Privacy Policy
How Verify Now collects, uses, and protects your personal information
Last updated: 3 November 2026
POPIA Aligned
South African privacy controls
Data Protected
AES-256 encryption
Your Rights
Access, correct, delete
Cape Town Storage
Private files in South Africa
Introduction
This Privacy Policy describes how Verify Now (the "Site," "we," "us," or "our") collects, uses, and discloses your personal information when you visit, use our services, or make a purchase from verifynow.co.za (the "Site") or otherwise communicate with us (collectively, the "Services").
This Privacy Policy applies to Urban Luxury Brands (Pty) Ltd trading as VerifyNow, registration number 2007/013732/07.
VerifyNow is operated by Urban Luxury Brands (Pty) Ltd (registration 2007/013732/07).
Our Information Officer is registered with the South African Information Regulator for POPIA and PAIA contact purposes. You can review our PAIA Manual and Information Officer registration certificate.
Please read this Privacy Policy before supplying personal information. It explains each processing purpose, the applicable lawful basis, recipients, retention, safeguards and your rights. Where consent is the lawful basis, VerifyNow asks for it separately.
1. Changes to This Privacy Policy
We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Site, update the "Last updated" date and take any other steps required by applicable law.
2. How We Collect and Use Your Personal Information
To provide the Services, we collect and have collected over the past 12 months personal information about you from a variety of sources. The information that we collect and use varies depending on how you interact with us.
In addition to the specific uses set out below, we may use information we collect about you to communicate with you, provide the Services, comply with any applicable legal obligations, enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.
3. What Personal Information We Collect
The types of personal information we obtain about you depend on how you interact with our Site and use our Services.
Information We Collect Directly from You
- Basic contact details including your name, address, phone number, email
- Order information including billing address, payment confirmation, email address
- Account information including your username and password
- Verification information including ID documents, facial images for identity verification
- Customer support information from your communications with us
Information We Collect through Cookies
We automatically collect certain information about your interaction with the Services ("Usage Data"). This includes information about how you access and use our Site and your account, including device information, browser information, your IP address, and other interaction data.
Information We Obtain from Third Parties
- Companies who support our Site and Services
- Our payment processors, who collect payment information to process your transactions
- Third-party verification services for identity and document verification
4. How We Use Your Personal Information
Providing Products and Services
We use your personal information to provide you with the Services, process your payments, fulfill your orders, manage your account, and enable you to use our verification services.
Marketing and Advertising
We may use your personal information for marketing and promotional purposes, such as to send marketing communications by email, with your consent where required.
Security and Fraud Prevention
We use your personal information to detect, investigate, or take action regarding possible fraudulent, illegal, or malicious activity.
Communicating with You
We use your personal information to provide you with customer support and improve our Services.
4A. Lawful Bases for Verification Processing
For business-customer verification checks, our customer is typically the responsible party that establishes the lawful basis for the lookup. VerifyNow processes the request according to that documented instruction and applicable law.
| Processing activity | Typical lawful basis |
|---|---|
| Fraud detection and fraud prevention checks | Prescribed purpose, legal obligation, or legitimate interest where permitted |
| Driver's licence barcode, identity fields and embedded portrait | Lawful verification purpose, licence-holder privacy notice, and authority or consent where required |
| Vehicle licence disc barcode, visible printed fields and selected vehicle lookup | Lawful verification purpose and authority to process the supplied vehicle information |
| Home Affairs identity photo, licence portrait comparison, current selfie comparison, Passive Liveness and related biometric evidence | Lawful basis plus special-personal-information safeguards and consent or authorisation where required |
| Marketing communications | Consent where required, or legitimate interest for permitted business communications |
Every request requires a documented lawful basis, prescribed reason, or other valid processing authority. The default platform purpose is identity fraud prevention or fraud detection. When biometric photos are used for another purpose and consent is the required authority, the customer must give a clear notice and record voluntary, specific, and informed consent before submission. Photo retrieval, face comparison and liveness checks are provided only for identity fraud prevention or fraud detection. To use them for any other purpose, the customer must contact VerifyNow and receive written approval before submitting a request.
4B. Responsible Party, Operator, Controller and Processor Roles
For the purpose of data protection laws, different parties have different roles:
When We Act as Responsible Party / Data Controller
We are the responsible party under POPIA, and the data controller where that terminology applies, for personal information collected directly from you when you visit our website, create an account, or interact with our services. This includes account information, usage data, and communications.
