Identity Verification & Biometric Data Notice

1. Why we collect your identity document

Independent sellers must verify their identity before selling on CARVEXA and before being authorised to sell on behalf of an organisation. This protects buyers and honest sellers, and supports South African anti-fraud and FIC-aligned expectations. We collect the document image and extract: full name, date of birth, document type, document number and expiry date.

2. Why we perform facial verification

To check that the person creating the account is the person named on the document. CARVEXA requests a live capture in the app (a camera selfie, not an upload) and performs best-effort liveness assessment — checking whether the capture appears to be a real, live person rather than a photograph, screenshot, printed photo, recorded video or replay/deepfake attempt — and compares the face with the document photograph.

3. What information is processed

• The identity document image.
• Extracted identity details (name, date of birth, document type, number, expiry).
• The live selfie image.
• The automated comparison results (face match, liveness assessment) and reviewer notes.

4. Who processes it

CARVEXA processes verification data in-house, with access limited to trained verification staff. Where an external verification provider is engaged, it processes data only on CARVEXA's documented instructions under a written agreement, and this notice will name that provider.

5. Retention and deletion

The document image and selfie are deleted within 90 days of the final verification decision (including any review or appeal), unless retention is legally required. The decision record (verified / not verified, timestamp and reviewer) is retained; biometric templates are not created or stored — we keep no mathematical biometric templates of your face.

6. Security measures

• Documents and selfies are stored in secure private storage — never publicly accessible.
• Staff access uses short-lived signed links and is logged.
• ID numbers, passport numbers, dates of birth and facial images are never displayed to other users; the public sees only the verification status.

7. Consent, withdrawal and your rights

Biometric processing happens only with your informed consent, given before capture. You may withdraw consent at any time by contacting ask@carvexa.co.za — withdrawal stops further processing and triggers deletion where no legal requirement applies, but means your verification cannot remain active. You may access, correct or complain about your verification data at any time; unresolved complaints may be escalated to the Information Regulator.

8. Fair outcomes

A failed automated match is never treated as proof of fraud. Uncertain or failed checks go to human review, and you may attempt verification again. Verification status never automatically makes anyone a 'Trusted Seller' — that status is granted separately by CARVEXA.