Data Processing Addendum
This addendum applies to personal data that Azirious LTD ("Processor") processes on behalf of the merchant ("Controller") when the merchant uses IDReady. Terms such as "controller", "processor", "personal data" and "processing" have the meaning given in applicable data protection law (including the GDPR, UK GDPR and the CCPA/CPRA, where relevant).
1. Scope and details of processing
| Subject matter | Verifying the identity or age of the Controller's customers before order fulfilment. |
|---|---|
| Duration | While the Controller has the app installed, plus the deletion period in section 8. |
| Data subjects | The Controller's customers who are asked to verify. |
| Categories of data | Name, email address, order number and total; ID document and selfie images and facial geometry (held by the identity-verification sub-processor, not on the Processor's own servers, for the retention period the Controller chooses, default 30 days and maximum 90, and viewable by the Controller through the app); the outcome of the check (status, document type, issuing country, name-match result, face-match score, flags). |
| Special categories | Biometric data used to uniquely identify a person, processed on the data subject's consent. |
2. Instructions
The Processor processes personal data only on the Controller's documented instructions, which are these terms, the configuration the Controller chooses in the app, and the Controller's use of the app's features. If the Processor believes an instruction breaches the law it will tell the Controller.
3. Confidentiality
People authorised to process the data are bound by confidentiality obligations.
4. Security
The Processor maintains the measures described in its security overview, appropriate to the risk.
5. Sub-processors
The Controller authorises the sub-processors listed in the privacy policy (identity verification, hosting, network, email). The Processor binds each to data protection terms no less protective than these, remains responsible for them, and will give the Controller notice of new sub-processors in the app or by email, with the opportunity to object by uninstalling.
6. Data subject requests
The Processor will, taking into account the nature of the processing, assist the Controller in responding to requests from data subjects. Requests forwarded by Shopify (customer data requests and erasure) are handled automatically as described in the privacy policy. If a data subject contacts the Processor directly, the Processor will refer them to the Controller where the Controller is identifiable.
7. Assistance and breach notification
The Processor will assist with the Controller's obligations on security, impact assessments and consultation with authorities, to the extent relevant to the processing. The Processor will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Controller's data.
8. Deletion and return
The sub-processor deletes ID photos and selfies automatically at the end of the Controller's retention period. On uninstall, the Processor deletes the Controller's data about 48 hours later, when Shopify instructs it to, including any images still held by the sub-processor, unless the law requires retention. The Controller can export the outcome records it needs from the app before uninstalling.
9. Audits
The Processor will make available the information reasonably necessary to demonstrate compliance and will allow and contribute to reasonable audits by the Controller or its auditor, on reasonable notice, no more than once a year unless a breach has occurred.
10. International transfers
Where personal data is transferred outside the EEA/UK to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK Addendum, which are incorporated by reference, with the Controller as exporter and the Processor as importer, and the details in section 1 as the annexes.
11. Consumer-privacy laws
The Processor will not sell or share the personal data, will not retain, use or disclose it other than to provide the service, and will not combine it with other data, except as the law permits.