Privacy Notice

General

1. We, Affinidi Pte. Ltd together with our affiliates (collectively “Affinidi”) inform you about the processing of personal data for which we are responsible under the European Union (EU) 2016/679 General Data Protection Regulation (“GDPR”), Singapore Data Protection Act of 2012 and other applicable data protection laws of relevant jurisdictions.

2. This Privacy Notice (“Privacy Notice”) describes how we collect, use, disclose, and process your personal data when you access or use our websites (which include affinidi.com, docs.affinidi.com, portal.affinidi.com, apikey.affinidi.com, and events.affinidi.com (collectively, “Websites”)), as well as our products and services (which include the Affinidi Vault (Beta), Affinidi Login, Affinidi Desktop App, Reference App, Affinidi Portal, Affinidi Identity Verification, Affinidi Messaging, Affinidi CLI and any other products, tools or services offered by Affinidi, including any closed beta/open beta period (if applicable) of such products/services (collectively, our “Services”).

3. For clarity, in this Privacy Notice, the terms “we”, “us” and “our” refer to Affinidi while the terms “You”, “your” and “yours” refer to users of our Websites and Services (collectively referred to as “Data Subjects”).

4. Unless otherwise defined in this Privacy Notice, all capitalised terms shall have the meaning given under our “Terms and Conditions” linked here.

5. Data Protection Officer Contact: You can reach our data protection officer by sending an email to dataprotection@affinidi.com. We will respond to your inquiry within 30 days of receipt.

6. EU Representative: Affinidi’s data protection representative in the EU is Affinidi GmbH, Pariser Platz 6a, 10117 Berlin, Germany.

7. Exercising Your Rights: You can exercise your privacy and data protection rights by contacting dataprotection@affinidi.com. Please note that we cannot respond to your request if we cannot verify your identity and/or your authority to make the request. We may require additional information solely for the purpose of verifying your identity and/or authority to make the request. We will not use such additional information for any other purpose.

8. The following sections provide an overview of our typical data processing activities, grouped by categories of Data Subjects and processing purposes. For processing activities that relate only to specific events, or specific purposes, we will provide information separately where required.

9. In this Privacy Notice, the terms “data”, “personal data” and “personal information” are used interchangeably and refer to any information relating to an identified or identifiable natural person (as defined under applicable data protection laws).

10. We process personal information in relation to the following categories of individuals, as detailed in the sections below:

    1. Visitors of Websites
    2. Developers as Users of Services
    3. Consumers as Users of Services
    4. Service Providers, Business Partners and their Employees
    5. Business Contacts and Communication Partners
    6. Newsletter Recipients
    7. Participants in Surveys
    8. Users and Participants of Limited-Use Applications and Events
    9. Individuals whose personal information is processed through Infrastructure-Level Services
    10. Individuals interacting with, or whose personal data is processed through, AI agents or Third-Party Agents

1. Visitors of Websites

1.1. Web Server Log Data

a) Each time a visitor accesses our Websites, our web server processes data which the visitor’s browser automatically transmits.

b) We process the following personal data for the purposes of delivering the contents of the Websites you have accessed, ensuring the security of the IT infrastructure and correcting errors:

• IP address allocated to your device
• Date and time of the request, including time zone
• Specific page or file accessed
• HTTP status code and the data volume transmitted
• Website from which their request originated
• Browser type and version
• Operating system of your device
• Language settings

c) We process this data for delivering the contents of the Websites you have accessed, ensuring the security of the IT infrastructure, correcting errors and analysing website performance and usage patterns.

d) The legal basis for the processing web server log data (where GDPR applies) is our legitimate interest (Article 6 (1) (f) GDPR), specifically the operation of the Websites, ensuring IT security and facilitating user interaction.

e) We collect this data directly from your browser activity when you visit our Websites.

f) We retain web server log data for a maximum of six (6) months, after which it is deleted. This retention period is necessary to ensure website security, troubleshoot technical issues, and analyse usage patterns.

g) The recipient of the data is Amazon Web Services EMEA SARL (“AWS”), 38 Avenue John F. Kennedy, L-1855 Luxembourg (uses service providers in the USA), which we use as a processor within the framework of a data processing agreement. We have concluded the EU Standard Contractual Clauses (2021/914; Module 3) with AWS. Amazon Web Services, Inc. is certified in accordance with the EU-US Data Privacy Framework (Article 45 GDPR where the GDPR is applicable). You can request a copy of the main contractual provisions of the EU Standard Contractual Clauses at any time.

h) Use of the Websites requires processing of web server log data and cannot function otherwise.

