Digital ID Card Service Product Addendum
Version 2.0 • Nov 30, 2026 View Previous Versions
Overview
This Digital ID Card Service Product Addendum (“Product Addendum”) describes the Subscription for the Licensed Product and is incorporated into and forms part of the Master Service Agreement (“MSA”) between Client and ID123 Inc. (“Service Provider”) in the version applicable to Client’s Subscription, together with any other incorporated addenda, each as amended from time to time (the “Agreement”). Nothing in this Product Addendum waives either Party’s rights or obligations under the Agreement. Capitalized terms not defined here have the meanings given in the Agreement.
1. Licensed Product
The “Licensed Product” refers to the ID Management System (“IDMS”) and Digital ID Card Wallet App (“ID Wallet”) provided by the Service Provider through its Cloud Service. The Licensed Product enables the Client to manage ID card records that can be installed, displayed and used by individual users (“End Users”) within their ID Wallet (“Digital ID Cards”) or printed on physical cards (“Physical ID Cards”) using compatible third-party ID card printers. The range of available actions within the Licensed Product depends on the Client’s Subscription level, and may include: (A) designing digital and physical ID card templates; (B) creating, updating and archiving ID card records; (C) issuing Digital ID Cards to End Users and managing installed Digital ID Cards; (D) communicating with End Users through in-app messaging; (E) printing Physical ID Cards from ID card records; (F) integrating with third-party services; and (G) interacting with third-party hardware.
2. Cloud Service Account Access and Management
The Client’s access to the IDMS is provided through a Cloud Service account (“Account”). Account access commences on the Subscription Start Date and continues until termination of this Product Addendum or the Agreement. Each Account is designated for use by only one institution.
The Client may request multiple Accounts, and each requested Account with a Subscription will remain active for the duration of its Subscription Term. The Client is responsible for all agreed costs and fees associated with the usage of each active Account, and must manage and monitor its Accounts to ensure compliance with this Product Addendum and applicable laws, regulations and guidelines.
Account profile. The name and address of the institution recorded in the Account profile are used to identify the Customer of Record under Section 14.14 of the MSA and to determine the application of any jurisdiction-specific terms of the Data Processing Addendum. Client is responsible for keeping that information current.
Data Region. IDMS data is partitioned logically by geographic region (“Logical Region”), and each Account is set up in the Logical Region in which Client issues ID cards to End Users. A Logical Region is hosted in a Cloud Provider Region selected by Client by reference to its own place of establishment (the “Data Region”). Relocation of Client Data to a different Cloud Provider Region is governed by Section 3.3.2 of the MSA.
Encryption. Client Data is encrypted at rest and in transit as described in the Data Processing Addendum.
3. Subscription Period
The Subscription period of the Licensed Product commences on the Effective Date of the initial order and continues for an initial term set forth below (the “Initial Term”). After the Initial Term, the Subscription renews for successive periods of equal duration (each a “Renewal Term”), as set forth below, unless terminated by either party as described below.
If the Initial Term is one (1) year, the Subscription automatically renews for successive one (1) year Renewal Terms, each a Subscription Period, unless terminated by either party. To terminate the Subscription, either party must give written notice of its intent not to renew at least thirty (30) days before the end of the then-current Subscription Period, unless otherwise agreed in writing. For the Client’s convenience, the Client may also give notice of termination within the first 30 days after the start of a new one (1) year Subscription Period, in which case any prorated fees for usage during that period, and any annual fees passed through by third parties that are not refundable, will be due.
If the Initial Term is one (1) month, the Subscription automatically renews for successive one (1) month Renewal Terms, each a Subscription Period, unless terminated by either party before the next Renewal Term. The Service Provider will give Client 30 days’ advance written notice of its intent not to renew. The Client will authorize an Account administrator to terminate its Subscription by signing into its Account and electing to terminate immediately or at the end of the current Term. For data security reasons, the Client may not cancel a monthly Renewal Term solely by giving an email notice of termination.
4. Usage-Based Pricing and Subscription Fee
The pricing for the Licensed Product comprises a subscription fee and usage fees. The Subscription fee covers the Client’s access to the Account and the features included within its selected Subscription tier. Usage fees are charged per card, by reference to the number of Digital ID Card records present in the Client’s Account during each Subscription Period.
