Data Processing Addendum

Version: 20.10.2026

Effective date: 20.10.2026

Preamble

This Data Processing Addendum (the “DPA”) forms part of, and is incorporated into, the Terms of Service entered into between Verifico Ltd (“Verifico”, “we”, “us” or “our”) and the business or organisation identified as the Client under the Terms of Service (“Client”, “you” or “your”).

This DPA governs the processing of Personal Data by Verifico on Client’s behalf in connection with the Service, and reflects the requirements of Article 28 of the UK GDPR and, where applicable, the EU GDPR, as well as equivalent obligations under other applicable Data Protection Laws (including, but not limited to, the laws of the United States and Canada) to the extent they apply to the processing.

Terms not defined in this DPA have the meaning given to them in the Terms of Service. In the event of a conflict between this DPA and the Terms of Service, this DPA prevails in respect of the processing of Personal Data.

1. DEFINITIONS

Adequate Country means a country or territory outside the UK and the European Economic Area (“EEA”) that is recognized by providing an adequate level of protection for Personal Data by UK adequacy regulations under Article 45 of the UK GDPR (for transfers subject to the UK GDPR) or by a decision of the European Commission under Article 45 of the EU GDPR (for transfers subject to the EU GDPR), and, where such recognition is limited to certified recipients, only in respect of those recipients.

“Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “processing” and “supervisory authority” have the meanings given in the Data Protection Laws.

Client (also "you" or "your") means the business or organisation that subscribes to the Service and that initiates, requests, or directs a verification of a User through the Service. Client determines why a verification is required, which Checks are requested, and how the resulting Verification Result is used, including the final decision made about the User.

Data Protection Laws means all applicable data protection and privacy legislation in force from time to time, including, without limitation, the UK GDPR, the Data Protection Act 2018, Data (Use and Access) Act 2025, the EU GDPR (where applicable), and other applicable data protection and privacy laws in the United States (including the California Consumer Privacy Act as amended by the California Privacy Rights Act, other relevant state comprehensive privacy laws, and relevant state biometric privacy laws, including the Illinois Biometric Information Privacy Act), Canada (including PIPEDA and, where applicable, Québec’s private sector privacy legislation), and any other jurisdiction in which Verifico verifies a User, in each case as amended, replaced or re-enacted.

Controller means a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

Processor means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller.

User has the meaning given in the Terms of Service there defined as "User or Verified Person", also "End User".

User Data means the Personal Data processed by Verifico on Client’s behalf and on Client’s instructions under this DPA, as further described in Schedule 1 (aligning with the "User Data" defined term in the Terms of Service).

Sub-processor means any Processor engaged by Verifico to process User Data on Client’s behalf in connection with the Service.

Standard Contractual Clauses or SCCs means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission (currently Commission Implementing Decision (EU) 2021/914 of 4 June 2021), as amended or replaced from time to time.

UK Addendum means the International Data Transfer Addendum to the EU Commission’s Standard Contractual Clauses issued by the UK Information Commissioner’s Office under Section 119A of the Data Protection Act 2018, as in force from time to time.

Transfer Mechanism means the SCCs, the UK Addendum or such other lawful transfer mechanism recognised under the applicable Data Protection Laws for the international transfer of Personal Data, including transfers outside the UK or EEA, and equivalent lawful transfer mechanisms recognised under the data protection laws of the United States, Canada, or any other jurisdiction from or to which Personal Data is transferred in connection with the Service.

2. ROLES AND SCOPE OF PROCESSING

2.1 Status of the parties. In respect of User Data processed through the Service to carry out verifications requested by Client, Client is the Controller and Verifico is the Processor. This applies both to User Data that Client provides to Verifico directly, and to User Data that a User provides directly to Verifico in order to complete a verification initiated by Client. Where Verifico processes User Data for its own purposes (for example, to comply with its own legal or regulatory obligations, or to maintain its own fraud-prevention records where permitted by law), Verifico acts as an independent Controller for that processing. That processing is not carried out on Client’s behalf, is not governed by this DPA, and is described in Verifico’s Privacy Notice.

2.2 Details of processing. The subject matter, duration, nature and purpose of the processing, the types of Personal Data, and the categories of Data Subjects are set out in Schedule 1 (Details of Processing).

2.3 Client’s instructions. Client instructs Verifico to process User Data to provide the Service in accordance with the Terms of Service, this DPA, and any further written instructions given by Client from time to time, including instructions given through Client’s use of the Service’s functionality (for example, configuring the type of check requested) and by Client’s configuration of a Verification Process that includes a Proof of Citizenship, Proof of Residency or Liveness Check step. A Verification Process that includes the Liveness Check step constitutes Client’s instruction to process biometric data as described in Schedule 1.

2.4 Client’s responsibilities. Client is responsible for ensuring it has a valid lawful basis for instructing Verifico to process User Data, and for complying with its own obligations as Controller under the Data Protection Laws, including in relation to the privacy information given to Users, as further described in the Terms of Service.

