Didit

" Didit trains, evaluates, and improves its identity-verification, biometric, and fraud-detection models, and operates cross-customer fraud-prevention safeguards, using anonymized or pseudonymized data derived from verification activity (for example: document features, fraud signals, attack patterns, model-error samples). Didit applies anonymization, pseudonymization, aggregation, and access controls so that the data used for training and fraud detection cannot reasonably be linked back to an identifiable individual outside the underlying verification record. This processing is grounded in Didit's legitimate interest in: improving the accuracy and safety of identity and fraud infrastructure used by all customers; detecting and preventing fraud, identity-theft attacks, deepfakes, and known-attacker repeat attempts; and meeting regulatory expectations around model performance, fairness, and security. Opt-out. A customer or end user may opt their data out of model training and fraud-detection processing by: deleting the underlying verification record via the API or the Business Console (the deletion removes the record from training pipelines on the next refresh cycle), or emailing privacy@didit.me with the relevant session identifier or account, requesting an opt-out. Opt-outs apply prospectively from the date of the request; Didit will also use commercially reasonable efforts to purge eligible records from active training datasets."

" Didit's public websites and standard business services are not directed to children. Some customers may lawfully use Didit for age-related or identity-related checks involving younger users, but that use must be supported by an appropriate legal basis and the customer's own notices. If you believe personal data was submitted to Didit without proper authorization, contact privacy@didit.me ."

" This Privacy Policy explains how Didit processes personal data when you visit our websites, contact us, use our products and services, or complete an identity or fraud verification flow powered by Didit. If you are verifying your identity for a bank, fintech, crypto platform, marketplace, employer, or another organization that uses Didit, that organization is the party that decides why the verification is required. In those cases, it is the controller or business , and Didit acts as its processor or service provider . For verification-specific processing, biometric data, and white-label flows, read our Verification Privacy Notice and End User Terms for Identity Verification ."

" Depending on the service and geography, your data may be processed by one or both of the following Didit entities: Didit Identity Spain, S.L. , CIF B22929327, Calle Nápoles 227, P. 1, 08013 Barcelona, Spain. Contracting entity for European Union, United Kingdom, European Economic Area, and Switzerland customers and the establishment that operates the European data plane. Didit Identity, Inc. , EIN 39-2860573, 1111B S Governors Ave STE 34855, Dover, Delaware 19904, United States. Contracting entity for United States, Canada, Latin America, Asia-Pacific, Middle East, and global customers. When we say "Didit" , "we" , "us" , or "our" , we mean the Didit entity or entities providing the applicable service. Privacy contact: privacy@didit.me Data Protection Officer: dpo@didit.me Security contact: security@didit.me General contact: hello@didit.me "

" This Privacy Policy applies when you: visit `didit.me` or any Didit-operated website; request information, a demo, or support; create or manage a Didit business relationship, account, or integration; apply for a role with Didit; or use a verification, fraud-prevention, authentication, or compliance flow operated by or through Didit. Our role changes depending on the context:"

" Website visitors, marketing, recruiting, sales, support, and direct business relationships Controller Didit decides why and how the data is processed for those direct interactions. Verification flows requested by a Didit customer Processor / Service Provider The customer decides why the verification happens and what checks are enabled. Didit processes data on the customer's behalf. Security, abuse prevention, service integrity, audit logging, legal compliance, fraud-model training and validation on anonymized or pseudonymized data, and legal claims Independent controller for that specific purpose Didit may process limited data to secure the platform, train and improve fraud-detection and verification models, comply with law, and establish, exercise, or defend legal claims. "

" If you are in a white-label verification flow or on a custom domain, custom branding does not necessarily mean only the branded company processes your data. Didit may still provide the underlying verification technology and related processing."