The usage fee amount may vary based on the integrations selected by the Client and on any additional features or services not included in the Subscription fee. The Subscription fee may include a predetermined number of Digital ID Card records intended to be issued during the Subscription Period; if the Client exceeds that number, additional usage fees apply for each additional Digital ID Card record.
The Client will be billed for the Subscription fee at the beginning of the Subscription Period and invoiced for applicable fees, including usage fees, in each subsequent monthly invoice cycle or as otherwise specified in the Order Form. The Client is responsible for paying all applicable fees in accordance with the payment terms in the Agreement.
5. Payment Terms
The Client agrees to the following payment terms for the Subscription fee and usage fees associated with the Licensed Product:
(A) Invoicing. The Subscription fee is invoiced based on the Subscription tier selected. Usage fees not prepaid are invoiced monthly thereafter or at the end of the Subscription Period.
(B) Payment due date. All amounts due must be received by the Service Provider no later than 30 days from the date the invoice is made available to the Client or, if applicable, in accordance with the payment schedule in the Order Form. Amounts not received by the due date are past due.
(C) Late payment. The Service Provider may charge interest on past due amounts at the rate of 1.5% per month, or the maximum rate permitted by applicable law if lower, from the due date until paid in full.
(D) Payment methods. The Client must pay using the payment methods agreed in the Order Form, and is responsible for any fees or charges associated with its chosen payment method.
6. Issuance and Responsible Use of Digital ID Cards
The Client is responsible for the issuance of Digital ID Cards to its End Users through the Licensed Product, and must ensure that each Digital ID Card is issued to the correct individual and that the information contained in it is accurate, current and compliant with applicable laws, regulations and guidelines.
The Client is also responsible for monitoring and managing the use of Digital ID Cards by its End Users, and must take appropriate measures to ensure that End Users do not use Digital ID Cards improperly, fraudulently or unlawfully, which may include providing clear usage instructions, establishing and enforcing usage policies, and implementing measures to detect and prevent unauthorized or fraudulent use.
If the Client becomes aware of improper, unauthorized or fraudulent use of a Digital ID Card by an End User, it must promptly take appropriate action, including notifying the Service Provider where necessary.
The Service Provider disclaims liability for the misuse of Digital ID Cards by Client’s End Users and for any consequences or damages resulting from such misuse. The Client is solely responsible for the misuse of its issued Digital ID Cards by its End Users and for ensuring compliance with all laws, regulations and guidelines relating to their issuance and use.
7. Administrator Permissions and System Emails
The Client is responsible for inviting and granting permissions to its Account administrators in accordance with applicable data protection and data transfer laws, and must ensure that its administrators have access rights consistent with the Client’s privacy policies, contractual obligations, and each administrator’s employer, physical location, role and responsibilities, and that those permissions do not contravene applicable law.
The Service Provider sends system emails to administrators invited by the Client, including account creation, password reset, notifications and other Account-related information necessary for effective management of the Account.
The Client is responsible for providing accurate email addresses for its administrators, for ensuring that invited administrators are authorized to access and manage the Account, and for ensuring that the transfer and storage of email received by its administrators complies with applicable law. The Service Provider disclaims liability for unauthorized access or misuse resulting from email addresses provided by the Client.
The Service Provider makes reasonable efforts to ensure deliverability of system emails but cannot guarantee delivery or prevent mishandling due to factors beyond its control, such as Client email server settings, spam filters or incorrect addresses, and disclaims liability for failure of delivery or the Client’s mishandling of system emails.
8. Email Invitations and Reminders
The Service Provider, on behalf of the Client, may send email invitations to End Users inviting them to install the ID Wallet and their Digital ID Cards. The Client may customize the content of these invitations. If a Digital ID Card is not installed within a specified period, the Service Provider will also send reminders to the End User to complete installation.
The Client is solely responsible for the content of email invitations and reminders and for ensuring that they comply with applicable law, including in respect of the collection of email addresses and the sending of End User Personal Data by email. The Service Provider disclaims liability for the content of these emails and for any consequence of the Client’s collection of email addresses or of the dissemination of inappropriate or non-compliant content initiated by the Client.
