Legal
Data Procesing Addendum- Basic Plan
Last updated: April 21st, 2026
By clicking “Continue to Payment” (or similar “Continue” button), you are electronically accepting the terms of this Data Processing Addendum (the “DPA”) on behalf of the entity you identified below (“Customer”), effective as of the date you click (the “Effective Date”), which will govern the data processing terms and conditions applicable between the Parties related to Customer's use of the Incode Basic Subscription Plan services as described in the Order Form presented at checkout. This DPA is supplemental to, and forms an integral part of, the Master Services Agreement (the “Agreement”) also included as part of the legal documents under the Order Form presented at checkout. This DPA constitutes a legally binding agreement between the Customer you represent and Incode Technologies, Inc. and its Affiliates (“Incode”). If you do not agree to these terms, do not proceed.
Terms not otherwise defined in this DPA will have the meaning as set forth in the Agreement.
By accepting the DPA, you agree to the following terms and conditions:
1. DEFINITIONS
“Applicable Data Protection Law” means all applicable laws and regulations governing the processing of Personal Data, including without limitation: (a) the EU General Data Protection Regulation (Regulation 2016/679) (“GDPR”); (b) the UK GDPR as retained in UK law by virtue of the European Union (Withdrawal) Act 2018; (c) the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, Law No. 13,709/2018) (“LGPD”); (d) the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (“CPRA”); and (e) any other applicable national, state, or provincial data protection or privacy law, each as may be amended from time to time.
“Biometric Data” means data generated by automatic measurements of an individual’s biological characteristics — including facial geometry and faceprints — used to identify a specific individual. Biometric Data constitutes Sensitive Personal Data under this DPA.
“Controller” means the entity that independently determines the purposes and means of processing Personal Data.
“Data Subject” means an identified or identifiable natural person to whom Personal Data relates. In the context of the Services, this is the End-User.
“Incode Authorized Personnel” means employees, officers, agents, and contractors of Incode who have a need to access Customer Personal Data to enable Incode to perform its obligations under this DPA.
“Personal Data” means any information relating to an identified or identifiable natural person, including Biometric Data, as defined under Applicable Data Protection Law included within Customer Data.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise processed. Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data.
“Processing / Process” means any operation or set of operations performed on Personal Data, whether automated or not, including collection, recording, storage, adaptation, retrieval, use, disclosure by transmission, and erasure or destruction.
“Processor” means an entity that processes Personal Data on behalf of and under the instructions of a Controller.
“Restricted Transfer” means a transfer of Personal Data to a country or territory not recognized as providing an adequate level of protection under Applicable Data Protection Law.
“Standard Contractual Clauses or SCCs” means the transfer mechanism set forth in the Transfer Mechanism Section which may be amended as required to the applicable Territory where the Personal Data is collected. In this case, the mechanism is based on the SCCs published by the European Commission available at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.
“Sub-Processor” means any third party engaged by Incode to process Customer Data on Incode’s behalf.
“Supervisory Authority” means an independent public data protection authority which is established in a territory and has the right to control the processing of Personal Data by Customer and/or Incode.
2. ROLES OF THE PARTIES. The roles of the Customer and Incode (controller, independent controller) are dependent upon the Services provided to Customer and the processing purposes as detailed in Schedule A herein.
3. CUSTOMER RESPONSIBILITIES
3.1 Lawful Basis. Customer shall ensure it has and maintains a valid lawful basis under Applicable Data Protection Law for all processing of End-User Personal Data through the Services. For any flow including the processing of Biometric Data, Customer must obtain explicit, freely given, specific, informed, and unambiguous consent from each End-User before initiating any identity verification session involving biometric capture. Customers acknowledge that user consent is mandatory in all production flows as agreed under Schedule A.
3.2 Privacy Notice. Customer shall provide End-Users with a clear and accessible privacy notice that meets the requirements of Applicable Data Protection Law.
3.3 Data Quality. Customer is responsible for the accuracy, completeness, and lawfulness of Customer Data submitted to the Services. Customer shall not instruct Incode to process Personal Data in a way that violates Applicable Data Protection Law or any third-party rights.
3.4 Security of Access. Customer is responsible for securing its account credentials and ensuring only Authorized Personnel access the Services. Customer must promptly notify Incode of any unauthorized access to its account. Customer is responsible for (i) independently determining whether the security measures provided for in the Services adequately meet Customer’s obligations under Applicable Data Protection Law and (ii) securely backing up Customer Data in its own systems in order to comply with its legal obligations.
4. INCODE RESPONSIBILITIES
4.1 Generally. Incode processes Personal Data as an Independent Controller for Identity Verification and Fraud Prevention, and as a Controller for Service Improvement and Business Operations, each as further detailed in Schedule A. Incode independently determines its lawful basis, purposes, and means of Processing for each such purpose.
