Data Processing Addendum (DPA) — postal.ID

This DPA forms part of the Master Subscription Agreement.

1. Roles

For Verification Subject Data:

• Customer is the Controller.
• postal.ID is the Processor.

2. Processing on instructions

postal.ID will process Verification Subject Data only on Customer's documented instructions, including configuration settings, API calls, and written support requests.

3. Confidentiality

postal.ID ensures persons authorized to process personal data are bound by confidentiality.

4. Security measures (TOMs)

postal.ID will implement appropriate technical and organizational measures as described in Annex 2.

5. Subprocessors

Customer authorizes postal.ID to use subprocessors listed in Annex 3. postal.ID will provide notice of new/changed subprocessors and allow Customer to object within [X] days.

6. Assistance

postal.ID will assist Customer (to the extent applicable) with:

• data subject rights requests;
• security and breach notifications;
• DPIAs/consultations, reasonably requested.

7. Breach notification

postal.ID will notify Customer without undue delay after becoming aware of a personal data breach involving Verification Subject Data.

8. Audits

Customer may audit postal.ID's compliance with this DPA on reasonable notice, subject to confidentiality and security constraints, and not more than [once per year] unless a breach occurs.

9. Return/deletion

At termination, postal.ID will delete or return Verification Subject Data as configured, subject to legal retention requirements.

10. International transfers

Where transfers of EU/EEA or UK personal data occur to jurisdictions without adequacy, the parties will incorporate appropriate safeguards (see Transfer Addendum).

Annex 1 — Processing details

• Subject matter: Proof of Address verification; optional digital verification; optional KYC/AML integrations if enabled.
• Duration: Term + retention period configured by Customer.
• Nature/purpose: Provide verification workflows and evidence artifacts; fraud prevention and security.
• Categories of data subjects: Subjects, Customer admin users (for account access logs), Customer contacts.
• Categories of personal data (verification): name, address, email/phone, verification codes (hashed), delivery events, audit logs, device/IP metadata (if enabled).
• Special categories: only if Customer enables KYC/biometric/liveness modules via third-party vendors (handled under separate addendum).

Annex 2 — Technical and Organizational Measures

[Insert controls: encryption, access controls, logging, key management, backups, incident response, SDLC, etc.]

Annex 3 — Subprocessors

[Insert subprocessor table or reference URL with versioning.]