Skip to content
Verity

Verity / Legal

Data Processing Agreement

For businesses that verify their customers with Verity. It explains how we handle your customers’ personal data on your behalf, as the Nigeria Data Protection Act 2023 requires.

Effective 6 October 2026

1. Who this applies to

This agreement is between Verity and any business that uses Verity to verify its own customers, through the API, verification links or the dashboard (“you”). It forms part of our Terms of Use and applies from the moment you run a check. If you need a signed copy for your records, email support@verity.com.ng and we’ll send one.

2. Roles

For the people you verify, you are the data controller: you decide to verify them and why. Verity is your data processor: we process their data only to carry out the checks you ask for. For your own account details (your staff’s names, emails and billing), Verity is the controller, as described in our Privacy Policy.

3. What we process

  • People: your customers, applicants or other individuals you verify.
  • Data: NIN or BVN, the identity record returned for it (name, date of birth, gender, phone number, photo and other fields the source provides), selfies taken for face matching, the match score, and records of each request.
  • Purpose: confirming a person’s identity for you, and keeping a record of the check for you and for audit.
  • Duration: while you use Verity, then as set out in section 8.

Photos and selfies are biometric data, a sensitive category under the Act. We use them only to compare faces for the check you request.

4. Your responsibilities

  • Have a lawful basis for each check and, where consent is your basis, get the person’s consent first. The API asks you to confirm this with "consent": true on every request.
  • Tell the people you verify that you use Verity, for example in your privacy notice.
  • Only send data you’re entitled to send, and keep your API keys and webhook secret secure.

5. Our commitments

  • We process personal data only on your instructions: the checks you request through Verity. We don’t use it for our own purposes, sell it, or combine it with other customers’ data.
  • Only staff who need access to run or support the service can see it, and they are bound by confidentiality.
  • We protect it with encrypted connections (HTTPS), access controls, hashed API keys and passwords, signed webhooks, IP allowlisting for API keys, and logging of every API request.
  • We help you respond to requests from the people you verify (access, correction, deletion) and to any enquiry from the Nigeria Data Protection Commission.
  • We tell you without undue delay, and within 48 hours of becoming aware, if a personal data breach affects your data, with the information you need to meet your own duty to notify the Commission within 72 hours.

6. Sub-processors

We use these providers to run the service. Each is bound to protect the data at least as strictly as this agreement requires:

  • Identity data provider: a licensed partner that returns NIN and BVN records from the official sources and compares faces. We share the ID number and, for face matching, the selfie.
  • Hosting provider: the servers that run Verity and store check records.

Our email and payment providers don’t receive the personal data of the people you verify. We’ll tell you before adding or replacing a sub-processor that receives it, so you can object.

7. Where data is stored

Check records are stored on our servers, which may be outside Nigeria. Where data leaves Nigeria, we rely on the safeguards the Act allows for cross-border transfers, including contractual protections with our providers.

8. How long we keep it

  • Photos and selfies: deleted automatically 30 days after the check. Store the photo yourself when you receive it if you need it longer.
  • Check records (the masked ID number, name, date of birth, result and score): kept while your account is open so you can see your verification history, and for up to six years after, for audit and legal claims.
  • Unfinished verification links: the full ID number is removed when the link is used or expires.

If you close your account or ask us to, we delete or anonymise your customers’ data within 30 days, except where the law requires us to keep it.

9. Audits

On reasonable notice, and no more than once a year unless a breach has occurred, we’ll answer your security questionnaire and provide the information you need to show you meet the Act.

10. Contact

For data protection questions, requests or to report a concern, email support@verity.com.ng.