Privacy Policy & Biometric Governance
Detailed disclosure of our biometric processing practices, data protection safeguards, and compliance with Pakistani digital onboarding regulations.
01 Institutional Scope & Roles
KYC Verify Pakistan operates as an institutional identity verification infrastructure serving banks, microfinance institutions, telecommunications providers, fintech applications, and corporate platforms operating within the Islamic Republic of Pakistan.
Depending on your relationship with our services:
-
Data Processor Role: When processing verification sessions on behalf of enterprise partners, KYC Verify acts strictly as a Data Processor adhering to the instructions and compliance mandate of the originating institutional client.
-
Data Controller Role: For users interacting directly with hosted onboarding portals, KYC Verify ensures end-to-end data stewardship and sovereignty over session execution.
02 Biometric Data Collection & Processing
To establish identity authenticity and defeat synthetic spoofing or identity fraud, KYC Verify processes specific identity and biometric attributes only upon explicit applicant consent:
-
National Identity Card (CNIC / Smart NIC / NICOP): High-resolution optical scans of front and rear card surfaces to extract textual attributes (Full Legal Name in English and Urdu, Father/Husband Name, 13-digit National ID Number, Date of Birth, Gender, Issue Date, Expiry Date, and Issuing Authority) adhering to national citizen database specifications.
-
Facial Mesh Geometry & Landmarks: Real-time 468-point 3D facial mesh vectors capturing yaw, pitch, roll, inter-pupillary distance, and facial contours to assess 3D volumetric presence.
-
Active Liveness Sequences: Guided micro-movements (such as head turns and natural blink rhythms) to verify physical live human presence in accordance with ISO 30107-3 presentation attack detection standards.
Zero Synthetic Retention Guarantee
Biometric vectors are derived mathematically and used strictly for instantaneous 1:1 face matching against the official identity card portrait. Biometric vectors are never converted into surveillance templates or cross-matched across unrelated consumer databases.
03 Ephemeral Biometric Purge Policy
We enforce a strict Zero-Retention Ephemeral Biometric Policy for all dynamic video frames captured during the camera verification workflow:
-
Immediate Purge: Continuous video streams and intermediate rotational frames collected during liveness testing are processed in memory and purged immediately from disk and server caches once the verification score is established.
-
Audit Trail Artifacts: Only the single verified front portrait frame, document scans, and cryptographic audit proofs are preserved for institutional audit and AML/CFT record-keeping mandates.
04 Security & Cryptographic Standards
Our infrastructure incorporates defense-in-depth security principles engineered to protect sensitive citizen data against unauthorized access, exfiltration, or tampering:
-
Transport Security: All web access, user sessions, and media uploads are enforced over TLS 1.3 encryption with HTTP Strict Transport Security (HSTS).
-
Data at Rest: Database records, identity hashes, and document archives are protected with AES-256 standard encryption on dedicated enterprise storage volumes.
-
Role-Based Access Control (RBAC): Administrative console access is restricted to verified compliance personnel with audit logging for every inspection.
05 Non-Disclosure & Third-Party Sharing
KYC Verify maintains an uncompromising zero-monetization policy regarding personal and biometric information:
Strict Prohibition on Data Commercialization
We do not sell, rent, monetize, or trade applicant identity records, biometric templates, or document captures to third-party advertising brokers, behavioral profilers, or unauthorized platforms under any circumstances.
Information is shared only under the following strictly authorized parameters:
-
Originating Enterprise Client: Data and verification verdicts are securely delivered back to the specific financial institution or enterprise where the applicant initiated the verification session.
-
Sovereign & Lawful Requests: When compelled by valid Pakistani judicial orders, the Prevention of Electronic Crimes Act (PECA 2016), or authorized statutory regulatory mandates.
06 Applicant Rights & Data Purge Requests
Citizens and applicants whose verification records are processed through KYC Verify maintain the following rights in accordance with national data privacy standards:
-
Right to Information: The right to know the precise categories of data captured and the algorithmic criteria used in liveness verification.
-
Right to Rectification: The ability to re-attempt verification in the event of document capture glare, camera focus failure, or optical occlusions.
-
Right to Erasure: Upon closure of customer relationships with the sponsoring institution, customers may request data purge subject to regulatory AML/KYC retention statutory periods.
07 Compliance Office & Contact Information
For regulatory inquiries, compliance audits, or data subject requests, please contact our dedicated Data Protection and Compliance Governance office: