GDPR
Lunixi acts as a data processor under GDPR. Your organisation is the data controller. A Data Processing Agreement (DPA) must be signed before EU personal data is processed.
For obligations under Türkiye's KVKK, the detail of how field-level encryption is applied and the erasure endpoints, see KVKK. Both pages describe the same technical foundation; the scope and obligation frameworks differ.
Lawful basis
Processing carried out through Lunixi typically relies on one of:
- Legal obligation (Art. 6(1)(c)) — AML and sanctions screening is required by law
- Legitimate interests (Art. 6(1)(f)) — fraud prevention
Document your lawful basis in your own privacy policy. Lunixi can provide a template clause.
Data minimisation
Only send Lunixi the data necessary for the risk decision. Screening endpoints accept optional fields — you are not required to pass fields you don't have or don't need.
Do not write personal data into free-form extra fields: those fields are not encrypted.
Retention
Retention is not a single global number — it is resolved per data type and per jurisdiction.
| Data | Default period |
|---|---|
| Identity verification records (EU/UK default) | 1825 days (5 years) |
| Identity verification records (Türkiye) | 2920 days (8 years) |
| Biometric images | 90 days (Türkiye ruleset) |
| Suspicious activity report records | 5 years (fixed) |
Periods are overridable per installation.
Automatic destruction is off by default. Destruction jobs are planned, but actually deleting data must be enabled per installation. Confirm whether it is enabled in your own installation.
Right to erasure (Art. 17)
Erasure is carried out through operator endpoints that require authentication and pass authorisation checks:
| Operation | Endpoint |
|---|---|
| Start an erasure request | POST /kyc/admin/sessions/:sessionId/erasure |
| List erasure requests | GET /kyc/admin/erasure-requests |
| Withdraw consent | POST /kyc/admin/sessions/:sessionId/consent/withdraw |
There is no erasure endpoint the data subject can call directly. You receive the request, assess it as data controller, and apply the outcome through these endpoints.
Erasure is subject to legal retention obligations: personal identifiers can be removed while decision outcomes are retained for audit. On completion a signed destruction certificate is produced and attached to the destruction record.
Right of access (Art. 15)
A structured export endpoint exists for data-subject access requests:
GET /kyc/admin/sessions/:sessionId/dsar-exportThe export itself is written to the audit trail — whose data was exported, when, and by whom is on record.
Technical measures
- Field-level AES-256-GCM encryption, with a per-tenant data encryption key and key wrapping
- Document objects are encrypted at the application layer before they are written to storage — there is no configuration in which an unencrypted object can be written
- Central redaction in logs and error traces; card numbers are validated with Luhn and Turkish national IDs with their check digit before masking
- Hash-chained audit log
For the full list of which fields are encrypted and which are plaintext, see KVKK. We do not claim "all personal data is encrypted" and we write the exceptions down explicitly.
Transfers and hosting
Object storage and key management run on infrastructure we operate; they are not delegated to a third-party cloud provider. A region-specific separate installation can be provisioned.
This page is not a binding hosting statement for your installation. The binding statement about where your data actually sits, the sub-processor list and the transfer mechanism (including Standard Contractual Clauses) is given in the DPA. Request it from [email protected].
DPA
To request the Data Processing Agreement, email [email protected].