Last updated: 10 July 2026

This Privacy Notice explains how personal data are processed when you use the age verification function provided on this website.

It supplements the general Privacy Policy of the website and applies specifically to the age verification process.

1. Data Controller

The Data Controller is:

Kiri Nawa Kai APS
Via Bruno Cesana 10
20132 Milan, Italy
Italian Tax Code: 97750310159

Privacy contact: kirinawakai@pec.poste.it

Kiri Nawa Kai APS determines why age verification is required, how the verification result is used on this website, and how long the resulting verification status remains valid.

2. Purpose of the age verification

The purpose of the processing is solely to determine whether a logged-in user is eligible to access content or areas of the website that are subject to age restrictions.

Kiri Nawa Kai APS does not determine the applicable minimum age inside WordPress and does not attempt to calculate your age independently.

The applicable eligibility rules are handled by the verification workflow configured through Didit. Depending on the verification path, country, document information and other factors relevant to the configured workflow, Didit returns a final verification outcome.

Our website uses only the final result necessary for access control.

In practical terms, our website needs to know only whether the verification has been successfully passed. We do not need to know your exact age.

3. Verification provider

The age verification process is powered by Didit, an external identity and verification technology provider.

For verification flows requested by Kiri Nawa Kai APS, Didit generally processes personal data on behalf of Kiri Nawa Kai APS as a processor or service provider.

For users and customers in the European Union, Didit identifies its European entity as:

Didit Identity Spain, S.L.
CIF B22929327
Calle Nápoles 227, P. 1
08013 Barcelona, Spain

Didit may also act as an independent controller for certain limited purposes determined by Didit itself, including platform security, abuse prevention, service integrity, legal compliance, audit logging and the establishment, exercise or defence of legal claims.

You should also read Didit’s current Verification Privacy Notice, Privacy Policy, and End User Terms for Identity Verification, available on Didit’s website.

4. Categories of data that may be processed during verification

The exact data processed depend on the verification workflow and on the verification path required in your individual case.

Depending on the workflow, Didit may process categories of data including:

• selfie or face images;
• liveness captures or video;
• facial characteristics or data derived from facial geometry;
• anti-spoofing and fraud-prevention signals;
• identity document images and information extracted from documents, where document verification is required;
• date of birth and other identity information contained in a submitted document, where applicable;
• country and, where applicable, regional information relevant to the verification workflow;
• IP address;
• browser and device information;
• timestamps and session information;
• network-derived location information;
• technical, integrity and risk signals;
• verification results, warnings and status transitions.

Not every category listed above is necessarily processed in every verification.

Kiri Nawa Kai APS configures and uses the verification service for age eligibility purposes and seeks to minimise the data retained after the verification has been completed.

5. Biometric and liveness data

Where the configured verification workflow requires facial analysis, liveness checks or similar technology, Didit may process face images, selfie images, video or liveness captures, anti-spoofing signals and data derived from facial characteristics.

Such processing may involve sensitive data and, depending on the precise purpose and applicable law, may constitute processing of biometric data or special-category personal data.

These data are processed for the limited purpose of carrying out the requested age verification, confirming liveness, preventing spoofing or manipulation, protecting the integrity of the verification process and producing the verification outcome.

Kiri Nawa Kai APS does not receive or retain a biometric template, facial embedding, selfie, liveness video or facial geometry data in its WordPress user profile.

6. Data received and retained by Kiri Nawa Kai APS

Kiri Nawa Kai APS intentionally applies a data-minimisation approach.

After a successful verification, the website permanently retains only the minimum information needed to manage temporary access:

• the fact that the user has successfully completed age verification;
• the date and time at which verification was completed;
• the date and time at which the verification status expires.

Kiri Nawa Kai APS does not retain in the WordPress user profile:

• your exact age;
• your date of birth;
• the minimum age threshold applied by Didit;
• your identity document number;
• a copy of your identity document;
• your nationality;
• your selfie;
• your face image;
• your liveness video;
• a biometric template;
• a facial embedding;
• facial geometry data;
• the full Didit verification report;
• detailed verification scores.

The website therefore uses a temporary access status rather than maintaining a copy of your identity verification file.

7. Temporary technical data used during the verification

To securely connect the Didit verification session with the correct logged-in WordPress account, the website temporarily processes limited technical identifiers, which may include:

• a randomly generated, single-use pseudonymous identifier;
• the Didit verification session identifier;
• the internal WordPress user identifier associated with the session;
• temporary deletion and retry status information.

