DOT legal documents · DOT ID

Consent to processing of identity verification data

DRAFT. This text has not yet been approved by the owner and has no legal effect; no consent is collected on it. Places in square brackets are to be filled in.

Version 1.0 (draft)

This document explains what happens to your data if you verify your identity in DOT ID and which consent you give by pressing "Start verification". The controller is "DOT" Limited Liability Company ("DOT" MMC, VÖEN 1700516571, Republic of Azerbaijan, 79 Ismayilbey Gutgashinli St., apt. 24, Yasamal district, Baku AZ1073; contact — privacy@dot.az). Identity verification is voluntary and available from 18: without it your DOT ID account works, but some product functions may be unavailable.

1. Which data is processed

1.1. Images. Photos of your identity document (identity card of a citizen of the Republic of Azerbaijan, passport or another supported document), a photo of your face taken at the moment of verification, and the portrait from the document. The face photo is a special category of data (biometric data), because it is used to match you against the portrait in the document.

1.2. Document data. Last name, first name, patronymic; last and first name in Latin script from the document's machine-readable zone (if there is no such zone — entered by you once); FIN (personal identification number); document series and number; document type; issuing country; date of birth; expiry date.

1.3. Result. Verification status (verified / declined / action required), decline reason, the "over 18" flag, verification time and the technical identifier of the verification session.

1.4. Secret code. A four-digit code you set once after verification, to quote when contacting the support of DOT products. The code is stored encrypted and cannot be changed by you; every reveal is recorded under "Activity" and accompanied by a notification.

2. Purposes

• to confirm that the DOT ID account is used by the person whose document is presented;
• to confirm the age of majority for services that require 18 years;
• to let DOT products rely on a verified identity (company representation, contracts, hand-over of data to registrars — only on your separate action);
• to prevent fraud and duplicate accounts on one document.

3. How verification works and who receives the data

3.1. Verification is performed by the identity verification provider Didit on its own secure page: you photograph the document and your face directly in the provider's interface. Didit automatically checks the authenticity of the document, reads its data and matches your face to the portrait. Didit acts as a data processor on DOT's instructions under a contract and processes data in accordance with its own privacy policy; Didit's servers may be located outside the Republic of Azerbaijan (cross-border transfer on the basis of your consent and contractual safeguards, Article 14 of the Law "On Personal Data").

3.2. After a positive result DOT ID receives the document data and images from Didit and stores them encrypted in its own storage: document data under a separate key, images in an encrypted object store. Only the document's expiry date and the "over 18" flag are kept in clear. After that DOT ID does not request your data from Didit again, apart from re-checking the status.

3.3. An automated decline may be reviewed by a person on your request through "Support".

4. Who sees the data

• You — under "Verification": full name, document type and country, date of birth; the FIN and document number are shown as asterisks and revealed by a click. Photos are not shown in the cabinet.
• DOT products — only on your action receive the fact of verification, your full name and, where a particular service requires it and you confirm it at the moment of hand-over, individual document fields. Photos are never passed to products.
• DOT staff with an administrator role — see your name and verification status in the account record; the FIN, document number, date of birth and photos are not available to them. Every view of the record is journaled, and you may request that journal.
• Didit — to the extent of clause 3.1.
• Public authorities — only on a lawful request.

5. How long the data is kept

Document data, images and the secret code are kept while your account exists and the consent is in force. They are erased irreversibly:

• when you withdraw consent ("Verification" → "Withdraw"): the verified status is removed and products that relied on it are notified;
• when the account is deleted — after the 30-day waiting period;
• when the document expires, the verified status ceases to be current and you may verify again.

A result obtained in test mode (synthetic data) is marked as a test result and is never treated as identity verification.

6. Your rights

You may: decline verification (the account remains); withdraw consent at any time — this does not affect the lawfulness of processing before withdrawal; obtain information about the stored data and the journal of access to it; request correction (document data is corrected by a new verification, the Latin-script name once by you); complain to the competent state authority for personal data or to a court. Requests — privacy@dot.az or "Support".

7. What you confirm by pressing "Start verification"

I, a DOT ID user, confirm that:

1. I present my own valid document and photograph my own face;
2. I have read this document and the DOT ID Privacy Policy;
3. I consent to "DOT" LLC processing the data of my identity document and my biometric data (face photo) for the purposes listed in section 2, with the involvement of the processor Didit, including cross-border transfer, on the terms described above;
4. I understand that the consent is voluntary and may be withdrawn under "Verification", and that withdrawal ends the identity verification.

The document is published in Azerbaijani, Russian and English; in case of discrepancy the Azerbaijani version prevails.