Last updated: 12 September 2026
This document summarises the obligations OSVOY YAZILIM LİMİTED ŞİRKETİ takes on as a data processor when its Osvoy Verify service is used. It forms an integral part of the service agreement; customers who need a signed copy can request one at [email protected].
1. Parties and roles
- Controller: the organisation using the service (the customer)
- Processor: OSVOY YAZILIM LİMİTED ŞİRKETİ
- Data subject: the end user being verified
Osvoy processes personal data only on the customer's documented instructions and only to the extent necessary to provide the service.
2. Subject matter and duration
Subject matter: identity document verification, biometric face matching, liveness detection and AML screening. Duration: the term of the service agreement.
Categories of data: identity document images and the data on them (name, document number, date of birth, expiry date, nationality), selfie images, biometric templates, liveness results, sanctions/watch list and PEP match records, and transaction metadata (timestamp, IP address, device information).
Categories of data subject: the end users the customer submits for verification.
Biometric data is a special category under GDPR Art. 9 and KVKK Art. 6. Establishing the lawful basis, and providing the required information and explicit consent, rests with the controller.
3. Retention and deletion
The retention period is set by the customer. In Zero Data Retention mode, raw images and biometric templates are permanently deleted the moment verification completes; only the verification result and the audit record are kept.
On termination, data is returned or deleted at the customer's choice. Records that law requires be kept are retained only for the mandatory period and with restricted access.
4. Security measures
- TLS 1.3 in transit, AES-256 at rest
- Role-based access control on a least-privilege basis
- A timestamped audit record for every verification step
- Confidentiality obligations on personnel
- Regular backups and access log review
5. Sub-processors
Delivering the service relies on sub-processors such as hosting, email delivery and sanctions/PEP list providers. Each is bound in writing to obligations equivalent to those in this document. The current list is available on request; additions are notified to the customer in advance and the customer's right to object is reserved.
6. International transfers
Where a transfer is required, the safeguards under GDPR Chapter V and KVKK Art. 9 apply — an adequacy decision or standard contractual clauses.
7. Data subject requests
Requests that reach Osvoy directly are not answered by us; they are forwarded to the relevant controller without delay. We provide the technical assistance the customer needs in order to respond to requests it receives itself.
8. Breach notification
On becoming aware of a personal data breach, the customer is informed without undue delay and in any event within 24 hours. The notification covers the nature of the breach, the categories of data affected, the likely consequences and the measures taken. Notifying the supervisory authority under GDPR and KVKK is the controller's obligation.
9. Audit
The customer may audit compliance with this document once a year, on reasonable notice. Audits are conducted so as not to disrupt operation of the service.