1.2. Cookies and Similar Technologies

a) We use cookies and similar technologies on our Websites. Detailed information about the specific cookies we use, their purposes, legal basis, retention periods, and how to manage your cookie preferences can be found in our Cookie Policy.

b) This Privacy Notice should be read in conjunction with our Cookie Policy, which provides comprehensive information about our use of cookies and similar tracking technologies.

c) You can manage your cookie preferences at any time through our Cookie Setting Panel available on our Website or by following the instructions in our Cookie Policy.

2. Developers as Users of Services

2.1. Affinidi is not responsible for the data protection compliance of Developer’s own services or data processing activities. The Developer acts as a separate controller for their own data processing and therefore the Developer’s own privacy policy governs such processing.

2.2. Data of Developers is processed by Affinidi for the following purposes: (i) preparation and performance of our contractual relationship, (ii) fulfilment of legal requirements (including tax and commercial law obligations), (iii) product usage analytics to support product improvement, (iv) providing technical support, (v) fraud prevention and security monitoring, (vi) compliance with regulatory requirements.

2.3. The processed data includes:

• Registration data: Login credentials (which may include email address), passphrase, and contract conclusion details
• Billing data: payment card information, name, billing address, contact information, tax identification number
• Decentralized ID (“DiD”): unique identifier assigned to the Developer
• Authentication Tokens: tokens to identify access requests from the Developers
• Project Data: Information relating to projects of the Developer projects
• Usage Data and Monthly Active Users
• HTTP data: protocol data generated when accessing our Services via HTTP(S), including IP address, type and version of browser, operating system, the page visited, the page previously visited (referrer URL), date and time of the visits
• Communication Data and questions regarding support requests
• Data from Affinidi Vault’s (Beta) cloud services, including data collected via Cloud Backup or Cloud Profile (where applicable)

2.4. The legal basis for the processing is (i) contractual necessity (Article 6 (1) (b) GDPR where applicable), where processing is necessary for the performance of our contract with you and (ii) legal obligations (Article 6 (1) (c) GDPR where applicable) where processing is necessary for in particular tax and commercial law provisions. The legal basis for the processing of technically required cookies in the Services is our legitimate interest in providing the technical functions of the relevant Services (Article 6 (1) (f) GDPR where applicable).

2.5. The data is either provided directly by the Developers or collected automatically through use of our Services.

2.6. The data is deleted in accordance with our retention policy and applicable legal requirements (e.g. commercial and tax law retention periods). In principle, Developer data is deleted no later than ten (10) years after the respective processing activity.

2.7. Except back-up data, developer data described in section 2.3 above may be shared with other Affinidi group companies for the purposes outlined above. All Affinidi companies have entered into EU Standard Contractual Clauses and maintain internal privacy and data collection policies.

2.8. In specific cases data may be transmitted to service providers, legal advisors, courts, or regulatory authorities as required by law or for the protection of our legitimate interests.

2.9. We also engage the following processors to perform Services on our behalf, in particular to provide, maintain and support IT systems: AWS for cloud infrastructure and hosting service, HubSpot, Inc. (“HubSpot”), Two Canal Park, Cambridge, MA 02141, USA for customer relationship management and marketing automation. We have concluded the EU Standard Contractual Clauses (2021/914; Module 3) with AWS and HubSpot. In addition, Amazon Web Services, Inc. and HubSpot are certified under the EU-US Data Privacy Framework (Article 45 GDPR where applicable). You can request a copy of the main contractual provisions of the EU Standard Contractual Clauses at any time.

