Privacy Policy

1. Introduction

The National Authority for Digital Certification ("NADC", "we", "our", or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains what information we collect, how we use it, how we protect it, and your rights when using the SUDAPASS application.

2. Information We Collect

Personal Information

We may collect the following personal information:

• Full name
• Date of birth
• Nationality
• Passport number
• Passport expiry date
• Email address

Face Images

To establish and verify your digital identity, SUDAPASS collects:

• A facial photograph extracted from the electronic passport (NFC chip), which forms part of your verified digital identity.
• A selfie image captured during registration or authentication to perform liveness detection and verify that you are the rightful holder of the passport.

SUDAPASS does not collect or store biometric templates or biometric identifiers derived from face images.

3. How We Use Your Information

We use your information solely to provide secure digital identity services, including:

• Verifying your identity.
• Performing liveness detection.
• Confirming that you are the rightful passport holder.
• Creating and managing your trusted digital identity.
• Processing authorization requests initiated by you.
• Complying with applicable laws and regulations.

The passport facial photograph is retained as part of your verified digital identity.

The selfie image is used solely for identity verification and liveness detection.

Neither the passport facial photograph nor the selfie image is used for:

• Artificial Intelligence (AI) model training.
• Advertising.
• Marketing.
• User profiling.
• Analytics unrelated to identity verification.

4. Sharing of Information

Your personal information, passport facial photograph, and selfie image are not shared with third parties for advertising, marketing, analytics, or AI training.

Information may only be disclosed when required by applicable law or to authorized government entities as necessary to provide official digital identity services.

5. Data Storage and Security

We implement appropriate technical and organizational safeguards to protect your information, including:

• Encryption of data both in transit and at rest.
• Secure storage in government-operated data centers located in Sudan.
• Secure access controls and monitoring to protect stored information.

SUDAPASS does not store biometric templates or biometric identifiers.

6. Face Image Retention and Deletion

The passport facial photograph extracted from the electronic passport is retained as part of your verified digital identity for as long as your digital identity remains active or as otherwise required by applicable laws and regulations.

The selfie image collected during registration or authentication is retained solely for identity verification, fraud prevention, security investigations, and compliance with applicable legal requirements.

• Selfie images are retained for a maximum of 12 months from the date of collection.
• After the retention period expires, selfie images are permanently and securely deleted.

7. Your Rights

Subject to applicable laws, you have the right to:

• Access your personal data.
• Request correction of inaccurate information.
• Request deletion of your personal data where permitted by law.
• Withdraw your consent where applicable.

8. Contact Us

For privacy-related questions or requests, please contact:

National Authority for Digital Certification (NADC)

Email: info@nadc.gov.sd