Privacy Policy

This Privacy Policy explains how OKIAS (SMC-Pvt) Ltd collects, uses, shares, retains and protects personal data in connection with the OKIAS identity verification platform and API. It is written to align with the EU/UK General Data Protection Regulation (GDPR) and comparable data protection laws.

This document is provided for transparency. Our controller–processor terms are published as a Data Processing Agreement; for a signed copy or data-protection questions, contact security@okias.io.

1. Scope

This policy covers personal data processed through the Service and the okias.io website. It applies to two categories of individual: (a) our direct customers and their staff who hold OKIAS accounts, and (b) the End Users whom our customers submit for verification.

2. Data controller & our roles

Controller: OKIAS (SMC-Pvt) Ltd, Reg No. H489273, ICN 0308002, Lane No 1, Bank Street, Husaini Chowk, Bahawalpur, Punjab 63100, Pakistan. We are the controller for account, billing and website data.

Processor: For Verification Media and results submitted by a customer about their End Users, the customer is the controller and OKIAS processes that data on the customer’s documented instructions under a DPA.

3. Personal data we collect

Account & billing data

• Name, work email, company details and role of account users.
• Authentication data, API keys and audit logs of dashboard/API activity.
• Billing contact, top-up history and payment-processor references (we do not store full card numbers).

Verification data (about End Users)

• Verification Media: identity document images, selfies and liveness frames.
• Extracted PII: name, date of birth, document number, nationality, expiry and similar fields read from the document.
• Biometric data: facial templates/embeddings derived to perform 1:1 face match and liveness (special-category data — see §5).
• Derived signals: decision, reason codes, confidence scores, sanctions-screening results and non-PII risk signals used for audit.

Technical & website data

• IP address, device/browser metadata, and essential cookies needed to run the site and dashboard.

4. Biometric data (face match & liveness)

To confirm that a live, present person matches their identity document, the Service derives facial embeddings from the selfie and document portrait and analyses liveness frames. This is special-category biometric data. It is processed only to perform the verification the customer requested, is encrypted, is not used to train general-purpose models, and is retained under the retention rules in §9. Where consent is the applicable legal basis, the customer is responsible for obtaining the End User’s explicit consent before submission.

5. Lawful bases (GDPR)

• Contract (Art. 6(1)(b)): to provide the Service to our customers.
• Legal obligation / substantial public interest (Art. 6(1)(c), Art. 9(2)(g)): to support customers’ AML/KYC and sanctions obligations.
• Legitimate interests (Art. 6(1)(f)): to secure the Service, prevent fraud and maintain audit records.
• Explicit consent (Art. 9(2)(a)): for biometric processing where consent is the applicable basis; obtained by the customer from the End User.

6. How we use personal data

• To run identity verifications and return decisions and reason codes.
• To operate, secure, debug and improve the Service (using de-identified or aggregated data where feasible).
• To bill customers, prevent abuse, and comply with law and lawful requests.
• To communicate service, security and account notices.

We do not sell personal data, and we do not use End-User biometric data to train general-purpose AI models.

7. AI processing & automated decisions

Verification Media is processed by an AI provider (Google Gemini) to read documents and help produce a verification decision. Because a verification outcome can significantly affect an End User, our customers are responsible for providing human review and appeal channels as required by law (e.g. GDPR Art. 22). OKIAS returns explainable reason codes to support that review. Extracted PII is stored encrypted; non-PII signals and scores are retained for audit.

8. Sub-processors

We engage sub-processors under contractual data-protection obligations. This is the complete, current list — the same list published in our Data Processing Agreement:

To be explicit: every identity document image and selfie submitted for verification is transmitted to Google LLC’s Gemini API for analysis. Customers are notified by email at least 30 days before we add or replace a sub-processor that touches End-User data (see the DPA, §7). Questions: security@okias.io.

9. Data retention

Retention is enforced by an automated purge job that runs hourly. For every verification older than the retention window it permanently deletes the uploaded document, selfie and liveness media and erases the extracted identity fields and biometric analysis details, while keeping the decision, scores and reason codes (without PII) for audit, billing integrity and fraud prevention. The default window is 90 days for live verifications and 7 days for sandbox verifications; the live window is configurable at the platform level. Account and billing records are retained for the period required by applicable law.

10. International transfers

OKIAS is established in Pakistan and hosts the Service in the Netherlands (EU). Verification Media is transferred to Google LLC in the United States for the AI analysis described in §7 and §8. Where personal data is transferred out of the EEA/UK, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses (and the UK Addendum) together with encryption in transit. We do not currently offer regional data-residency options; hosting is single-region and AI analysis always involves the US transfer to Google (see the DPA, §13, for a candid list of current limitations).

11. Data security

We maintain SOC 2-aligned controls (working toward formal attestation): encryption of extracted PII in transit and at rest, least-privilege and role-based access, network isolation, audit logging, and secret management. No system is perfectly secure; we operate a vulnerability-disclosure channel at security@okias.io.

12. Your data-subject rights

Subject to applicable law, individuals have rights to access, rectify, erase, restrict, port and object to processing of their personal data, and to withdraw consent. Because OKIAS is usually a processor for End-User data, End Users should first contact the organisation that submitted them; OKIAS will assist that organisation in responding, and will act directly where law requires. The step-by-step process for End Users — who to contact, what identity proof we need, and response timelines — is published at Data Subject Requests. Account holders may exercise their own rights directly via self-service export and erasure in the dashboard, or by email: security@okias.io.

13. Children

The Service is not directed to children and is intended for verifying adults, except where a customer is legally required to verify a minor and has a valid legal basis and appropriate consent. We do not knowingly collect children’s data outside such instructed processing.

14. Cookies

The okias.io website and dashboard use essential cookies required for authentication, security and core functionality. We keep non-essential tracking to a minimum; where used, it is subject to consent as required by law.

15. Changes to this policy

We may update this Privacy Policy. Material changes will be notified by email or dashboard notice. The version and effective date at the top of this page always reflect the current version.

16. Contact & Data Protection Officer

For privacy questions, data-subject requests, or to reach our data-protection function, contact us. A dedicated privacy alias will be published when available; until then please use the security address, which routes to our data-protection function.

• Data protection / privacy: security@okias.io
• General support: support@okias.io
• OKIAS (SMC-Pvt) Ltd — Reg No. H489273 — ICN 0308002, Lane No 1, Bank Street, Husaini Chowk, Bahawalpur, Punjab 63100, Pakistan.