improve and secure our website and platform, manage risk and prevent illegal or prohibited activity, and for internal operations, analysis and research.

Where you contact us via a social media platform, you should be aware that you are sharing your personal data with that platform as well as with us. We use social media channels for inbound enquiries only and endeavour to respond via email or phone.

In all cases where information is provided to us so that we can provide the Service to an Enterprise Client, we act as a Processor in respect of that information, and the relevant Enterprise Client acts as the Controller, save as otherwise described in Section 2.

1.2 Legal basis for processing

We process personal data only where we have a valid legal basis under applicable data protection law. Depending on the context, our legal basis will normally be one of the following:

• the processing is necessary to perform a contract with you, or to take steps at your request before entering into one;

• the processing is necessary for our legitimate interests, or those of an Enterprise Client, provided these are not overridden by your data protection interests or fundamental rights and freedoms;

• we have your explicit consent, in particular for special category data such as biometric information; or

• the processing is necessary to comply with a legal obligation, for example under Anti-Money Laundering or Know Your Customer laws.

Where we ask you to provide personal data to comply with a legal requirement or to perform a contract, we will make this clear at the relevant time, including whether provision of the data is mandatory and the possible consequences of not providing it.

1.3 Legitimate interest

Legitimate interest is most appropriate where we use your data in a way you would reasonably expect. Where you submit an enquiry, it is reasonable to expect us to process your data to respond to you. Where you encounter an issue with our website or the Service, it is reasonable to expect us to process your data to resolve it. In each case, we have considered whether this processing could unfairly affect your interests and concluded that it does not.

1.4 Who we share your personal information with

We do not sell your personal information. We do not share it (as that term is used in the CCPA) for cross-context behavioural advertising. Where we act as a Processor, User Data is disclosed only on the Enterprise Client's documented instructions and as permitted by our Data Processing Addendum. The buyer and fraud-prevention bullets below apply to User Data only where the Enterprise Client has instructed or permitted that disclosure. We may disclose personal information to the following categories of recipients:

• our third-party service providers, who support the operation, functionality, hosting, or security of our website and platform, or who help us analyse and improve our services;

• competent law enforcement, regulatory or government authorities, courts, or other authorised bodies, where we consider disclosure necessary to comply with a legal obligation or to protect our or another person’s rights;

• an actual or potential buyer of our business (and its advisers), in connection with an actual or proposed merger, acquisition or sale, provided the buyer agrees to use the information only for the purposes disclosed in this Privacy Notice; and

• other relevant parties in order to fulfil a contractual obligation, protect the rights, property or safety of Verifico or others, or to exchange information for the purpose of fraud prevention and risk mitigation.

1.5 How we keep your personal information secure

We take appropriate technical, organisational and physical measures to protect personal data against unauthorised access, loss, alteration or disclosure, taking into account the risks associated with the relevant processing. We continuously review and improve our security measures and monitor access to data. Uploaded identity documents and images are held in private storage and are made available to authorised personnel only through time-limited links (valid for no more than 15 minutes), and verification links expire after 8 hours.

No method of transmitting or storing information over the internet is completely secure. By submitting your data, you acknowledge this inherent characteristic of the digital environment. If you notice any sign of a security breach or data leak, please notify us immediately at contact@verifico.me and we will take prompt action to investigate and address the issue.

1.6 Cookies and similar technologies

We use cookies and similar tracking technologies across our public website and verification interfaces in accordance with Regulation 6 of the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR. You can find out more, and manage your preferences, via our Cookie Policy.

1.7 Your data protection rights

Subject to applicable law and certain exceptions, you have the right to:

• object to processing based on legitimate interests, and to a decision based solely on automated processing (see Section 2.12);

• restrict our processing of your personal data in certain circumstances;

• be told what personal data we hold about you and how we process it;

• request a copy, in a commonly used electronic format, of the personal data we hold about you;

• request correction of inaccurate or incomplete personal data;

• request erasure of your personal data (the “right to be forgotten”), subject to certain legal exceptions;

• request that we transmit your personal data, in a structured and machine-readable format, to another organisation, where technically feasible; and

• lodge a complaint with a data protection authority about our collection or use of your personal data.

