Privacy Policy

seeID (Pty) Ltd ("seeID", "we", "us", or "our") operates the seeID identity verification platform, accessible at seeid.co.za and associated subdomains (the "Platform").

The Platform provides South African businesses and institutions ("Clients" or "Tenants") with tools to verify the identity of their customers and employees by cross-referencing government identity documents and biometric data against authoritative sources — including the Department of Home Affairs (DHA) National Population Register (NPR) and the South African Police Service (SAPS) criminal records database.

In processing personal information on behalf of our Clients, seeID acts as an Operator under POPIA. Our Clients act as the Responsible Party in relation to the individuals whose information they submit for verification (the "Data Subjects"). seeID is additionally the Responsible Party for personal information it collects directly from the users who register and manage accounts on the Platform.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you are a Client, your acceptance of our Terms of Service constitutes agreement to process personal information only in accordance with this Policy and POPIA.

We collect personal information in two distinct capacities:

2.1 Platform Account Information Responsible Party

When a business registers for and uses the Platform, we collect the following information from the authorised representative and workspace users:

• Full name, work email address, and password credentials
• Organisation name, type, industry, and registered business details
• Billing contact information and payment method details (processed via our payment provider; seeID does not store full card numbers)
• API keys and integration credentials generated for programmatic access
• Usage activity logs, login timestamps, IP addresses, and browser/device identifiers for audit and security purposes

2.2 Verification Subject Data Operator

When a Client submits a verification request, the Platform processes personal information about the individual being verified. This may include:

• South African ID number (13-digit national identity number)
• Full name, date of birth, gender, and nationality as recorded on the NPR
• Facial biometric data — live photographs or short video sequences submitted for liveness detection and facial comparison
• Identity document images (South African green ID book, Smart ID card, or passport) submitted for document integrity checks
• SAPS criminal clearance data, where the Client's subscription tier includes this service and where the Data Subject has provided express consent
• The outcome of each verification check (verified, failed, or flagged), together with confidence scores and reasons

2.3 Automatically Collected Technical Data

When you use the Platform we automatically collect:

• IP address and approximate geolocation derived from it
• Browser type, version, and operating system
• Pages visited, features used, and interaction timestamps (clickstream data)
• Performance and error telemetry to support system reliability

We use the personal information we collect for the following purposes, each supported by a lawful basis under POPIA section 11:

seeID does not use verification subject data for any purpose other than performing the specific check instructed by the Client. We do not build profiles on Data Subjects, sell their information, or use it for direct marketing.

seeID shares personal information only to the extent necessary to deliver the Platform's services. We do not sell personal information. Categories of recipients include:

• Government data sources — The Department of Home Affairs (DHA) NPR interface and the South African Police Service (SAPS) — for the sole purpose of executing the verification request. These entities are separate Responsible Parties governed by their own legislative frameworks.
• Payment processors — Our payment provider processes billing transactions. Card and payment data is handled exclusively by the processor under PCI-DSS requirements; seeID receives only tokenised payment references.
• Cloud infrastructure providers — Servers, databases, and storage operated on our behalf by cloud providers under written data processing agreements that impose POPIA-equivalent obligations. All primary data processing occurs within South Africa where practicable.
• Email and communication services — For transactional notifications such as email verification, password resets, and billing alerts.
• Legal and regulatory authorities — Where we are under a legal duty to disclose, or where disclosure is necessary to protect the rights, property, or safety of seeID, our Clients, or the public.

Any sub-operator engaged by seeID is contractually bound to process personal information only on documented instructions, to maintain appropriate security measures, and to assist seeID in meeting its POPIA obligations.

Cross-Border Transfers

Where personal information is processed outside the Republic of South Africa, seeID ensures that the recipient country or organisation affords an adequate level of protection equivalent to POPIA, in compliance with section 72 of POPIA. We maintain records of all cross-border data flows and will inform you of any material change.

We retain personal information only for as long as necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are:

At the end of the applicable retention period, personal information is securely deleted or irreversibly anonymised using industry-standard methods. Clients may request earlier deletion of their verification data subject to applicable legal hold obligations.

POPIA grants Data Subjects the following rights. These rights apply to personal information for which seeID is the Responsible Party. Where seeID is processing data as an Operator on behalf of a Client, Data Subjects should direct their requests to the Client who submitted the data.

To exercise any right where seeID is the Responsible Party, submit a written request to our Information Officer at privacy@seeid.co.za. We will respond within 30 days as required by POPIA and may request proof of identity before actioning your request.

seeID implements appropriate technical and organisational measures to protect personal information against loss, damage, unauthorised access, disclosure, or destruction. Our security programme includes:

• Encryption of all personal data in transit using TLS 1.2 or higher, and at rest using AES-256 encryption
• Role-based access controls (RBAC) ensuring users can only access data within their authorised tenant workspace
• Multi-factor authentication (MFA) available to all accounts and mandatory for administrative access
• Continuous security monitoring, intrusion detection, and automated alerting for anomalous activity
• Regular penetration testing and vulnerability assessments by independent security professionals
• Background checks for employees and contractors with access to personal information
• A documented incident response plan with notification procedures in accordance with POPIA section 22

In the event of a security compromise involving personal information, seeID will notify the Information Regulator and affected parties in accordance with POPIA section 22 as soon as reasonably possible — and no later than 72 hours after becoming aware of the breach.

While we take all reasonable steps to safeguard your information, no transmission over the internet is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately of any suspected unauthorised use.

The Platform uses cookies and similar browser storage technologies. We use only the following categories:

seeID does not use advertising or tracking cookies. You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to the Platform.

The Platform may process special personal information as defined in POPIA section 26, including biometric data (facial images) and, in some verification flows, information about criminal behaviour obtained via SAPS. Such processing occurs only where:

• The Data Subject has given explicit, specific, and informed consent; or
• Processing is necessary for a legitimate purpose such as employment screening or financial services compliance, and is authorised under applicable sector legislation; or
• A specific exemption under POPIA applies.

The Platform is designed for South African businesses and is not directed at children under 18 years of age. seeID does not knowingly collect personal information from children for account registration purposes. Where a verification check is lawfully required on a minor (e.g. for certain compliance use cases), the Client must ensure that appropriate parental or guardian consent is in place in accordance with POPIA section 35.

seeID has appointed an Information Officer as required under POPIA. For any questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern, please contact us: