Version 2026-11-03. This agreement ("DPA") is part of the contract between ZOI LABS LLC ("Zoi ID", processor) and the company that uses Zoi ID to verify its users ("Partner", controller). It applies to personal data Zoi ID processes for the Partner. Partner signs it by accepting the Zoi ID partner terms or an order form that refers to it.
1. Roles and instructions
1.1 Partner is the controller and Zoi ID is the processor of End User data processed to provide the verification service. Zoi ID processes it only on Partner's documented instructions: this DPA, the partner API calls and the settings Partner chooses (level, requirements such as proof of address or source of funds and source of wealth and their policies, scopes, webhooks, dashboard members and roles).
1.2 Zoi ID is an independent controller only for: sanctions screening records it must keep under United States law, its security and access logs, and keyed fingerprints kept to stop fraud across its service, as described in the Zoi ID Privacy Notice.
1.3 If Zoi ID thinks an instruction breaks the law, it tells Partner and may refuse it.
2. Details of processing
| Item | Description |
|---|---|
| Subject matter and duration | identity verification for the term of the contract and the retention periods of the Zoi ID Retention Schedule |
| Nature and purpose | document authenticity checks, 1:1 face comparison, liveness, sanctions and PEP screening, duplicate detection, proof of address checks when Partner asks for them (for its customer due diligence and fraud prevention), source of funds and source of wealth checks when Partner asks for them (for its enhanced due diligence under its anti-money-laundering and counter-terrorist financing duties: Zoi ID checks that the evidence is genuine and consistent and reports it; Partner makes the decision), human review, quality control of decisions (fraud reports from Partner, fraud labels, blind second review of a sample of decided sessions) to measure and lower wrong decisions, reporting results to Partner |
| Data subjects | Partner's end users who start a verification, including already verified end users that Partner asks again for proof of address or source of funds (follow-up sessions) |
| Personal data | document data, document images and chip files, liveness video and frames, residence and optionally address, declarations, device integrity results, technical data, check results; for proof of address: the document the end user sends and images of its pages, the data read from it (type, date, issuer, holder name, address), PDF signature and file checks, official verification codes printed on it, device time zone and language, keyed fingerprints of the file and its signature, the confirmed address and how it was proven; for source of funds and source of wealth (financial data): the end user's answers (employment status, occupation, employer or business name, yearly income range, sources of the money, expected monthly volume range, total wealth range and how it was built), only when Partner's policy asks for them up to 5 documents and images of their pages, the data read from them (type, date, issuer, holder name, employer, main amount and currency), PDF signature and file checks, keyed fingerprints of each file and its signature, reviewer verdicts on each document, and the summary kept with the identity (answers, document summaries, evidence level); for quality control: fraud reports and labels (status, category, source, an optional note) and second review verdicts |
| Special categories | biometric data for 1:1 verification, only with the end user's explicit consent collected in the Zoi ID flow. Financial data is not a special category, but both parties treat it as sensitive (section 4.5) |
| Retention | Zoi ID Retention Schedule |
3. Zoi ID's duties
3.1 Confidentiality. Only trained staff bound by confidentiality access the data, and only as needed.
3.2 Security. Zoi ID keeps the measures in Annex 1 and does not lower them during the term.
3.3 Subprocessors. Partner gives general authorization for the subprocessors listed at https://kyc.zoi.network/legal/subprocessors. Zoi ID gives at least 30 days' notice of changes; Partner may object on reasonable data protection grounds and, if no solution is found, end the affected service without penalty. Zoi ID binds each subprocessor to the same obligations and stays responsible for it.
3.4 Assistance. Zoi ID helps Partner answer data subject requests (through the partner API: lookup and erasure, and by email for copies and corrections), with data protection impact assessments and with consulting authorities.
3.5 Breaches. Zoi ID tells Partner without undue delay and in any case within 36 hours after becoming aware of a personal data breach affecting Partner's data, with the information it has and updates as it learns more.
3.6 Deletion. At the end of the service, or when Partner erases an end user through the API, Zoi ID deletes the data as set out in the Retention Schedule, except data it must keep by law (section 1.2).