You can exercise any of these rights by contacting us using the details at the beginning of this Privacy Notice. Where we process your personal data as a Processor on behalf of an Enterprise Client, we will forward your request to that Enterprise Client within five (5) business days and will not respond to it except on the Enterprise Client's instructions. You may also contact the Enterprise Client directly. You can find out more about your rights from the UK Information Commissioner’s Office at https://ico.org.uk/for-the-public/.

1.8 Children’s personal data

Our website and general enquiry channels are not directed at children. Where we process personal data relating to children in the context of the Service, this is addressed in Section 4 of our Terms of Service (which restrict the Service to individuals aged 18 and over) and in the Age Check described in Section 2.1. In accordance with Verifico's Terms of Service, the Service is not intended for use by, and must not be used by, individuals under the age of 18.

1.9 Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our data processing practices, applicable law, or other relevant circumstances. Where we make changes, we will update the “Last updated” date at the top of this Privacy Notice, and, where required by law or where the changes are material, we will provide additional notice, for example through the Service or by direct notification. Changes take effect once the updated version is published, unless otherwise stated. We encourage you to review this Privacy Notice periodically.

SECTION 2. END USERS

This section applies, in addition to Section 1, if you are an individual who has been asked to complete an identity verification using the Service (for example, because an Enterprise Client has asked you to verify your identity as part of an application, onboarding process, or transaction).

2.1 What personal information we collect from End Users

To perform automated identity verification and fraud analysis, depending on the type of check requested, we collect and process:

• your name and surname;

• your date and place of birth, and nationality;

• your residential address;

• your email address and phone number;

• your IP address and technical/device information;

• information and images from your Identity Credentials;

• proof-of-residency documents (such as utility bills or bank statements) and the information on them, where an address check is requested;

• information relating to citizenship, where a proof-of-citizenship check is requested;

• biometric data, including facial geometry derived from a live photo or video, for the purpose of face-matching and liveness detection; and

• any other information you choose to share with us.

2.2 Purposes and legal basis for processing End User data

We process End User personal data only where we have a valid legal basis, as set out below:

We also use End User data, in anonymised, de-identified, or aggregated form, for testing, analytics and service quality (for example, to refine optical character recognition). We do not use End User data to train general or shared models, including through external AI providers, without the Enterprise Client's prior written instruction, and we never use biometric data for that purpose.

We use an automated language model to extract and structure address data from proof-of-residency documents. This model may be provided by a Sub-processor, and it is subject to the restrictions on training described above.

2.3 Legitimate interest

Where we rely on legitimate interest, this is because we use your data in a way you would reasonably expect (for example, to detect spoofing, fake documents, or automated bot attacks that could compromise the Service or put you or Our Client at risk of fraud). We have assessed that this processing does not unfairly override your data protection interests or fundamental rights and freedoms.

2.4 Special category data

Enterprise Clients are able to request a variety of verification checks. Depending on the check, these may require special category data from you, data revealing:

• biometric data, where used for identification purposes;

Under the Data Protection Laws, we require your explicit consent to process special category data, which we will ask you to provide during the verification process. If you do not give consent, we will not be able to carry out the relevant check. The most common example is biometric data used for face-matching (see Section 2.10 for further detail).

2.5 Criminal offence data

As part of certain screening checks, an Enterprise Client may ask us to process criminal offence data about you (for example, as part of an enhanced due diligence or adverse media check). An Enterprise Client is only permitted to request this where it has its own lawful basis for doing so under the Data Protection Laws. Any query about an Enterprise Client’s lawful basis for requesting criminal offence data should be directed to that Enterprise Client.

2.6 Who we share End Users’ personal information with

We share End Users’ personal information with the following categories of recipients:

• the Enterprise Client that requested the verification, who will normally act as the Controller of your information;

• our Data Providers and other third-party service providers who help us perform identity, document, biometric, or screening checks;

• competent law enforcement, regulatory, or government authorities, where required by law, and we will notify the Enterprise Client of such a request where legally permitted, disclosing no more than is strictly required; and

• other relevant parties in order to fulfil our contract with the Enterprise Client, or to prevent fraud and mitigate financial risk.

Such transfers are only permitted where there is a legitimate purpose, a valid contract or instructions in place, and following verification of the recipient’s reliability. Enquiries regarding our Data Providers or other processors may be directed to our Data Protection Officer (see Contact Us). A list of Sub-processors is available on request under the Data Processing Addendum.

