Alert

We’re sorry, but this service is not available in your location.

icon-utilities-bar Loginicon-utilities-bar Help Centericon-utilities-bar How to get verified
ON THIS PAGE
External Sources Exhibit
1. Scope
2. Use of external sources
3. Veriff UK Identity Verification Services
4. Unstructured Docs, Proof of Address, and/or Proof of Address Lite
5. Know Your Business Verification Solutions
6. Database Verification
7. Beta Services
8. Presence Verification with Coercion Detection

External Sources Exhibit

This External Sources Exhibit (“Exhibit”) is hereby incorporated into the Agreement by and between Veriff and Customer. All capitalized terms that are not expressly defined in this Exhibit have the meanings assigned to them in the Agreement, with accompanying information about the applicable Service in the Service Description portion of the  Documentation, currently found at https://www.veriff.com/service-description/ver-VSD-2301

1. Scope

1.1. This Exhibit governs the purchase of Services by Customer under an Order Form where:

1.1.1.  Sessions are checked against Third Party Sites. “Third Party Sites” means either (a) a third-party service provider identified as a “Conditional sub-processor” in Veriff’s sub-processor list available on Veriff’s website, currently at https://help.veriff.com/en/articles/6896122-sub-processors-used-by-veriff (“Sub-processor Page”), or (b) a data source (e.g. a government data registry) which is identified on Veriff’s website, currently at https://help.veriff.com/en/articles/6896680-veriff-s-use-of-external-data-sources.

1.1.2.  The Services purchased shall be identified as Veriff UK Identity Verification Services.

1.2.  Customer acknowledges and agrees that in the event of a conflict between this Exhibit and the Agreement, including the Data Processing Addendum, this Exhibit will control with respect to the specific Service purchased.

1.3.  Parties agree that UKDIATF Terms, as defined in Section 3 of this Exhibit, are an integral part of this Agreement and in the event of a conflict between the UKDIATF Terms and the Agreement, including this Exhibit, the UKDIATF Terms shall prevail.

2. Use of external sources

2.1. In the event the purchased Service relies upon a Third Party Site, Customer authorizes and instructs Veriff to transfer the Customer Data to the Third Party Site, and, if applicable, the data source country for the purpose of delivering the Service and performing the Session.

2.2.  For Third Party Sites listed as external data sources here, the Third Party Site acts as an independent controller for the Personal Data submitted through the Session. For Third Party Sites listed as Conditional subprocessors here, the Third Party Site acts as a processor for the Personal Data submitted through the Session.

2.3. For all Third Party Sites, Customer acknowledges and agrees that:

2.3.1. where Veriff obtains results from Third Party Site on Customer’s behalf, Veriff does not control, is not responsible for, and makes no express or implied warranties with regard to the availability, security, response times, or the accuracy of results returned from such Third Party Sites;

2.3.2. any data, including all Personal Data, received from such Third Party Sites are obtained by Veriff at the instruction of Customer and on behalf of Customer;

2.3.3. Veriff will process Personal Data from Third Party Sites only on Customer’s behalf and in accordance with any DPA between Veriff and Customer;

2.3.4. Customer will process Personal Data from Third Party Sites only for the following “Permitted Uses“:

2.3.4.1. To verify identity as required for compliance with Customer’s legal obligations under applicable “Know Your Customer” laws;

2.3.4.2. To inform, develop, and improve Customer’s threat detection, trust and safety, or security systems or protocols, including through the identification of actual or suspected threat activity or incidents;

2.3.4.3. To develop more effective incident response plans, such as by proactively identifying threat-specific procedures or countermeasures; and

2.3.4.4. To strengthen, improve, and develop safeguards against known attacks, such as adversarial inputs or data poisoning.

