Data Processing Agreement

Executive Summary

This Data Processing Agreement is entered into between the Customer and Urban Luxury Brands (Pty) Ltd trading as VerifyNow, registration number 2007/013732/07. By creating an account, registering for API access, generating or using an API key, or using the VerifyNow API, the Customer agrees to this Data Processing Agreement. This Data Processing Agreement is incorporated into and forms part of the written agreement between the parties. Where VerifyNow processes Personal Information on behalf of the Customer, the parties agree that this Data Processing Agreement records their written operator agreement for purposes of POPIA, including section 21.

VerifyNow is operated by ULB Media (Pty) Ltd (registration 2025/767907/07). The business was developed under Urban Luxury Brands (Pty) Ltd, incorporated in 2007, and continues under ULB Media with the same leadership and operational experience.

VerifyNow does not provide consumer credit reports, does not compile or maintain consumer credit profiles, and does not make loan, affordability, or credit-granting decisions. Verification results are processed only for the purpose stated in the Terms of Service.

1. Definitions

2. Appointment as Operator / Data Processor

The Customer appoints VerifyNow as an operator under POPIA, and as a data processor where that terminology applies, to process personal information on the Customer's behalf solely to provide the services outlined in the Terms of Service.

VerifyNow agrees to process personal information only in accordance with the Customer's documented lawful instructions and applicable data protection laws.

Every request requires a documented lawful basis, prescribed reason, or other valid processing authority. The default platform purpose is identity fraud prevention or fraud detection. When biometric photos are used for another purpose and consent is the required authority, the Customer must give a clear notice and record voluntary, specific, and informed consent before submission.

The account accepts the API policies when generating an API key. The accepted Terms permit integration of enabled checks into the Customer's business workflows, subject to account permissions, available credits and required licences. VerifyNow acts as a processor and, under POPIA, an operator for those requests. The Customer remains the responsible party and, where FICA applies, the accountable institution for its decisions. This DPA governs personal-information processing. A negotiated agreement can record the enterprise integration scope and commercial terms.

3. Verify Now's Obligations

4. Customer Obligations

5. Data Breach Notification

In the event of a personal data breach, Verify Now will:

• Notify the Customer immediately where there are reasonable grounds to believe their personal information has been accessed or acquired by an unauthorised person
• Provide details of the breach, affected data, and mitigation measures
• Assist the Customer in meeting their notification obligations to the Information Regulator
• Implement immediate containment and remediation measures
• Conduct a thorough investigation and provide a detailed incident report

6. Cross-Border Data Transfers

Transfers of personal information outside South Africa must meet section 72 of POPIA. Where we rely on a recipient's law, binding corporate rules or binding agreement, those protections must meet the requirements of that section, including safeguards for onward transfers. We may also rely on consent or another transfer basis expressly permitted by section 72 where its conditions are met.

7. Subprocessors

Verify Now may engage third-party subprocessors to assist in providing services. Their roles can include infrastructure, operational services and verification functions where personal information is processed on Verify Now's instructions, including cloud hosting, private storage, databases, time-limited idempotency, biometric processing, email delivery, and support tooling.

• All subprocessors are bound by equivalent data protection obligations
• Customers will receive at least 30 days' notice of any new subprocessors
• Verify Now maintains contractual and oversight controls for subprocessors
• Infrastructure sub-processors are identified in the public register

For the current list of subprocessor categories, see our Sub-processors page.

Verify Now remains responsible for its own obligations under this DPA and applicable data protection law, subject to the limitations, exclusions, and allocation of responsibility in the Terms of Service and any signed customer agreement. A verification supplier's role depends on its processing activities and contractual arrangement. Applicable operator agreements and disclosure duties apply to that role.

8. Verification Sources

To provide identity verification services, Verify Now accesses authoritative data sources under lawful authority. A source or verification provider may receive the fields needed to fulfil the request. Depending on the service, it may act as an operator processing on our instructions or as an independent responsible party under its own lawful authority.

The public sub-processor register identifies infrastructure providers. Verification suppliers are described by service category. Their processing roles determine the applicable operator agreements and other data-protection duties. Required disclosures follow applicable law and customer contracts.

Access to these sources is governed by applicable South African legislation and the terms of our lawful authority to access such information for verification purposes.

Some Verify Now services are fulfilled using authorised third-party verification and data suppliers under their own permitted-use frameworks. Verify Now is not a credit bureau and does not provide credit information.

9. Data Retention and Deletion

10. Return and Deletion on Termination

Upon termination or expiry of services, Verify Now will, at the Customer's election:

• Return all personal information to the Customer in a commonly used, machine-readable format
• Securely delete all personal information (including copies) and provide written confirmation

This obligation does not apply to personal information or metadata that Verify Now is required to retain under applicable law, or that is needed for audit logs, lawful-basis evidence, billing records, security, dispute handling, or compliance.

11. Audit Rights

Customers have the right to audit Verify Now's compliance with this DPA, subject to:

• Reasonable advance notice (minimum 30 days)
• Limitation to once per year unless required by incident investigation
• Confidentiality obligations regarding Verify Now's systems and processes
• Customer responsibility for audit costs

Verify Now will also provide documentation of our security practices to demonstrate adherence to data protection standards upon reasonable request.

12. Security Assurance and Reviews

Verify Now commits to maintaining robust security practices through:

• Annual security assessments and vulnerability testing
• Regular review and updates of security measures
• Prompt remediation of identified vulnerabilities
• Ongoing staff training on data protection and security protocols

Security assessment summaries are available to Customers upon request, subject to confidentiality obligations. Please contact security@verifynow.co.za for more information.

13. Governing Law and Jurisdiction

This DPA is governed by the laws of South Africa. Any disputes arising from or relating to this agreement will be subject to the exclusive jurisdiction of the South African courts.

This agreement is subject to POPIA and other applicable South African and international data protection regulations.

14. Contact Information

15. Amendments

Verify Now may update this DPA to reflect changes in law, regulation, or business practices. Customers will be notified of material changes with at least 30 days' notice. Continued use of services after amendments constitutes acceptance of the updated terms.