2.7 International data transfers

Where your personal data is transferred outside the United Kingdom or European Economic Area we take steps to ensure the transfer complies with applicable data protection law, in particular through adequacy decisions or the use of the UK’s International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or the EU Commission’s standard contractual clauses. Once your data leaves the UK or EEA, it becomes subject to the laws of the recipient country, and may be disclosed to local authorities there. Where Verifico acts as Controller, you may request further information about the safeguards in place for a specific transfer.

2.8 How long we keep End Users’ personal information

Where an Enterprise Client is the Controller, that Enterprise Client decides the retention period for the data we process on its behalf. We retain the data until we are instructed to erase or anonymise it whether by explicit instruction from the Enterprise Client or under our contractual arrangement with them or as otherwise required by applicable law (for example, AML record-keeping obligations).

Where an Enterprise Client requires you to create an account directly with us, we act as the Controller for that account data only where it is used for our own purposes; where the account is created to carry out a verification for an Enterprise Client, we act as a Processor. In that case, your account data is retained until you ask for it to be erased, or the Enterprise Client’s default retention period has elapsed, whichever is sooner. If you wish your account to be erased, please email contact@verifico.me including the name, email address and mobile number used to create the account; we will action this within 30 days. Erasing your account does not erase the verification data we hold on behalf of the Enterprise Client to exercise your right to erasure in full, please contact the Enterprise Client for whom you completed the verification.

2.9 Retention of End User personal information

We retain End User personal data only for as long as necessary to perform the relevant verification and provide the Service to the Enterprise Client, or as otherwise required by applicable law (for example, AML record-keeping obligations). Once the applicable retention period has ended, or upon a valid request from the Enterprise Client or from you, we will delete or anonymise your personal data, unless a longer period is required by law. In any case, End User verification data is not retained for more than six (6) months after completion of the relevant verification, and biometric data is deleted within 90 days of completion of the verification session, unless applicable law requires a longer period.

2.10 Biometric data

Where a check requires biometric data (such as facial geometry derived from a live photo or video), we collect your explicit consent before the verification process begins and use this data solely for the purpose of confirming your identity and physical presence. We do not use biometric data for any other purpose, and we do not sell, lease, trade or otherwise profit from it. We do not use biometric data for one-to-many identification, to build or maintain a database of faces, or to train general or shared models. We do not disclose your raw biometric data to Enterprise Clients — only the outcome of the verification is shared with them, where relevant. Biometric data is protected using security measures that are at least as protective as those we apply to other sensitive or confidential information, and is retained only for as long as necessary for the purpose collected, and in any case within 90 days of completion of the verification session, whichever is sooner, unless a longer period is required by law.

2.11 Jurisdiction-specific notices for End Users

Depending on where you live, you may have additional rights regarding your personal data. This section supplements the rest of this Privacy Notice; where a provision here conflicts with the general terms of this Notice, the provision in this section prevails for residents of the relevant jurisdiction. If none of the notices below apply to you, the general provisions of this Privacy Notice apply.

This section supplements the main text of the document and clarifies how your rights are exercised depending on your region. If any provision in this section conflicts with the general terms of the Policy, these specific provisions shall take precedence.

2.11.1 Notice to Individuals Who are Residents of Certain U.S. States

A number of U.S. states, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others that have since adopted comprehensive consumer privacy laws, grant their residents specific rights regarding their personal information. This section is addressed to residents of those states and, where applicable, also serves as our notice at collection under the California Consumer Privacy Act, as amended.

2.11.1.1. Categories of Personal Information We Collect and Disclose.

In the course of providing our identity verification services, we collect the following categories of personal information about you: identifiers (such as your name, email address, and phone number); government identification information and document images; biometric information (facial geometry data derived from a photo or video you provide); internet or network activity information (such as your IP address and device data); and inferences drawn from the verification process (such as a match or no-match result). The purposes for which we collect, use, and disclose this information, and the categories of recipients to whom it may be disclosed, are described in the “Legal Grounds and Purposes of Processing” and “Disclosure and International Data Transfers” sections of this Privacy Notice.