The Service Provider makes reasonable efforts to ensure deliverability of email invitations and reminders but cannot guarantee delivery or prevent mishandling due to factors beyond its control, and disclaims liability for failure of delivery or for the mishandling of email invitations and reminders by the Client or End Users.
The Service Provider maintains logs of email invitations for a duration based on the Client’s Subscription level and settings, after which they are deleted. It is the Client’s responsibility to purchase a Subscription level with adequate log retention.
9. End User Registration and Data Roles
9.1 Registration. On receiving an invitation or instruction, each End User registers with the ID Wallet directly by clicking the invitation or opening the ID Wallet app, providing an email address or telephone number to the Service Provider, and agreeing to the End User License Agreement (“EULA”) to create an ID Wallet account. The End User may also provide a name when registering. The ID Wallet collects device information to identify each device used by the End User and generates pseudonymized tokens representing the device and the ID Wallet account. The ID Wallet may also collect the End User’s consent to receive communications, including push notifications delivered through the Apple and Google platforms; consent for push notifications, and the transfer and storage of push notification data, are between the End User and the relevant platform provider.
9.2 Allocation of roles. Data Processed in connection with the ID Wallet is Processed in the capacities set out in the following table.
| Data | Capacity in which the Service Provider Processes it |
|---|---|
| Digital ID Card records issued by Client, including card template data, photographs, identification numbers and attributes | Processor, on behalf of Client |
| The association between a Digital ID Card and the ID Wallet account on which it is installed | Processor, on behalf of Client |
| In-app messages, and email invitations and reminders sent at Client’s direction | Processor, on behalf of Client |
| Face data Processed for photo validation or identity verification | Processor, on behalf of Client; Processed transiently and not retained |
| ID Wallet account information, being the email address or telephone number used for authentication and the name the End User provides, together with device information, pseudonymized device and account tokens, and communication preferences | Controller where the account uses a personal email address; Processor where Section 9.3 applies |
| Support requests an End User submits directly to the Service Provider about the technical operation of the ID Wallet | Controller where the account uses a personal email address; Processor where Section 9.3 applies. Requests concerning Digital ID Card data are referred to Client under Section 16. |
9.3 Institutional email addresses. Where an End User’s ID Wallet account is registered with an email address in a domain belonging to the Client that issued a Digital ID Card held in that account, the Service Provider Processes that End User’s ID Wallet account information, device information and direct support requests as Processor on behalf of that Client, and not as Controller. That Processing is subject to the Data Processing Addendum and, where applicable, the Student Data Protection Addendum.
9.4 Personal email addresses. Where an End User registers with, or changes the ID Wallet account to, a personal email address, including in order to retain possession and control of their content in a personal account where applicable law provides for that, the End User establishes a direct relationship with the Service Provider, and from that point the Service Provider Processes as Controller only the ID Wallet account information, device information and communication preferences needed to operate the account. Digital ID Card records issued by a Client, and the data within them, remain the Client’s and are Processed on its behalf in either case. The Service Provider uses data it Processes as Controller under this Section only to operate, secure, support, maintain and improve the ID Wallet, to send service communications and to comply with law, and does not sell it, use it for targeted advertising, or use it to build profiles of End Users.
9.5 Data Region and transfers. ID Wallet account information, communication preferences and device information received directly by the Service Provider during registration are stored in the Data Region corresponding to the location in which the End User registered. A Digital ID Card issued by Client is linked to the End User’s ID Wallet account on installation in the same Data Region. An End User may register for an ID Wallet account in more than one Data Region where the End User needs to install Digital ID Cards issued in more than one Data Region. Where the Service Provider acts as Controller under Section 9.2, its direct collection of that information does not constitute a transfer of Personal Data by Client.
9.6 Privacy notice. The rights of End Users in respect of data the Service Provider Processes as Controller are described in the Service Provider’s Privacy Policy.
10. In-App Messaging and Push Notifications
The Licensed Product enables the Client to send in-app messages and push notifications to alert End Users of events related to a Digital ID Card’s lifecycle and to inform them that a new in-app message is available. The content of in-app messages is stored and processed by the Service Provider in the Account’s Data Region and is encrypted in transit between the Data Region and the ID Wallet. The content of a push notification may be transferred away from the Client’s Data Region and processed by third parties having their own relationship with each End User, such as Apple and Google; the Client therefore agrees not to include End User Personal Data in the text of a push notification.
