Overview
This Data Processing Agreement ("DPA") reflects the parties' agreement under GDPR Article 28 and equivalent UK GDPR provisions. It applies when a customer ("Controller") uses VerifyCore to process personal data on behalf of its end users or clients, and AMT Consulting LLC ("Processor") processes that data to deliver the Service.
Parties
- Controller — the customer organisation that determines the purposes and means of processing personal data submitted to VerifyCore.
- Processor — AMT Consulting LLC, Str. Zef Jubani, Nr. 5, 10000 Prishtinë, Republic of Kosovo.
Subject matter and duration
Processing is limited to identity verification, AML screening, risk scoring, audit logging, and related compliance workflows enabled in the Controller's VerifyCore account. Processing continues for the term of the commercial agreement and any applicable retention period thereafter.
Nature and purpose of processing
The Processor will collect, store, analyse, and transmit personal data solely to provide the VerifyCore platform, execute verification and screening workflows, generate compliance records, and fulfil support and security obligations defined in the Service documentation.
Types of personal data
- Identity and contact information (name, email, address, date of birth);
- Government ID document data and images;
- Biometric facial data and liveness results, where enabled;
- AML/sanctions screening inputs and match results;
- Technical logs, IP-derived metadata, and audit events.
Sub-processors
The Controller authorises the Processor to engage sub-processors that are necessary to operate the Service. Current sub-processors include:
- Supabase — database, authentication, and file storage (EU region where configured);
- OpenSanctions — sanctions and PEP screening data;
- Resend — transactional email delivery.
The Processor will maintain an up-to-date sub-processor list and provide notice of material changes in accordance with applicable data protection law.
Security measures
The Processor implements appropriate technical and organisational measures including encryption in transit (TLS 1.3), encryption at rest (AES-256), role-based access control, row-level security policies, audit logging, and environment segregation. Details are described in our Security & Trust page.
Data subject rights
The Processor will assist the Controller, taking into account the nature of processing, in responding to data subject requests including access, rectification, erasure, restriction, and portability, as required under GDPR Articles 15–22.
Contact
DPA and privacy enquiries: info@amt-ks.com