The random identifier sent to Didit is not designed to contain your name, email address, WordPress username or other directly identifying account information.

These temporary data are retained only for as long as reasonably necessary to:

1. associate the verification result with the correct logged-in user;
2. validate the result received through the secure server-to-server webhook;
3. complete the deletion process with Didit; and
4. retry deletion if a temporary technical failure occurs.

Once the deletion workflow has successfully completed, the temporary session mapping and temporary Didit identifiers are deleted from the local purge queue.

8. Legal basis

The verification process is initiated only after an affirmative action by the user.

Where consent is the applicable legal basis, Kiri Nawa Kai APS relies on your consent under Article 6(1)(a) GDPR.

Where the verification involves biometric data constituting special-category personal data under Article 9 GDPR, and explicit consent is required by applicable law, Kiri Nawa Kai APS relies on your explicit consent under Article 9(2)(a) GDPR.

Limited technical and security processing may also be carried out where necessary for the legitimate interests of Kiri Nawa Kai APS under Article 6(1)(f) GDPR, including:

• preventing circumvention of age restrictions;
• protecting restricted areas of the website;
• preventing fraud, spoofing and abuse;
• maintaining the security and integrity of the verification process.

Where a specific legal obligation requires age-related access controls, relevant processing may also be based on Article 6(1)(c) GDPR.

Didit may rely on separate legal bases for limited processing it performs as an independent controller, as described in Didit’s own privacy documentation.

9. Is providing the data mandatory?

No. You are not required to complete age verification.

However, if you do not start or complete the verification, or if the result does not confirm eligibility, you will not be able to access content or areas for which a valid age verification is required.

Refusing age verification does not prevent you from accessing other parts of the website that do not require verification.

Where consent is relied upon, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Depending on the stage of the process, withdrawal may make it impossible to complete or maintain age-verified access.

10. Verification outcome and automated processing

The verification outcome may be generated through automated systems operated by Didit according to the configured verification workflow.

Depending on the workflow, automated systems may analyse age-related eligibility, document integrity, liveness, anti-spoofing signals, facial comparison, technical signals or other verification indicators.

Kiri Nawa Kai APS uses the resulting verification outcome solely to determine whether the logged-in user may access age-restricted content.

Kiri Nawa Kai APS does not use the age verification process to create a marketing profile, determine prices, assess creditworthiness, make employment decisions or infer unrelated personal characteristics.

If you believe a verification outcome is incorrect, you may contact Kiri Nawa Kai APS at kirinawakai@pec.poste.it to request assistance or reconsideration of the access decision.

11. Local retention period

A successful verification status is normally valid on this website for:

7 days from the successful verification.

During this period, the user does not normally need to repeat the verification.

After expiry:

• the user is no longer treated as age verified;
• access to protected content is no longer granted on the basis of the expired status; and
• the expired local verification metadata are removed in accordance with the plugin’s normal expiry and cleanup process.

A new verification may then be required.

If Kiri Nawa Kai APS changes the validity period of the age verification status, this Notice should be updated accordingly.

12. Immediate deletion instructions sent to Didit

Kiri Nawa Kai APS follows a privacy-minimising process-and-purge approach.

After a final verification outcome is securely received, the integration is designed to:

1. retain locally only the minimum access-control information described above;
2. send a deletion request for the Didit verification session;
3. send a deletion request for the associated Didit user entity created for that verification;
4. retry failed deletion requests automatically where a temporary technical error occurs; and
5. delete temporary local Didit identifiers once the purge workflow has successfully completed.

This deletion process is applied after final outcomes, including unsuccessful verification outcomes where applicable.

A user who does not pass verification should not remain stored merely because access was refused.

13. Didit retention settings and residual records

In addition to the immediate deletion requests described above, Kiri Nawa Kai APS configures the dedicated Didit application with the shortest standard retention period currently available through the Didit Business Console:

1 month / 30 days.

This retention setting acts as an additional maximum retention control for data subject to the application retention policy. It does not replace the immediate deletion requests sent after the verification result.

Users should nevertheless understand that an API deletion request does not necessarily mean that every technical record disappears instantaneously from every layer of Didit’s infrastructure.

According to Didit’s documented data lifecycle, certain session history, operational records or related metadata may remain for the applicable configured retention period before hard deletion. Didit may also retain separate limited records where necessary for security, audit, legal compliance, dispute resolution or legal claims.

Didit documents separate API audit logging for security and compliance purposes. Such audit records may be retained for up to 365 days and are described by Didit as metadata logs rather than copies of verification request or response bodies or personal data from verification sessions.