The Client is solely responsible for the content and frequency of the in-app messages and push notifications it sends or configures, and for compliance with applicable laws on electronic communications and data privacy. The Service Provider disclaims liability for the content or consequences of such messages and notifications.
The Service Provider strives to ensure timely delivery of in-app messages and push notifications, but delivery may be affected by factors beyond its control, and the Service Provider is not responsible for delayed or undeliverable messages or notifications.
The Service Provider maintains logs of in-app messages for a duration based on the Client’s Subscription level and settings, after which they are deleted. It is the Client’s responsibility to purchase a Subscription with adequate log retention.
11. Physical ID Card Printing
The Licensed Product allows the Client to design and print Physical ID Cards using third-party ID card printers. The Client will comply with all applicable laws, regulations and guidelines governing the creation, use and distribution of Physical ID Cards, and is responsible for selecting and maintaining the appropriate printer, printing materials and any other equipment or supplies.
The Service Provider disclaims liability for the quality, performance or functionality of Physical ID Cards, which depend on the Client’s choice of printer and materials and its adherence to the Service Provider’s guidelines, and is not responsible for any damage, loss or issue arising from the use, distribution or possession of Physical ID Cards.
12. Categories of Personal Data
12.1 Supported categories. The Licensed Product is designed and approved to Process the following categories of Personal Data: (a) identity attributes, including name, date of birth, gender and pronouns, photograph and signature; (b) identification numbers assigned by Client or by a government or other issuing authority and printed on or associated with a credential; (c) facial images and supporting identity documentation submitted for credential issuance, photo validation and identity verification; (d) contact information; (e) affiliation, membership, employment, education, entitlement, certification, licence and status attributes; and (f) device, usage and log data generated through use of the Licensed Product.
12.2 Special categories. Where a Client’s credential requires it, the Licensed Product is designed to Process the categories of Sensitive Data described in Appendix 1 of the Data Processing Addendum, for the purposes stated there. This Section is the specification referred to in Section 7.1.2(a) of the MSA.
12.3 Health attributes. A health-related attribute displayed on or associated with a credential, such as a disability, patient, caregiver or health professional designation, is a supported category for the purposes of Section 7.1.2(b)(i) of the MSA. The Licensed Product is not designed to hold medical records or clinical information, and Client will not use it for that purpose.
13. Automated Processing and Artificial Intelligence
13.1 Photo guideline validation. The Licensed Product may apply automated checks to ID photographs submitted by End Users or uploaded by Client in order to identify departures from the photo guidelines configured by Client, such as whether the subject’s eyes are open, whether headwear or dark eyewear obscures the face, and whether the framing meets the card template. These checks produce a pass or fail signal. Client, and not the Service Provider, determines whether a photograph is accepted.
13.2 Face comparison. Where enabled by Client and permitted by the End User, the Licensed Product may perform a one-to-one comparison between a photograph or video captured by the End User in the ID Wallet and the photograph associated with that End User’s card record, to confirm that the person installing a Digital ID Card is the person to whom it was issued. The Licensed Product does not perform one-to-many facial identification and does not maintain a facial template database.
13.3 Synthetic images. The Service Provider does not use automated tools to generate synthetic photographs of a person’s face.
13.4 No automated decisions with legal effect. The processing described in this Section is a quality and fraud-prevention control and does not constitute a decision based solely on automated processing producing legal effects concerning an End User or similarly significantly affecting them. Client retains the ability to review, override, and manually approve or reject any outcome through the IDMS, and is responsible for making a route to human review available to End Users.
13.5 Face data. Face data derived for the purposes described in Sections 13.1 and 13.2 is processed transiently, is not written to persistent storage, and is not included in backups. Further detail is published in the Service Provider’s Biometric Data Statement.
13.6 Model training. The Service Provider will not use Client Data, End User Personal Data, ID photographs, or any data derived from them to train, fine-tune, evaluate or otherwise develop artificial intelligence or machine learning models except with Client’s prior written consent. Where such consent is given, the Service Provider will use only that Client’s data and only for the purpose of providing the Services to that Client. This position is given contractual effect in the Data Processing Addendum.