When We Act as Operator / Data Processor
We act as an operator under POPIA, and a data processor where that terminology applies, when processing personal information on behalf of our business customers for identity verification purposes. In these cases, our customers are the responsible parties or data controllers and determine the purposes and means of processing.
5. Cookies
Like many websites, we use Cookies on our Site. We use Cookies to power and improve our Site and our Services (including to remember your actions and preferences), to run analytics and better understand user interaction with the Services. We may also permit third parties and service providers to use Cookies on our Site.
Most browsers automatically accept Cookies by default, but you can choose to set your browser to remove or reject Cookies through your browser controls. Please keep in mind that removing or blocking Cookies can negatively impact your user experience and may cause some of the Services to work incorrectly or no longer be available.
6. How We Disclose Personal Information
In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy:
- With vendors or other third parties who perform services on our behalf (e.g., IT management, payment processing, data analytics, customer support, cloud storage)
- With business and marketing partners to provide services, with your consent
- When you direct, request us, or otherwise consent to our disclosure
- With our affiliates or otherwise within our corporate group
- In connection with a business transaction or to comply with legal obligations
We do not use or disclose sensitive personal information for the purposes of inferring characteristics about you.
6A. Verification Sources
To provide identity verification services, we access authoritative data sources under lawful authority. Verification providers may receive the fields needed to fulfil your request. Their role depends on the service and contractual arrangement: an operator processes information on our instructions, while an independent responsible party processes it under its own lawful authority.
The public infrastructure register identifies hosting and operational providers. Verification suppliers are described by service category. Their processing roles determine the applicable operator agreements and other data-protection duties. Required disclosures follow applicable law and customer contracts.
Our Verification Sources Include:
- Department of Home Affairs (DHA) – For South African ID verification
- Other lawful and authorised sources – As permitted under applicable legislation
Access to these sources is governed by applicable South African legislation and our lawful authority to access such information for verification purposes.
Some services are fulfilled using authorised third-party verification and data suppliers under their own permitted-use frameworks. VerifyNow is not a credit bureau and does not provide credit information.
6B. Infrastructure Sub-processors
We engage third-party service providers to support our infrastructure and operations. These sub-processors provide services such as cloud hosting, databases, monitoring, email/SMS delivery, and support tooling.
All sub-processors are bound by data protection agreements and are required to implement appropriate security measures.
For more information about our sub-processors, please see our Sub-processors page.
6C. Processing Locations and Cross-Border Transfers
Some infrastructure services process information outside South Africa. Certain face-match and machine-learning services may involve processing outside South Africa through cloud infrastructure. Applicable data-processing agreements, access controls and cross-border transfer safeguards govern that processing. The sub-processor register describes our infrastructure providers and their purpose.
Transfer controls
- Service limitation: information is sent only for the requested verification service
- Data minimisation: only the fields required by that service are transferred
- Safeguards: international transfers are subject to the applicable POPIA cross-border requirements
Contact us at privacy@verifynow.co.za for service-specific processing locations.
7. Third Party Websites and Links
Our Site may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites.
8. Children's Data
The Services are not intended to be used by children, and we do not knowingly collect any personal information about children. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted.
9. Security and Retention of Your Information
We implement enterprise-grade security measures to protect your personal information, including AES-256 encryption at rest and TLS 1.3 encryption in transit (with TLS 1.2+ supported where required for compatibility). For more details, please see our Information Security Policy.
Full reports from ordinary single checks are not stored by default after delivery. Batch processing temporarily stores row inputs and provider results so the job can be completed, shown in batch history, and downloaded. We also retain consent evidence and the account, audit, billing, security, and status records needed to provide and protect the Services.
Number Plate Lookup and Vehicle Valuation retain encrypted retry copies for up to seven days so an interrupted request can be recovered without another charge. Access is limited to the account that requested the check. Billing references and request fingerprints are retained as audit metadata after the result expires. Valuation searches reuse public listing evidence for up to three days and vehicle identification details for up to 30 days.
Vehicle Check, Number Plate Lookup and Vehicle Valuation are stored-report features. Completed dashboard reports are kept in the authenticated user's report history so the PDF can be downloaded again. They remain subject to the account, contract, deletion, and retention controls that apply to that customer.
Ongoing AML processing and retention
Production AML matching runs in Cape Town, South Africa. The screening dataset, ongoing enrolment lookup mappings and encrypted saved screening responses use dedicated Cape Town Redis. Other platform services follow the processing locations in the sub-processor register.
