Identity Verification Policy

1. Purpose

This Identity Verification Policy describes how Worqen OÜ ("Worqen") verifies the identity of Users before they can post jobs, apply to jobs, send invitations, fund escrows or receive payments. It supplements the Terms of Service and the Privacy Policy.

2. Why we verify

• To comply with our obligations under the Estonian Money Laundering and Terrorist Financing Prevention Act (MLTFPA), the EU Anti-Money-Laundering Directives, the Brazilian Anti-Money Laundering Law (Law 9,613/1998) and the Indian Prevention of Money Laundering Act 2002.
• To protect Workers and Employers from impersonation, fraud and account takeover.
• To meet our internal sanctions and politically-exposed-person (PEP) screening obligations.
• To maintain the integrity of escrow settlement and dispute resolution.

3. When verification is required

Browsing public listings on the Service does not require an account or verification. To perform any of the following actions, you must complete identity verification:

• Posting a job;
• Applying to a job;
• Sending or accepting invitations;
• Funding an escrow;
• Releasing funds from escrow;
• Withdrawing funds (when withdrawal flows are enabled).

We may also re-verify your identity at any time in response to risk signals, before unlocking certain features, or where we are required by law.

4. Verification provider

Verification is performed by Sumsub (Sum and Substance Ltd, United Kingdom), an FCA-supervised regulated identity-verification provider acting as our processor under EU Standard Contractual Clauses. Sumsub provides the user-facing verification flow, performs document and biometric checks, and reports a result (PASS / REJECTED / RESUBMISSION_REQUESTED) to Worqen. Sumsub's privacy notice is available at sumsub.com/privacy-notice.

5. What is collected

5.1 Individual verification

Every User verifies as a natural person. From that person we collect:

• Government-issued identity document — passport, national identity card or driver's licence (image of front and back where applicable).
• Live selfie with liveness check, used to biometrically match your face to the photo on the identity document.
• Personal data on the document — full legal name, date of birth, nationality, document number, expiry date.
• Proof of address (where required) — utility bill or bank statement dated within the last 3 months.
• Sanctions / PEP screening data derived from the above.
• Device, IP and session metadata captured by Sumsub to detect forgery, replay attacks and bot activity.

5.2 Business and entity verification (KYB)

An Employer may be either an individual or a legal entity such as a company. Where an Employer registers or transacts as a legal entity, the natural person completing sign-up must still pass individual verification under Section 5.1, and we may additionally require business verification ("Know Your Business", or "KYB") before that entity can post a job, fund an escrow or release funds. KYB is performed by Sumsub as our processor on the same terms set out in Section 4. Where KYB applies, we may collect:

• Business-registration details — registered legal name, legal form, business-registry (company) number, country of incorporation and registered-office address.
• Beneficial-ownership information — the identity and the ownership or control percentage of each ultimate beneficial owner, together with the individual verification data in Section 5.1 for each beneficial owner we are required to verify.
• Representative authority — evidence that the natural person acting for the entity is authorised to do so, such as a board resolution, power of attorney, or an entry in a public register naming them as a director or authorised representative.
• Registry and screening data — extracts from applicable company registers, and sanctions / PEP screening of the entity, its beneficial owners and its representative.

We collect and verify this information to meet our customer-due-diligence and beneficial-ownership obligations under the Estonian Money Laundering and Terrorist Financing Prevention Act (MLTFPA) and the EU Anti-Money-Laundering Directives, and in our legitimate interest in preventing fraud and confirming that a person transacting on behalf of an entity is authorised to do so. KYB records are retained on the same basis as the verification records described in Section 6, and any entity and beneficial-owner data we process is handled in accordance with the Privacy Policy. Business verification does not change how funds are held: escrow remains non-custodial and on-chain, and it does not change the wallet arrangement you have chosen for settlement (see Section 12.2).

5.3 Your consent to biometric verification, and how to withdraw it

The live selfie and liveness check described above involve biometric data — a special category of personal data. Before Sumsub captures it, you are asked to give your explicit consent to this specific processing (GDPR Article 9(2)(a)). That consent covers only the biometric face-match used to confirm that you are the person shown on your identity document; it is separate from, and does not replace, the anti-money-laundering legal obligation under which we keep the record of your verification (see Section 6).

You can withdraw this consent at any time, and withdrawing it is as easy as giving it: email dpo@worqen.com with the subject line "Withdraw biometric consent". Withdrawal takes effect for the future only — it does not affect the lawfulness of any biometric processing carried out before you withdrew.

What withdrawal does, and does not, do:

• It stops any further biometric processing of your face-match data. In practice the biometric template is in any event deleted by Sumsub 30 days after the verification decision (see Section 6), so after that window there is no biometric data left to process.
• Because a passed verification is required to transact (see Section 3), withdrawing consent before you have completed verification means you cannot be verified, and your account stays in browse-only mode — able to browse listings but blocked from posting, applying, funding escrow or being paid, exactly as described in Section 8.2.
• It does not erase the verification result, Sumsub applicant ID and decision metadata that we are required to keep for five years under the Estonian MLTFPA and the EU Anti-Money-Laundering Directives (see Section 6). That record rests on our legal obligation, not on your consent, and cannot be deleted on request while the retention period runs.
• It does not affect any funds already held in escrow. Those funds sit in a non-custodial on-chain escrow vault outside Worqen's custody; they are released or refunded through the normal escrow and dispute process regardless of your verification status, and are not forfeited (see Section 8.3).

6. Retention

We retain different categories of verification data for different periods:

We override these retention defaults only where required by a longer statutory obligation or by an active legal hold (litigation, regulatory investigation, court order).