2.10. Processing of Developer data is necessary to perform our contract with you. If the required data is not provided, the contract cannot be established or performed. Data that is not necessary for the performance of the contract will be labelled accordingly.

2.11. We do not engage in automated decision making, including profiling, that produces legal effects or similarly significantly affects Developers.

3. Consumers as Users of Services

3.1. Affinidi is not responsible for the data protection compliance of Developer’s services and data processing activities. The Developer acts as a separate controller for their data processing, and the privacy policy of the Developer applies to such processing.

3.2. For the use of Affinidi Vault (Beta)

3.2.1. While setting up your Vault, you have the option to either store data locally on your device or to create a Cloud Profile to store your data on the cloud.

3.2.2. If you opt to store your data locally on your edge device, Affinidi does not process or access this data. All data remains stored locally on your device under your control.

3.2.3. When you choose to create a Cloud Profile and consent to store your data on the cloud, Affinidi will store your data on your behalf with your explicit consent, until you decide to delete your Cloud Profile. Your data is encrypted, and only you can access the contents of your encrypted data. You retain full control over who can access and share your data.

3.2.4. When you log in to Affinidi Vault (Beta) using biometric data, Affinidi has no access to your biometric data. The biometric data used for authentication (fingerprints, facial recognition) is securely stored within your device (e.g., Apple’s Secure Enclave). Affinidi does not store or process biometric data on your device or in the cloud. The privacy policy of your device provider (e.g., Apple) governs how this biometric data is handled.

3.2.5. Separately, you may also opt to create a Cloud Backup, which stores data from both your edge device and Cloud Profile on Affinidi’s servers. Cloud Backup is designed for recovery purposes. By opting for Affinidi cloud service, you acknowledge that:

• Server-Side Storage: Your data will be securely stored and processed on Affinidi’s cloud infrastructure. It will not be stored on your personal devices unless explicitly chosen by you.
• Access and Control: You retain full control over who can access and share your data. Sharing preferences can be managed at any time through your Vault.
• Encryption: All data stored in the Cloud Backup is encrypted both in transit and at rest. The private key remains with you, ensuring that Affinidi has no access to your files.
• Data Retention: Data will be retained only as long as necessary to provide the service or comply with applicable laws. You can request deletion at any time, subject to our data retention policy.
• Deletion of Cloud Backup: Cloud Backup can only be deleted by submitting a formal request via our Data Deletion Request Form. For processing deletion requests, we require your email address, Vault Backup ID, first name and last name to accurately identify and delete the correct data. Alternatively, you can follow the instructions provided in the email containing your Backup ID.

3.3. For the use of Affinidi Identity Verification (IDV)

3.3.1. Our IDV service is provided in partnership with Veriff OÜ (“Veriff”), 12932944, Niine 11, Tallinn 10414, Estonia, a third-party sub-processor, to verify your identity. This service enables us to create Verifiable Credentials (VCs) based on the verification results.

3.3.2. Role of Veriff as Sub-Processor: We have entered into a data processing agreement with Veriff as our processor/sub-processor. Veriff processes your data solely for the purpose of performing identity verification services on our behalf and on behalf of the Developer. The terms and conditions of Veriff apply to the Users when you use their platform.

3.3.3. In the IDV service, Affinidi acts as a data processor and uses the verification results to create and share VCs with you.

3.3.4. Personal data of Consumers are processed for the purposes of (i) preparation and performance of the contractual relationship, (ii) fulfilment of legal requirements, (iii) product usage analytics for product improvement, (iv) providing technical support, (v) credential issuance (for IDV services), and (vi) fraud prevention and security monitoring.

3.3.5. The following data is processed by Affinidi and/or its Third Party partners:

• Contract data: Login credentials (can include email), passphrase, contract conclusion data
• Decentralized ID (“DiD”): unique identifier assigned to the Consumer
• Authentication Tokens: tokens to identify the access requests of the Consumer
• Usage Data
• HTTP data: protocol data generated when accessing our Services via HTTP(S), including IP address, type and version of browser, operating system, the page visited, the page previously visited (referrer URL), date and time of the visit. HTTP(S) data also accumulates on the servers of service providers (e.g. when requesting third-party content)
• Communication data and questions regarding support requests

3.3.6. Backup Data: data from Affinidi Vault (Beta) account, in case you have opted for the cloud back-up option which includes back up of your edge profile data, VCs received, etc (stored in encrypted form, inaccessible to Affinidi).