Names and identifiers used to link an enrolment are protected through keyed HMAC-SHA-256 digests and organisation-scoped random tokens. These records remain pseudonymised personal information. Enrolment mappings remain available while a subject is enrolled; withdrawn-subject mappings and associated enrolment metadata follow the seven-year retention schedule after withdrawal.
Encrypted ongoing AML response replays expire from the active store after 48 hours. The separate Adverse Media Search API also retains encrypted retry responses for up to 48 hours. These limited replay copies are exceptions to the default single-check report policy. Account, billing and other operational records follow their stated retention schedules.
SMS OTP processing and terms
SMS OTP sends and checks a one-time code on the customer’s instructions. The customer determines the lawful purpose, gives the recipient the required privacy notice and holds the account records. VerifyNow acts as operator for the requested processing and manages its own service security and billing obligations. OTP establishes access to the receiving phone.
Customers must request transactional codes for a recipient’s current verification journey. Promotional messages, purchased contact lists, unsolicited bulk messaging and attempts to bypass network or WASPA restrictions are prohibited. The customer must protect its credentials, implement signup abuse controls and respond to recipient complaints. Applicable POPIA duties and the WASPA Code of Conduct must be observed. VerifyNow may suspend abusive OTP use.
Urban Luxury Brands (Pty) Ltd trading as VerifyNow supplies this API service. Customers must have the bill-payer’s authority and obtain the recipient’s request and any required consent for the OTP. The recipient needs an SMS-capable mobile number and network coverage. Network or roaming charges may apply under the recipient’s plan. This service creates no recurring SMS subscription.
Report billing errors or unwanted codes through our contact page with the verification ID where available. We investigate the dispatch and billing record and process applicable refunds. Customers may also use the WASPA complaints process. These terms preserve applicable statutory rights.
One credit buys four SMS sends at standard pricing. When the SMS balance is empty, the next send buys a four-send pack using prepaid credits. Unused sends remain available to the same account. Verification and status polling are included. A confirmed rejection before acceptance releases the reserved SMS allowance. Credit refunds are handled manually. Accepted sends remain used if handset delivery fails. An uncertain send reserves one allowance and uses it after ten minutes unless rejection is confirmed.
- Raw phone number and SMS code
- Used in memory for dispatch and verification processing. VerifyNow does not write the raw number or plaintext code to its OTP database or application logs. The gateway request has a ten-second timeout.
- Challenge code hash
- Encrypted code hashes are stored in Cape Town with a five-minute expiry. Successful use, lockout and supersession trigger deletion; expiry remains the backstop if deletion is interrupted.
- Abuse-prevention tokens
- Keyed phone and reference tokens are stored in Cape Town and expire after 24 hours without further activity. IP tokens expire after one hour without further activity. These tokens are personal information.
- Retry records
- Encrypted request fingerprints and verification outcomes are stored in Cape Town for 72 hours to prevent duplicate sends and charges. Fingerprints are keyed and may be derived from submitted data; they remain subject to personal-information safeguards.
- Billing and account records
- Amounts, opaque transaction identifiers and OTP terms acceptance follow the existing billing and account retention schedule. They exclude recipient phone numbers and codes.
Temporary OTP code hashes, phone- and IP-derived abuse tokens, and retry payloads are encrypted and stored in Cape Town, South Africa. The account database keeps opaque processing references and billing controls. Customer-specific hourly counters contain aggregate counts and are retained for eight days for abuse detection. Administrative alerts are retained for 30 days.
Expiry prevents further verification. Physical cleanup runs on a schedule; database backups follow the infrastructure retention schedule and may contain earlier encrypted or hashed records until backup rotation. Restored data must undergo OTP expiry and cleanup before use.
This SMS OTP service supports South African mobile numbers only. SMS delivery partners and mobile networks apply their own retention requirements. Delivery metadata may be retained for approximately three years, and their terms permit cross-border processing. Message content may be retained for operational or lawful requirements. These delivery records have separate deletion schedules from VerifyNow’s temporary OTP data.
OTP terms acceptance is recorded with the accepting account user, version and timestamp. It applies to this service. Requests for access, correction or deletion can be sent through VerifyNow support, subject to identity verification and lawful retention obligations.
Subprocessor register · Data Processing Agreement · Privacy policy · WASPA Code of Conduct
Document Intelligence processing and privacy
Document Intelligence analysis runs in Johannesburg, South Africa, using VerifyNow’s proprietary engine. Application requests, temporary cloud uploads and encrypted retry results use Cape Town services.
