Data Processing Agreement

This Data Processing Agreement (“DPA”) sets out the terms on which OKIAS (SMC-Pvt) Ltd processes personal data — including special-category biometric data — on behalf of its customers through the OKIAS identity verification platform and API (the “Service”). It is written to satisfy Article 28 of the EU/UK General Data Protection Regulation (GDPR) and forms part of the agreement between OKIAS and each customer.

This page is the current reference text. For a countersigned copy see §14, and read it together with our Privacy Policy and Terms of Service.

1. Parties & roles

For all personal data submitted to the Service about the individuals a customer asks us to verify (“End Users”), the customer is the data controller and OKIAS is the data processor. End Users — the applicants whose documents and faces we analyse — are the data subjects. OKIAS acts as an independent controller only for its own account, billing and website data, as described in the Privacy Policy; that processing is outside the scope of this DPA.

Processor: OKIAS (SMC-Pvt) Ltd, Reg No. H489273, ICN 0308002, Lane No 1, Bank Street, Husaini Chowk, Bahawalpur, Punjab 63100, Pakistan.

2. Subject matter, duration & nature of processing

The subject matter of processing is identity verification: reading and validating identity documents, comparing a live selfie against the document portrait, adjudicating liveness, and screening extracted names against sanctions data, in order to return a verification decision with reason codes. Processing continues for the term of the customer’s agreement with OKIAS and ends with deletion under §12. The nature of the processing is collection, storage, automated analysis (including by an AI sub-processor, see §7), structuring, retrieval, disclosure to the customer, and erasure.

3. Categories of data & data subjects

• Identity document images — photos or scans of passports, ID cards, driving licences and similar documents.
• Selfie & liveness frames — images of the End User’s face captured during the verification flow.
• Extracted identity fields — name, date of birth, document number, nationality, expiry date and similar fields read from the document.
• Decision metadata — verification status, confidence scores, reason codes, sanctions-screening results and audit records.

Facial images processed for 1:1 face comparison and liveness constitute biometric data under GDPR Article 9. The customer, as controller, is responsible for establishing a lawful basis (including explicit consent where that is the applicable basis) before submitting an End User for verification.

4. Processing purposes & documented instructions

OKIAS processes End-User data only to perform the verification the customer requested, to return and support the resulting decision, to maintain security and audit records, and as otherwise documented in the customer’s configuration (for example the retention window in §12). Each API call and each dashboard action is a documented instruction. OKIAS will not process End-User data for its own purposes, will not sell it, and does not use End-User biometric data to train general-purpose AI models. If OKIAS believes an instruction infringes data-protection law, it will inform the customer before proceeding. If Union, Member State or other applicable law requires processing beyond the customer’s instructions, OKIAS will inform the customer before processing unless that law prohibits it.

5. Confidentiality

Access to End-User data is limited to personnel who need it to operate the Service, and who are bound by contractual confidentiality obligations. Administrative access to production systems is role-restricted and every administrative action is written to the append-only audit log described in §6.

6. Security measures (Article 32)

The Service implements the following technical and organisational measures:

• Encryption in transit — TLS for all connections to the API, dashboard and hosted verification flows.
• Field-level encryption at rest — extracted identity fields and sensitive records are encrypted with AES-256-GCM before storage.
• Credential protection — account passwords are hashed with argon2id; API keys are stored hashed and shown only once at creation.
• Multi-factor authentication — TOTP-based MFA for platform administrator access.
• Role-based access control — least-privilege roles across the dashboard and admin surfaces.
• Tamper-evident audit log — administrative actions are recorded in a hash-chained, append-only audit log; each entry cryptographically commits to the previous one.
• Automated retention purge — an hourly job permanently strips Verification Media and extracted PII past the configured retention window (§12).
• Rate limiting — request throttling on authentication and API endpoints to resist brute-force and abuse.

7. Sub-processors

The customer generally authorises the engagement of the sub-processors listed below. This is the complete, current list — we do not use any third party for End-User data that is not on it.

