Skip to main content

DPA — Sumsub

Data Processing Agreement — Sumsub

Between:

  • Data Controller: ALAI Holding AS, Org. No. 932 516 136 ("Controller")
  • Data Processor: Sumsub Limited ("Processor")

Effective Date: [DATE] Product: Drop payment services — KYC/Identity Verification

This DPA supplements the generic DPA template (dpa-template.md) with Sumsub-specific processing details. All general terms from the template apply unless overridden below.

Appendix 1 — Processing Details

Field Description
Purpose Identity verification (KYC/CDD) for Drop users, including document verification, liveness checks, PEP screening, and sanctions list checks in accordance with Norwegian AML legislation (hvitvaskingsloven)
Nature Collection, verification, storage, and analysis of identity documents and biometric data
Duration Duration of service agreement between Controller and Sumsub
Data subjects Drop end users (natural persons in Norway applying for or holding Drop accounts)
Data types Full name, date of birth, national ID number (encrypted), nationality, identity document images (passport/ID card), selfie/liveness capture, PEP screening results, sanctions check results, risk score, verification status
Special categories Biometric data for identity verification (GDPR Art. 9(2)(g) — substantial public interest: AML obligations)

Appendix 2 — Security Measures (Sumsub)

  1. Encryption: TLS 1.3 in transit; AES-256 at rest for all stored documents and data
  2. Access Control: Role-based access, MFA for all staff, principle of least privilege
  3. Data Residency: EU data centers (primary processing within EEA)
  4. Logging: Comprehensive audit trail for all verification events and data access
  5. Data Retention: Verification data retained for the period specified by Controller (aligned with hvitvaskingsloven 5-year requirement), then securely deleted
  6. Incident Response: 24/7 security operations, breach notification within 24 hours
  7. Certifications: SOC 2 Type II, ISO 27001, PCI DSS compliant
  8. Sub-processors: List maintained and available at Sumsub's sub-processor page; 30-day advance notice of changes

Additional Sumsub-Specific Terms

Biometric Data

  • Biometric data (liveness/selfie) processed solely for identity verification purposes
  • Not used for surveillance, profiling, or any purpose beyond KYC verification
  • Deleted upon completion of verification cycle (not retained beyond verification outcome)

Data Subject Rights

  • Sumsub shall assist Controller in responding to data subject access, erasure, and portability requests within 10 business days
  • Verification results and risk scores can be exported in machine-readable format

Transfer Impact Assessment

  • Primary processing: EU/EEA data centers
  • Any processing outside EEA covered by EU SCCs (Decision 2021/914)
  • TIA documentation available upon request

Signatures

Data Controller — ALAI Holding AS

Name: ___________________________ Title: ___________________________ Date: ___________________________

Data Processor — Sumsub Limited

Name: ___________________________ Title: ___________________________ Date: ___________________________

No comments to display

Back to top