Identity Verification Consent

When you provide consent for identity verification, the following occurs:

• Your identity document details (such as driver licence, passport, or Medicare card) are submitted as an information match request
• The request is transmitted to the relevant official record holder who maintains the official records for that document type
• The official record holder checks whether the information you provided matches their records
• A verification result (match or no match) is returned to the business requesting the verification
• The verification request and result may be processed through third-party service providers (see below)

VeroID uses the following categories of third-party service providers to deliver identity verification services:

• Cloud Infrastructure Provider

  Hosts our systems using hosted Australian data

• Official Record Holders

  Document issuers and official record holders that maintain identity records (passport office, road authorities, births/deaths/marriages registries, Medicare, immigration)

• Payment Processor

  Revolut - Processes payments for our business customers (does not handle identity verification data)

• Cellcast

  Delivers SMS messages for hosted verification links (mobile number and message text). Data held in Australia.

All third-party service providers are bound by contractual obligations to protect your information and use it only for the purpose of providing identity verification services.

The information collected is used only for the purpose of verifying your identity. It will NOT be used for:

• Creating a data profile about you or tracking your behaviour (online or otherwise)
• Offering you goods or services
• Advertising or promoting goods or services to you
• Enabling any other person or entity to offer, advertise, or promote goods or services
• Market research of any kind
• Any purpose other than verifying your identity

VeroID and its business customers have the following legal obligations in relation to the collection of your identification information:

• Compliance with the Privacy Act 1988 (Cth) and Australian Privacy Principles
• Obtaining your express consent before submitting any verification request
• Using your information only for the stated purpose of identity verification
• Not retaining identification information beyond what is strictly necessary
• Maintaining appropriate security measures to protect your information
• Notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals in the event of an eligible data breach
• Keeping transaction records for a minimum of 7 years as required by applicable conditions

Under Australian privacy law, you have the following rights in relation to the collection of your identification information:

• The right to access personal information held about you
• The right to request correction of inaccurate information
• The right to make a complaint about the handling of your information
• The right to withdraw consent (though this may affect your ability to access certain services)
• The right to remain anonymous or use a pseudonym when dealing with organisations (where lawful and practicable)

Note: If your identity was verified through a business using VeroID, please contact that business directly regarding your personal information, as they are the primary holder of your data and responsible for managing your privacy rights.

If you decline to provide consent for identity verification:

• The business requesting verification will not be able to verify your identity through this service
• You may be unable to access products, services, or benefits that require identity verification
• The business may offer alternative methods of identity verification (where available)
• You will not be disadvantaged in any other way beyond the inability to complete the verification

If you have concerns about the collection, use, or disclosure of your identification information, you can make a complaint:

• All data is encrypted in transit using TLS 1.2 or higher
• Data at rest is encrypted using industry-standard encryption
• All systems and data are hosted within Australia
• Strict access controls limit who can access verification data
• Comprehensive audit logging tracks all system access
• Identity documents and document numbers are not stored by VeroID beyond what is necessary to complete the verification
• Information is permanently removed or de-identified once the verification purpose is fulfilled