" The categories of data we process depend on the service, workflow configuration, and your relationship with Didit. They may include: Identifiers and contact data , name, email address, phone number, mailing address, date of birth, and similar identifying information. Business and account data , company name, billing information, account credentials, API usage details, and records of your relationship with Didit. Verification data , identity document images, extracted document data, proof-of-address files, questionnaire answers, sanctions or watchlist screening inputs, and verification outcomes. Biometric and liveness data , where the workflow includes face verification or similar checks, selfies, face images, videos, liveness captures, anti-spoofing signals, and data derived from scans of facial geometry. Device, network, and technical data , IP address, browser type, operating system, language, device identifiers, timestamps, geolocation inferred from network data, and other security or anti-fraud telemetry. Communications and support data , messages, support tickets, call records, email exchanges, and operational logs. Third-party and public-source data , information provided by our customers, identity or fraud-prevention partners, public authorities, telecom providers, and publicly available sources where permitted by law. Recruitment data , CVs, employment history, and other materials submitted during hiring. We do not need every category listed above for every interaction. The exact data used depends on the services requested and the configuration selected by the relevant customer."

" We may use personal data for the following purposes: To operate our websites and services , account access, product delivery, customer support, billing, and communications. To provide identity and fraud infrastructure services , User Verification (Know Your Customer / KYC), Business Verification (Know Your Business / KYB), Transaction Monitoring, Wallet Screening (Know Your Transaction / KYT), and other configured checks. To secure the platform , prevent abuse, detect spoofing, prevent fraud, monitor suspicious activity, and maintain service integrity. To train, evaluate, and improve fraud-detection and verification models using anonymized or pseudonymized data derived from verification activity, where permitted by law. See Section 11 for the opt-out. To respond to requests , demo requests, support questions, due diligence requests, and business communications. To manage recruiting and hiring , review applications and communicate with candidates. To comply with legal and regulatory obligations , maintain records, respond to lawful requests, enforce contracts, and carry out internal or external audits. To establish, exercise, or defend legal claims and protect the rights, safety, and security of Didit, our customers, and affected individuals."

" Where the General Data Protection Regulation (GDPR), United Kingdom GDPR, Swiss data protection law, or similar laws apply, Didit relies on one or more of the following legal bases: Performance of a contract or steps taken at your request before entering into a contract. Legitimate interests , securing our platform, supporting customers, preventing fraud, maintaining records, training and improving fraud-detection and verification models on anonymized or pseudonymized data, and communicating with business contacts, provided those interests are not overridden by your rights. Consent , including where consent is required for marketing communications, certain cookies, or biometric processing in a particular jurisdiction or workflow. Legal obligation , where processing is required to comply with applicable law, regulation, court order, or lawful request from authorities. Establishment, exercise, or defense of legal claims . Where special-category or sensitive data is processed, including biometric data used to uniquely identify you, Didit processes that data only where permitted by applicable law. In verification flows, the relevant customer is responsible for determining and documenting the primary legal basis for the verification itself, including whether explicit consent is required."

" Depending on your location and the applicable law, you may have the right to: access your personal data; request correction of inaccurate or incomplete data; request deletion or erasure; request restriction of processing; object to certain processing, including processing on the basis of legitimate interests (see Section 11 for the model-training and fraud-detection opt-out); withdraw consent where processing is based on consent; request portability of the data you provided; not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, subject to the conditions and exceptions in Article 22 GDPR; and lodge a complaint with a supervisory authority. Didit's lead supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos / AEPD) at `aepd.es`. When Didit acts as controller, submit privacy requests to privacy@didit.me or dpo@didit.me . When Didit acts as processor or service provider for a customer verification flow, direct your request to the organization that asked you to verify. That customer controls the purpose of the verification and is best positioned to respond. If Didit receives such a request directly, we may forward it to the relevant customer."

" Didit uses cookies and similar technologies on its websites for functionality, security, analytics, and attribution. Read our Cookies Policy for the full inventory, the consent banner controls, and our Global Privacy Control (GPC) and Do Not Track (DNT) posture."

" Didit uses administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, and unlawful destruction, including encryption at rest with AES-256, encryption in transit with TLS 1.3, key management in AWS KMS, role-based access control, environment separation, continuous monitoring, vendor oversight, and incident response procedures. See the Information Security Policy for the full posture and certifications. No security measure is perfect. You should also protect your own devices, credentials, and communications."