7. Who can access your verification data

• Sumsub reviewers see your raw documents and selfie during the verification flow under their own privacy notice.
• Worqen Trust & Safety personnel see only the verification result and the disposition metadata listed above. They can re-open a Sumsub case for re-review if a dispute or fraud signal arises within the 30-day Sumsub retention window.
• Other Worqen staff do not have access to verification data.
• We do not share verification data with other Users. Only a generic "Verified" badge appears on your profile after a PASS result.

The "Verified" badge confirms only that the User completed our identity-verification process and returned a PASS result at the time of that check; it confirms identity and nothing more. It is not an endorsement, recommendation, guarantee or warranty by Worqen of that User's skill, ability, qualifications, honesty, willingness or availability to work, professional licensing, insurance, solvency, creditworthiness, or of the quality, safety, legality or outcome of any engagement. Consistent with Section 2 of the Terms of Service, Worqen does not endorse, vouch for or stand behind any User; Workers and Employers remain responsible for independently evaluating one another before entering into any engagement.

8. Failure outcomes

8.1 Resubmission requested

Sumsub may request resubmission if the document is unreadable, expired, or fails liveness. You can retry without penalty.

8.2 Rejection

If verification is rejected after reasonable resubmission attempts, your account remains usable in browse-only mode but is blocked from posting, applying, escrowing or being paid. We will tell you in writing the high-level reason for rejection where this does not compromise an active investigation or violate AML "tipping-off" rules under Estonian MLTFPA § 49.

8.3 Account suspension following rejection

Where rejection is based on detected forgery, sanctions match, or other serious risk signal, your account may be suspended pending review. Funds already in escrow are not forfeited but may be frozen pending dispute resolution.

9. Re-verification triggers

We may require re-verification if:

• Your identity document on file has expired;
• You change material profile data (name, date of birth, nationality);
• Risk signals indicate a possible account takeover;
• Three years have passed since your last successful verification;
• You request a higher transaction or withdrawal threshold (when those tiers are introduced);
• An applicable regulator's rules require it.

10. Service levels

• Automated verifications typically complete within a few minutes of submission.
• Manual review (when escalated by Sumsub) is targeted to complete within 72 hours; we will notify you if more time is needed.
• Appeals (see Section 11) are answered within 14 days.

11. Appeals and complaints

You may appeal a rejection or any decision arising from verification by emailing dpo@worqen.com with the subject line "Verification Appeal". Include any supporting documentation. We will respond substantively within 14 days. You may also exercise your data-subject rights set out in the Privacy Policy, including the right to lodge a complaint with your local supervisory authority.

12. Sanctions screening and settlement wallets

12.1 Sanctions screening

Verification includes screening of your name and date of birth against the Office of Foreign Assets Control (OFAC) Specially Designated Nationals list, the EU Consolidated sanctions list, the United Kingdom OFSI sanctions list, and the United Nations Security Council sanctions list. We are also required to refuse business with users in comprehensive-sanctions territories (currently DPRK, Iran, Cuba, Syria and the occupied territories of Ukraine). A sanctions match results in account refusal or termination and may be reported to the Estonian Financial Intelligence Unit.

12.2 Settlement wallets and identity

Worqen's escrow itself is non-custodial: escrowed funds are held on the Solana blockchain by an escrow smart contract in a program-derived vault, not by Worqen. The money leg of every job settles on-chain rather than through a Worqen-held account, so the sanctions and anti-money-laundering screening described in Section 12.1 protects escrow settlement only where the wallet doing the funding or receiving belongs to the same verified person we have screened.

The wallet you settle through. Settlement wallets come in two forms, and they are not both self-custodial. A self-custodial external wallet (for example Phantom or Solflare) is controlled by you alone and Worqen holds no key to it. A platform-managed wallet is generated by Worqen at your request; Worqen stores its private key in encrypted form and signs transactions with it on your instruction, and you can reveal and export that key at any time. The full description of the two options, and of what Worqen does and does not hold in each, is in Terms of Service Section 8.

Where you use a platform-managed wallet, that wallet is created for a single verified account holder and is bound to your verified identity from the moment it is generated, so the screening in Section 12.1 attaches to it directly.

Wallet-to-identity binding. When you connect an external Solana wallet to fund or receive escrow, you confirm that the wallet is controlled by you, the verified account holder. We associate the wallet address(es) you use for escrow with your verified identity record and retain that association for the AML record-keeping periods set out in Section 6. This linkage is described as a data category in the Privacy Policy under "Transactions and wallets".

You must not:

• Fund escrow from, or receive escrow into, a wallet you do not control;
• Use a wallet belonging to a sanctioned person, or to a third party who has not completed verification, to move funds through the Service;
• Use a settlement wallet to help another person circumvent identity verification or sanctions screening (see also the Acceptable Use Policy).

Consequences. Where we have reasonable grounds to believe a settlement wallet is not controlled by the verified account holder, or is linked to a sanctioned person or to circumvention of these controls, we may pause the affected transaction, require re-verification, freeze funds already in escrow pending review, or suspend or terminate the account. Because blockchain transactions are irreversible, we cannot reverse a transfer once it has settled on-chain; these controls operate before funding and release, not after settlement.

We do not screen wallet addresses against sanctions lists on-chain. Worqen is not licensed or authorised as a crypto-asset service provider under Regulation (EU) 2023/1114 (MiCA) or as a comparable virtual-asset service provider in any other jurisdiction; the platform-managed wallet described above is offered as an ancillary convenience for using the marketplace rather than as a standalone custody or asset-administration service, and the position is set out more fully in Terms of Service Section 8. The wallet-to-identity binding in this Section is an anti-money-laundering control that ties the on-chain money leg back to the verified person, in line with the legal obligations set out in Section 2.

13. Contact

Worqen OÜ — Tallinn, Estonia
Verification questions / appeals: dpo@worqen.com