For this reason, Kiri Nawa Kai APS does not claim that every byte of data is physically erased from every Didit system at the exact instant the verification finishes.

Our policy is instead to:

• request deletion immediately after the final result;
• delete the associated Didit user entity;
• configure the shortest available standard application retention period;
• retain locally only the minimum temporary access status required by the website.

14. Recipients of personal data

Personal data used for age verification may be processed by:

• Kiri Nawa Kai APS, strictly to the extent necessary to operate the access-control system;
• Didit, as the verification technology provider;
• authorised Didit group entities involved in providing, supporting or securing the service;
• hosting, infrastructure, security, audit, communications and other service providers or subprocessors used by Didit where necessary to provide the service;
• competent authorities, courts, regulators or law-enforcement bodies where disclosure is required by applicable law.

Kiri Nawa Kai APS does not sell age-verification data or biometric data.

Kiri Nawa Kai APS does not use age-verification data for advertising or marketing profiling.

15. International data transfers

Didit documents European processing as the default processing region for its verification platform and identifies a Spanish entity for European customers.

Nevertheless, depending on infrastructure, service providers, support requirements, security operations and the specific role in which Didit acts, personal data may be processed outside the country where the verification began.

Where personal data are transferred outside the European Economic Area and applicable law requires safeguards, Didit states that it uses recognised transfer mechanisms such as:

• adequacy decisions;
• the European Commission’s Standard Contractual Clauses;
• applicable intra-group arrangements; or
• other lawful transfer mechanisms recognised by data-protection law.

16. Security

Kiri Nawa Kai APS uses technical and organisational measures intended to reduce unnecessary disclosure of verification data.

The integration is designed so that:

• the Didit API key is kept server-side and is not exposed to the browser;
• verification results are accepted through a signed server-to-server webhook;
• the browser callback is not treated as authoritative proof of successful verification;
• only a verification session previously created by the website can be associated with a WordPress user;
• pseudonymous, single-use identifiers are used instead of sending the WordPress username or email address as the session identifier;
• temporary data are deleted after successful privacy cleanup;
• failed deletion requests are retried.

Didit separately describes technical and organisational measures for protecting verification data, including access controls, encryption, monitoring and security procedures.

17. Your rights

Subject to the conditions and limitations established by applicable law, you may have the right to:

• obtain confirmation as to whether personal data concerning you are being processed;
• access your personal data;
• request correction of inaccurate data;
• request erasure of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive portable data where the right to data portability applies;
• withdraw consent at any time where processing is based on consent;
• obtain information concerning relevant automated processing;
• lodge a complaint with a competent supervisory authority.

To exercise rights relating to the age verification requested by Kiri Nawa Kai APS, contact:

Kiri Nawa Kai APS
Via Bruno Cesana 10
20132 Milan, Italy
Email / PEC: kirinawakai@pec.poste.it

Where Didit processes data solely on behalf of Kiri Nawa Kai APS, requests should normally be addressed first to Kiri Nawa Kai APS.

Where Didit acts as an independent controller for one of its own limited processing purposes, Didit identifies the following privacy contacts in its own documentation:

privacy@didit.me
dpo@didit.me

18. Right to lodge a complaint

You have the right to lodge a complaint with a competent data-protection supervisory authority.

For users in Italy, the competent authority is:

Garante per la protezione dei dati personali
Piazza Venezia 11
00187 Rome, Italy

You may also contact another competent supervisory authority where permitted by the GDPR.

19. Users who do not meet the applicable age requirement

A person may begin a verification process and subsequently be found not to satisfy the eligibility requirements applied by the Didit workflow.

In that situation:

• the user is not marked as age verified;
• access to restricted content is not granted;
• Kiri Nawa Kai APS does not retain the user’s exact age merely because the verification failed;
• the same post-verification deletion workflow is intended to apply to the Didit session and associated temporary identifiers.

The fact that a user does not pass verification is not used by Kiri Nawa Kai APS for advertising, profiling or unrelated purposes.

20. Changes to this Notice

Kiri Nawa Kai APS may update this Notice where necessary to reflect:

• changes to the age verification workflow;
• changes to the WordPress integration;
• changes to retention periods;
• changes to Didit’s services or documented processing practices;
• legal or regulatory developments.

The date of the latest update will be shown at the top of this Notice.

Material changes affecting the purposes, legal basis or nature of the processing will be communicated where required by applicable law.