4.2 Security. Incode will implement and maintain appropriate technical and organizational measures to protect Customer Data from Personal Data Breaches, as described under Schedule C ("Technical and Organizational Security Measures"). Notwithstanding any provision to the contrary, Incode may modify or update the Technical and Organizational Security Measures at its discretion provided that such modification or update does not result in a material degradation in the protection offered by the Technical and Organizational Security Measures.
4.3 Confidentiality. Incode shall take commercially reasonable steps to ensure the reliability and appropriate training of any Incode Authorized Personnel. Incode shall ensure that all Incode Authorized Personnel are made aware of the confidential nature of Customer Data and are under a statutory duty of confidentiality or have executed confidentiality agreements that prevent them from disclosing or otherwise Processing, both during and after their engagement with Incode, any Customer Data except in accordance with their obligations in connection with the Services.
4.4 Personal Data Breaches. Incode will notify Customer without undue delay after becoming aware of any Personal Data Breach and will provide timely information relating to the Personal Data Breach as it becomes known or reasonably requested by Customer. At Customer´s request, Incode will promptly provide Customer with such reasonable assistance as necessary to enable Customer to notify relevant Personal Data Breaches to any Supervisory Authorities and/or affected Data Subjects, if Customer is required to do so under Applicable Data Protection Laws.
5. DATA RETENTION AND DELETION.
Incode will delete Customer Data within 30 days of termination or upon Customer request; provided that this obligation does not apply to Personal Data processed by Incode as a Controller or Independent Controller (as detailed in Schedule A), which shall be handled in accordance with Incode data retention and deletion policies. This 30 days term will apply except where Incode is required by applicable law to retain some or all of the Customer Data, or where Incode has archived Customer Data on back-up systems, which data we will be blocked from any further Processing (except to the extent necessary for its continued hosting or Processing required by law, rule or regulation) and delete in accordance with Incode´s retention and deletion policies. Incode strongly recommends that Customer retain a backup copy of all its Customer Data to comply with any applicable legal obligations and to retrieve it from the Services within thirty (30) from the termination date of the Agreement. Incode retains and deletes Personal Data in accordance with its Controller and Independent Controller retention schedules and Applicable Law. Customer acknowledges that Incode may retain Personal Data processed as Controller or Independent Controller notwithstanding Customer’s deletion request.
In addition to the above, specifically regarding Biometric Information collected in the United States of America and unless otherwise required by an order from a court of competent jurisdiction or applicable law, the Parties hereby agree that Incode will delete Biometric Information upon the earlier of: (i) the initial purpose for collecting the Biometric Information has been satisfied; or (ii) the applicable legal retention period for the state in which the Biometric Information was collected or received from (e.g. 3 years in Illinois) has elapsed. This deletion will happen automatically as per the terms agreed hereunder.
6. SUB-PROCESSORS
6.1 General Authorization. Customer provides a general authorization for Incode to engage Sub-Processors, including its Affiliates, to assist in providing the Services, subject to the conditions in this Section 6.
6.2 Sub-Processor List. Incode’s current list of approved Sub-Processors, including their names, locations, and nature of processing, is available upon Customer request. Customer acknowledges and agrees that Incode may, from time to time, engage additional third parties for the purpose of providing the Services and hereby provides general written authorization to do so. Incode will update the Sub-Processor list prior to any new Sub-Processor commencing processing of Customer Data. Customer may request updated Sub-Processor´s List at any time by submitting a request to dataprotection@incode.com.
6.3 Sub-Processor Contracts. Incode shall impose data protection obligations on each Sub-Processor that are no less protective than those set out in this DPA. Incode remains fully liable to Customer for each Sub-Processor’s performance.
7. INTERNATIONAL DATA TRANSFERS
7.1 Transfer Mechanisms. Where processing of Customer Data involves a Restricted Transfer, Incode will ensure that such transfer is protected by an appropriate safeguard recognized under Applicable Data Protection Law, which may include: (a) EU Standard Contractual Clauses (SCCs); (b) the UK International Data Transfer Addendum to the EU SCCs; (c) Swiss transfer mechanisms; or (d) any other legally recognized mechanism in force at the time of transfer. If the SCCs, implemented as described below, cannot be used to lawfully transfer such Personal Data in compliance with Applicable Data Protection Laws, the parties agree that the required amendments to maintain the spirit agreed on the below sections shall instead be incorporated by reference and form an integral part of this DPA and shall apply to such transfers. If required, the Annexes or Appendices needed shall be populated using the information contained in the Schedules to this DPA (as applicable).
