Data Processing Agreement

Executive Summary

This Data Processing Agreement is entered into between the Customer and Urban Luxury Brands (Pty) Ltd trading as VerifyNow, registration number 2007/013732/07. By creating an account, registering for API access, generating or using an API key, or using the VerifyNow API, the Customer agrees to this Data Processing Agreement. This Data Processing Agreement is incorporated into and forms part of the written agreement between the parties. Where VerifyNow processes Personal Information on behalf of the Customer, the parties agree that this Data Processing Agreement records their written operator agreement for purposes of POPIA, including section 21.

VerifyNow does not provide consumer credit reports, does not compile or maintain consumer credit profiles, and does not make loan, affordability, or credit-granting decisions. Verification results are processed only for the Customer's documented lawful purpose.

1. Definitions

2. Appointment as Operator / Data Processor

The Customer appoints VerifyNow as an operator under POPIA, and as a data processor where that terminology applies, to process personal information on the Customer's behalf for the sole purpose of providing identity verification, KYC/AML screening, and related services as outlined in the Terms of Service.

VerifyNow agrees to process personal information only in accordance with the Customer's documented lawful instructions and applicable data protection laws.

3. Verify Now's Obligations

4. Customer Obligations

5. Data Breach Notification

In the event of a personal data breach, Verify Now will:

• Notify the Customer without undue delay and within 48 hours of becoming aware of a confirmed breach
• Provide details of the breach, affected data, and mitigation measures
• Assist the Customer in meeting their notification obligations to the Information Regulator
• Implement immediate containment and remediation measures
• Conduct a thorough investigation and provide a detailed incident report

6. Cross-Border Data Transfers

Verify Now may transfer personal information to countries outside South Africa only:

• Where the Information Regulator has determined adequate protection exists
• With appropriate safeguards including standard contractual clauses
• With explicit consent from data subjects where required
• For specific derogations as permitted by POPIA

7. Subprocessors

Verify Now may engage third-party subprocessors to assist in providing services. Subprocessors are limited to infrastructure and operational services only, including cloud hosting, databases, monitoring, email/SMS delivery, and support tooling.

• All subprocessors are bound by equivalent data protection obligations
• Customers will receive at least 30 days' notice of any new subprocessors
• Verify Now maintains contractual and oversight controls for subprocessors
• A register of current subprocessors is available on request

For the current list of subprocessor categories, see our Sub-processors page.

Verify Now remains responsible for its own obligations under this DPA and applicable data protection law, subject to the limitations, exclusions, and allocation of responsibility in the Terms of Service and any signed customer agreement. Verification sources remain independent authoritative or authorised sources and are not treated as Verify Now subprocessors.

8. Verification Sources

To provide identity verification services, Verify Now accesses authoritative data sources under lawful authority. These verification sources are not subprocessors; they are government and authorised entities that provide authoritative data for verification purposes.

Access to these sources is governed by applicable South African legislation and the terms of our lawful authority to access such information for verification purposes.

Some Verify Now services are fulfilled using authorised third-party verification and data suppliers under their own permitted-use frameworks. Verify Now is not a credit bureau and does not provide credit information.

9. Data Retention and Deletion

10. Return and Deletion on Termination

Upon termination or expiry of services, Verify Now will, at the Customer's election:

• Return all personal information to the Customer in a commonly used, machine-readable format
• Securely delete all personal information (including copies) and provide written confirmation

This obligation does not apply to personal information or metadata that Verify Now is required to retain under applicable law, or that is needed for audit logs, lawful-basis evidence, billing records, security, dispute handling, or compliance.

11. Audit Rights

Customers have the right to audit Verify Now's compliance with this DPA, subject to:

• Reasonable advance notice (minimum 30 days)
• Limitation to once per year unless required by incident investigation
• Confidentiality obligations regarding Verify Now's systems and processes
• Customer responsibility for audit costs

Verify Now will also provide documentation of our security practices to demonstrate adherence to data protection standards upon reasonable request.

12. Security Assurance and Reviews

Verify Now commits to maintaining robust security practices through:

• Annual security assessments and vulnerability testing
• Regular review and updates of security measures
• Prompt remediation of identified vulnerabilities
• Ongoing staff training on data protection and security protocols

Security assessment summaries are available to Customers upon request, subject to confidentiality obligations. Please contact security@verifynow.co.za for more information.

13. Governing Law and Jurisdiction

This DPA is governed by the laws of South Africa. Any disputes arising from or relating to this agreement will be subject to the exclusive jurisdiction of the South African courts.

This agreement is subject to POPIA and other applicable South African and international data protection regulations.

14. Contact Information

15. Amendments

Verify Now may update this DPA to reflect changes in law, regulation, or business practices. Customers will be notified of material changes with at least 30 days' notice. Continued use of services after amendments constitutes acceptance of the updated terms.