3.3.7. When using the cloud profile, if the User opts to extract the data from any of the files into a profile, Affinidi uses AWS’s Textract service to extract the data and all such data will be stored with Affinidi for processing purposes and until the extracted data is stored with the User.

3.3.8. All the data stored on your Cloud Profile including the profile data if you have selected to store the data on cloud.

3.3.9. If the User has opted for Affinidi IDV, the following data will be processed either by Affinidi or its sub-processors/processors appointed by Affinidi:

• Personal identification data (e.g., name, date of birth, and ID document details)
• Biometric data (e.g., facial recognition for verifying the identity of the User with the document shared)
• Images or videos of your ID document and/or your face for verification purposes (e.g. Image of your passport, driver’s license, etc.)
• Data extracted from the documents for creation of identity VC

3.3.10. The legal basis for processing is (i) contractual necessity (Article 6 (1) (b) GDPR where applicable) where processing is necessary for contract performance (ii) compliance with legal obligations (Article 6(1)(c) GDPR where applicable), where in particular tax and commercial law provisions, (iii) consent (Article 6(1)(a) GDPR where applicable), where processing of your data for IDV purposes.

3.3.11. The data is either provided directly by the Consumers or collected automatically through service usage.

3.3.12. Data Retention Periods: (i) The data is deleted in accordance with legal requirements, e.g. retention periods under commercial and tax law. This means that the data will be deleted no later than ten (10) years after the respective processing activity or (ii) in case of Cloud Backup when the User terminates his contract with us or instructs us to delete the backup. (iii) Data relating to the liveness check will be deleted immediately after having finished the liveness check. (iv) The VC created for identity will be deleted immediately after it has been transferred to the User’s Vault. Affinidi does not retain any copy of the VC issued to Users.

3.4. Consumer data may be shared with other Affinidi group companies for the purposes outlined above. All Affinidi companies have entered into EU Standard Contractual Clauses and set up internal privacy and data collection policies.

3.5. In specific cases data may be transmitted to a collection of service providers, legal advisors and courts.

3.6. We may also enter into service agreements with other businesses to perform services on our behalf, in particular to provide, maintain and support IT systems. We have entered into a data processing agreements with AWS, HubSpot, and Veriff, which we use as processors/sub-processors.

3.7. We have concluded the EU Standard Contractual Clauses (2021/914; Module 3) with AWS, HubSpot and Standard Contractual Clauses (2021/914; Module 1 and 4) with Veriff. Amazon Web Services, Inc. and HubSpot, Inc. are certified in accordance with the EU-US Data Privacy Framework (Article 45 GDPR where the GDPR is applicable). You can request a copy of the main contractual contents of the EU Standard Contractual Clauses at any time. In addition, when your personal data is processed by a sub-processor, their privacy policy may also apply. We encourage you to review their privacy policy to understand how they handle your data.

3.8. For your convenience, the privacy policies of our key sub-processors can be accessed at the following links:

3.9. Please note that by entering into relevant data processing agreements with our processors/sub-processors, we aim to ensure our sub-processors maintain appropriate data protection standards.

3.10. Processing of Consumer data is necessary in order to perform our contract with you. If required data is not provided, the contract cannot be established or performed.

3.11. We do not engage in automated decision making, including profiling, that produces legal effects or similarly significantly affects Consumers.

4. Service Providers, Business Partners and their Employees

4.1. Affinidi may process personal data regarding service providers, business partners and their employees to establish and maintain business relationships.

4.2. We process personal data of service providers, business partners and their employees, including name, title, postal address, email address, telephone number, employment details, employment history and any other details that they later choose to share in line with the necessities of the business relationship.

4.3. Personal data is collected from the applicable service provider, business partner, or their employees, or from publicly accessible sources like websites and business directories.

