Client portal

GDPR compliance

Updated on October 23, 2026

Last updated: 20 October 2026

This page sets out how VerifAge complies with Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”) and with French Act No. 78-17 of 6 January 1978, as amended (the French Data Protection Act, loi Informatique et Libertés). It supplements the Privacy policy.

1. Our approach: data protection by design

VerifAge is based on a simple principle: proving that a person is of legal age without revealing who they are.

  • Minimisation: only the e-mail address, telephone number and date of birth are requested. No surname, no first name.
  • Double anonymity: partners do not know the identity of the User, and VerifAge does not know to which partners the User proves that they are of legal age.
  • Rapid deletion of sensitive data: the video and the identity document are erased as soon as the operator has made a decision, and at the latest within 15 days.
  • Choice of method: the User can always validate their age without biometric processing (methods 2, 3 and 4).

2. Controller and DPO

Controller:

  • SAS INOVA DIGI-TECH – 16 rue de la Côte – Bâtiment D1 – 54000 Nancy
  • RCS Nancy 918 907 809 – SIRET 918 907 809 00027 – contact@verifage.com

Data protection officer:

3. Role of VerifAge in relation to partners

INOVA DIGI-TECH acts as controller for the management of User accounts and the validation of their age.

Partner websites, vending machines and points of sale remain responsible for the processing operations they carry out for their own activities. VerifAge transmits to them only a binary result (of legal age / not verified), without any identity data, and receives from them no information about Users’ purchases.

The number of verifications is counted per website or vending machine, solely for billing purposes, without being associated with the identity or the account of the User.

4. Processing operations carried out

4.1 Management of User accounts

  • Data: e-mail, telephone, date of birth, registration date, validation method, status.
  • Legal basis: performance of the contract (Article 6.1.b of the GDPR).
  • Duration: for as long as the account is active, then deletion after 3 years of inactivity.

4.2 Age verification by video (method 1)

  • Data: video of the face, photograph of the identity document, result of the analysis.
  • Legal basis: explicit consent (Articles 6.1.a and 9.2.a of the GDPR).
  • Duration: deletion as soon as the operator has made a decision, at the latest 15 days after submission.

4.3 Verification at an approved Operator (method 2)

  • Data: validation status and identifier of the Operator who carried out the validation. No copy of the identity document.
  • Legal basis: performance of the contract.
  • Duration: that of the account.

4.4 Verification via France Identité (method 3)

  • Data: “over 18 years of age” attestation only.
  • Legal basis: performance of the contract.
  • Duration: that of the account.

4.5 Validation by pre-registered e-mail or telephone (method 4)

  • Data: e-mail or telephone number entered by the Operator, confirmation code.
  • Legal basis: performance of the contract; the User confirms the validation themselves by means of a code.
  • Duration: code valid for 15 minutes; e-mail or telephone kept for the duration of the account.

4.6 Proof of legal age to partners

  • Data: temporary tokens, codes and QR codes (QR code renewed every 30 seconds). No history is kept.
  • Legal basis: performance of the contract.

4.7 Management of Business customers and billing

  • Data: company, contact, SEPA mandate, invoices, number of verifications per website or vending machine.
  • Legal basis: performance of the contract and legal obligation (Article 6.1.c).
  • Duration: duration of the relationship, then 5 years; accounting records 10 years.

4.8 Security and fraud prevention

  • Data: technical logs, IP address, reports.
  • Legal basis: legitimate interest (Article 6.1.f).
  • Duration: 12 months at most.

4.9 Notifications and application stability

  • Data: device notification identifier, crash reports.
  • Legal basis: performance of the contract and legitimate interest.
  • Duration: that of the account; crash reports 90 days at most.

4.10 Handling of requests and the exercise of rights

  • Data: content of correspondence, supporting documents.
  • Legal basis: legal obligation and legitimate interest.
  • Duration: 3 years from the closure of the request.

5. Biometric data

The video of the face used in method 1 falls within the special categories of data within the meaning of Article 9 of the GDPR. This processing is governed as follows:

  • it is carried out only with the explicit consent of the User, obtained before any recording;
  • it is optional: other validation methods, without biometric processing, are always offered;
  • it serves solely to verify the match between the face and the identity document, as well as the age, for a one-off validation;
  • no biometric template is kept after the decision;
  • the analysis is carried out exclusively within the European Union;
  • the video and the identity document are deleted as soon as the operator has made a decision, and at the latest 15 days after they are sent.

This processing is the subject of a data protection impact assessment (Article 35 of the GDPR), which is kept up to date.

6. Human intervention

No refusal decision is based solely on automated processing. The result of the artificial-intelligence analysis is systematically reviewed by a human Operator, who makes the final decision. In accordance with Article 22 of the GDPR, the User may express their point of view and contest any decision by writing to contact@verifage.com; their request is re-examined by an Operator.

7. Processors

INOVA DIGI-TECH uses only processors providing sufficient guarantees, bound by a contract compliant with Article 28 of the GDPR:

  • Scaleway SAS (France) – data hosting – data hosted in France.
  • Amazon Web Services, Amazon Bedrock (Europe inference profile) – automated analysis of the video and the identity document – processing within the European Union.
  • Brevo (France) – sending of transactional e-mails – European Union.
  • Twilio – sending of confirmation SMS messages – United States.
  • Viva – collection of SEPA direct debits from Business customers – European Union.
  • Google (Firebase) – notifications and crash reports for the Android and iOS application.
  • Apple – notifications for the iOS application.

The up-to-date list of processors may be obtained on request from the DPO.

8. Transfers outside the European Union

Data is hosted in France and biometric data never leaves the European Union.

Only limited processing operations may involve a transfer to the United States: the sending of SMS messages (Twilio: telephone number and code), as well as notifications and crash reports (Google, Apple). These transfers are based on the European Commission’s adequacy decision relating to the EU–US Data Privacy Framework and, failing that, on the standard contractual clauses or approved binding corporate rules.

9. Security

In accordance with Article 32 of the GDPR, INOVA DIGI-TECH implements appropriate technical and organisational measures, in particular:

  • encryption of data in transit (TLS) and of sensitive data at rest;
  • segregation and restriction of access according to the principle of least privilege;
  • strong authentication of Operators and administrators;
  • logging and traceability of access;
  • automatic deletion of videos and identity documents;
  • encrypted backups and business-continuity procedures;
  • confidentiality undertakings by authorised persons.

10. Data breaches

In the event of a personal data breach, INOVA DIGI-TECH documents it, notifies it to the CNIL (Commission nationale de l’informatique et des libertés) within 72 hours where it is likely to result in a risk to individuals, and informs the data subjects as soon as possible where that risk is high.

11. Minors

VerifAge is reserved for persons of legal age. Where a verification reveals that a person is a minor, their registration is refused and their data is deleted.

12. Exercise of rights

Every data subject has the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw their consent at any time, the right not to be subject to a decision based solely on automated processing, and the right to set out instructions regarding the fate of their data after their death.

Requests are to be sent:

  • by e-mail: dpo@verifage.com;
  • by post: DPO – SAS INOVA DIGI-TECH – 16 rue de la Côte – Bâtiment D1 – 54000 Nancy.

A response is provided within one month, which may be extended by two months in the case of a complex request. Proof of identity may be requested where there is reasonable doubt as to the identity of the applicant. The copy of the data is transmitted by means of a secure link valid for 24 hours.

13. Complaints to the CNIL

Any person may lodge a complaint with the Commission nationale de l’informatique et des libertés:

  • CNIL – 3 place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07 – www.cnil.fr

14. Updates

This page is updated whenever the processing operations change significantly. The date of the last update appears at the top of the page.