1. Overview
These TDS Risk Terms of Service (“Terms”) govern access to and use of TDS Risk and its associated application programming interfaces, dashboard, verification services, fraud and risk signals, audit functionality and related services.
TDS Risk is provided by The Data Supermarket Ltd, a company registered in England and Wales under company number 13855926, whose registered office is at The Innovation Centre, Brunswick Street, Nelson, BB9 0PQ (“TDS”, “we, “us” or “our”).
By creating a TDS Risk account, creating or using an API key, submitting a verification request, purchasing credits or otherwise accessing TDS Risk, the customer (“Customer”, “you” or “your”) agrees to these Terms.
If you accept these Terms on behalf of a company or other organisation, you confirm that you have authority to bind that organisation.
These Terms apply specifically to TDS Risk.
Our general Website Terms continue to apply to use of the TDS website. Where these Terms conflict with the Website Terms in relation to TDS Risk, these Terms take precedence.
2. TDS RISK
2.1
TDS Risk is a fraud, identity and mobile intelligence platform which may make available services including:
- Trust Score
- Mobile KYC
- Session Intelligence
- Trust Score+
- TDS Audit
- Risk Recall
- Smart Alerts
- account-level audit and monitoring functionality; and
- any other risk, identity, telecommunications, compliance or fraud-prevention services introduced by TDS from time to time.
2.2
Not all services may be available at all times or to every Customer.
2.3
TDS may introduce, modify, replace or withdraw individual features or services where reasonably necessary, including because of:
- changes to upstream data providers
- mobile network operator requirements
- legal or regulatory requirements
- security considerations;
- product improvements
- technical requirements; or
- changes in available data coverage.
Where a material change negatively affects an active paid service, TDS will use reasonable efforts to provide notice where practicable.
3. Signals, Not Decisions
3.1
TDS Risk provides signals, information and verification results.
TDS does not make lending, credit, insurance, claims, employment, eligibility, onboarding, fraud, account, payment or other decisions on behalf of the Customer.
3.2
A Trust Score, risk level, reason code, indicator, Mobile KYC result, Session Intelligence response, Smart Alert or other TDS Risk output must not be treated as a decision made or recommended by TDS.
3.3
The Customer remains solely responsible for:
- determining how TDS Risk outputs are used;
- determining whether further checks are required;
- setting its own risk thresholds and policies;
- making decisions relating to its customers, applicants, leads, users, claims, transactions or accounts;
- complying with laws and regulatory requirements applicable to those decisions; and
- conducting any additional due diligence reasonably required for its business.
3.4
TDS Risk should ordinarily form part of a wider fraud, compliance or risk-management process and should not be relied upon as the sole basis for a material decision affecting an individual.
4. Customer Eligibility
4.1
TDS Risk is a business-to-business service.
You may only use TDS Risk in connection with legitimate business, professional, public-sector or organisational activities approved by TDS.
4.2
You must provide accurate and complete information during registration and onboarding.
4.3
TDS may conduct verification checks concerning you or your organisation, including checks relating to:
- business identity;
- company registration;
- website or domain ownership;
- contact information;
- regulatory registrations;
- identity of authorised representatives;
- mobile number ownership or identity;
- stated use case;
- privacy policy; and
- other compliance information reasonably required by TDS or its suppliers.
4.4
Successful registration does not create an unconditional right to use TDS Risk.
TDS may place an account into:
- Live mode;
- Sandbox mode;
- Restricted mode;
- Manual Review; or
- another access state reasonably required for security, compliance or supplier obligations.
6. API Keys
6.1
API keys are confidential credentials and must be protected accordingly.
6.2
An API key may be associated with a specific:
- Customer;
- service;
- lawful basis;
- recognised interest;
- declared use case;
- privacy policy;
- policy version;
- environment; and
- other compliance configuration.
6.3
The Customer must not use an API key for a materially different purpose from the purpose declared when that key was created unless the relevant configuration has first been updated or a new API key has been created.
6.4
TDS may revoke, suspend or rotate an API key where TDS reasonably believes:
- it has been compromised;
- it is being misused;
- the associated privacy-policy requirements are no longer satisfied;
- the Customer’s stated purpose has materially changed;
- a supplier or mobile network operator requires suspension;
- continued access may breach applicable law;
- the Customer has breached these Terms; or
- suspension is necessary to protect TDS, its suppliers, Customers, systems or individuals.
7. Customer Reference
7.1
Where supported, the Customer may submit its own unique reference within a verification request.
