Data Processing Addendum — ZeroTrust

Version: 2026-10-01 · Effective: October 1, 2026 · Supersedes: none, this is the first published version

This document is versioned by its effective date. Every superseded version remains available at zerotrust.entrinsia.com/dpa/<version> permanently. Changes are listed in the Revision History at the end.

This Data Processing Addendum ("Addendum") forms part of the ZeroTrust Terms of Service between Entrinsia Inc. ("Entrinsia") and the Customer, and applies to Entrinsia's processing of personal data on the Customer's behalf.

Terms used but not defined here have the meaning given in the Terms of Service. "GDPR" means Regulation (EU) 2016/679, and "UK GDPR" means that Regulation as it forms part of the law of England and Wales, Scotland, and Northern Ireland.

1. Roles

The Customer is the controller and Entrinsia the processor in respect of End User verification data. Where the Customer is itself a processor, Entrinsia is a subprocessor, and references to the Customer's instructions mean the instructions of the relevant controller as passed on by the Customer.

2. Details of Processing

Subject matter: identity and age verification of the Customer's End Users.

Duration: the term of the Terms of Service, together with the retention periods set out in the Privacy Policy.

Nature and purpose: capture and real-time analysis of a government-issued identity document and a video selfie; document authentication; liveness detection; facial comparison; extraction of configured text fields; return of a verification result to the Customer; and retention of a compliance record.

Types of personal data:

Facial images, and the biometric comparison derived from them, processed transiently and not retained
Identity document images, processed transiently and not retained
Name
Address, passed to the Customer where configured and not retained by Entrinsia
Date of birth, processed transiently and not retained
Document number, retained only as a keyed one-way hash
Document type and expiry status
City, state, and postal code
A record of biometric notice acceptance, comprising acceptance, notice version, and timestamp
Device, browser, and network diagnostics

Categories of data subject: individuals whom the Customer directs to verification, being the Customer's customers, applicants, or account holders.

3. Processing on Instructions

Entrinsia processes personal data only on the Customer's documented instructions, which comprise the Terms of Service, this Addendum, and the Customer's account configuration, unless required to do otherwise by applicable law. Where the law requires otherwise, Entrinsia will inform the Customer before processing, unless the law prohibits that notice on important grounds of public interest.

Entrinsia will inform the Customer if, in its opinion, an instruction infringes applicable data protection law.

4. Confidentiality

Entrinsia ensures that persons authorised to process personal data under this Addendum are bound by an appropriate obligation of confidentiality, whether contractual or statutory.

5. Security

Entrinsia implements appropriate technical and organisational measures, including:

Encryption of personal data in transit and at rest
Keyed one-way hashing of document numbers, with the keying material held server side and never released to a client
Handling of identity document images and video in ephemeral, in-memory processing only, without persistence to storage or backup
Removal of all image data on the capturing device before any cross-device transfer
Role-based access control limited to personnel who require access to operate or support the Service
Logging and monitoring of access, and of anomalous use of the verification flow

6. Subprocessors

The Customer gives general authorisation for Entrinsia to engage the subprocessors listed at zerotrust.entrinsia.com/subprocessors.

Entrinsia will give at least thirty (30) days' notice before adding or replacing a subprocessor that processes End User personal data. The Customer may object on reasonable data protection grounds within that period, with the remedy set out in Section 16 of the Terms of Service.

Entrinsia imposes on each subprocessor data protection obligations no less protective than those in this Addendum, and remains fully liable to the Customer for each subprocessor's performance.

7. Data Subject Rights

Taking into account the nature of the processing, Entrinsia will assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests to exercise data subject rights.

Where Entrinsia receives such a request directly from a data subject in respect of data processed for the Customer, Entrinsia will not respond substantively and will refer the request to the Customer without undue delay, except where Entrinsia is required to respond under applicable law.

8. Assistance

Entrinsia will provide the Customer with reasonable assistance in respect of data protection impact assessments and prior consultations with a supervisory authority, taking into account the nature of the processing and the information available to Entrinsia.

9. Personal Data Breach

Entrinsia will notify the Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware, of any personal data breach affecting personal data processed for the Customer, and will provide the information the Customer reasonably requires in order to meet its own obligations.

10. Deletion or Return

On termination of the Terms of Service, Entrinsia will delete personal data processed for the Customer within thirty (30) days, except for compliance records that remain within their retention period and records Entrinsia is required by law to retain.

On written request made before termination takes effect, Entrinsia will provide an export of the Customer's compliance records in a machine-readable format.

11. Audit

Entrinsia will make available to the Customer the information necessary to demonstrate compliance with this Addendum, including the materials described in Section 10.3 of the Terms of Service, and will allow for and contribute to audits conducted by the Customer or an auditor it mandates.

Audits may be conducted no more than once in any twelve month period, on at least thirty (30) days' notice, subject to confidentiality obligations and to reimbursement of Entrinsia's reasonable costs, save where an audit follows a personal data breach affecting the Customer.

12. International Transfers

Where the Customer transfers personal data subject to the GDPR or the UK GDPR to Entrinsia in the United States, the parties incorporate the European Commission's Standard Contractual Clauses of 4 June 2021, Module Two (controller to processor) or Module Three (processor to subprocessor) as applicable, with the Customer as data exporter and Entrinsia as data importer.

The optional docking clause applies.
Clause 17 is governed by the law of Ireland, and Clause 18(b) designates the courts of Ireland.
Annexes I, II, and III to those Clauses are populated by Sections 2, 5, and 6 of this Addendum respectively.

For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to those Clauses applies, with Tables 1 to 3 populated as above, and with the importer permitted to end the Addendum as set out in Table 4.

Version	Effective	Summary of changes
`2026-10-01`	October 1, 2026	First published version.

Data Processing Addendum