2.3.5. Customer will be responsible for the legality of any Customer Data;

2.3.6. Customer will obtain and maintain, and represents and warrants that it has obtained and maintained, all necessary licenses, notices, consents, and permissions required under applicable laws, including but not limited to Data Protection Laws (specifically including, to the extent applicable, notice and consent to collect and use biometric data) necessary for Veriff to collect, disclose, and otherwise process Customer Data and provide the Service to Customer under the terms of this Agreement;

2.3.7. upon request from Veriff, Customer will provide evidence that any required notices and consents referenced in Section 2.3.6. herein were provided and/or collected (as applicable);

2.3.8. Customer has a valid legal basis for transfers of End User’s Personal Data to a Third Party Site (e.g. the End User’s authorization where necessary); and

2.3.9. any service level, response time commitments, and/or uptime commitments will not apply to Sessions submitted to Third Party Sites.

3. Veriff UK Identity Verification Services

3.1. In respect of the Veriff UK Identity Verification Services the Customer acknowledges and agrees that:

3.1.1.  as such Services have mandatory requirements (“UKDIATF Terms”) as set forth in the UK Digital Identity and Attributes Trust Framework (“UKDIATF”) which may be, from time to time, updated, then the Parties agree, as applicable, to be bound by such requirements.

3.1.2.  Veriff’s responsibilities under the UKDIATF are limited to its role as an identity and component service provider and Customer shall be solely responsible for its use of identity and/or attribute data as provided by Veriff.

3.2. Data Processing Roles of Veriff UK Identity Verification Services. For the Veriff UK Identity Verification Services (M1A, M1B and L1B), the processing roles per the DPA apply, with the following exception:

3.2.1. As a part of the Session, Veriff conducts fraud or other unlawful conduct checks against the databases operated by Cifas, a company registered in England and Wales under company number 02584687 and with registered office at 6th Floor Lynton House, 7-12 Tavistock Square, London WC1H 9LT (“Cifas”). Customer acknowledges that for the purposes of conducting the checks against and filing the reports to the Cifas databases, Veriff acts as a joint-controller with Cifas. For clarity, Veriff is a controller for compiling and retaining information about the End Users reported to Cifas, if Veriff reasonably determines that the Session meets the reporting criteria agreed upon with Cifas.

3.2.2. In the context of the processing activities in Section 3.1 of this Exhibit, Customer shall be a controller of the Personal Data for the purpose of making the Personal Data available to Veriff, and authorizing the use of Personal Data to deliver the Service.

3.3.  Personal Data Processing and Data Subject Rights Handling. The Parties hereby acknowledge and agree to comply with the data protection principles of lawfulness, purpose and storage limitation, minimisation, accuracy, security and accountability as foreseen in Data Protection Laws, including the UK GDPR (General Data Protection Regulation (Regulation (EU) 2016/679), as transposed into United Kingdom national law by operation of Section 3 of the European Union (Withdrawal) Act 2018, together with the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019).

3.4.  End User Requests. Customer acknowledges that Veriff will be responsible for responding to End User requests related to those processing activities described in Section 3.2.1. of this Exhibit. In the event Customer receives such a request from the End User related to the processing activities described in Section 3.2.1. of this Exhibit, Customer must promptly forward such request to Veriff at support@veriff.com.

3.5.  Customer Responsibilities. Customer acknowledges and agrees that, to the extent it is considered a “relying party” for the purposes of the UKDIATF, it shall perform the responsibilities of a relying party under the framework and support Veriff’s compliance with its obligations as an identity and component service provider. Customer responsibilities include:

3.5.1.  implementing and maintaining procedures to detect, prevent, manage and respond to fraud, impersonation, or misuse of digital identities or attributes, consistent with the UKDIATF;

3.5.2.  notifying Veriff of any suspected or confirmed fraud, attempted impersonation, or other misuse of digital identities, attributes or identity evidence;

3.5.3.  cooperating fully with Veriff, law-enforcement bodies, and other authorities (including the Department for Science, Innovation and Technology or its designated oversight body/offices) in investigating and mitigating fraud events in a timely manner;

3.5.4.  promptly providing information required for fraud management when requested by Veriff, in accordance with applicable laws, including Data Protection Laws;