7.2
The API field identified as leadReference may represent the Customer’s unique reference for a:
- lead;
- claim;
- application;
- transaction;
- customer;
- account event;
- login;
- case;
- payment;
- investigation; or
- other relevant business event.
7.3
The Customer is responsible for determining what information is included within its Customer Reference.
7.4
Customers should avoid placing unnecessary personal data within Customer Reference fields.
8. Permitted Use
The Customer may use TDS Risk only:
8.1
for the approved purposes declared to TDS;
8.2
in accordance with applicable law;
8.3
in accordance with these Terms;
8.4
in accordance with relevant API documentation;
8.5
in accordance with applicable privacy and transparency obligations;
8.6
in accordance with any binding regulatory obligations applying to the Customer; and
8.7
subject to restrictions communicated by TDS which originate from applicable mobile network operators, telecommunications providers, data suppliers or regulatory requirements.
9. Prohibited Use
The Customer must not use TDS Risk:
- for unlawful surveillance;
- for stalking, harassment or intimidation;
- to discriminate unlawfully;
- to obtain information without an appropriate lawful purpose;
- to identify or investigate individuals for purely personal reasons;
- to reverse engineer underlying telecommunications or supplier data;
- to create or enrich an unauthorised consumer database;
- to resell raw TDS Risk outputs except where expressly authorised by TDS;
- to attempt to identify confidential TDS suppliers or underlying data sources where that information is not provided;
- to circumvent rate limits, security controls or account restrictions;
- to probe or test mobile numbers without a legitimate business purpose;
- to facilitate fraud, scams or other criminal activity;
- to impersonate another organisation or individual;
- to submit information the Customer does not have lawful authority to process;
- to circumvent or undermine TDS compliance controls;
- to allow unauthorised third parties to access TDS Risk; or
- in any manner prohibited by TDS’s upstream providers or applicable law.
TDS may immediately suspend activity reasonably suspected of falling within this section.
10. Lawful Basis And Customer Declarations
10.1
The Customer is responsible for identifying an appropriate lawful basis for its processing of personal data.
10.2
Where TDS asks the Customer to select a lawful basis, recognised legitimate interest, use case or other processing purpose, TDS records the Customer’s declaration.
10.3
TDS does not provide legal advice and does not warrant that a lawful basis, recognised interest or use case selected by the Customer is appropriate for the Customer’s circumstances.
10.4
The Customer must notify TDS or update its configuration if its relevant processing purpose, lawful basis or use case materially changes.
10.5
The Customer remains responsible for carrying out any:
- Legitimate Interests Assessment;
- Data Protection Impact Assessment;
- regulatory assessment;
- balancing test;
- consent assessment; or
- other legal or compliance assessment
required by applicable law.
10.6
Where TDS identifies information which appears inconsistent with the Customer’s declared use, TDS may request further evidence or suspend processing pending review.
11. Privacy Policy And Transparency Requirements
11.1
Certain TDS Risk services require the Customer to maintain appropriate wording within its publicly available privacy information.
11.2
The Customer must provide TDS with the relevant privacy-policy URL where requested.
11.3
TDS may automatically or manually scan the relevant policy to determine whether required wording remains present.
11.4
TDS may store evidence relating to the policy, including:
- URL;
- policy version;
- date and time observed;
- content hash;
- character count;
- relevant policy text;
- compliance status; and
- changes identified between versions.
11.5
If required wording is removed, materially changed or cannot be verified, TDS may:
- notify the Customer;
- mark the relevant API key as non-compliant;
- restrict or suspend the API key;
- request corrective action; or
- undertake further compliance review.
11.6
A TDS record identifying the privacy-policy version associated with a verification demonstrates the policy information associated with that processing event.
It does not, by itself, prove that an individual:
- saw the policy;
- read the policy;
- agreed to the policy;
- consented to the policy; or
- accepted the policy.
12. Coverage And Results
12.1
TDS Risk relies partly upon information made available by telecommunications providers, mobile network operators and other data providers.
Coverage may vary according to:
- service;
- mobile network;
- number type;
- available data;
- geographic coverage;
- provider participation;
- recency;
- technical availability; and
- other circumstances outside TDS’s reasonable control.
12.2
A successful API request does not guarantee:
- coverage;
- a match;
- a positive result;
- complete information;
- a particular Trust Score;
- particular reason codes; or
- that all requested fields will be populated.
12.3
A “no result”, “not available”, “unknown”, unmatched or similar response does not necessarily mean that the submitted information is false, inaccurate or fraudulent.
12.4
The Customer must interpret results in the context of its own fraud, risk and compliance controls.