13.7 Third-party services. The Service Provider will not transmit Client Data to a third-party artificial intelligence or machine learning service unless that service is listed as a Sub-processor and is contractually prohibited from using the data to train or improve its models, with any retention limited to what is necessary to perform the requested function and to meet that service’s own security, abuse-monitoring and legal obligations.
13.8 Changes. The automated processing features available in the Licensed Product may change from time to time and are described in the current version of this Product Addendum.
14. Audits and Investigations
The Client acknowledges that the Service Provider is not obliged to monitor or audit any Client Data or content. The Service Provider may nevertheless, where there is good cause, audit, investigate, or refuse, remove or disable access to content that it reasonably believes violates the Agreement or applicable law, to the extent reasonably necessary to address the matter, and will notify the Client promptly where legally permitted.
The Service Provider will not monitor Client Data that is Personal Data, and will not audit such Personal Data, without the express permission of the Client, the Client’s authorized representative, or the End User to whom it relates, except where required by law or where necessary in good faith for: (a) investigation of suspected or reported fraud; (b) investigation of a suspected or reported data breach; (c) investigation of a breach of the Agreement; (d) ensuring compatibility with a software update; or (e) protecting the security of the Services or the health or safety of any individual.
These activities form part of the Client’s documented instructions under the Data Processing Addendum. The Client remains responsible for ensuring that the content it provides, transmits or uses in connection with the Licensed Product complies with this Product Addendum and applicable law. The Client must promptly address any issue the Service Provider raises regarding content and take appropriate action to rectify any violation.
15. Client Support
The Service Provider offers support for the effective use of the Licensed Product, which may include documentation, training materials, troubleshooting and direct assistance from its support team.
Depending on the Subscription tier, the support team can be contacted through designated channels during specified business hours, and will make reasonable efforts to respond to and resolve Client inquiries in a timely manner, prioritizing requests by urgency and impact.
The Client is encouraged to use the Service Provider’s support resources, such as knowledge bases, FAQs and user guides.
The Service Provider may charge additional fees for support and training beyond the basic support offering, which will be communicated to and agreed with the Client before they are provided.
16. End User Support
The Client is responsible for End User support relating to use of the Licensed Product, and must provide a support email address and telephone number for each Digital ID Card it issues. The Client may not publish or provide the Service Provider’s support contact details to support an End User.
End Users may occasionally contact the Service Provider directly through a contact address published in an app store or on the Service Provider’s website. The Service Provider will assess each such request and either redirect the End User to the Client’s support contact or handle the request directly where it concerns the technical operation of the ID Wallet. Requests concerning Digital ID Card data are referred to the Client. The capacity in which the Service Provider Processes a direct support request is set out in Section 9.
17. Service Uptime
The service level applicable to the IDMS is set out in Section 3.4 of the MSA, or in a separate Service Level Agreement between the Parties where one is in force.
Digital ID Cards installed within the ID Wallet are designed to function offline once successfully installed, so that End Users can use them where connectivity is unavailable or limited. Features requiring connectivity, such as signing in, updates and synchronization with the IDMS, may not be available offline.
18. System Integrations
The Licensed Product may be integrated by the Client with external systems, such as access control, door entry or backend systems, to synchronize ID card data. The Client is responsible for the proper implementation, configuration and maintenance of these integrations in accordance with the Service Provider’s guidelines and applicable law.
The Service Provider disclaims liability for issues, malfunctions or damages resulting from the Client’s integrations with external systems, including data loss, security breaches, unauthorized access or disruption. Any assistance the Service Provider provides in relation to integrations is provided as-is without warranty.
The Service Provider may limit, suspend or terminate the Client’s access to integration features if the Client uses them in a manner that violates applicable law or the Agreement.
19. Google Play Store
The following applies to the ID Wallet which End Users download from the Google Play Store (“Google Play Apps”): (i) Client acknowledges that the Agreement is between Client and the Service Provider only, and not with Google LLC (“Google”); (ii) all use of Google Play Apps must comply with the current Google Play Store Terms of Service; (iii) Google is only a provider of the Google Play Store where End Users obtain the Google Play Apps; (iv) the Service Provider, and not Google, is solely responsible for its published Google Play Apps; (v) Google has no obligation or liability to Client with respect to Google Play Apps or the Agreement; and (vi) Client acknowledges that Google is a third-party beneficiary of the Agreement as it relates to the Service Provider’s Google Play Apps.