3.7 Audits. Zoi ID provides the information needed to show compliance with this DPA, answers reasonable security questionnaires once a year, and allows an audit by Partner or an independent auditor bound by confidentiality, at Partner's cost, with 30 days' notice, no more than once a year unless an authority requires it or after a breach.
4. Partner's duties
4.1 Partner has a lawful basis to send its users to Zoi ID, shows them the Zoi ID notices (the SDK and API provide the links), and does not ask for more data scopes than it needs.
4.2 Partner keeps its API keys and webhook secrets safe and tells Zoi ID at once if they leak.
4.3 Partner uses results only for the purposes it told its users.
4.4 Proof of address: Zoi ID sends Partner the result (proven or not, method, evidence level, document type and date, country) and the address lines only with the "address" scope. It does not send the document and deletes it as the Retention Schedule says. Partner keeps its own records for the period its law sets.
4.5 Source of funds and source of wealth: Zoi ID checks that the evidence is genuine and consistent with the end user's answers and gives Partner a structured summary. It does not decide whether the end user's money is legitimate; Partner's compliance team makes the enhanced due diligence decision and is responsible for it. Zoi ID sends Partner the evidence level, whether a person reviewed it and the number of documents with every scope, and the answers, the figures read and the findings only with the "financial_data" scope (never part of the eligibility scope). Zoi ID does not send the documents through the API. In the partner dashboard only members with the "compliance" role can open them, only with the "financial_data" scope, one page image at a time, and each view is written to the dashboard audit log. Partner gives that role only to staff who need it for its anti-money-laundering duties, uses the financial data only for those duties, and keeps its own records for the period its law sets.
5. International transfers
5.1 Zoi ID stores data in Germany and is a United States company. Where Partner is subject to the GDPR or UK GDPR and the processing involves a transfer to a third country without an adequacy decision, the parties agree to the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), and where relevant the UK International Data Transfer Addendum, which are incorporated by reference. For the clauses: option 2 of clause 9 (general authorization, 30 days), no clause 7 docking, Irish law and courts, Annex I is section 2 of this DPA, Annex II is Annex 1 of this DPA, Annex III is the subprocessor list.
5.2 For other countries that require a transfer mechanism (for example Brazil, Türkiye, Korea, Thailand, Vietnam, Indonesia), the parties will use the standard clauses or other mechanism that law provides, which Zoi ID makes available on request.
6. Liability and order of precedence
Liability follows the main contract. If this DPA and the main contract conflict on data protection, this DPA wins; the Standard Contractual Clauses win over both.
Annex 1: Technical and organisational measures
- Encryption. Personal data is encrypted in transit and at rest with industry-standard algorithms, with a separate key per file and per identity record. Keys are managed under a written key management policy and kept apart from the data they protect.
- Pseudonymisation. Duplicate and fraud checks use keyed one-way fingerprints instead of raw identifiers.
- Biometric data. No storage of face templates. Biometric processing happens in memory only, in isolated services.
- Data minimisation. National numbers that may not be kept are blurred or dropped. Partners receive only the scopes they are granted.
- Access control. Least-privilege, role-based access for named and trained staff only. Two-person rule for sanctions decisions. Append-only log of every access to personal data.
- Network and system security. Dedicated infrastructure for Zoi ID, protected at the network edge, with internal services segregated and no direct access to databases from the internet. Hardened, minimal system images and least privilege for every service.
- Secure development and vulnerability management. Automated security testing, dependency monitoring and timely patching, managed secrets, and signed releases verified before deployment.
- Availability and resilience. Encrypted backups, written recovery procedures, automated retention and deletion, and erasures applied again after any restore.
- Personnel. Training before access, confidentiality undertakings and periodic access reviews.
- Source of funds documents. Never sent through the partner API. In the partner dashboard only for the compliance role with the financial_data scope, page images only, every view in the dashboard audit log.
- Incident response. A written incident response plan, notice to Partner as set out in section 3.5, and notice to authorities within 72 hours where required.