4.4. We process personal data about service providers, business partners and their employees for the purpose of preparation and performance of the contractual relationship and for the fulfilment of our legal requirements. the legal basis for such processing are (i) contractual necessity (Article 6(1)(b) GDPR where applicable) where we enter into or perform contracts and (ii) Legitimate Interest (Article 6(1)(b) GDPR where applicable), in particular for communication with contractually relevant contract persons, and (iii) legal obligations (Article 6(1)(f) GDPR where applicable), for compliance with statutory requirements, such as tax and commercial law.

4.5. The personal data is deleted in accordance with legal requirements, e.g. retention periods under commercial and tax law. This means that the data will be deleted no later than ten (10) years after the respective processing activity, unless longer retention is required by law.

4.6. Recipients of data about service providers, business partners and their employees may include banks for the processing of payments. Public authorities and offices may receive data within the scope of their duties, insofar as we are obligated or entitled to transmit data. Moreover, in specific cases data may be transmitted to a collection of service providers, legal advisors and courts. We may also enter into service agreements with other businesses to perform services on our behalf, in particular to provide, maintain and support IT systems.

4.7. Processing of the contact data from service providers and business partners and their employees is necessary to perform the contracts or orders. If the data is not provided, the contract cannot be established or performed and communication is not possible without the data.

5. Business Contacts and Communication Partners

5.1. Affinidi may process personal data regarding business contacts and communication partners to facilitate business communications and relationship development.

5.2. We process personal data including name, postal address, email address, telephone number, employment details, title or any other details shared in line with the business communications.

5.3. We process data for communication with actual and prospective business contacts and communication partners, including business development activities and professional networking.

5.4. The legal basis for processing is legitimate interest, specifically communication with prospective business contacts and communication partners (Article 6 (1) (f) GDPR where applicable).

5.5. We obtain personal data from our business contacts and communication partners directly, from our clients or their agents, and from third-parties that interact with us in connection with our services.

5.6. The data is retained in accordance with our policies and legal requirements. In principle data will be deleted no later than ten (10) years after the respective processing activity, unless longer retention period is required by law or legitimate business purposes.

5.7. We may engage service providers to perform services on our behalf, in particular to provide, maintain and support IT systems.

5.8. The provision of data is required for prospective business partners and communication partners. The communication is not possible without the data.

6. Meetings, Calls and Virtual Collaboration Tools (Video Recording and AI-Assisted Note-Taking)

6.1. Affinidi may host or participate in meetings, calls or virtual collaboration sessions (including via Microsoft Teams or similar platforms) with business contacts, partners, customers, suppliers and other communication partners.

6.2. In this context, we may process personal data relating to such participants, including: (i) audio and video recordings of meetings (including participants’ voices and images), (ii) transcripts or written summaries of meetings, (iii) meeting metadata (such as date, time, participant names and roles), (iv) chat messages or shared content generated during the meeting.

6.3. Personal data is processed for the purpose of: (i) documenting discussions, decisions and action items, (ii) internal follow-up, coordination and recordkeeping, and (iii) improving meeting efficiency and collaboration.

6.4. Video Recording: Where meetings are recorded using collaboration platforms such as Microsoft Teams, participants are informed at the start of the recording through verbal notifications or indicators provided by the platform. Participants may choose to disable their camera or object to recording, where feasible.

6.5. AI-assisted note-taking: In some meetings, Affinidi may use AI-powered tools (such as AI note-taking or transcription services) to generate meeting notes, summaries or action points. Where such tools are used, participants are informed in advance (e.g. via meeting invitations) and/or at the start of the meeting, and may object to the use of such tools. AI-generated outputs are used solely for the purposes described above and are subject to access controls and retention limitations.

6.6. The legal basis for processing personal data in this context is: (i) our legitimate interests (Article 6(1)(f) GDPR, where applicable) in conducting and documenting business communications, and/or (ii) consent (Article 6(1)(a) GDPR, where applicable), particularly for external participants or where AI-assisted note-taking is used, in accordance with applicable data protection laws.

