Last updated: 8 November 2026

1. About This Policy

This Privacy Policy explains how One Shot Ventures Pty Ltd (ABN 50 690 149 609), trading as VeroID (“we”, “us”, “our”), collects, uses, discloses, and protects personal information.

VeroID is an Australian company subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We are committed to protecting the privacy of all individuals whose information we handle.

2. Our Service and Privacy Roles

VeroID provides business-to-business (B2B) identity verification services that enable our business customers to verify Australian identity documents by checking details with the document issuer or official record holder.

We do not provide consumer-facing identity verification services directly to individuals.

Privacy Roles: VeroID acts as a service provider to its business customers in relation to identity verification data. Our business customers are the primary holders of that personal information and are responsible for managing privacy rights, consent, and compliance in relation to their use of verification services. VeroID processes identity verification data only in accordance with our customers' instructions and applicable legal and regulatory requirements.

3. Information We Collect

3.1 Business Customer Information

When you sign up as a VeroID customer, we collect:

Business name and ABN
Contact details (name, email, phone)
Billing information and payment history (processed by Revolut), including subscription status, invoices, and credit purchases
Account credentials

3.2 Identity Verification Data

When our business customers submit identity verification requests through our application programming interface (API), a secure technical connection that allows their systems to send verification requests to us, we process:

Identity document details (e.g., document type, document number and other details printed on the document)
Personal details for matching (e.g., name, date of birth)
Images of identity documents captured in a hosted verification session
A live selfie, used for face matching and liveness checks. This is biometric information, which is sensitive information under the Privacy Act, and is only collected with the individual's consent
Screening details (name, and optionally date of birth, nationality and address) for sanctions, politically exposed persons (PEP) and adverse media checks
Verification and screening results (e.g., match or no match, face match and liveness scores, scored screening matches)

Important: This data is collected and processed on behalf of our business customers. The individual whose identity is being verified must have provided their express consent to our business customer before any verification request is submitted.

VeroID does not use identity verification data for profiling, marketing, or unrelated secondary purposes. Identity information is processed strictly for the purpose of providing verification services.

What we do not store: We do not retain the personal details used in a verification check (such as name, date of birth, or document number) in our systems. Those details are transmitted to the official record holder solely to perform the check and are not stored in our database. We keep only verification metadata (for example, document type, match result, and timestamps) as required for audit and compliance purposes.

3.3 Transaction Records

We maintain records of:

Verification transaction IDs
Timestamps
Document types verified
Verification outcomes (pass/fail)
Business customer identifiers
Credit purchases, subscription renewals, and credit usage

3.4 How We Collect Information

We collect personal information in the following ways:

directly from our business customers when they create accounts, communicate with us, or use our services;
via requests submitted through our application programming interface (API) when business customers initiate identity verification requests; and
automatically through system logs, audit records, and security monitoring tools when our services are accessed or used.

4. How We Use Information

We use personal information to:

Process identity verification requests by checking details with the document issuer or official record holder
Provide verification results to our business customers
Manage customer accounts and billing
Provide customer support
Comply with legal obligations and regulatory requirements
Maintain security and prevent fraud
Improve our services

Automated decision-making: VeroID uses computer programs to produce verification and screening results. Our business customers use these results when making decisions about individuals. See “Automated Decision-Making” below.

Automated Decision-Making

VeroID uses computer programs to produce identity verification and screening results for our business customers. Our business customers use these results, sometimes automatically and sometimes with human review, when deciding things such as whether to open an account, approve an application or onboard a person. Those decisions are made by the business customer, not VeroID. If a decision has affected you, please contact the business that made it.

Kinds of personal information our programs use

Identity information: name, date of birth, document type, document number and other details printed on the identity document
Images of identity documents captured in a hosted verification session
Biometric information: a live selfie, used to compare with the document photo (face matching) and to confirm a real person is present (liveness). Biometric information is sensitive information and is only used with your consent
Screening information: name, and optionally date of birth, nationality and address

What our programs do that relates to decisions

Return a match or no match result after details are checked with the document issuer or official record holder
Produce a face match score and a liveness score from 0 to 100. VeroID does not pass or fail these scores, and a low score does not end a verification session. Our business customers set their own minimum scores
Flag possible concerns with a document photo or the details entered. These flags do not stop the verification
Check names against sanctions, politically exposed persons (PEP) and, where requested, adverse media sources, covering more than 1.8 million records from 454 published lists, and return scored possible matches. Possible matches that score below 85 are automatically marked as cleared
Re-screen names on an ongoing basis, where the business customer enables monitoring

Decisions about our business customers

VeroID does not use automated decision-making for decisions about our business customers, such as account approval or fraud flags. These decisions are made by our staff.