13. Trust Score
13.1
Trust Score may return a score together with supporting carrier-derived risk signals.
13.2
Signals may include, where available, matters relating to:
- mobile-number stability;
- SIM activity;
- tenure;
- ownership signals;
- line type;
- network information;
- call divert or forwarding indicators;
- telecommunications indicators;
- associated risk reason codes; and
- other mobile intelligence.
13.3
A Trust Score is not a guarantee that:
- a person is legitimate;
- a person is fraudulent;
- a transaction is legitimate;
- a transaction is fraudulent; or
- a particular outcome will occur.
13.4
The Customer determines how Trust Score and individual reason codes interact with the Customer’s own risk policies and decision-making processes.
14. Mobile KYC
14.1
Mobile KYC may compare a mobile number with supplied identity information including, where supported:
- name;
- date of birth;
- address; and
- other supported attributes.
14.2
Mobile KYC availability depends upon participating data sources, mobile networks and available coverage.
14.3
A failure to return a match or result is not proof that the supplied identity information is false.
14.4
Unless expressly stated otherwise in the relevant pricing information, a valid Mobile KYC request is chargeable whether or not a match or result is returned.
15. Session Intelligence, Trust Score+ And Future Services
15.1
Where Session Intelligence, Trust Score+, or another additional service is made available, relevant API documentation and product descriptions form part of these Terms.
15.2
TDS may make individual products available in:
- beta;
- preview;
- pilot;
- sandbox; or
- limited-release
form and may identify additional restrictions applicable to those services.
16. Smart Routing And Product Guidance
16.1
TDS may provide Customers with guidance designed to:
- reduce unnecessary checks;
- optimise the order in which services are used;
- reduce avoidable API spend;
- improve use of available signals; or
- improve fraud and risk workflows.
16.2
Guidance may be based on:
- product behaviour;
- available coverage;
- reason codes;
- observed correlations;
- supplier information;
- TDS testing; or
- aggregated operational experience.
16.3
Unless expressly stated otherwise, such guidance does not guarantee a particular result and does not replace the Customer’s own fraud, risk or compliance controls.
17. TDS Audit
17.1
Eligible TDS Risk verification requests may automatically create a TDS Audit record.
17.2
The audit may contain information including:
- TDS Request ID;
- Customer Reference;
- timestamp;
- signature;
- verification type;
- relevant output;
- declared lawful basis;
- recognised interest where applicable;
- declared use case;
- privacy-policy version;
- policy evidence;
- result information;
- audit metadata; and
- information necessary to retrieve or verify the record.
17.3
TDS Audit records evidence relating to what TDS Risk returned and the associated processing context at the relevant point in time.
17.4
TDS Audit does not certify or guarantee that:
- the Customer’s processing was lawful;
- the Customer selected the correct lawful basis;
- the Customer’s ultimate decision was correct;
- fraud was present;
- fraud was absent;
- an individual consented to processing; or
- the Customer has satisfied all regulatory obligations.
17.5
Where TDS later introduces a separate service designed specifically to record acceptance or consent evidence, that service will be governed by its own applicable description and terms.
18. Risk Recall
18.1
Where available, Risk Recall allows an eligible original verification record to be retrieved or verified using relevant verification information, including the original TDS Request ID and signature.
18.2
Risk Recall is intended to retrieve or verify the original frozen verification evidence.
18.3
A Risk Recall event may itself generate:
- a new TDS Request ID;
- a timestamp;
- an audit event; and
- additional verification evidence associated with the recall.
18.4
TDS does not warrant that Risk Recall will remain available indefinitely where:
- legal retention requirements;
- deletion obligations;
- supplier restrictions;
- contractual restrictions;
- regulatory requirements; or
- technical constraints
require information to be deleted or become unavailable.
19. Account Audit Log
19.1
TDS may maintain an account-level audit log recording actions and events affecting a TDS Risk account.
19.2
Events may include:
- authentication;
- verification activity;
- user management;
- API-key activity;
- billing;
- policy activity;
- lead-source information;
- result activity;
- administrative access;
- Smart Alerts;
- security activity; and
- other platform events.
19.3
Where technically supported, audit events may be append-only and cryptographically signed or otherwise protected against undetected modification.
19.4
Audit events may contain:
- actor identity;
- actor role;
- timestamp;
- event category;
- event severity;
- source;
- relevant object or record identifiers; and
- category-specific metadata.
19.5
Audit logs are intended to support accountability, security, investigation and traceability.
They do not relieve the Customer of its own legal, regulatory or record-keeping obligations.
