Your information, explained.
This notice explains the information used to manage your account, review your passport and protect the service. It sets out why information is used, who can access it and how to exercise your rights.
01Who is responsible for your data
1.1 World Interactive LLC operates sureaddress and is the data controller for the account and service information described in this notice. The controller determines why and how that information is used. Our company and contact details are set out in section 14.
1.2 This notice covers visitors, applicants and account holders using the current website. It explains the information handled through registration, verification, service administration and website security. It does not replace a separate privacy notice issued by your bank, a government service or a carrier.
1.3 Reading this notice or accepting service terms does not amount to consent to every possible use of your information. Where consent is required for a particular optional purpose, that purpose and your choice must be explained separately.
02The information we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account details | Full name, email, registration date, accepted terms version and saved plan, location, handling and start-date preferences. | Information you enter; authorised account corrections. |
| Identity documents | The uploaded passport image or PDF, including the personal details visible on it, file type, size, upload date and verification decision. | Your upload and the administrator's review. |
| Service & payment records | Assigned address, service dates, credit balance, payment dates and amounts, transaction references and record corrections. | Your preferences, administrator actions and supplied payment records. |
| Security & activity | Connection IP address, browser information, attempted login or registration email, event time and outcome, and administrative access events. | Your connection and actions on the website. |
| Authentication | Protected password and recovery-code representations, session identifiers and security tokens. | Registration, sign-in and recovery actions. |
2.1 An entered email on a failed login attempt is a record of what was submitted, not proof that its owner made the attempt. The current service does not verify email ownership by sending a verification email.
2.2 The enquiry form saves a text draft to your device. Its message is not currently submitted to the Company. If you send it separately, the recipient will receive the information you choose to include.
03Purposes & lawful bases
We use personal information for the purposes below. The relevant legal basis depends on the activity and the information necessary to perform it.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Provide an account and agreed service | Identity, contact and service preferences; account status and transactions. | Performance of a contract or requested pre-contract steps, to the extent necessary. |
| Review identity and prevent misuse | Passport submission and review outcome. | Legitimate interests in confirming identity and protecting the service, subject to necessity and a documented balancing assessment. |
| Protect accounts and investigate incidents | Authentication and limited activity records. | Legitimate interests in account security, service integrity and abuse prevention. |
| Maintain required business records | Relevant payment and service records. | Legal obligation where a specific applicable record-keeping duty exists. |
We do not currently run advertising or promotional email campaigns through the website. Any future optional marketing or additional processing must have its own appropriate basis and notice. See the ICO's lawful-basis guidance.
04Passport uploads & verification
4.1 The service requires a UK passport upload to progress identity review. The document can contain a photograph, passport number, date and place of birth, nationality, signature and other details shown on the photo page. Upload only the document requested and avoid including unrelated pages or another person's information.
4.2 Uploaded documents are encrypted in storage. Access to download them is restricted to authorised administrators and is recorded in the account activity log. Administrators can approve verification after review; the account then displays the decision and approval date.
4.3 The service does not carry out facial recognition, biometric matching or automated passport authentication. Checks that a file is readable as an image or PDF are not an identity decision. No external identity-verification provider is connected.
4.4 If you do not provide the required document, verification cannot be completed. Information in the document is used for the identity review and related security purposes described in this notice.
05Payment & service information
5.1 The account stores payment records supplied by the operator and service-credit activity created by administrators. Records can include an amount, date, plan, reference and an indication of their source. Changes may retain an earlier value so a correction can be understood.
5.2 Online card processing is not connected, and the website does not collect card numbers or card security codes. A future payment provider, if introduced, will be identified together with the relevant data-sharing arrangements before the feature is used.
5.3 Customer payment history is restricted to the signed-in account. Authorised administrators can review the account and its service-credit activity to administer the service.
06Access & sharing
6.1 Authorised people administering sureaddress can access account information needed for support, verification, security and service administration. Verification downloads and specified administrative actions are logged.
6.2 The website loads fonts from Google Fonts and some photographs from Unsplash. Your browser contacts these providers directly and can disclose your IP address and ordinary request information. They are not given access to the account database or passport files by this integration.
6.3 Account records are held in the service database. Before an additional supplier is given access, the Company must identify its role, limit the information shared and establish the relevant data-protection arrangements. This notice will be updated to describe material changes to the recipients of your information.
6.4 We do not sell account information or supply it to advertising networks through this website. Disclosure to an authority or another party must have a valid basis and be limited to what is required; it is not an unrestricted permission to share personal documents.