3. VERIFICO’S OBLIGATIONS AS PROCESSOR

Verifico will:

• process User Data only on Client’s documented instructions, including with regard to transfers of User Data to a third country, unless required to do otherwise by law, in which case Verifico will inform Client of that legal requirement before processing, unless the law prohibits this on important grounds of public interest;

• inform Client immediately, and in any event within 24 hours of becoming aware, if, in Verifico’s reasonable opinion, an instruction from Client infringes the Data Protection Laws;

• ensure that persons authorised to process User Data are subject to a duty of confidentiality, whether contractual or statutory;

• implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as further described in Schedule 2 (Security Measures);

• taking into account the nature of the processing, provide reasonable assistance to Client, by appropriate technical and organisational measures, to fulfil Client’s obligations to respond to requests from Data Subjects to exercise their rights under the Data Protection Laws (including by notifying Client within five (5) business days of receiving any such request directly from a Data Subject, and not responding to it except on Client’s documented instructions);

• provide reasonable assistance to Client with data protection impact assessments and prior consultation with supervisory authorities, taking into account the nature of the processing and the information available to Verifico;

• notify Client without undue delay after becoming aware of a Personal Data Breach affecting User Data in accordance with Section 6.2, and provide such information as Client reasonably requires to meet its own notification obligations under the Data Protection Laws;

• at Client’s written election, delete or return all User Data to Client after the end of the provision of the relevant Service, and delete existing copies in accordance with Section 8, unless applicable law requires storage of the User Data;

• maintain a written record of the processing activities carried out on Client’s behalf and make it available to Client or a supervisory authority on request;

• make available to Client all information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by Client or an auditor mandated by Client, in accordance with Section 7 (Audit).

4. SUB-PROCESSORS

4.1 General authorisation. Client provides Verifico with a general written authorisation to engage Sub-processors to process User Data in connection with the Service, subject to this Section 4.

4.2 Sub-processor information and changes. On Client’s written request, Verifico will provide Client with information about the Sub-processors engaged in connection with the Service, including their identity, the processing they carry out and the location of that processing, in accordance with applicable Data Protection Laws. Verifico will inform Client of any intended addition or replacement of a Sub-processor (for example, by email to the contact address provided by Client) at least 10 business days before the change takes effect, so that Client has the opportunity to object under Section 4.3.

4.3 Objection. If, having become aware of a Sub-processor (whether through a notice or request under Section 4.2, through the exercise of Client’s audit rights under Section 7, or otherwise), Client reasonably objects to that Sub-processor on data protection grounds, Client must notify Verifico in writing within 14 business days of becoming aware of the Sub-processor, setting out the grounds for its objection. The parties will discuss the objection in good faith. If the parties cannot reach a resolution within a reasonable period, either party may terminate the affected part of the Service (or, if the objection cannot reasonably be accommodated other than by termination, the Terms of Service) on written notice, without further liability to either party arising solely from that termination.

4.4 Sub-processor obligations. Where Verifico engages a Sub-processor, Verifico will impose data protection obligations on that Sub-processor that are the same as those set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures. Verifico remains liable to Client, subject to Section 9.3 for the performance of a Sub-processor’s obligations in respect of User Data.

5. INTERNATIONAL TRANSFERS

5.1 Transfer mechanism. Client authorises Verifico to transfer User Data to any country or territory that is an Adequate Country. Verifico may transfer User Data to any other country (a) on the basis of appropriate safeguards in accordance with Data Protection Laws, or (b) pursuant to a Transfer Mechanism.

5.2 Where a Transfer Mechanism is required for transfers of User Data from Client to Verifico, Client acts as the data exporter and Verifico acts as the data importer; and where Verifico transfers User Data onward, Verifico acts as the data exporter and the relevant Sub-processor acts as the data importer in respect of onward transfers by Verifico of User Data to Sub-processors located outside the UK and the EEA in a country that is not an Adequate Country. Verifico will enter into an appropriate Transfer Mechanism with each such Sub-processor, unless the parties agree otherwise in writing for a specific transfer.

5.3 Additional safeguards. Where Verifico reasonably considers that the applicable Transfer Mechanism alone does not provide an adequate level of protection for a given transfer, having regard to the laws and practices of the destination country, Verifico will implement such additional technical, contractual or organisational measures as are reasonably necessary to protect the transferred User Data to a standard essentially equivalent to that required under the Data Protection Laws.

5.4 Government access requests. Where legally permitted, if a public authority requests access to User Data, Verifico will: use reasonable efforts to challenge the request where Verifico considers there are reasonable grounds to do so; notify Client promptly of the request; not disclose more User Data than is strictly required; and keep a record of the disclosure.