20. Administrative Access To Customer Accounts
20.1
TDS personnel may access Customer information where reasonably necessary for purposes including:
- customer support;
- bug investigation;
- error investigation;
- security;
- compliance review;
- suspected misuse;
- service administration; or
- legal obligations.
20.2
Where TDS uses a customer-authorised “View as Customer” function, additional authentication may be required.
20.3
Where supported, administrative access may record:
- the TDS administrator’s identity;
- the administrator’s email address;
- date and time;
- reason for access;
- session start;
- relevant actions taken during the session; and
- session end.
20.4
TDS may maintain separate read-only administrative access to Customer audit records for legitimate security, support and compliance purposes.
20.5
Access controls applicable to administrative functions may be changed or strengthened by TDS from time to time.
21. Smart Alerts
21.1
Smart Alerts may identify patterns including:
- abnormal verification volumes;
- repeated checks;
- changes in average Trust Scores;
- lead-source risk patterns;
- changes relating to previously checked numbers;
- unusual usage patterns; and
- other anomalous behaviour.
21.2
Smart Alerts may operate using:
- deterministic rules;
- statistical thresholds;
- account-specific baselines;
- defined conditions; or
- other methods disclosed by TDS.
21.3
Smart Alerts are informational signals.
TDS does not guarantee that:
- all suspicious activity will generate an alert;
- all alerts indicate fraud;
- all fraud will be detected;
- thresholds will be suitable for every Customer;
- every anomalous event will be detected; or
- the absence of an alert means activity is safe.
21.4
The Customer remains responsible for investigating and acting upon alerts according to its own policies.
22. Webhooks And Notifications
22.1
Where supported, TDS may send Smart Alerts or other events through:
- dashboard notifications;
- email;
- webhooks;
- API;
- SMS; or
- another supported channel.
22.2
The Customer is responsible for maintaining accurate notification information and securely configuring any webhook endpoint.
22.3
Delivery of a notification is not guaranteed.
22.4
Notifications must not be relied upon as the Customer’s sole fraud-monitoring or security mechanism.
23. Pricing
23.1
Current public pricing will be displayed on the TDS Risk website, dashboard or applicable pricing documentation.
23.2
Unless otherwise agreed in writing, charges are calculated at the price displayed or agreed when the relevant transaction or API request is made.
23.3
Prices are exclusive of VAT unless expressly stated otherwise.
23.4
TDS may change pricing for future use by giving reasonable notice where appropriate.
Pricing changes will not retrospectively alter charges already incurred.
23.5
TDS may agree different commercial terms with individual Customers, including enterprise pricing, without being required to offer those terms to other Customers.
24. Credits And Top-Ups
24.1
Certain TDS Risk services may operate using prepaid account credits.
24.2
Purchased credits:
- have no cash value outside TDS;
- may only be used for eligible TDS services;
- may not be transferred between unrelated Customers unless TDS agrees otherwise; and
- will be deducted as chargeable requests are processed.
24.3
Unless TDS expressly specifies otherwise, purchased credits will not expire solely because they remain unused.
24.4
Promotional, bonus or free credits may be subject to:
- expiry dates;
- usage restrictions;
- product restrictions; or
- other promotional conditions.
24.5
TDS may correct an account balance where an obvious:
- billing error;
- accounting error;
- duplicate transaction;
- technical error; or
- crediting error
has occurred.
25. Chargeable Requests
25.1
Unless expressly stated otherwise, a request becomes chargeable when TDS accepts and processes the request through the applicable service.
25.2
A request may remain chargeable where:
- no match is returned;
- the number is outside available coverage;
- the result is unknown;
- a risk indicator is absent;
- submitted information does not match;
- particular response fields are unavailable; or
- the Customer subsequently chooses not to use the result.
25.3
TDS will not ordinarily charge where a request fails solely because of a TDS platform error before the relevant upstream or TDS service has been successfully called, unless otherwise expressly disclosed.
25.4
Repeated or duplicate requests initiated by the Customer may each be chargeable where each request is separately processed.
26. Refunds
26.1
Except where required by law or expressly agreed otherwise, charges for successfully processed API calls are non-refundable.
26.2
Unused prepaid credits shall be treated in accordance with the refund policy displayed or agreed at the time of purchase.
26.3
TDS may issue credits or refunds at its discretion where:
- a material TDS billing error occurred;
- duplicate charging occurred because of a TDS system error;
- a service is permanently withdrawn and no reasonable alternative is available; or
- TDS otherwise considers a refund appropriate.