Asking about or seeking review of a result

If you want to know more about how our programs were used in a check about you, or you believe a result is wrong, contact privacy@veroid.com.au. We will explain how the check was carried out and work with the business that requested it to review the result. We do not disclose commercially sensitive information, such as how our matching is configured.

5. Data Minimisation

We follow strict data minimisation practices:

Short-lived images and biometric data: Document images, selfies and biometric data captured in hosted verification sessions are deleted within 24 hours. We do not keep copies of identity documents
No unnecessary retention: Identity verification data is not retained beyond what is strictly necessary to complete the verification and provide results
Minimal result storage: We store only transaction metadata (IDs, timestamps, outcomes) required for audit and compliance purposes
No secondary use: Verification data is used only for the purpose of providing the verification service

6. Consent Requirements

Before any identity verification request is processed, the individual whose identity is being verified must have provided their prior express consent for:

The collection and use of their personal information for identity verification
The disclosure of their information to VeroID and official record holders
The processing of their information to provide verification results
Where face matching or liveness is used, the collection and use of their biometric information (a live selfie) for those checks

Our business customers are contractually required to obtain this consent before submitting any verification requests.

Express Consent Statement: A sample consent statement that meets legislative requirements is: “I confirm that I am authorised to provide the personal details presented and I consent to my information being checked with the document issuer or official record holder via third-party systems for the purpose of confirming my identity.”

7. Disclosure of Information

We may disclose personal information to:

Official Record Holders: Identity verification data is transmitted to official record holders (e.g., passport office, road authorities, births/deaths/marriages registries) to process verification requests
Our business customers: Verification results are provided to the business customer who submitted the request
Service providers: We use Revolut for payment processing and cloud infrastructure providers with hosted Australian data
As required by law: We may disclose information if required by law, court order, or government authority

We do not sell personal information or share it for marketing purposes.

8. Overseas Disclosure

VeroID does not disclose personal information outside Australia. All systems and data used to provide the VeroID services are hosted and maintained within Australia.

9. Data Security

We implement robust security measures including:

Encryption in transit (TLS 1.2+) for all data transmission
Encryption at rest for stored data
Secure cloud infrastructure with hosted Australian data
Access controls and authentication for all systems
Comprehensive audit logging
Regular security assessments
Incident response procedures

All systems and data are maintained within Australia.

10. Notifiable Data Breaches

In the event of a data breach that is likely to result in serious harm to individuals, VeroID will take reasonable steps to contain and assess the breach and will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required under the Notifiable Data Breaches scheme.

11. Data Retention

We retain information as follows:

Transaction records: Kept for at least 7 years as required by applicable conditions, then deleted
Business customer information: Duration of the business relationship plus 7 years, then deleted where no longer required
Identity verification data: Not retained beyond what is necessary to complete the verification
Document images, selfies and biometric data: Deleted within 24 hours

12. Your Rights

Under the Privacy Act 1988 and Australian Privacy Principles, you have the right to:

Access personal information we hold about you
Request correction of inaccurate information
Make a complaint about our handling of your information

Note for individuals: If your identity was verified through VeroID by a business you interact with, please contact that business directly regarding your personal information. They are the primary holder of your information and responsible for managing your privacy rights in relation to their use of verification services.

13. Website Analytics and Cookies

Our website may use cookies and similar technologies to collect basic usage information such as IP address, browser type, and pages visited. This information is used to operate, maintain, and improve our website. You can disable cookies through your browser settings, however some website features may not function correctly.

14. Third-Party Service Providers

VeroID uses the following categories of third-party service providers to deliver identity verification services:

Cloud infrastructure provider: Hosts our systems and processes verification requests using hosted Australian data.
Official Record Holders: Document issuers and official record holders that maintain identity records, including passport office, road authorities, births/deaths/marriages registries, Medicare, and immigration authorities.
Payment Processor (Revolut): Processes subscription payments, credit pack purchases, and developer onboarding fees for business customers. Revolut does not have access to identity verification data.
Face matching and liveness provider: Processes selfies and document images for face matching and liveness checks using hosted Australian data, and is bound by the same contractual obligations
Cellcast: Delivers SMS messages for hosted verification links. Receives the person's mobile number and the SMS text. Data is held in Australia.

All third-party service providers involved in identity verification are bound by contractual obligations to protect personal information and use it only for the purpose of providing verification services.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to business customers via email. The current version will always be available on our website.

16. Privacy Contact

Our Privacy Contact is responsible for overseeing compliance with this Privacy Policy and the Privacy Act 1988 (Cth).

For privacy-related questions, access requests, or complaints, contact us at:

Email: privacy@veroid.com.au

One Shot Ventures Pty Ltd trading as VeroID
ABN: 50 690 149 609

17. Privacy Complaints

Privacy complaints may be made by contacting us using the details above. We will acknowledge receipt of a complaint within 5 business days and aim to resolve the complaint within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au
Phone: 1300 363 992