For Verification Subject Data:

• Customer is the Controller.
• postal.ID is the Processor.

postal.ID will process Verification Subject Data only on Customer's documented instructions, including configuration settings, API calls, and written support requests.

postal.ID ensures persons authorized to process personal data are bound by confidentiality.

postal.ID will implement appropriate technical and organizational measures as described in Annex 2.

Customer authorizes postal.ID to use subprocessors listed in Annex 3. postal.ID will provide notice of new/changed subprocessors and allow Customer to object within [X] days.

postal.ID will assist Customer (to the extent applicable) with:

• data subject rights requests;
• security and breach notifications;
• DPIAs/consultations, reasonably requested.

postal.ID will notify Customer without undue delay after becoming aware of a personal data breach involving Verification Subject Data.

Customer may audit postal.ID's compliance with this DPA on reasonable notice, subject to confidentiality and security constraints, and not more than [once per year] unless a breach occurs.

At termination, postal.ID will delete or return Verification Subject Data as configured, subject to legal retention requirements.

Where transfers of EU/EEA or UK personal data occur to jurisdictions without adequacy, the parties will incorporate appropriate safeguards (see Transfer Addendum).

• Subject matter: Proof of Address verification; optional digital verification; optional KYC/AML integrations if enabled.
• Duration: Term + retention period configured by Customer.
• Nature/purpose: Provide verification workflows and evidence artifacts; fraud prevention and security.
• Categories of data subjects: Subjects, Customer admin users (for account access logs), Customer contacts.
• Categories of personal data (verification): name, address, email/phone, verification codes (hashed), delivery events, audit logs, device/IP metadata (if enabled).
• Special categories: only if Customer enables KYC/biometric/liveness modules via third-party vendors (handled under separate addendum).

[Insert controls: encryption, access controls, logging, key management, backups, incident response, SDLC, etc.]

[Insert subprocessor table or reference URL with versioning.]