26.4
Promotional or free credits are not redeemable for cash.
27. Fair Use, Rate Limits And Abuse
27.1
TDS may apply:
- rate limits;
- request limits;
- concurrency limits;
- automated abuse controls;
- technical restrictions; and
- reasonable security controls.
27.2
Customers must not attempt to circumvent those controls.
27.3
Where a high-volume Customer requires different limits, TDS may agree alternative limits separately.
28. Service Availability
28.1
TDS will use reasonable efforts to provide a reliable service but does not guarantee uninterrupted or error-free availability.
28.2
TDS Risk may be affected by systems outside TDS’s direct control, including:
- mobile networks;
- telecommunications providers;
- cloud or hosting providers;
- payment providers;
- data suppliers;
- internet providers;
- DNS services;
- email services; and
- third-party infrastructure.
28.3
Scheduled or emergency maintenance may temporarily affect availability.
28.4
Unless a separate Service Level Agreement has been agreed in writing, no specific uptime commitment applies.
28.5
TDS may implement emergency changes without prior notice where reasonably necessary to protect security, integrity, legality or availability of the service.
29. Sandbox
29.1
Sandbox access may contain:
- simulated responses;
- test data;
- restricted functionality;
- non-production credentials;
- limited product functionality; or
- other functionality intended for integration testing.
29.2
Sandbox results must not be treated as live production results.
29.3
TDS may restrict a Customer to Sandbox pending:
- verification;
- compliance review;
- privacy-policy checks;
- onboarding checks;
- supplier approval requirements; or
- security review.
30. Data Protection
30.1
Each party shall comply with applicable data-protection legislation, including as applicable:
- the UK GDPR;
- the Data Protection Act 2018;
- the Data (Use and Access) Act 2025; and
- other applicable UK privacy and data-protection legislation as amended from time to time.
30.2
The parties acknowledge that their respective controller and processor roles may differ according to the particular processing activity.
30.3
Where TDS processes personal data on behalf of the Customer as Processor, the Data Processing Terms contained in Schedule 1 apply.
30.4
Where TDS processes personal data for its own purposes as an independent Controller, including where applicable for:
- platform security;
- fraud prevention;
- abuse prevention;
- billing;
- account administration;
- compliance;
- establishment, exercise or defence of legal claims; or
- legal and regulatory obligations,
TDS’s Privacy Policy and applicable law govern that processing.
30.5
Nothing in these Terms transfers the Customer’s legal or regulatory responsibilities to TDS.
31. Security
31.1
TDS will maintain appropriate technical and organisational measures having regard to:
- the nature of the services;
- the type of information processed;
- available technology;
- implementation cost; and
- risks associated with the processing.
31.2
The Customer must also maintain appropriate security in relation to:
- its account;
- user accounts;
- passwords;
- multi-factor authentication;
- API credentials;
- systems integrated with TDS;
- personal data submitted to TDS;
- retrieved results;
- exported reports; and
- webhook endpoints.
31.3
The Customer must notify TDS without undue delay if it becomes aware of:
- compromised credentials;
- compromised API keys;
- unauthorised account access; or
- another security incident which may affect TDS Risk.
32. Security Incidents And Personal Data Breaches
32.1
Where TDS becomes aware of a Personal Data Breach affecting Customer Personal Data for which TDS acts as Processor, TDS will notify the Customer without undue delay.
32.2
TDS will provide information reasonably available to it which is necessary to assist the Customer in meeting applicable legal obligations.
32.3
Notification by TDS does not constitute an admission of fault or liability.
33. Confidentiality
33.1
Each party shall keep confidential information received from the other confidential and shall use that information only as necessary to perform or receive the services or fulfil applicable legal obligations.
33.2
Confidentiality obligations do not apply to information which:
- is lawfully public;
- was already lawfully known without restriction;
- is independently developed without use of confidential information;
- is lawfully received from another source without confidentiality restrictions; or
- must be disclosed by law, court order or regulatory requirement.
33.3
Where legally permissible, a party required to disclose confidential information shall give the other party reasonable notice before disclosure.
34. Intellectual Property
34.1
TDS and its licensors retain all intellectual-property rights in and relating to:
- TDS Risk;
- APIs;
- software;
- documentation;
- Trust Score methodology;
- reason-code structures;
- user interfaces;
- TDS Audit;
- Risk Recall;
- Smart Alerts;
- reports;
- algorithms;
- databases;
- branding; and
- associated materials.
34.2
Subject to these Terms, the Customer receives a limited, non-exclusive, non-transferable and revocable right to use TDS Risk for its legitimate internal business purposes.