2.11.1.2. No Sale or Targeted Advertising.

We do not sell your personal information, and we do not use the personal information we process as part of the identity verification service for cross-context behavioural or targeted advertising. Where our website separately uses analytics or advertising cookies for visitors browsing our public pages, those practices are described in our Cookie Policy, and any related choices can be exercised there. When we process personal information on behalf of an Enterprise Client through the identity verification service, we act as a service provider to that Enterprise Client and do not sell or share it, or use it outside our business relationship with that Enterprise Client.

2.11.1.3. Your Rights.

Subject to certain exceptions and to our ability to verify your request, you have the right to: know what personal information we hold about you and request a copy of it; request correction of inaccurate information; request deletion of your personal information; and not be discriminated against for exercising any of these rights. You, or an authorised agent acting on your behalf, may submit a request by contacting us at contact@verifico.me. If we decline your request, you may appeal our decision by writing to the same address; if you remain unsatisfied with the outcome, you may also contact the attorney general of your state of residence.

2.11.2 Notice Regarding Biometric Information to Individuals Who are Residents of the State of Illinois, Texas, and Washington.

Illinois, Texas, and Washington states have each adopted specific laws regulating the collection, use, and retention of biometric identifiers and biometric information, including the Illinois Biometric Information Privacy Act. These laws generally define a “biometric identifier” to include a retina or iris scan, fingerprint, voiceprint, or a scan of hand or face geometry, and “biometric information” to include any information derived from such an identifier that is used to identify a person; a photograph on its own, a written signature, or a physical descriptor such as height or eye colour is generally not covered.

As part of the identity verification process, we collect facial geometry information derived from the live photo or video you provide and compare it against your identification document to confirm that you are physically present and match the document submitted. We obtain your consent to this processing before the verification process begins and do not use your biometric information for any other purpose.

We retain biometric identifiers and biometric information only for as long as necessary to fulfil the purpose for which it was collected. We will permanently delete such data once that purpose has been satisfied, and in any case within 90 days of completion of the verification session, whichever occurs first, unless a longer retention period is required by law. Our written biometric retention and destruction policy is available to the public and on request. We do not sell, lease, trade, or otherwise profit from your biometric information, and we do not disclose your raw biometric data to Enterprise Clients; where relevant, we may share only the outcome of the verification with the Enterprise Client that requested it. Your biometric data is protected using security measures that are at least as protective as those we apply to other sensitive or confidential information.

2.11.3 Notice to Individuals Who are Residents of Canada

If you are located in Canada, the collection, use, and disclosure of your personal information is subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, equivalent provincial legislation.

Under PIPEDA, you have the right to access the personal information we hold about you, to request that inaccurate information be corrected, and to withdraw your consent to our processing of your personal information at any time, subject to legal or contractual restrictions. If you have concerns about how we have handled your personal information, you may contact us using the details in the “Contact Us” section below. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

If you reside in Quebec, additional obligations apply to us under Quebec’s Act Respecting the Protection of Personal Information in the Private Sector, including specific requirements applicable to the processing of biometric data. Quebec residents may direct privacy-related complaints to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).

2.11.4 Other Jurisdictions

If you are located in a jurisdiction not specifically addressed above, the general provisions of this Privacy Notice apply to the processing of your personal information, and you may still have rights available to you under locally applicable data protection law. Where any provision of this section conflicts with the general terms of this Privacy Notice, the more specific provision in this section shall prevail for residents of the relevant jurisdiction.

2.11.5 Notice Regarding UK Digital Identity Verification Services

We are working towards offering identity verification services aligned with the UK's Digital Identity and Attributes Trust Framework (UKDIATF). This section describes how we intend to process your personal data in that context. It will only apply once such services become available, and we will update it with full operational detail, including the identity of any fraud prevention or verification partners involved, before the relevant service is offered to you.

Where this Service becomes available, we generally expect to process your personal data as a Processor, acting on the instructions of the Enterprise Client that directs you to complete the verification, which will act as the Controller. Where we conduct identity fraud or activity history checks as part of the Service (for example, by checking your details against a recognised UK fraud prevention database) we act as an independent Data Controller for that specific purpose. In such cases, we will identify the relevant fraud prevention service to you, and explain the basis on which your data may be reported to it, before you use the Service.

We do not intend to use personal data collected through this Service for marketing purposes.