5.5 Onward transfers. On Client’s written request, and to the extent permitted by applicable law, Verifico will provide Client with information about the Transfer Mechanism relied on for transfers of User Data to Sub-processors outside the UK and the EEA, so that Client can reflect those transfers in its records of processing and in its transfer risk assessments.

6. SECURITY AND PERSONAL DATA BREACHES

6.1 Security measures. Verifico will implement and maintain the technical and organisational security measures described in Schedule 2, and will review and update those measures periodically to address evolving risks.

6.2 Breach notification. Verifico will notify Client immediately, and in any event within 24 hours, after becoming aware of a Personal Data Breach affecting User Data. The notification will, to the extent then known, describe the nature of the breach, the likely categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach. Verifico will provide further information as it becomes available and will reasonably cooperate with Client’s own investigation and notification obligations.

7. AUDIT

7.1 Client’s audit right. On reasonable written notice, and no more than once in any 12-month period (unless Client reasonably believes there has been a breach of this DPA, or an audit is requested by a supervisory authority), Verifico will make available to Client all information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by Client or an auditor mandated by Client. Verifico may in the first instance respond to a request under this Section 7 by providing a summary of relevant audit reports, security certifications, or completed information security questionnaires; where that information is not reasonably sufficient to demonstrate compliance with this DPA, Client may conduct an audit, including an on-site inspection, in accordance with Section 7.2.

7.2 Scope. Any audit or inspection under Section 7.1 must be subject to appropriate confidentiality obligations, conducted during normal business hours and with minimal disruption to Verifico’s operations, and must not give Client access to information about other clients of Verifico. Where an audit or inspection extends to the premises or systems of a Sub-processor, Verifico will procure access to the extent permitted by its agreement with that Sub-processor, failing which Verifico will make available that Sub-processor’s relevant audit reports and certifications. Client will bear all costs of any audit or inspection under Section 7.1, including the costs of any third-party auditor engaged by Client, unless the audit reveals a material breach of this DPA by Verifico, in which case Verifico will reimburse Client’s properly documented costs of that audit.

8. RETURN AND DELETION OF DATA

8.1 On termination or expiry of the Terms of Service, or earlier at Client’s written request, Verifico will, at Client’s election, delete or return all User Data then held by Verifico, and delete existing copies within 30 days of termination, expiry or Client’s request (as applicable) and confirm that deletion in writing on Client’s request, save to the extent Verifico is required by applicable law to retain some or all of the User Data, in which case Verifico will continue to protect that data in accordance with this DPA for as long as it is retained.

8.2 Where deletion or return is technically infeasible for specific User Data (for example, information contained within secure backups), Verifico will isolate that data from further active processing and delete it in accordance with its standard backup deletion schedule, which will not exceed 90 days from the relevant termination, expiry or deletion request. Until deleted, such data will not be restored or used for any purpose other than compliance with applicable law, including Biometric Data.

9. GENERAL

9.1 Changes to this DPA

Verifico may update this DPA where reasonably necessary to reflect changes in the Data Protection Laws, a change to the Transfer Mechanism referred to in Section 5, or a material change to the Service. Verifico will give Client at least 30 days’ written notice of any such change by email to the contact email address provided by the Client, save where a shorter period is required to comply with applicable law.

9.2 Order of precedence

If there is a conflict between this DPA and an applicable Transfer Mechanism incorporated by reference, the Transfer Mechanism prevails to the extent of the conflict.

9.3 Liability

The liability provisions set out in the Terms of Service apply to this DPA, and each party’s total liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service , provided that nothing in this Section 9.3 limits liability to Data Subjects or any liability that cannot be limited under Data Protection Laws.

9.4 Severability

If any provision of this DPA is held to be invalid, illegal or unenforceable, the remaining provisions will continue in full force and effect.

9.5 Governing law and jurisdiction

This DPA is governed by, and subject to the jurisdiction set out in, the Terms of Service.

9.6 US state privacy and biometric laws.

To the extent that Biometric Data relates to Users in Illinois, Texas, Washington or any other state with a biometric privacy law: (a) before any Liveness Check, Client will obtain the written release required by that law; (b) Verifico will make its written biometric retention and destruction policy available to Client and to the public on request; and (c) Verifico will not sell, lease, trade or otherwise profit from Biometric Data. For personal information subject to the California Consumer Privacy Act, Verifico acts as a service provider and will not sell or share User Data, retain, use or disclose it outside the direct business relationship with Client or for any purpose other than the business purposes described in Schedule 1, or combine it with personal information received from other sources except as permitted by applicable regulations. Verifico will notify Client if it can no longer meet these obligations.

SCHEDULE 1: DETAILS OF PROCESSING

SCHEDULE 2: SECURITY MEASURES

Verifico implements and maintains the following categories of technical and organisational measures, appropriate to the risk associated with the processing of User Data. Specific implementation detail may evolve over time provided the overall level of protection is not reduced.