6.7. Recordings, transcripts and AI-generated summaries are accessible only to authorized Affinidi personnel and are not shared externally unless required for the stated purposes or legal obligations.

6.8. Recordings of meetings (including audio and video), transcripts, AI-generated summaries, notes, and related meeting materials are retained only for as long as necessary to fulfil the purposes for which they were collected. Unless a longer retention period is required for legal, regulatory, or legitimate business purposes, such data is generally retained for no longer than one (1) year, after which it is securely deleted or anonymized.

7. Newsletter Recipients

7.1. If you subscribe to our newsletter, you will receive information about Affinidi and our Services.

7.2. We process your data for the purpose of sending the newsletters and related communications.

7.3. The data processed are: (a) contact information: name, email address; (b) HTTP data: protocol data generated when opening the newsletters via HTTP(S), including IP address, type and version of browser, operating system, the page visited, referrer URL, date and time of the visits.

7.4. The legal basis for the processing of data for newsletters is consent (Article 6 (1)(a) GDPR where applicable). Your consent is obtained when you subscribe to our newsletter.

7.5. Your contact details are provided directly by you when subscribing; HTTP data is automatically provided by your browser when opening newsletters.

7.6. We use HubSpot as our processor for newsletter services. We have concluded the EU Standard Contractual Clauses (2021/914; Module 3) with HubSpot. HubSpot, Inc. is certified in accordance with the EU-US Data Privacy Framework (Article 45 GDPR where the GDPR is applicable). You can request a copy of the main contractual contents of the EU Standard Contractual Clauses at any time.

7.7. Data related to newsletters will be retained until you unsubscribe from our newsletter services. You can withdraw consent at any time using the unsubscribe function in our newsletter.

Personal data is required to receive newsletters. Without providing personal data, the newsletters cannot be sent.

8. Participants in Surveys or Feedback

8.1. When individuals consent to participate in surveys, feedback collection, or studies (“Participants”), we process their personal data for conducting surveys, collecting feedback and finalize studies.

8.2. The data processed are: (i) contact information: name and email address (for non-anonymous surveys); (ii) professional information: industry the Participant works in, job role and title, the country of residence; (iii) survey responses: answers to the survey questions; (iv) communication data; (v) technical data: timestamps of the survey completion and submission.

8.3. The legal basis for processing survey data is consent (Article 6 (1)(a) GDPR where applicable).

8.4. The personal data is provided directly by the Participants.

8.5. Participants’ personal data is processed for the purpose of conducting and evaluating surveys/feedback using questionnaires for business development, product improvement and market research.

8.6. The survey and feedback data is retained for one (1) year after the survey is conducted, unless longer retention is necessary for legitimate business purposes or under relevant legislations such as commercial and tax law.

8.7. We use HubSpot as our processor for survey and feedback services. We have concluded the EU Standard Contractual Clauses (2021/914; Module 3) with HubSpot. HubSpot, Inc. is certified in accordance with the EU-US Data Privacy Framework (Article 45 GDPR where applicable). You can request a copy of the main contractual articles of the EU Standard Contractual Clauses at any time.

8.8. Participation in surveys and studies is entirely voluntary.

9. Limited-Use Applications, Events & Infrastructure-Level Services

9.1. We may offer certain applications or features for temporary, limited-use (e.g. proof of concepts, demos, event specific applications), either individually or in partnership with third parties. These services are not intended for general public or production use and may be modified or discontinued at any time.

9.2. Certain limited-use, early access, open beta or closed beta Services may operate on top of Affinidi’s infrastructure-level capabilities, including Affinidi Trust Fabric components such as Agent Gateway, Agent Stream and related gateway, routing, orchestration, observability, audit and governance functionalities. This may include limited-use, early access, beta and production Services, depending on the relevant Service, deployment, configuration and features used. The infrastructure-level processing described in this section reflects the current deployment of these Services and does not limit the applicability of similar processing practices to other Services where relevant.

