Privacy Policy

1. Who we are and our role

Verifisha is a product of Sperico Limited, a company incorporated in Kenya and registered with the Office of the Data Protection Commissioner (ODPC) as a data processor, registration number 816-4166-93FB.

When we run checks on your behalf, you are the data controller and we act as your data processor — you remain responsible for having a lawful basis and, where required, the subject’s consent. For the limited personal data we collect to operate our own business — such as your account, enquiries and our website — we act as a data controller in our own right.

2. The data we collect and where it comes from

Depending on how you use the Service, we collect personal data from several sources:

• Directly from you — account details (name, email, phone, organisation and login), enquiries and waitlist details, and, where you verify yourself, identity details, uploaded documents and any photo or selfie you provide.
• From our customers — where an organisation uses Verifisha to verify someone, it submits information about that Verification Subject so the check can run.
• From external data sources — information returned from authorised government, regulatory, commercial and public sources and from verification providers (for example identity, business, financial, risk and reference data).
• Automatically — usage and device data such as pages viewed, actions taken, IP address, browser, device and timestamps, and security and audit metadata.
• Verification data — the details, status, results, consent records and audit history connected to each verification request.

3. How we use data and our lawful basis

We use personal data to provide and secure the Service, run requested checks, prevent and investigate fraud and misuse, take payment, support you, keep audit records, comply with legal obligations, and improve the reliability of the Service. Our lawful bases include performance of a contract, consent, legitimate interests and compliance with law.

4. Consent and people who are checked

Sensitive checks are consent-led: the subject is asked to approve before checks run, and that consent is stored as evidence. If you run checks through Verifisha, you are responsible for having a lawful basis and, where required, the subject’s consent. People being verified are also shown a short verification notice before a check runs.

5. Biometric information

Some verification methods may, where offered and where you or a customer choose to use them, involve biometric-related processing — for example a selfie or photo, a short video or liveness check, comparison of a face against an identity document, and any biometric template or similar information derived from these.

Biometric-related information is sensitive. Where it is processed, we do so for identity-verification and fraud-prevention purposes, on an appropriate lawful basis (usually the Verification Subject’s consent); we share it only with the providers needed to perform the check, keep it only for as long as necessary, and protect it with the safeguards described below. Where a check does not use these methods, no biometric information is collected.

6. Cookies and analytics

We use essential cookies to run the site, and analytics to understand and improve how it is used. We use Google Analytics 4 and Microsoft Clarity, which set cookies and collect usage and device data. We do not send your name, email, phone or ID numbers to these tools, and we mask sensitive form fields from session recording.

7. Third-party providers and subprocessors

To deliver the Service we rely on third-party data sources (such as IPRS, the Business Registration Service, credit reference bureaus and watchlists) and on service providers that process personal data on our behalf — our subprocessors — for things like hosting, identity and biometric verification, payments, communications and analytics.

We engage subprocessors under written terms that require them to protect personal data and to process it only for the purposes we set, and we remain responsible to you for personal data they handle on our behalf. We keep a current list of our subprocessors and will provide it to business customers on request.

8. Sharing and disclosure

We do not sell personal data. We share it only as needed to provide the Service, with your instruction or consent, to comply with the law or a lawful request, or to protect our rights and the safety of others.

9. Data retention

We keep personal data only as long as we need it for the purposes above, to meet legal, regulatory and audit obligations, and to resolve disputes. In practice, retention depends on the type of data:

• Account information — for the life of your account, plus any period required by law.
• Verification requests and results — for the period needed for the purpose of the check and any applicable legal or business requirement.
• Consent and audit evidence — for as long as needed to demonstrate that processing was lawful.
• Identity documents, selfies and liveness media — for the minimum period necessary, and not kept as raw biometric material longer than needed.
• Security and financial records — for the relevant security or statutory retention period.

10. Security

We protect personal data with encryption in transit and at rest, scoped and access-logged sharing, and least-privilege access. No system is perfectly secure, but we work continuously to keep your data safe.

11. International processing and transfers

Verifisha is Kenya-first. Some of our service providers may process personal data outside Kenya. Where that happens, we take steps to ensure an appropriate level of protection as required by applicable data-protection law. We do not claim that all personal data is processed only within Kenya.

12. Your rights

Subject to law, you may:

• Access the personal data we hold about you.
• Ask us to correct or delete your personal data.
• Object to or restrict certain processing, and withdraw consent.
• Lodge a complaint with the Office of the Data Protection Commissioner.

13. Marketing and the app waitlist

If you join our waitlist or ask to be contacted, we use your details to send you the updates you asked for (such as early access and launch news). You can opt out at any time.

14. Children and sensitive data

The Service is not intended for children under 18, and we do not knowingly collect their personal data except where a check is lawfully requested by a parent, guardian or authorised party. Sensitive personal data — such as health or biometric data — carries a higher bar under the law, and we handle it with extra care and limited retention.

15. Changes and contact

We may update this Policy from time to time and will post the new version here with a revised date. To exercise your rights or ask a question, contact us using the details on our contact page.