7.2 EU SCCs. Where EU SCCs apply, Module One (Controller to Controller) is incorporated into this DPA by reference, with Incode as data importer and Customer as data exporter. Clause 7 (docking) will apply, Clause 11 (optional redress) is excluded. Clause 17 is governed by the law of Ireland; disputes under Clause 18(b) are referred to Irish courts. The details in Schedule B shall be used to complete Annex I and the technical and organizational measures in Schedule C satisfy the Annex II requirements.
7.3 LGPD. For transfers of Brazilian residents’ Personal Data, Incode will comply with applicable LGPD requirements, including processing under a valid legal basis under Articles 7 and 11 (for Biometric Data as Sensitive Personal Data) of the LGPD.
7.4 Conflict. In the event that any provision of the Agreement, including this DPA contradicts, directly or indirectly, the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.
8. COMPLIANCE RECORDS & AUDIT RIGHTS. Customers acknowledge that the Service is hosted by our hosting Sub-Processors who maintain independently validated security programs (including SOC 2 and ISO 27001) and that Incode systems are audited annually as part of SOC 2 compliance and regularly tested by independent third-party penetration testing firms.
Where required by Applicable Law for Controller-to-Controller arrangements, Incode shall make available compliance documentation sufficient to demonstrate adherence to this DPA.
9. DATA PROTECTION IMPACT ASSESSMENTS AND PERMITTED DISCLOSURES. To the extent that the required information is reasonably available to Incode, and Customer do not otherwise have access to the required information, Incode will provide reasonable assistance to Customer with any data protection impact assessments, as required under Applicable Data Protection Laws. Each party acknowledges that the other party may disclose the Standard Contractual Clauses (or equivalent method included as Transfer Mechanism in section 7 of this DPA), this DPA and any privacy related provisions in the Agreement to any Supervisory Authority upon request.
10. GENERAL
10.1 Governing Law. This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by Applicable Data Protection Law or the Standard Contractual Clauses.
10.2 Entire Agreement on Data Protection. This DPA, together with the Agreement and the Schedules below, constitutes the entire agreement between the parties with respect to the processing of Customer Data and supersedes all prior agreements on such subject matter.
10.3 Amendments. Incode may update this DPA by posting a revised version at https://www.incode.com/legal/self-serve-dpa. For existing customers, revisions take effect thirty (30) days after they are published. Prior versions remain accessible at their versioned URLs for customers who accepted those versions.
10.4 Severability. If any provision of this DPA is held invalid or unenforceable, it will be limited to the minimum extent necessary, and the remaining provisions remain in effect.
Acceptance by Electronic Click
This DPA is accepted electronically. No handwritten or wet signature is required. By checking both boxes presented on the Incode checkout page and clicking “Continue to payment,” the individual accepting this DPA represents that, as of the Effective Date: (a) they have read and understood this DPA in its entirety; (b) they are duly authorized to bind Customer; and (c) Customer agrees to be bound by all terms herein.
SCHEDULE A TO DATA PROCESSING ADDENDUM
ROLES, PROCESSING PURPOSES & END USER CONSENT REQUIREMENTS
This Schedule A to the DPA forms part of the Agreement and describes the roles according to the processing purposes and related consent requirements for the Incode Omni Services.
1. PROCESSING PURPOSE DESCRIPTION & ROLES.
Purpose: Identity Verification (IDV) & Fraud Prevention
Description: Conducted independently and separately from the Customer to confirm the identity of individuals, prevent fraud and support future verifications.
Customer Role: Independent Controller
Incode Role: Independent Controller
Purpose: Improving Services & Business Operations
Description: Includes training machine learning models, algorithm enhancements, product optimizations and support internal operations, analytics, and the innovation of new products and services.
Customer Role: Not Applicable
Incode Role: Controller
2. END-USER CONSENT. The Parties agree to collect appropriate consents pursuant to Applicable Data Protection Law and according to the terms hereunder. The Customer acknowledges and agrees that the following Data Subject Consent Form language is mandatory in all production flows.
Should Customer disable the consent or unilaterally change its content from that agreed under the Data Subject Consent Form below, Incode will be entitled to display it automatically or suspend the Service.
——————————————————
Data Subject Consent Form
[Customer Name] (Customer) and Incode Technologies, Inc. (Incode) process your personal data, including biometric data, obtained from your identification document/card and facial geometry (selfie), for the purposes identified below.
Retention and Destruction
Your biometric data will be retained by [Customer Name] and Incode, subject to Applicable Law, for the lesser of: (i) until the original purpose of collection no longer exists; or (ii) for the applicable legal retention period as identified by the parties under their respective Privacy Policies (e.g. 3 years in IL), after which it will be securely deleted.