3.5.5.  implementing technical and organisational measures that provide a level of security equivalent to the UKDIATF requirements to maintain the integrity of any data and associated metadata;

3.5.6.  not retaining Personal Data longer than necessary for its verified purpose and upon request by Veriff, providing evidence of deletion or anonymisation of Personal Data;

3.5.7.  notifying Veriff without undue delay if Customer becomes aware of any actual or suspected security, privacy, or service incident, personal-data breach, compromise of UKDIATF, or any complaint relating to the digital identity or attribute data, including Personal Data, that could affect trust, users, or Veriff’s certification and shall cooperate with Veriff in investigation, information sharing, containment, and reporting;

3.5.8.  storing, displaying, and using any information regarding UKDIATF Service or identity and attribute data, including Personal Data, in a manner that does not alter or misrepresent its content or meaning;

3.5.9.  notifying Veriff if it becomes aware that any digital identity or attribute data, including Personal Data, appears inaccurate, corrupt, or inconsistent with other identity evidence, and cooperating with Veriff to verify or correct any identified inaccuracy;

3.5.10.  cooperate with Veriff, including in relation to any matters related to End Users and connected communications, in order for Veriff to fulfil its obligations under the UKDIATF;

3.5.11.  not acting in a manner that would cause Veriff to breach its obligations under the UKDIATF; and

3.5.12.  in case the Customer is another certified participant of the UKDIATF then follows the requirements of such certified participant.

3.6. Governing Law and Jurisdiction. This Section 3, and Personal Data processing subject to this Section 3 of Exhibit, is governed by and construed in accordance with English law, and in the event any claim or dispute arises from or related to this Section 3, each party hereby submits to the exclusive jurisdiction of the courts of England.

4. Unstructured Docs, Proof of Address, and/or Proof of Address Lite

4.1. Customer acknowledges and agrees that with respect to their use of Unstructured Docs, Proof of Address, and/or Proof of Address Lite, they will fully comply with following conditions:

4.1.1. Where Customer submits the birth certificates for children, such documents must be uploaded by authorised guardian in compliance with applicable law;

4.1.2. Customer further agrees and warrants that it shall fully comply with the following articles:

4.1.2.1. Healthcare Restrictions: Unstructured Docs, Proof of Address, and/or Proof of Address Lite service cannot be used for “clinical purposes”, as a substitute for professional medical advice, or in any manner that is overseen by or requires clearance or approval from any applicable regulatory authority. Customers are responsible for determining if their specific use case falls within the permissible administrative scope.

4.1.2.2. Age Restrictions: Customer will not, and will not allow End Users to, use Unstructured Docs, Proof of Address, and/or Proof of Address Lite service as part of a website, Customer Application, or other online service that is directed towards or is likely to be accessed by individuals under the age of 18.

4.1.2.3. Prohibited Use Policy: All processing must adhere to the prohibited uses policies, which can be accessed at Acceptable Use Policy and Generative AI Acceptable Use Policy.

5. Know Your Business Verification Solutions

5.1. Customer hereby acknowledges and agrees that in respect to their use of Know Your Business Verification Solutions, the following applies:

5.1.1. Business Registry Verification & Registry Document Request: Customer agrees to comply with any terms and conditions attached to the applicable Order Form.

5.1.1.1. Customer shall use the product only for the purpose of assessing and managing risks with respect to its legal and compliance obligations including but not limited to money laundering, fraud, corruption, terrorism, crime, sanctions, and other regulatory risks and associated obligations

5.1.2. Business AML: Customer agrees to comply with provisions outlined at: MemberCheck, Addendum A; as applicable. Customer shall use the product only for one or more of the following purposes:

5.1.2.1. assisting in complying with legal duties and regulations which apply to the Customer;

5.1.2.2. performing a statutory role as a Governmental organisation;

5.1.2.3. performing law enforcement duties; or

5.1.2.4. assisting a third party entity in relation to the obligations

6. Database Verification

6.1. If Customer has bought a Database Verification product as listed on the Order Form, the Customer acknowledges and agrees that their use of the Service, complies with this Section hereunder.

