Privacy Policy

1.Two different roles

When you visit this website, contact us, or hold a VerifiX console account, ITSEC is the controller of that data and this policy applies directly.

When one of our customers verifies, screens, or monitors an individual through the Platform, that customer is the controller and ITSEC is the processor acting on its instructions. If you were verified through a business that uses VerifiX, contact that business to exercise your rights; we will support them in responding.

2.Data we collect as controller

• Contact and enquiry data: name, work email, company, role, segment, expected volume, and the message you send us through a form on this site.
• Console account data: user name, email, role assignment, and authentication events.
• Usage and security logs: IP address, timestamps, user agent, API request metadata, and audit events, used to operate and secure the Platform.
• Billing and contract data for customers, including order forms and invoicing details.

3.Why we use it

• To respond to sandbox requests, pricing questions, and security or DDQ reviews.
• To provide, secure, support, and improve the Platform.
• To administer accounts, contracts, invoicing, and access control.
• To detect and investigate abuse, fraud, and security incidents.
• To meet our own legal, tax, and record-keeping obligations.

4.Legal bases

We rely on the performance of a contract for account, support, and billing activity; legitimate interests for securing the Platform and responding to business enquiries you initiate; consent where we ask for it; and legal obligation where retention or disclosure is required of us.

5.Where data is held

Platform data — verification records, documents, screening results, monitoring records, case notes, and audit trails — is held in UAE regions on Amazon Web Services and Microsoft Azure.

Some screening, registry, blockchain analytics, and Travel Rule sources operate outside the UAE. Where a check requires a query to such a source, only the data needed for that query is sent, governed by the sub-processor list and the DPA.

6.Sharing

We share personal data with the sub-processors listed on the sub-processors page, with professional advisers under confidentiality, and with authorities where we are legally required to do so. We do not sell personal data and we do not use platform data to build products for other customers without a separate written agreement.

7.Retention

Enquiry data is kept while a commercial conversation is active and for a reasonable period afterwards. Account, contract, and billing records are kept for the period our own legal and tax obligations require.

For data we process on a customer's behalf, retention is set by that customer in its configuration and in the DPA, reflecting its own record-keeping obligations.

8.Security

Data is encrypted in transit and at rest, access is role-based, least-privilege, and logged, and administrative access is limited to named personnel. ITSEC is certified to ISO/IEC 27001 and ISO 22301. Security documentation is available under NDA.

9.Your rights

Subject to applicable law, you can ask us for access to your personal data, correction of inaccurate data, deletion, restriction of processing, or a copy in portable form, and you can object to processing based on legitimate interests. Where we act as processor, we will refer your request to the responsible customer.

To make a request, write to sales@verifix.ae with enough detail for us to identify your records.

10.Cookies and website analytics

This site uses only the cookies and local storage needed to operate the site and keep a signed-in console session. We do not use advertising cookies or cross-site tracking on this website.

11.Changes and contact

We will update this page when our practices change and revise the effective date above. Questions or complaints: sales@verifix.ae.