To be explicit: every identity document image and selfie submitted for verification is transmitted to Google LLC’s Gemini API for analysis. Google processes this data as our sub-processor under its API data-use terms; per those terms and our configuration it is not used to train Google’s models.

Changes to sub-processors

We will notify customers by email at least 30 days before adding or replacing a sub-processor that touches End-User data. A customer with a reasonable data-protection objection may terminate the affected services and receive a refund of unused prepaid credits per the Refund & Credits Policy.

8. International transfers

The Service is hosted in the Netherlands (EU). Verification Media is transferred to Google LLC in the United States (and Google’s global infrastructure) for the AI analysis described in §7. For transfers of personal data outside the EEA/UK, the parties rely on the European Commission’s Standard Contractual Clauses (module 2, controller-to-processor, with the UK Addendum where applicable), which are incorporated into signed DPAs, together with encryption in transit. Customers should review this transfer position — in particular the US transfer of biometric data to Google — before onboarding End Users.

9. Assistance with data-subject rights

Taking into account the nature of the processing, OKIAS will assist the customer in responding to End-User requests under GDPR Articles 15–22 (access, rectification, erasure, restriction, portability, objection). The dashboard and API give customers direct access to, and deletion of, their End Users’ verification records. If an End User contacts OKIAS directly, we will forward the request to the customer without undue delay and act on the customer’s instructions, except where law requires us to act directly. The applicant-facing process is published at Data Subject Requests.

10. Personal-data breach notification

OKIAS will notify affected customers without undue delay, and in any event within 72 hours of becoming aware of a personal-data breach affecting End-User data, providing the information reasonably required for the customer’s own Article 33/34 obligations: the nature of the breach, categories and approximate volumes affected, likely consequences, and measures taken. Initial notice may be partial and supplemented as investigation continues. Security contact: security@okias.io.

11. Audit & information rights

OKIAS will make available the information reasonably necessary to demonstrate compliance with this DPA — this document, the sub-processor list, security-control descriptions and, when completed, third-party attestation reports (§13). Customers may audit no more than once per year (or after a breach affecting their data) on 30 days’ written notice, during business hours, without access to other customers’ data, at their own cost. Because formal audit reports are not yet available, we currently answer security questionnaires directly — a pragmatic substitute we are honest about.

12. Deletion & return at end of processing

An automated retention job runs hourly and permanently deletes uploaded document/selfie/liveness media and nulls extracted identity fields and biometric analysis details for every verification older than the configured retention window — 90 days by default for live verifications, 7 days for sandbox, with the live window configurable. The verification decision, scores and reason codes are retained without PII for audit and billing integrity. On termination of the agreement, the customer may export verification results beforehand via the dashboard/API; remaining End-User PII is deleted by the same purge mechanism, and account-level erasure can be requested per the Privacy Policy. Copies held by sub-processors are deleted under the terms in §7.

13. Current limitations — read before signing

• Single-region hosting. The platform runs in one region (Netherlands). There is no multi-region redundancy today.
• No data-residency options. We cannot currently pin processing or storage to a customer-chosen region, and AI analysis involves a US transfer to Google regardless of where you are.
• SOC 2 in progress. Controls are SOC 2-aligned but there is no completed attestation yet; no audit report can be provided today.
• No external penetration test yet. Security testing so far is internal. An independent test is planned; findings summaries will be available to customers under NDA once complete.

If any of these is disqualifying for your compliance posture, we would rather you know now. Ask us for the current status of each item at security@okias.io.

14. Obtaining a signed DPA

This page is the reference text. To execute the DPA (including the Standard Contractual Clauses annex), email support@okias.io or security@okias.io from your account email with your legal entity details; we will return a countersigned copy. Continued use of the Service for End-User verification constitutes acceptance of the then-current version of this DPA. Material changes are notified by email with the version and date shown at the top of this page.

15. Contact

• Data protection & security: security@okias.io
• Contracts & general: support@okias.io
• OKIAS (SMC-Pvt) Ltd — Reg No. H489273 — ICN 0308002, Lane No 1, Bank Street, Husaini Chowk, Bahawalpur, Punjab 63100, Pakistan.