34.3
The Customer must not:
- copy or reproduce TDS software except as expressly permitted;
- reverse engineer TDS Risk except to the limited extent such restriction is prohibited by law;
- attempt to derive underlying scoring methodology;
- resell or sublicense TDS Risk without written authorisation;
- remove proprietary notices;
- reproduce TDS documentation for unauthorised commercial purposes; or
- use TDS outputs or confidential information to develop a directly competing telecommunications-intelligence service.
35. Customer Data
35.1
As between TDS and the Customer, the Customer retains its rights in information submitted by or on behalf of the Customer.
35.2
The Customer grants TDS the rights reasonably necessary to:
- receive;
- process;
- transmit;
- store;
- secure;
- audit;
- return; and
- otherwise use Customer Data
to provide, operate, secure and administer TDS Risk and comply with applicable legal obligations.
35.3
Any use of Customer Data for aggregated statistics, analytics or service improvement must be consistent with applicable law, TDS’s Privacy Policy and the parties’ respective data-protection roles.
36. Sub-Processors And Suppliers
36.1
TDS may use third parties to provide elements of TDS Risk, including providers of:
- telecommunications information;
- mobile network information;
- cloud infrastructure;
- hosting;
- communications;
- identity verification;
- compliance services;
- fraud-prevention services; and
- payments.
36.2
Where TDS acts as Processor and appoints a Sub-processor, applicable data-protection requirements relating to Sub-processors apply.
36.3
TDS shall impose appropriate contractual data-protection obligations on Sub-processors where required by applicable law.
36.4
Where required, TDS may maintain and make available a current list of material Sub-processors.
37. Third-Party And Mobile Network Data
37.1
The Customer acknowledges that certain TDS Risk outputs depend upon information supplied by third parties.
37.2
TDS does not own all underlying information.
37.3
TDS may therefore be required to:
- apply use restrictions;
- change permitted use cases;
- modify response fields;
- change coverage;
- modify retention periods;
- suspend particular services;
- suspend particular Customers;
- conduct compliance checks; or
- terminate access
where reasonably required by an upstream provider, mobile network operator, law, court or regulator.
37.4
TDS shall not be responsible for an upstream provider changing or ceasing supply of information where that change is outside TDS’s reasonable control.
38. Compliance Review
38.1
TDS may periodically review Customer use of TDS Risk.
38.2
The Customer must provide reasonable information necessary to verify continued permitted use, including where applicable:
- use-case information;
- privacy notices;
- lawful-basis information;
- supporting regulatory information;
- website information;
- business information; and
- reasonable evidence concerning how TDS Risk is integrated and used.
38.3
Failure to cooperate with a reasonable compliance review may result in restriction or suspension of the relevant service.
39. Suspension
39.1
TDS may suspend all or part of a Customer’s access immediately where reasonably necessary because of:
- suspected unlawful use;
- fraud;
- security compromise;
- breach of these Terms;
- non-payment;
- non-compliant privacy wording;
- misrepresentation during onboarding;
- material supplier requirement;
- regulatory direction;
- excessive technical abuse;
- breach of API restrictions;
- risk to TDS;
- risk to another Customer;
- risk to an upstream supplier; or
- risk to an individual.
39.2
Where appropriate and lawful, TDS will explain the reason for suspension and provide the Customer with an opportunity to remedy the issue.
40. Termination
40.1
The Customer may stop using TDS Risk at any time unless subject to a separately agreed contract term.
40.2
TDS may terminate or permanently restrict an account:
- for material breach which is not remedied within a reasonable period after notice;
- immediately for serious misuse, fraud or unlawful activity;
- where required by law;
- where required by an upstream provider;
- where continued provision creates an unacceptable security or regulatory risk;
- for persistent non-payment; or
- where the relevant service is permanently discontinued.
40.3
Termination does not affect rights, liabilities or charges accrued before termination.
41. Effect Of Termination
Following termination:
- API keys may cease operating;
- Customer access may be removed;
- unused credits will be treated in accordance with section 25;
- Customer Data may be retained or deleted according to applicable law and documented retention periods;
- audit information may be retained where TDS has a lawful reason or obligation to retain it; and
- provisions intended to survive termination remain effective.
42. Warranties
42.1
TDS warrants that it will provide TDS Risk with reasonable care and skill.