9.3. In operating these Services, Affinidi may process technical and operational data, such as logs, metrics, traces, timestamps, identifiers, configuration metadata, policy decisions and audit and governance records. Depending on the relevant Service, configuration and features enabled by the customer, processing may also include prompts, responses, streamed or intermediate content and related metadata. This processing is carried out for purposes including providing the configured Service, routing and policy enforcement, auditability, governance, customer-configured model evaluation, quality assurance and drift detection, system reliability, security monitoring, troubleshooting service testing improvement.

Where drift-detection functionality is enabled, Agent Stream may retain a bounded sample of interaction data, including prompts and model outputs, for replay-based evaluation and comparison. Where Affinidi uses data for service analytics or improvement, we aim to use aggregated, anonymised or otherwise minimised technical and usage information where reasonably possible. Customer prompts, responses and other customer content are not used to train general-purpose AI models unless separately and expressly agreed with the customer.

9.4. Certain audit information may be made available to authorized administrators of the relevant customer account through the Service or available technical interfaces. Customers are responsible for managing administrator permissions and ensuring that access is granted only to individuals who require it for authorized business, security, audit or compliance purposes. Where necessary to operate, secure or support Services, a limited number of authorized Affinidi infrastructure or support personnel may also access relevant records, subject to role based access controls and confidentiality obligations.

9.5. Affinidi applies privacy-by-design and data minimisation principles to such processing, including limiting the scope and retention of observability data and applying reasonable technical safeguards (such as masking of clearly sensitive data categories) to reduce unnecessary exposure of personal data where supported by the relevant Service and configuration.

Customer can configure governance recording to minimize the amount of interaction content retained, including by disabling storage of full prompt and response bodies where these are not required for the intended audit or governance purpose.

Retention varies depending on the relevant Service, data type and customer configuration. Operational logs and metrics are generally retained for limited or customer configurable periods. Certain customer–configured audit or governance records, prompt templates and related records may be retained within the relevant Service until deleted by an authorized customer user or until the relevant instance is deleted, subject to applicable legal or contractual requirements. Customers may also configure export of logs or records to their own Open Telemetry or other external destinations, in which case retention in those external systems is controlled by the customer and/or the relevant Third Party.

For Agent Stream drift-detection functionality, captured interaction samples are retained subject to configurable retention controls. By default, up to 200 captured prompt/output samples may be retained per Surface. An age-based retention limit may also be configured; where no age limit is configured, retained samples remain subject to the applicable count limit. Access to Drift data is restricted to authorised administrator roles through role-based access controls. Where supported and enabled by the relevant configuration, the storage layer also supports encryption at rest.

In this context, Affinidi generally acts as a data processor, processing personal data on behalf of customers in accordance with their configurations and instructions. Customers remain responsible for the content of data transmitted through the Services and for ensuring appropriate legal bases, notices, and safeguards.

9.6. The personal data processed may include, depending on the specific limited-use application, event, Service, configuration and features used: (i) contract and account-related details (e.g., name, email, address, and any identifiers required for registration or using of the Services), (ii) device and technical information (e.g., IP address, browser type, operating system), (iii) Decentralized Identifiers (DiDs) and other identity or authentication-related information, (iv) event registration identifiers and VCs issued for event participation (if applicable) and (v) technical logs, metrics, traces and configuration metadata, (vi) policy decisions, trust-check results, audit or governance records and related identifiers, and (vii) where enabled by the customer, prompts, responses and other interaction content. Application and telemetry logs may be masked or otherwise minimised where supported, although audit or governance records may contain identifiable or pseudonymised information where necessary for the configured functionality. Depending on the content submitted by the customer or its users, interaction content may incidentally include sensitive or special-category personal data. Where Affinidi processes such data on behalf of a customer as a processor, the customer is responsible for ensuring that the processing is lawful, including identifying an appropriate legal basis and, where applicable, a condition for processing special-category personal data, providing required notices, and configuring the Service appropriately for the intended use. Customers should avoid submitting sensitive or special-category personal data unless it is necessary for the intended use and appropriate legal and security safeguards are in place. We may also process aggregated or anonymized usage and performance metrics for service analytics and improvement where such information does not identify an individual. The exact data collected may vary depending on the Service and features and settings selected by you or relevant customer.