Your Rights
Under applicable laws, you have the right to: withdraw your consent, access, correct, request deletion or transfer of your data. Details on exercising your rights and applicable procedures are available in the [Customer Privacy Policy] and Privacy Policy | Incode.
Consent Statement: By selecting the applicable checkbox below and providing your biometric information you consent to each selected processing purpose and confirm that you:
- Understand the purposes for which your personal data, including biometric data, is processed.
- Acknowledge the [Customer Privacy Policy], Privacy Policy | Incode, Biometric Data Policy and Notice | Incode, Terms of Use | Incode and retention and destruction policies.
- Provide explicit, voluntary consent for the purposes selected below.
[ ] Identity Verification & Fraud Prevention (Required): Conducted by Customer and Incode to confirm your identity, prevent fraud, and support future verifications.
[ ] Improving Services/Business Purposes: Including training of machine learning models & development of new products and Services by Incode.
[ CONTINUE BUTTON]
——————————————————
SCHEDULE B TO DATA PROCESSING ADDENDUM
This Schedule B forms part of the Agreement and describes the Personal Data Processing activities carried out by each party in connection with the Services.
1. PARTIES.
The parties, their roles, and contact details are as identified in the Order Form and Schedule A.
Incode's data protection contact is dataprotection@incode.com.
2. DESCRIPTION OF PROCESSING.
Data Subjects: Current and potential End-Users of Customer.
Categories of Personal Data:
(a) Identity & Contact Data: First and last name, email address, phone number, user name, billing address, zip code, age/date of birth, and gender.
(b) Identification Documents & Biometric Data: Photos/selfies, front and back of personal ID photo and information, faceprint/facial geometry (biometric identifier), image-forensics metadata, and presentation-attack detection metadata.
(c) Device & Network Data: IP address, device ID/unique identifier, type of device, operating system, browser, domain server, and GPS and IP-based location data.
(d) Derived & Analytical Data: Model-generated anomaly, confidence, and risk scores. Certain metadata and analytical data points (e.g., telemetry, embeddings, graph attributes, and scores) may constitute Personal Data while linkable to an identifiable session or device. Incode processes such data for its Independent Controller purposes and may retain or deidentify it in accordance with its data minimization and aggregation policies.
(e) Sensitive Data: Faceprint/facial geometry.
Frequency of Processing: Continuous.
Nature and Purpose of Processing: For the purposes identified in Schedule A. Customer Personal Data may be subject to: (i) processing necessary for the purposes identified in Schedule A; and/or (ii) disclosures in accordance with the Agreement or this DPA and/or as compelled by applicable laws.
Retention Period: For the duration of the Agreement or until requested by Customer, subject to the retention and deletion terms in Section 5 of the DPA (including Incode's right to retain Personal Data processed as Controller or Independent Controller in accordance with its retention schedules and Applicable Law).
SCHEDULE C TO DATA PROCESSING ADDENDUM
TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES
This Schedule C forms part of the DPA and describes the technical and organizational measures implemented by Incode to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
Incode maintains technical and organizational security measures in accordance with industry standards as described below. Customer acknowledges and agrees these measures are appropriate to safeguard the security and integrity of Customer Personal Data pursuant to the Agreement and the DPA.
Key security measures include:
(a) Certifications: Information Security Management System certified under ISO/IEC 27001:2022, with annual SOC 2 compliance audits and regular independent third-party penetration testing.
(b) Encryption: Encryption of all personal data using AES-256 for data at rest and TLS 1.3 for data in transit. This ensures that data is unreadable if intercepted or accessed without authorization. Key management practices align with standards like NIST 800-57, including regular key rotation and storage in secure hardware security modules (HSMs).
(c) Access Control: Role-based access control (RBAC) with least-privilege principles, multi-factor authentication (MFA), and multi-tenant data segregation.
(d) Network Security: Deployment of firewalls, virtual private networks (VPNs), and intrusion detection/prevention systems (IDS/IPS) to protect the network perimeter and monitor internal traffic. Segmentation of internal networks prevents lateral movement of potential attackers. Use of zero-trust architecture ensures continuous verification of access requests.
(e) Secure Development: Secure Software Development Lifecycle (SDLC) practices aligned to OWASP Top Ten, with vulnerability assessments and penetration testing performed at least annually by an independent third party.
(f) Incident Response: Documented Incident Response Plan with procedures for identification, containment, eradication, and recovery, including communication plans aligned to regulatory notification timelines.
(g) Business Continuity: Encrypted backups in geographically distributed locations, with documented disaster recovery and business continuity plans tested at least annually.
(h) Data Minimization and Privacy by Design: Policies and automated tools to ensure only necessary Personal Data is collected and processed, with data protection principles embedded into product design and development.
Incode may modify or update these measures at its discretion, provided that such modification does not result in a material degradation in the protection offered.