DOT ID Privacy Policy
DRAFT. This text has not yet been approved by the owner and has no legal effect; no consent is collected on it. Places in square brackets are to be filled in.
Version 1.0 (draft)
Personal data controller: "DOT" Limited Liability Company ("DOT" MMC), VÖEN (tax ID) 1700516571, Republic of Azerbaijan, 79 Ismayilbey Gutgashinli St., apt. 24, Yasamal district, Baku AZ1073 (hereinafter "DOT", "we").
Person responsible for personal data processing: Elchin Huseynov.
Personal data contact: privacy@dot.az; written requests — to the registered address.
This Policy describes which personal data DOT processes in the DOT ID service (the sites id.dot.az, auth.dot.az, admin.dot.az and the DOT ID programming interfaces), for which purposes and on which legal basis, to whom it is disclosed, how long it is kept and which rights you have. The Policy follows the Law of the Republic of Azerbaijan "On Personal Data" No. 998-IIIQ of 11 May 2010, the Law "On Information, Informatisation and Protection of Information", the Civil Code of the Republic of Azerbaijan and other applicable legislation.
1. What DOT ID is
DOT ID is a single account for the products of the DOT ecosystem (the "products"): one sign-in, one identity verification, one set of contact details that you pass on to products yourself. DOT ID does not sell data, shows no advertising and uses no third-party analytics trackers.
2. Which data we process
2.1. Account data. First and last name, e-mail address (also the user name), phone number, DOT ID number (a six-digit number assigned by the system), interface language, language of e-mails and SMS, time zone, account creation date.
2.2. Sign-in and security data. Password (stored only as an irreversible hash), passkeys and WebAuthn security keys (public parts only), authenticator-app secret, recovery codes (hashed), session details (sign-in and sign-out times, sign-in method and second factor used), truncated network address (first three groups for IPv4, the /48 prefix for IPv6), browser and device type. These are needed so that you can sign in and others cannot, and so that you can see your sign-in history under "Activity".
2.3. Identity verification data. Processed only with your separate consent and described in the "Consent to processing of identity verification data". In short: the data of your identity document (full name, Latin-script name from the machine-readable zone, FIN, series and number, type, country, date of birth, expiry date), photos of the document, the portrait and your face, the verification result and the "over 18" flag. Document data and photos are stored encrypted; photos are never passed to products. The FIN is not an account identifier and is not used to merge accounts automatically.
2.4. Companies and representation. VÖEN, company name and registered address (pre-filled from the state register by VÖEN — a hint, not a confirmation of authority), the company's contact e-mail and phone, documents confirming your authority as a representative (if you upload them), review status.
2.5. Addresses. Postal addresses you save for yourself or a company, including map coordinates if you set a point on the map.
2.6. Payment methods. Masked card number (first six and last four digits), expiry date, card scheme, issuing bank, a technical reference to the card held by the payment provider. The full card number and the CVV never pass through DOT ID: the card is entered on the secure page of the payment service provider (Yığım or Epoint).
2.7. Support requests and notifications. Texts of support requests and replies, in-cabinet notifications, the fact that an e-mail or SMS was sent (address or number, time, template; the text of one-time codes is not kept).
2.8. Logs. Server logs (request time, path, response code, truncated network address) and the DOT ID administrators' journal (who viewed or changed your record, when and for which reason).
2.9. Age. A DOT ID account may be created by a person aged 16 or over; identity verification and product services that require the age of majority are available only from 18 (the age is confirmed by the document). If we learn that an account was created by a person under 16, we block it and erase the data as described in section 7.
3. Purposes and legal bases
| Purpose | Data | Basis |
|---|---|---|
| Account creation, sign-in, access recovery | 2.1, 2.2 | performance of the contract (Terms of Use) |
| Protection against unauthorised access, incident investigation | 2.2, 2.8 | performance of the contract; legitimate interest in service security |
| Verification of identity and age of majority | 2.3 | your separate consent |
| Representation of companies in products | 2.4 | performance of the contract; consent when uploading documents |
| Storing addresses and payment methods for use in products | 2.5, 2.6 | performance of the contract |
| Sign-in to products and passing data to them | 2.1 (2.3–2.5 only on your action) | performance of the contract; your action at sign-in or hand-over |
| Service e-mails and SMS (address confirmation, codes, security notices) | 2.1 | performance of the contract; legitimate security interests |
| Replies to requests | 2.7 | performance of the contract |
| Legal obligations, accounting and tax records | the necessary data | law |
We make no decisions with legal effect on you solely by automated processing: the result of an automatic document check can be reviewed by a person on your request.