6.2. Mexico – INE Biometric Database Verification

6.2.1. Customer acknowledges and agrees that with respect to the Mexico – INE Biometric Database Verification:

6.2.1.1. Prior to using this Service, the Customer must enter into an agreement with Institutio Nacional Electoral (“INE“), which may be subject to additional costs and taxes by the relevant Mexican authorities, and which will include sending a letter of intent to INE that states that FIMPE Fideicomiso F/00185 will participate as the Customer’s technological operator; and

6.2.1.2. The customer must collect a valid consent from the End User for the Mexico – INE Biometric Database Verification and forward it to Veriff via a solution provided by Veriff.

6.3. CPF Database Verification and Brazil – CPF Biometric Database Verification

6.3.1. Personal Data Processing. For processing Personal Data for, and as a result of, the CPF Database Verification and/or the Brazil – CPF Biometric Database Verification (hereinafter, jointly or severally referred to as “CPF Database Check(s)”), the Customer hereby acknowledges and agrees to comply with the Brazilian General Data Protection Law (LGPD; Federal Law no. 13,709/2018) and other applicable laws of the Federative Republic of Brazil, including warranting:

6.3.1.1. to uphold and fulfill any direct or indirect (either submitted to Veriff or directly to the Customer) decision, decrees or orders that concern the CPF Database Check(s) either by supervisory or other authorities;

6.3.1.2. that the country in which the Personal Data is processed by the Customer offers a level of personal data protection adequate to that established in the Federative Republic of Brazil;

6.3.1.3. to inform Veriff in case it receives an End User request to exercise its rights specifically in relation to the CPF Database Check(s);

6.3.1.4. to ensure an appropriate legal basis for exercising the CPF Database Check(s); provided that the legal basis is consent, to validly obtain, manage and retain proof of the consent, including promptly providing Veriff with such proof;

6.3.1.5. to inform Veriff in case it is subject to any supervisory activity concerning Personal Data returned as a result of the CPF Database Check(s);

6.3.1.6. unless allowed otherwise under applicable laws, ensure the deletion of Personal Data returned as a result of the CPF Database Check(s) if required by the Third Party Site providing the CPF Database Check(s) or applicable law; and

6.3.1.7. that the Personal Data returned as a result of the CPF Database Check(s) will be processed by the Customer solely for fraud prevention purposes.

6.4. The Database Verification Service allows Customer to access to external data sources requiring adherence to specific requirements; these are: Australia – DVS Database Verification; Australia – Credit Bureau Database Verification; Australia – Superannuation & Payroll Database Verification; Australia – VEVO Database Verification; Australia – Electoral Roll Database Verification; Australia – Death Check Database Verification; Austria – Credit Bureau Database Verification; Cambodia – National ID Database Verification; Canada – Residential Database Verification; Canada – Credit Bureau (FINTRAC) Database Verification; China – Bank Card Database Verification; China – National ID Database Verification; China – Passport Database Verification; China – Phone Database Verification; Colombia – National ID Database Verification; Germany – Credit Bureau Database Verification; India – Drivers License Database Verification; India – EPIC (Voter’s Registration) Database Verification; India – PAN (Permanent Account Number) Database Verification; India – Passport Database Verification; India – Aadhaar Database Verification; Indonesia – Residential Identity Card Database Verification; Malaysia – National ID Database Verification; New Zealand – Utility Database Verification; New Zealand – Credit Bureau Database Verification; New Zealand – DIA Births Database Verification; New Zealand – DIA Citizenship Database Verification; New Zealand – DIA Passport Database Verification; Philippines – Credit Bureau Database Verification; Philippines – Residential Database Verification; Poland – Credit Bureau Database Verification; Singapore – Credit Bureau Database Verification; Spain – National ID Database Verification; Switzerland – Credit Bureau Database Verification; Thailand – National ID Database Verification; United Kingdom – Credit Bureau Database Verification; United Kingdom – 1×1 Sequence Search Database Verification; United States – Financial Services Database Verification; and United States – Credit Bureau Database Verification.

