Kaluta KYC Inc. ("Kaluta KYC", "we", "us") provides identity verification services to businesses ("Customers"). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website and verification platform. We comply with Canada's PIPEDA, the EU/UK GDPR, and other applicable data-protection laws.
1. Who is the data controller?
When an end user completes a verification, our Customer is the data controllerand Kaluta KYC acts as a data processor on their behalf. For our website and business accounts, Kaluta KYC is the controller. You can reach our Data Protection Officer at privacy@kalutakyc.com.
2. Information we collect
From end users (during verification)
- Identity document images (passport, national ID, driver's license, residence permit)
- Data extracted from documents: name, date of birth, document number, nationality, expiry date
- Facial images and selfie captures used for biometric comparison and liveness detection
- Device, browser, and connection metadata used for fraud prevention
From business customers
- Account details: company name, email, industry, country, website
- Billing and usage records
- API and dashboard activity logs
3. Biometric data
Facial geometry derived from selfies and document photos is biometric information. We process it solely to perform the verification requested by our Customer, never to build advertising profiles. Biometric templates are encrypted and are not shared with third parties except as required to deliver the service or by law.
4. How we use information
- To perform identity verification, document authentication, face matching, and liveness checks
- To detect, prevent, and investigate fraud and security incidents
- To provide, maintain, and improve our services
- To comply with legal, regulatory, and AML/KYC obligations
- To bill Customers and provide support
5. Legal bases (GDPR)
We process personal data under one or more of the following bases: performance of a contract, compliance with a legal obligation, our legitimate interests in preventing fraud, and—where required for biometric data—explicit consent obtained at the start of the verification flow.
6. Data retention
Verification data is retained for the period instructed by our Customer or as required by applicable AML regulations (typically 5–7 years), after which it is securely deleted. Customers may request deletion of specific records at any time, subject to legal retention requirements.
7. Sharing & sub-processors
We share data with vetted sub-processors (cloud hosting, object storage) under data-processing agreements. We do not sell personal information. We may disclose data to comply with valid legal requests or to protect our rights and the safety of users.
8. International transfers
Data may be processed in Canada and other jurisdictions. Where we transfer personal data internationally, we rely on adequacy decisions or Standard Contractual Clauses to ensure equivalent protection.
9. Security
We apply bank grade safeguards including encryption in transit (TLS) and at rest, access controls, audit logging, and continuous monitoring. See our Security & Compliance page for details.
10. Your rights
Depending on your jurisdiction, you may have the right to access, correct, delete, or port your data, to object to or restrict processing, and to withdraw consent. End users should contact the business that requested their verification; you may also contact us at privacy@kalutakyc.com and we will route the request appropriately.
11. Cookies
Our website uses essential cookies for authentication and session management, and limited analytics cookies to understand usage. You can control cookies through your browser settings. The verification flow uses only strictly necessary cookies.
12. Children
Our services are not directed to individuals under 16. We do not knowingly collect data from children except where a Customer is legally required to verify a minor with appropriate consent.
13. Changes
We may update this policy from time to time. Material changes will be posted on this page with a revised "Last updated" date.
14. Contact us
Kaluta KYC Inc.
120 Adelaide Street West, Suite 2500
Toronto, Ontario M5H 1T1, Canada
privacy@kalutakyc.com