Privacy Policy

Last updated: 4 November 2026 · HECID by Hekate Systems

1. What we collect

HECID collects identity verification data that you provide during onboarding: identity document images, selfie captures, and the derived verification result. We also collect account data (email, name) and technical metadata (IP address, device, timestamps) required to operate the service.

2. How we use it

Verification data is used solely to perform identity verification on behalf of the organisation that requested it. We do not sell, rent, or share personal data with third parties for marketing. Data is retained only as long as necessary for the verification purpose and applicable legal obligations.

3. Security

All data is encrypted in transit (TLS 1.2+) and at rest. Evidence packages are sealed with SHA-256 hashes and stored in tenant-isolated databases. Access is restricted to authenticated, authorised personnel under least-privilege roles.

4. Your rights (GDPR / UK GDPR)

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate data.
• Erasure: Request deletion ("right to be forgotten").
• Portability: Export your data in machine-readable form.
• Objection: Object to processing based on legitimate interest.

To exercise these rights, contact privacy@hekatesystems.com.

5. Data retention

Verification evidence is retained for the period specified by the requesting organisation's workflow policy (typically 5 years for KYC). Account data is retained until you request deletion.

6. Sub-processors

HECID is self-hosted by each organisation. No personal data is transmitted to Hekate Systems or any third-party sub-processor unless explicitly configured by the organisation (e.g., an external identity provider).

7. Contact

Hekate Systems · privacy@hekatesystems.com · www.hekatesystems.com