Your rights in relation to this processing are the same as those described elsewhere in this Privacy Notice, including your right to access, correct, or object to the processing of your personal data, and to complain to the relevant supervisory authority. Further information is available in the “Your data protection rights (Section 1.7)” section above.

2.12 Automated decision-making

Some checks, including liveness detection, face comparison and document analysis, are carried out using automated systems. These systems produce a Verification Result, but the decision on your application or relationship is made by the Enterprise Client, not by us. You may ask the Enterprise Client to review any decision based on such a result, and you have the right to object to a decision based solely on automated processing.

SECTION 3. ENTERPRISE CLIENTS

This section applies, in addition to Section 1, if you are a representative of an Enterprise Client – that is, a business, financial institution, legal practice, or other organisation that uses the Service to verify its own customers, applicants or users.

3.1 What personal information we collect from Enterprise Clients

During onboarding, we collect:

• the names and contact details of your personnel who will use the Service;

• usernames and account credentials; and

• company and billing information relating to your organisation.

Where you provide personal data relating to your own End Users in connection with your use of the Service (for example, to initiate a verification), we process that information as described in Section 2, acting as your Data Processor unless otherwise agreed in our Data Processing Addendum.

What you provide to us about your own customers

When you use the Service to request a verification, you (or your system, via our API or dashboard) will typically provide us with some information about the individual to be verified, so that we can initiate the relevant check. The information you need to provide depends on the type of check:

• Identity document verification: your customer’s name, and an image or scan of their identity document.

• Facial and biometric (liveness) verification: your customer’s name, and, where the check is initiated by you rather than the individual directly, their mobile number or email address so that we can invite them to complete the selfie or video step.

• Address verification: your customer’s name, address, and date of birth.

• Screening checks (sanctions, PEP, adverse media): your customer’s name, date of birth, and nationality.

• Know-your-business (KYB) checks: the corporate entity’s name and registration details, and, where relevant, the name and role of associated beneficial owners or officers.

• All checks: a reference or transaction description that helps you and us identify the check within your account.

For checks other than identity document verification, we will typically use this information only to invite your customer to complete the relevant steps directly with us (for example, by uploading a document or completing a liveness check) – we do not ask you to provide more of your customer’s personal data than is necessary to do this. For identity document verification, we use the information you provide to perform the check itself, in accordance with our Terms of Service.

Once your customer begins interacting with the Service directly, any further personal data we collect from them is processed as described in Section 2 (End Users), and you should ensure your customers have been given the Consumer Wording or equivalent notice described in your Terms of Service before you provide us with any of their personal data.

3.2 What we do with this information

We use the information collected during onboarding and account management to:

• create and maintain your Enterprise Client account;

• provide the Service and otherwise perform our agreement with you;

• respond to your enquiries and provide support;

• send you service, security, or account-related communications; and

• where you have agreed to receive them, send you marketing communications about our services, from which you may opt out at any time.

3.3 Legitimate interest

Where you have indicated willingness to sign an Order Form, it is reasonable to expect us to issue one to you. Where you submit an enquiry, it is reasonable to expect us to process your data to respond to you. In each case, we have considered whether this processing could unfairly affect your interests and concluded that it does not.

3.4 Who we share Enterprise Clients’ personal information with

We may share personal data relating to your personnel with:

• our third-party service providers who support billing, payments, marketing, legal, logistics, IT, or security functions;

• competent law enforcement, regulatory, or government authorities, where required by law; and

• an actual or potential buyer of our business, in connection with a proposed merger, acquisition or sale, on the same basis as described in Section 1.3.

We do not share your personnel’s personal data with other Enterprise Clients.

3.5 How long we keep Enterprise Clients’ personal information

We keep personal data relating to your personnel for as long as your organisation has an active account or contract with us, or as otherwise reasonably necessary to fulfil the purposes described above, including any period required to comply with our legal, accounting, or regulatory obligations after our relationship ends.

Contact Us

Please review this Privacy Notice carefully and contact our Data Protection Officer if you have any comments, questions or concerns, or if you wish to exercise any of the rights described above.

Verifico Ltd

Company number: 17437921

Registered office: 128, City Road, London, EC1V 2NX, United Kingdom

Data Protection Officer email: contact@verifico.me

Last updated: 20.10.2026