For Verification Subject Data processed in connection with Customer's use of the verification service:

• Customer is the Controller; and
• postal.ID is the Processor, processing only on Customer's documented instructions.

For postal.ID's own Website/Admin/Billing Data, postal.ID is a Controller (see Privacy Notice — Website & Customer Admin Users).

• Services: postal.ID platform, portals, APIs, and verification workflows.
• Verification: address verification via postal mail code/QR and optional digital factors (email/SMS OTP), and optional KYC/AML add-ons if enabled.
• Case: a verification request created by Customer.
• Subject: the individual being verified.
• Evidence Pack: generated artifacts and logs for a Case.
• Assurance Level: Digital Verified / Postal Verified / Digital+Postal Verified (defined in Verification Services Terms).

postal.ID grants Customer a non-exclusive, non-transferable right to access and use the Services during the Term, subject to this Agreement, the AUP, and the Order Form.

Customer will:

• ensure it has a lawful basis to provide Subject data and initiate verification;
• provide required notices/consents (especially for SMS/email where required);
• configure policies responsibly (assurance levels, expiry, reminders);
• keep credentials secure and use RBAC appropriately.

postal.ID provides evidence-backed events and artifacts. Customer remains responsible for its onboarding/compliance decisions. postal.ID does not guarantee prevention of fraud or confirm legal residency.

Customer pays for letters from prepaid credit, bought by card on Customer's billing page in amounts from £50 to £5,000.

• VAT. Prices exclude VAT. A customer whose billing address is in the UK pays VAT at 20% on top of each top-up; a customer outside the UK pays no UK VAT. postal.ID's VAT number is GB000000000.
• Letters. A letter's price is taken from the credit when the letter is ordered — when a case, a reissue or a step-up asks for it — and is paid back to the credit if the letter is not posted.
• Expiry. Unused credit expires 12 months after Customer's last top-up. postal.ID e-mails Customer's admins 30 days before it expires.
• Refunds and disputes. If a top-up payment is refunded or disputed, the credit it bought is taken back. If that credit has already been spent, the balance goes below £0.00 and no letter is sent until Customer tops up again.

Each party will protect the other's Confidential Information using reasonable care.

The DPA forms part of this Agreement. Customer instructions are set in the Service configuration, API calls, and documented support tickets.

postal.ID will maintain appropriate technical and organizational measures per the Security Addendum.

postal.ID retains all IP in the Services. Customer retains IP in its data.

postal.ID may suspend access for AUP violations, security threats, suspected fraud, or legal compliance.

Term is as stated in the Order Form. Either party may terminate for material breach not cured within [30] days. On termination, data return/deletion occurs per DPA and retention settings.

Except as expressly stated, Services are provided "as is". postal.ID disclaims implied warranties to the maximum extent permitted by law.

Liability caps and exclusions apply as specified in the Order Form. Common structure:

• cap = fees paid in the [12] months preceding the claim;
• exclude indirect/consequential damages;
• carve-outs for IP infringement and breach of confidentiality as negotiated.

• postal.ID indemnifies Customer for third-party IP infringement claims regarding the Services.
• Customer indemnifies postal.ID for claims arising from Customer data, instructions, or unlawful use.

postal.ID may update Service features. Material changes to legal terms will be notified with reasonable advance notice.

This Agreement is governed by DIFC laws and subject to exclusive jurisdiction of the DIFC Courts.

Order Form → DPA/Transfer Addendum → Security Addendum → this Agreement → policies (AUP, etc.).

Legal notices: legal@postal.id