9.7. Where Affinidi processes personal data on behalf of a customer as a processor, the customer is responsible for determining the applicable legal basis for such processing and providing any required notices to individuals. Where Affinidi processes personal data as a controller for its own purposes in connection with these Services, the applicable legal basis may include (i) contractual necessity (Article 6 (1) (b) GDPR where applicable), (ii) compliance with legal obligations (Article 6 (1) (c) GDPR where applicable) where processing is necessary for in particular tax and commercial law provisions, (iii) consent, where required (e.g. for marketing or optional features) and (iv) legitimate interest, such as fraud prevention, service administration and security.

9.8. Data is either provided directly by you or collected automatically through application usage and event participation.

9.9. The data is processed for the purpose of (i) enabling participation in the event or limited-use application, (ii) providing technical support, (iii) improving functionality and user experience, and (iv) ensuring security and preventing misuse.

9.10. Except for data subject to Service-specific or customer-configured retention as described above, Limited Use Application and event data is generally retained for one (1) year after the relevant event concludes or the application becomes unavailable, unless a longer or shorter retention period applies under the relevant Service configuration, contractual requirements or applicable law.

For the Services, retention periods vary depending on the relevant Service, data type and customer configuration. Operational logs and metrics are generally retained for limited or customer-configurable periods. Audit or governance records, prompt templates and other customer-configured records may be retained until deleted by an authorised customer user, until the relevant instance is deleted, or for such other period as required by the applicable Service configuration or contractual requirements. Where data is exported to customer-configured external systems, retention in those systems is controlled by the customer and/or the relevant Third Party. Affinidi may retain limited information for longer where necessary to comply with legal obligations, investigate security incidents, or establish, exercise or defend legal claims.

9.11. We may engage service providers to perform services on our behalf, in particular to provide, maintain and support IT systems.

10. AI Agents & Third-Party Agents

10.1. Certain features in our Services may enable interaction with AI Agents. Where an AI Agent runs locally on your device, Affinidi does not ordinarily process or store your prompts, transcripts, or outputs on Affinidi servers. Where AI Agent interactions rely on Affinidi Trust Fabric or other infrastructure-level gateway, routing, orchestration, observability, audit or governance capabilities, Affinidi may process and depending on customer configuration, retain interaction data in accordance with the practices described in the “Limited-Use Applications, Events & Infrastructure-Level Services” section above.

10.2. If you choose to use a Third Party Agent, Model Provider, witness provider, telemetry destination or other external service, data you provide or configure for transmission (such as prompts, context, output and metadata) may be transmitted to and processed by that Third Party in its environment. Where such Third Parties are selected or configured by the customer, the customer is responsible for its arrangements with those Third Parties and for ensuring that the relevant processing complies with applicable law. Possessing by those Third Parties will be subject to the customer’s arrangement with them and any applicable privacy or data protection terms. Where configured by the customer for evaluation or drift-detection purposes, sampled interaction data may also be transmitted to the same or another customer-configured Model Provider for replay and comparison.

10.3. We do not use AI Agent interactions for profiling or automated decision-making that produces legal or similarly significant effects.

11. Your Rights and General Information

11.1. We do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

11.2. You have the following rights under applicable data protection laws. To exercise any of these rights, please contact us at dataprotection@affinidi.com. We will respond to your request within one month of receipt, though this may be extended by two additional months for complex requests.

• You may withdraw your consent at any time, if your data is processed based on your consent. The withdrawal of consent does not affect the lawfulness of processing before withdrawal. To withdraw consent, contact dataprotection@affinidi.com or use specific withdrawal mechanisms where provided (e.g., newsletter unsubscribe links).
• You may at any time object to processing of your data if your data is processed based on our legitimate interest.
• You may at any time request access to your personal data processed by Affinidi.
• You have the right to data portability, where it is applicable.
• You may request correction of inaccurate personal data at any time and also completion of incomplete personal data.
• You may request erasure of your personal data at any time, provided that no right or legal obligation of Affinidi requires further processing of your personal data.
• You may request restriction of processing for your data at any time.
• You may at any time lodge a complaint with a supervisory authority.