20. Apple App Store
The following applies to the ID Wallet which End Users download from the App Store (“App Store App”). The Agreement is solely between Client and the Service Provider, not Apple, and Apple has no responsibility for the App Store App or its content. Use of the App Store App must comply with the App Store Terms of Service. Apple has no obligation to furnish maintenance or support services for the App Store App and no other warranty obligation in respect of it; any claims, losses, liabilities, damages, costs or expenses attributable to a failure to conform to any warranty are governed solely by the Agreement and the law applicable to the Service Provider as provider of the software. Apple is not responsible for addressing any End User or third-party claim relating to the App Store App or its possession or use, including product liability claims, claims that it fails to conform to a legal or regulatory requirement, and claims under consumer protection or similar legislation. In the event of a third-party claim that the App Store App or its possession and use infringes intellectual property rights, the Service Provider, not Apple, is solely responsible for its investigation, defence, settlement and discharge. Apple and its subsidiaries are third-party beneficiaries of the Agreement as it relates to the App Store App and may enforce these terms against Client as such.
21. Mobile Apps
To use the ID Wallet, each End User must have a valid email address or telephone number and a mobile operating system compatible with the ID Wallet. The Service Provider does not warrant that the ID Wallet is or will remain compatible with every device or operating system, and is not responsible for data charges an End User may incur. The Service Provider may publish upgraded versions of the ID Wallet which, if configured by the End User, may upgrade automatically, and may for good cause require End Users to upgrade the ID Wallet, or their operating system, to continue to use Digital ID Cards or to remain compatible with required security features.
22. Free Trial
If the Service Provider offers, and Client registers for, a free trial of the Licensed Product, the Service Provider will make the applicable Account available to Client free of charge until the earliest of (a) the end of the free trial period for which Client registered, (b) the date Client purchases a Subscription, or (c) termination of the trial by the Service Provider at its discretion. Additional trial terms may appear on the trial registration page, including the duration of the trial, and are incorporated into this Product Addendum and binding during the free trial. The Service Provider may limit or modify the free trial at any time.
22.1 WITH RESPECT TO THE FREE TRIAL, CLIENT DATA AND CONTENT TRANSFERRED TO THE IDMS DURING THE FREE TRIAL MAY BE PERMANENTLY LOST UNLESS A SUBSCRIPTION TO THE SAME FEATURES IS PURCHASED BEFORE THE END OF THE FREE TRIAL PERIOD. NOTWITHSTANDING ANY REPRESENTATION OR REMEDY IN THE MASTER SERVICE AGREEMENT, INCLUDING SECTIONS 5, 9.1, 9.4 AND 9.5, DURING THE FREE TRIAL THE LICENSED PRODUCT IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, AND THE SERVICE PROVIDER HAS NO INDEMNIFICATION OBLIGATION OR LIABILITY OF ANY KIND IN RESPECT OF USE DURING THE FREE TRIAL, SAVE WHERE SUCH EXCLUSION IS NOT ENFORCEABLE UNDER APPLICABLE LAW, IN WHICH CASE THE SERVICE PROVIDER’S LIABILITY IN RESPECT OF THE FREE TRIAL WILL NOT EXCEED US$100. WITHOUT LIMITING THE FOREGOING, THE SERVICE PROVIDER DOES NOT REPRESENT OR WARRANT THAT (A) USE DURING THE FREE TRIAL WILL MEET CLIENT’S REQUIREMENTS, OR (B) USE DURING THE FREE TRIAL WILL BE UNINTERRUPTED, TIMELY OR ERROR-FREE. EXCEPT FOR CLIENT’S REMEDY FOR DISCLOSURE OF CONFIDENTIAL INFORMATION UNDER SECTION 6 OF THE MSA, CLIENT’S SOLE REMEDY FOR ANY BREACH OF THESE TERMS DURING THE FREE TRIAL IS TERMINATION OF THE FREE TRIAL ACCOUNT. CLIENT IS LIABLE TO THE SERVICE PROVIDER AND TO END USERS FOR ANY DAMAGES ARISING FROM ITS BREACH OF THIS PRODUCT ADDENDUM OR ITS USE OF THE LICENSED PRODUCT DURING THE FREE TRIAL.