4. To whom data is disclosed
4.1. Products of the DOT ecosystem. When you sign in to a product with DOT ID, the product receives your internal identifier, name, e-mail address (with its verification flag) and details of the sign-in level and time. Phone, addresses, company data and the identity verification result are passed to a product only on your explicit action in DOT ID or in the product; document photos are never passed. A product of which you are already a user may look up your account by an exact verified e-mail address, phone number or DOT ID number to add you to its workspace; it then receives your name and masked contacts, and you receive a notification. The list of products is shown under "Applications". Each product is a separate controller of its own data with its own privacy policy.
4.2. Processors (parties processing data on our instructions).
| Processor | What it receives | Purpose |
|---|---|---|
| Didit (identity verification provider) | document and face photos, document data — with your consent (section 2.3) | automatic check of document authenticity and face match |
| LSIM (SMS operator, Azerbaijan) | phone number, text of the service SMS | delivery of codes and notices |
| Hetzner Online GmbH (Germany) | all DOT ID data in encrypted storage and backups | server hosting and backup storage |
| Microsoft Azure (Sweden region) | encryption keys and service passwords only, no personal data | secrets vault |
| Cloudflare (Turnstile service) | technical browser details and network address during registration and password reset | protection of public forms against automated sign-ups |
| Google (Maps service) | your network address and, when you press "Locate me", the device coordinates — only on the address form page | map for choosing an address |
| Yığım, Epoint (payment service providers, Azerbaijan) | card details are entered by you on their page; DOT ID receives a technical reference and masked data | linking a bank card |
Our own mail server mail.dot.az | e-mail address, message text | e-mail delivery |
Each processor is bound by a contract to process data only on our instructions and to protect it.
4.3. Cross-border transfer. DOT ID servers are located in Germany, and the identity verification provider and some services are outside the Republic of Azerbaijan. Transfers are made to countries providing adequate protection of personal data, or on the basis of your consent and contractual safeguards, as provided by Article 14 of the Law "On Personal Data".
4.4. Public authorities. We disclose data to public authorities only on a lawful and substantiated request in the cases provided by law.
4.5. We do not sell your data and do not share it for third-party marketing.
5. Cookies and local storage
DOT ID uses only strictly necessary cookies: the session cookies of the cabinet and of the Administration Center, the session cookie of the sign-in server and the request-forgery protection cookie. They require no separate consent. The browser's local storage keeps your chosen theme and language. There are no analytics or advertising cookies.
6. How we protect data
Encrypted connections (TLS), application-level encryption of document data and photos with separate keys, keys held in a dedicated secrets vault, password hashing, a mandatory second factor for administrators, logging of every administrator access to your data before the response is served, access separation between internal services (each interface accepts only its own access keys), encrypted backups with integrity checks, regular software updates. Staff access is role-limited and recorded in a journal you may request.
7. How long we keep data
| Data | Period |
|---|---|
| The account and all its content | while the account exists |
| After a deletion request | 30 days of waiting (deletion can be cancelled meanwhile), then irreversible erasure of data, photos, the secret code and backup references; products are notified of the deletion |
| Identity verification data | while the account exists or until consent is withdrawn; on withdrawal they are erased and the verified status is removed |
| Sessions and sign-in history | at most 30 days from a session's last activity; "Activity" records — while the account exists |
| Administrators' journal | 5 years; anonymised when the account is deleted |
| Server logs | 14 days |
| Records of sent e-mails and returned (undeliverable) e-mails | 7 days as address hashes; the "undeliverable" flag — until the address is confirmed or 180 days |
| Backups | 30 daily and 12 monthly copies; data of a deleted account found in a backup is not restored into the service — the deletion journal is re-applied after any restore |
| Data required by accounting legislation | for the periods set by law |
8. Your rights
You may: obtain information about which data about you is processed (most of it is visible in the cabinet); correct inaccurate data ("Profile"); withdraw consent to the processing of identity verification data ("Verification" → "Withdraw"); delete the account ("Settings" → "Deletion"); obtain the journal of administrators' access to your data; object to processing and request its restriction in the cases provided by law; complain to the competent state authority for personal data or to a court.
Requests go to privacy@dot.az or through "Support". We reply within the period set by law and no later than 7 working days. To confirm the requester's identity we may ask you to sign in or to reply from your verified address.
Withdrawing consent does not affect the lawfulness of processing before the withdrawal and may make unavailable the functions for which the data was necessary (for example, company representation without a verified identity).
9. Your part in account security
Never share your password or codes with anyone, including DOT staff — we never ask for them. Enable a second factor. Report suspicious activity through "Support"; an e-mail about a sign-in from a new device is sent automatically.
10. Changes to this Policy
We announce material changes at least 30 days in advance by an in-cabinet notice and an e-mail. The current version, its number and its effective date are always published on this page; previous versions are available on request. Continued use of DOT ID after changes take effect means acceptance of the new version in the parts that require no separate consent.
11. Language
The Policy is published in Azerbaijani, Russian and English. In case of discrepancy the Azerbaijani version prevails.