6.4.1. For using each Database Verification listed under Section 6.4., Customer must validly obtain, manage and retain proof of the End User’s consent for the Service to be conducted, including promptly providing Veriff with such proof upon request. This requirement does not apply to: (i) Australia – Death Check Database Verification; or (ii) New Zealand – Utility Database Verification.

6.4.2. Prior to using any of the following Database Verifications, Customer must fill out and submit to Veriff the access application provided by Veriff to Customer , which may be subject to the Third Party Site’s review and approval: Australia – DVS Database Verification, Australia – Credit Bureau Database Verification, Australia – Superannuation & Payroll Database Verification, Australia – VEVO Database Verification, Australia – Electoral Roll Database Verification, Australia – Death Check Database Verification, Canada – Residential Database Verification, Canada – Credit Bureau (FINTRAC) Database Verification, New Zealand – Utility Database Verification, New Zealand – Credit Bureau Database Verification, New Zealand – DIA Births Database Verification, New Zealand – DIA Citizenship Database Verification, and New Zealand – DIA Passport Database Verification.

6.4.3. With reference to United States – Financial Services Database Verification and United States – Credit Bureau Database Verification, the following shall apply:

6.4.3.1. Customer represents and warrants that it has a permissible purpose under the Gramm-Leach-Bliley Act (“GLBA”) for the use of United States – Financial Services Database Verification and United States – Credit Bureau Database Verification that are based on, derivative of, or produced with regard to data that is subject to GLBA; and

6.4.3.2. In addition to the indemnity provisions in the Agreement, each party agrees to defend, indemnify, and hold harmless the other party and its suppliers from any third-party claims arising from that party’s breach of applicable Data Protection Laws, including but not limited to GLBA.

7. Beta Services

7.1. Omni-Method Services

The applicability of this section is subject to the agreed Services, described in this Section 7, as stipulated in the Omni-Method Beta Order Form.

7.2. e-ID Verification

These terms apply to Services where Veriff provides e-ID Verification through a Third Party Site.

7.2.1. The Customer acknowledges and agrees that:

7.2.1.1. it shall use the Service solely for its own internal business purposes related to identity verification and/or fraud prevention.

7.2.1.2. it shall have a valid legal basis to collect End User’s Personal Data, share it with Veriff, the Third Party Site and the relevant e-ID Provider, and retrieve verification results as well as any additional End User’s Personal Data; such legal basis shall be the End User’s informed and explicit consent and shall be collected through Veriff’s consent collection user interface.

7.2.1.3. it shall not use any End User Data for a purpose not previously disclosed or compatible, or for which consent has been withdrawn.

7.2.2. The Customer acknowledges and agrees that access to certain e-ID Providers’ services is subject to additional terms and conditions established by each e-ID Provider (“Provider Specific Terms” or “PSTs”). The applicable PST(s) depend on which e-ID Provider(s) the Customer uses through the Service; applicable PSTs are set forth below. The Customer shall:

7.2.2.1. comply with all PSTs as applicable at any time to the specific e-ID Provider(s) that the Customer uses in connection with the Service;

7.2.2.2. be solely responsible for any breach of the PSTs by the Customer.

7.2.3. PSTs may be updated from time to time by the relevant e-ID Provider. Veriff shall notify the Customer about changes to any PST without undue delay to the extent Veriff becomes aware of such changes. Veriff shall not be responsible for any failure by an e-ID Provider to provide advance notice of such changes, and such changes shall become effective on the date specified by the applicable e-ID Provider. Continued use of the Service following such changes constitutes the Customer’s acceptance of the updated PSTs. For the avoidance of doubt, PSTs reflect mandatory requirements imposed by the relevant e-ID Provider as a condition of access to the applicable digital identity scheme; if the Customer does not intend to comply with any updated PST, Veriff shall be entitled to suspend access to the relevant Service.

