Privacy Policy
Last updated: 28 January 2026
1. About This Policy
This Privacy Policy explains how One Shot Ventures Pty Ltd (ABN 50 690 149 609), trading as VeroID (“we”, “us”, “our”), collects, uses, discloses, and protects personal information.
VeroID is an Australian company subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We are committed to protecting the privacy of all individuals whose information we handle.
2. Our Service
VeroID operates as a Document Verification Service (DVS) Gateway Service Provider. We provide business-to-business (B2B) identity verification services that enable our business customers (“Gateway Users”) to verify Australian identity documents through the government's DVS.
We do not provide consumer-facing identity verification services directly to individuals.
3. Information We Collect
3.1 Business Customer Information
When you sign up as a VeroID customer, we collect:
- Business name and ABN
- Contact details (name, email, phone)
- Billing information (processed by Stripe)
- Account credentials
3.2 Identity Verification Data
When our business customers submit identity verification requests through our API, we process:
- Identity document details (e.g., document type, document number)
- Personal details for matching (e.g., name, date of birth)
- Verification results (match/no match)
Important: This data is collected and processed on behalf of our business customers. The individual whose identity is being verified must have provided their express consent to our business customer before any verification request is submitted.
3.3 Transaction Records
We maintain records of:
- Verification transaction IDs
- Timestamps
- Document types verified
- Verification outcomes (pass/fail)
- Business customer identifiers
4. How We Use Information
We use personal information to:
- Process identity verification requests through the DVS
- Provide verification results to our business customers
- Manage customer accounts and billing
- Provide customer support
- Comply with legal obligations and DVS requirements
- Maintain security and prevent fraud
- Improve our services
5. Data Minimisation
We follow strict data minimisation practices in accordance with DVS Gateway Service Provider requirements:
- No document storage: We do not store identity documents or document images
- No unnecessary retention: Identity verification data is not retained beyond what is strictly necessary to complete the verification and provide results
- Minimal result storage: We store only transaction metadata (IDs, timestamps, outcomes) required for audit and compliance purposes
- No secondary use: Verification data is used only for the purpose of providing the verification service
6. Consent Requirements
Before any identity verification request is processed, the individual whose identity is being verified must have provided their prior express consent to:
- The collection and use of their personal information for identity verification
- The disclosure of their information to VeroID and the Document Verification Service
- The processing of their information to provide verification results
Our business customers are contractually required to obtain this consent before submitting any verification requests.
7. Disclosure of Information
We may disclose personal information to:
- The DVS: Identity verification data is transmitted to the Australian Government's Document Verification Service to process verification requests
- Official Record Holders: The government agencies that maintain official identity records (e.g., passport office, road authorities, births/deaths/marriages registries)
- Our business customers: Verification results are provided to the business customer who submitted the request
- Service providers: We use Stripe for payment processing and AWS for cloud infrastructure
- As required by law: We may disclose information if required by law, court order, or government authority
We do not sell personal information or share it for marketing purposes.
8. Data Security
We implement robust security measures including:
- Encryption in transit (TLS 1.2+) for all data transmission
- Encryption at rest for stored data
- Secure cloud infrastructure hosted in Australia (AWS Sydney region)
- Access controls and authentication for all systems
- Comprehensive audit logging
- Regular security assessments
- Incident response procedures
All systems and data are maintained within Australia in compliance with DVS requirements.
9. Data Retention
We retain information as follows:
- Transaction records: Minimum 7 years (as required by DVS Gateway Service Provider conditions)
- Business customer information: Duration of the business relationship plus 7 years
- Identity verification data: Not retained beyond what is necessary to complete the verification
10. Your Rights
Under the Privacy Act 1988 and Australian Privacy Principles, you have the right to:
- Access personal information we hold about you
- Request correction of inaccurate information
- Make a complaint about our handling of your information
Note for individuals: If your identity was verified through VeroID by a business you interact with, please contact that business directly regarding your personal information. They are the primary holder of your information and responsible for managing your privacy rights in relation to their use of verification services.
11. Third-Party Services
We use the following third-party services:
- Document Verification Service (DVS): Australian Government service for identity verification
- Amazon Web Services (AWS): Cloud infrastructure (Sydney region)
- Stripe: Payment processing
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified to business customers via email. The current version will always be available on our website.
13. Contact Us
For privacy-related questions, access requests, or complaints, contact us at:
Email: privacy@veroid.com.au
One Shot Ventures Pty Ltd trading as VeroID
ABN: 50 690 149 609
14. Complaints
If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992