07How long information is kept
Retention depends on the purpose of the record and any applicable obligation. Account closure, completion of verification, outstanding transactions, disputes and legal record-keeping duties are relevant when deciding whether continued retention is necessary.
| Record | Current treatment |
|---|---|
| Account, service & payment information | Retained in the account database until an authorised deletion. When reviewing retention, the Company considers account administration, outstanding transactions, applicable record-keeping duties and the resolution of disputes. |
| Passport files & approval records | Stored separately as encrypted verification records after review. Deletion is administered by the Company; completing verification does not automatically delete the uploaded file. Retention should be limited to an ongoing verification, security or legal need. |
| Security activity | Older entries are pruned during service use after 90 days, with an additional limit of approximately 100,000 recent events. Pruning runs when the service is used. |
| Login sessions | Access expires after up to seven days, or after 24 hours without activity. An anonymous session lasts up to one hour. Expired access does not mean the underlying account has been deleted. |
| Enquiry drafts | A file saved on your device, retained until you delete it or according to your device's settings. |
Signing out removes access through that session; it does not erase your account, passport or transaction history. A deletion request should identify the information concerned so the Company can assess it alongside any applicable retention obligation.
08Cookies & external resources
8.1 The website uses a first-party cookie to associate requests with a login or anonymous session and support account security. It contains an opaque identifier rather than your password, passport image or payment details.
| Name | Purpose | Lifetime |
|---|---|---|
letterlane_sessionor, on HTTPS, __Host-letterlane_session | Recognises the session and supports authenticated account requests. | Up to seven days when signed in; up to one hour for an anonymous session. Server-side inactivity limits also apply. |
8.2 The website does not use advertising, analytics or cross-site tracking tools. You can remove or block cookies in your browser, but account functions may stop working. Any new non-essential storage or tracking must be disclosed and the required choice provided before use.
8.3 Google Fonts and Unsplash make separate network requests when their resources are loaded. See the providers' Google privacy policy and Unsplash privacy policy for their processing. The ICO explains when storage and access exceptions apply.
09International processing
9.1 Service infrastructure and externally loaded resources can involve processing in more than one country. The use of a UK postal address does not by itself determine where website or supplier data is processed.
9.2 Before a restricted international transfer, the Company must identify the destination, recipient and applicable transfer mechanism. Depending on the arrangement, this may involve UK adequacy regulations or appropriate contractual safeguards and an assessment of the relevant protections.
9.3 Details of a mechanism and how to obtain information about the safeguards must be provided once the actual transfer arrangement is known. See the ICO's international-transfer guidance.
10Security & confidentiality
10.1 The current service uses password hashing, encrypted passport storage, access-controlled account routes and restricted administrator access. Sessions and sensitive responses are protected by server-side checks. These measures reduce risk but do not make any system immune to misuse or error.
10.2 Keep your credentials private and sign out on shared devices. A recovery code can provide access to password recovery and should be protected accordingly. Do not send passport copies in an ordinary enquiry when a dedicated upload is available.
10.3 If you believe information has been disclosed incorrectly or an account is compromised, use the confirmed Company contact. The Company must assess incidents and make notifications required by the applicable law.
11Your privacy rights
Depending on the circumstances and legal basis, you may request access, correction, erasure, restriction of use or a portable copy of eligible information. You may withdraw consent where processing relies on it, without changing the lawfulness of earlier use.
Your right to object: you may object to processing based on legitimate interests because of your particular situation. You can object to direct marketing at any time.
Rights are subject to applicable conditions and exemptions. Requests normally receive a response within one month, with extensions or other adjustments where the law permits. We may need proportionate information to confirm identity; a further passport copy should not be requested automatically for every enquiry.
Use the contact in section 14. You may also complain to the Information Commissioner's Office. See the ICO's explanation of data protection rights.
12Automated decisions & younger users
12.1 Passport approval is made by an administrator. The website applies automated technical rules, including login rate limits, session expiry, upload format checks and credit eligibility calculations. These rules do not perform biometric profiling or an automated assessment of a person's immigration or banking eligibility.
12.2 If an account status appears incorrect, ask the Company to review the relevant record. A status in the profile reflects service administration and should not be treated as a decision made by a bank or public authority.
12.3 The service is intended for adults and is not designed to collect children's passport documents. Contact the Company if a child's information has been submitted so its appropriate treatment can be reviewed.
13Changes to this notice
13.1 This notice was updated on 15 December 2023. Its version and date identify the wording you are reading. Future material changes to data purposes, recipients or retention should be explained before the changed processing begins.
13.2 Introducing a hosting service, payment provider, email notification system, identity-checking vendor or mail-handling operation may require a revised notice. A new page alone does not provide consent where a separate choice is required.
13.3 The information a privacy notice should contain is described in the ICO's transparency guidance.
14Controller details & privacy enquiries
- Data controller
- World Interactive LLC
- Service brand
- sureaddress
- Contact
- Use the Company contact provided with your account or service agreement.
Send privacy enquiries to the Company contact provided with your account or agreement. Include your account email, describe the information or activity concerned and tell us which right you wish to exercise. Avoid including unnecessary identity documents in an initial enquiry.
Where a representative or data protection officer is required, their contact details must be made available through the Company. You may exercise your rights without appointing a professional representative.
You can contact the UK privacy regulator through the ICO complaints service.