Documents are used to perform the requested analysis. VerifyNow does not use these uploads to train models or send them to external AI services for analysis.
Uploads and connections to the analysis engine use HTTPS. Temporary cloud files use AES-256 server-side encryption. Stored analysis responses use AES-256-GCM encryption.
The engine uses temporary working files and removes them after processing. Large-upload links are valid for 10 minutes and upload references expire after 15 minutes. Temporary cloud files are deleted after processing or by expiry cleanup. Access expiry and physical deletion are separate; cleanup can finish after access expires.
Encrypted analysis responses use a 72-hour expiry in the active retry store, allowing the same request to be retried without another charge. Account, billing, consent and security records follow their own retention schedules. Infrastructure logs and backups follow the applicable provider schedules. These replay records are an exception to the default single-check report policy.
These locations describe the Document Intelligence processing workflow. Account databases, global edge services, support and payment providers have separate processing arrangements, including locations outside South Africa, as listed in the subprocessor register. Other verification services follow their own disclosures.
Specialist bank-verification report details
Submitted identity and bank-account details for foreign-passport and Capitec Business checks are stored encrypted in Redis for up to seven days to support asynchronous report delivery. Access requires the account that requested the check. The input copy then expires; verification outcomes and audit metadata follow their applicable retention schedules.
9A. Retention Schedule (Default)
We retain different types of personal information for different periods based on legal requirements and operational needs:
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Ordinary single-check reports | Not stored by default after delivery | Data minimisation |
| Vehicle Check, Number Plate Lookup and Vehicle Valuation report history | While retained in the authenticated customer account, subject to the applicable contract and deletion process | Report re-download and support |
| Self-service batch inputs, row results, and result files | Up to 30 days after completion | Processing and secure result delivery |
| Large-batch source uploads | Up to 7 days | Secure intake and processing |
| Consent documents and consent evidence | 7 years under the current schedule | Consent evidence and auditability |
| Audit, billing, security, and account records | Applicable legal, accounting, security, and contractual period | Auditability and service administration |
| Payment card or bank-account payment credentials | Not stored by VerifyNow | Handled by payment processors |
9B. Breach Notification
In the unlikely event of a security incident affecting your personal information, we are committed to transparent and timely communication in accordance with POPIA requirements.
Our Commitment:
- Where VerifyNow acts as an operator, affected customers are notified immediately when there are reasonable grounds to believe their personal information has been accessed or acquired by an unauthorised person. Where VerifyNow acts as the responsible party, notification follows section 22 of POPIA.
- Information Regulator notified as required by POPIA
- Clear communication of what data was affected and recommended protective measures
10. Your Rights and Choices
Depending on where you live, you may have some or all of the rights listed below in relation to your personal information:
Right to Access
Request access to personal information we hold about you
Right to Delete
Request that we delete personal information we maintain about you
Right to Correct
Request that we correct inaccurate personal information
Right of Portability
Receive a copy of your personal information in a portable format
Right to Opt Out
Opt out of marketing communications at any time
Withdrawal of Consent
Where we rely on consent, you may withdraw it
You may exercise any of these rights by contacting us using the contact details provided below. We will not discriminate against you for exercising any of these rights.
11. Complaints
If you have complaints about how we process your personal information, please contact us using the contact details provided below. If you are not satisfied with our response to your complaint, depending on where you live, you may have the right to lodge your complaint with your local data protection authority (in South Africa, this is the Information Regulator).
12. International Users
A selected service may require personal information to be processed outside the country where the customer or data subject is located. We limit the information to what that service requires and apply the relevant contractual and statutory transfer safeguards, including POPIA's cross-border requirements where applicable.
13. Contact
Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please contact us:
Company: Urban Luxury Brands (Pty) Ltd trading as VerifyNow
Registration number: 2007/013732/07
Address: First Floor, Block B, Eagle Canyon Office Park, Cnr Dolfyn & Christiaan De Wet Str, Randparkridge, Randpark
Information Officer: Ruwaida Foster
Information Officer registration: 2026-002705 with the South African Information Regulator. View certificate
Email: hello@verifynow.co.za
Website: verifynow.co.za
14. Policy Updates
This Privacy Policy may be updated periodically to reflect changes in our practices or regulatory requirements.
Version: 2.3
Last Updated: 3 November 2026