7.2.4. The Customer acknowledges that, in the course of providing the Services, Veriff may receive requests from government or regulatory entities, or any other competent authority, or be contractually or legally required, to provide information about the Customer and the Customer’s use of the Services as a condition of continued access to, or provision of, the Services. The Customer authorises Veriff to disclose the Customer’s data to a Third Party Site, government entities, or regulatory authorities (or their designated representatives) to the extent reasonably necessary to comply with such requests or requirements. The Customer shall:

7.2.4.1. maintain books and records demonstrating compliance with this Section 7.2 and applicable PSTs;

7.2.4.2. upon Veriff’s reasonable request, promptly provide information or documentation necessary to satisfy audit or information requests from a Third Party Site, e-ID Providers, or regulatory authorities; and

7.2.4.3. grant Veriff (or its designated auditor) reasonable access to audit the Customer’s compliance with this Section 7.2. and applicable PSTs, in a manner that does not unreasonably interfere with the Customer’s operations.

7.2.5. The Customer shall defend Veriff and its Affiliates, and its and their respective officers, directors, employees and contractors, from and against a suit or proceeding by a third-party arising out of or relating to: (a) any breach by the Customer of this Section 7.2. and applicable PSTs; and (b) any claims relating to the Customer’s use of e-ID Verification; and shall indemnify Veriff for any damages, attorney fees and costs finally awarded against Veriff as a result of, or for any amounts paid by Veriff under a court-approved settlement of, a claim against Veriff. Any provisions that seek to exclude or limit the Customer’s liability in the Agreement shall not apply to the Customer’s liability arising under or in connection with this Section 7.2. This Section 7.2. survives the termination of the Agreement.

7.3. India – DigiLocker e-ID Verification

These terms apply only when the Customer uses DigiLocker as an e-ID Provider through Veriff’s e-ID Verification Service.

7.3.1. The Customer shall comply with:

7.3.1.1. the Digital Personal Data Protection Act 2023;

7.3.1.2. the Information Technology Rules, 2011;

7.3.1.3. the Aadhaar Act, 2016; and

7.3.1.4. all regulations issued thereunder.

7.3.2. When collecting sensitive personal information (as defined under applicable Indian law) through India – DigiLocker e-ID Verification, the Customer shall:

7.3.2.1. clearly disclose the purpose of collection and use;

7.3.2.2. implement appropriate security safeguards; and

7.3.2.3. comply with all retention and deletion requirements under applicable Indian law.

7.4. Denmark – MitID e-ID Verification

These terms apply only when the Customer uses MitID as an ID Provider through Veriff’s e-ID Verification Service.

7.4.1. The Customer shall comply with, and ensure its End Users comply with, the MitID Rules and requirements as set forth by the MitID Partnership (available at https://www.mitid.dk/en-gb/).

7.4.2. The Customer shall follow the MitID UX Scheme and display MitID in accordance with the guidelines provided by Nets Denmark A/S at https://www.signaturgruppen.dk/application/files/4917/1835/4565/UX_scheme_-_extracted.pdf. The Customer shall not alter, obscure, or misrepresent the MitID authentication process.

7.4.3. The Customer shall not charge End Users any fee specifically for authenticating via the Denmark – MitID e-ID Verification.

7.4.4. The Customer shall display the MitID domain validation indicator to End Users during the authentication process.

7.5. Brazil – Selfie IDV

7.5.1. The Customer shall comply with the requirements established under Section 6.3. (“CPF Database Verification and Brazil – CPF Biometric Database Verification”).

8. Presence Verification with Coercion Detection

Customer acknowledges and agrees that with respect to their use of Presence Verification with Coercion Detection, they will fully comply with following conditions:
8.1 Customer will not, and will not allow End Users to, use Presence Verification with Coercion Detection as part of a website, Customer application, or other online service that is directed towards or is likely to be accessed by individuals under the age of 18.
8.2 All processing must adhere to the prohibited uses policies, which can be accessed at Acceptable Use Policy and Generative AI Acceptable Use Policy.