42.2
Except as expressly stated in these Terms and to the maximum extent permitted by law, TDS does not warrant that:
- every fraud attempt will be detected;
- every legitimate customer will receive a favourable result;
- every fraudulent customer will receive an adverse result;
- third-party data will always be complete or accurate;
- every mobile number will be covered;
- every identity will be matched;
- the service will always be uninterrupted;
- outputs will be suitable as the sole basis for a decision;
- Smart Alerts will detect every relevant event; or
- use of TDS Risk guarantees compliance with any law or regulation.
43. Customer Warranties
The Customer warrants that:
- it is legally entitled to submit information to TDS;
- it has a legitimate and lawful purpose for each verification;
- its declared use case is accurate;
- information supplied during onboarding is materially accurate;
- it will not use TDS Risk unlawfully;
- it will maintain required privacy and transparency information;
- it will comply with applicable supplier restrictions notified to it;
- it will maintain suitable internal fraud and risk controls; and
- it will comply with binding industry or regulatory requirements applicable to its use.
44. Limitation Of Liability
44.1
Nothing in these Terms limits liability which cannot lawfully be limited or excluded.
44.2
Subject to section 44, neither party shall be liable to the other for indirect or consequential loss.
44.3
Subject to section 45, TDS shall not be liable for loss arising solely from:
- a Customer decision made using a TDS Risk signal;
- fraud which TDS Risk does not detect;
- legitimate activity which the Customer incorrectly treats as suspicious;
- failure or inaccuracy of an upstream data source outside TDS’s reasonable control;
- Customer misuse;
- Customer misconfiguration;
- compromise of Customer credentials caused by the Customer;
- Customer failure to maintain required privacy information; or
- Customer failure to carry out additional due diligence reasonably required for its business.
44.4
Subject to section 45, TDS shall not be liable for:
- loss of profits;
- loss of revenue;
- loss of anticipated savings;
- loss of business;
- loss of goodwill; or
- business interruption,
except to the extent such exclusion or limitation is prohibited by law.
44.5
Subject to section 44, TDS’s aggregate contractual liability arising out of or in connection with TDS Risk during any rolling 12-month period shall not exceed, ANY FEES PAID OR PAYABLE BY THE CUSTOMER TO TDS DURING THE PRECEDING 12 MONTHS, SUBJECT TO ANY AGREED MINIMUM OR MAXIMUM CAP.
45. Liability That Cannot Be Excluded
Nothing in these Terms excludes or limits liability where it would be unlawful to do so, including liability for:
- death or personal injury caused by negligence;
- fraud;
- fraudulent misrepresentation; or
- any other liability which cannot lawfully be excluded or limited.
46. Indemnity
46.1
The Customer shall indemnify TDS against reasonable losses, claims, liabilities, damages, costs and expenses arising from:
- unlawful use of TDS Risk by the Customer;
- material breach of the prohibited-use provisions;
- Personal Data submitted without appropriate authority or lawful basis;
- unauthorised resale or distribution of TDS outputs;
- material misrepresentation during onboarding; or
- material breach of applicable supplier restrictions communicated to the Customer,
except to the extent the relevant loss was caused by TDS’s own breach, negligence or unlawful conduct.
47. Changes To These Terms
47.1
TDS may update these Terms to reflect:
- changes in law;
- regulatory developments;
- new products;
- changes to suppliers;
- security requirements;
- technical developments; or
- reasonable commercial changes.
47.2
For material changes, TDS will provide reasonable notice where practicable.
47.3
Continued use of TDS Risk following the effective date of amended Terms constitutes acceptance where legally permissible.
48. Notices
48.1
Formal notices may be sent by email to the address registered on the relevant account unless an enterprise agreement specifies another method.
48.2
Customers are responsible for maintaining an accurate and monitored email address.
49. Assignment
49.1
The Customer may not assign these Terms without TDS’s prior written consent, such consent not to be unreasonably withheld or delayed.
49.2
TDS may assign these Terms in connection with:
- a corporate reorganisation;
- merger;
- acquisition;
- restructuring; or
- sale of substantially all relevant business assets,
subject to applicable law.
50. Force Majeure
Neither party shall be liable for delay or failure caused by circumstances outside its reasonable control, including but not limited to:
- significant telecommunications failure;
- mobile network outage;
- internet outage;
- supplier outage;
- cloud infrastructure failure;
- governmental action;
- industrial action;
- natural disaster;
- war;
- civil disturbance;
- major cyber incident; or
- other comparable event,
provided the affected party takes reasonable steps to mitigate the effect.
51. Entire Agreement
These Terms, together with:
- any applicable Order Form;
- Schedule 1 – Data Processing Terms;
- the TDS Privacy Policy;
- applicable service documentation;
- applicable pricing information;
- any separately agreed enterprise agreement; and
- any other document expressly incorporated by reference
constitute the agreement governing the Customer’s use of TDS Risk.
Where an individually signed enterprise agreement expressly conflicts with these Terms, the individually signed agreement takes precedence to the extent of that conflict.
52. Third-Party Rights
Unless expressly stated otherwise, a person who is not a party to these Terms has no right to enforce them under the Contracts (Rights of Third Parties) Act 1999.
53. Severability
If any provision of these Terms is found to be invalid, unlawful or unenforceable, the remaining provisions continue in full force and effect.
54. Waiver
Failure or delay by either party in enforcing a provision does not constitute a waiver of that provision or of the right to enforce it later.
55. Governing Law And Jurisdiction
These Terms and any non-contractual obligations arising from or connected with them are governed by the laws of England.
The courts of England shall have exclusive jurisdiction unless otherwise agreed in writing.
Schedule 1
Data Processing Terms
This Schedule applies to the extent TDS processes Personal Data on behalf of the Customer as a Processor.
1. Definitions
For this Schedule:
Controller, Processor, Personal Data, Personal Data Breach, Processing, Data Subject and Supervisory Authority have the meanings given to them under applicable Data Protection Law.
Data Protection Law means applicable UK legislation governing the processing of Personal Data, including the UK GDPR, Data Protection Act 2018 and relevant provisions of the Data (Use and Access) Act 2025, in each case as amended or replaced from time to time.
Customer Personal Data means Personal Data processed by TDS on behalf of the Customer in providing TDS Risk.
Sub-processor means another Processor appointed by TDS to process Customer Personal Data on behalf of the Customer.
2. Roles
2.1
For Customer Personal Data processed by TDS solely on documented instructions from the Customer:
- Customer: Controller
- TDS: Processor
2.2
This allocation applies only to the relevant processing activity.
Either party may act as an independent Controller for other processing which it undertakes for its own purposes.
3. Subject Matter
The subject matter of the Processing is the provision of TDS Risk fraud, mobile intelligence, identity verification, auditing, monitoring and associated services requested by the Customer.
4. Duration
Processing shall continue for:
- the period during which TDS provides the relevant service; and
- any subsequent period during which retention is required or permitted by applicable law, contractual obligations or documented retention policies.
5. Nature And Purpose Of Processing
Processing may include:
- receipt;
- collection;
- transmission;
- comparison;
- verification;
- querying;
- analysis;
- storage;
- retrieval;
- audit logging;
- security monitoring;
- transmission of verification results;
- support;
- deletion; and
- other Processing reasonably necessary to provide TDS Risk.
The purpose is to provide the TDS Risk services requested by the Customer.
6. Categories Of Personal Data
Depending upon the service used, Customer Personal Data may include:
- mobile telephone number;
- name;
- date of birth;
- address;
- Customer Reference;
- telecommunications-related signals;
- mobile network signals;
- fraud or risk signals;
- verification outputs;
- account identifiers;
- transaction or event references;
- technical and security information; and
- other information expressly submitted through an approved TDS Risk endpoint.
7. Categories Of Data Subject
Data Subjects may include:
- customers;
- prospective customers;
- applicants;
- claimants;
- account holders;
- leads;
- users;
- authorised representatives;
- persons involved in transactions; and
- other individuals legitimately submitted by the Customer for an approved purpose.
8. Controller Rights And Obligations
The Customer:
- determines the purpose for which Customer Personal Data is processed;
- determines whether use of TDS Risk is appropriate;
- provides documented instructions to TDS;
- is responsible for identifying an appropriate lawful basis;
- is responsible for required privacy information;
- is responsible for ensuring submitted information is relevant and necessary;
- remains responsible for decisions made using TDS outputs; and
- may exercise its rights under this Schedule and applicable Data Protection Law.
9. Documented Instructions
9.1
TDS shall process Customer Personal Data only on documented instructions from the Customer unless processing is required by applicable UK law.
9.2
Documented instructions may include:
- these Terms;
- API requests;
- API-key configuration;
- service selections;
- lawful-basis declarations;
- recognised-interest declarations;
- use-case declarations;
- settings selected through the TDS dashboard;
- support instructions; and
- other written instructions accepted by TDS.
9.3
Where applicable law requires TDS to process Customer Personal Data other than on Customer instructions, TDS shall notify the Customer before processing unless the law prohibits such notification.
9.4
If TDS believes an instruction infringes applicable Data Protection Law, TDS may notify the Customer and suspend the relevant instruction pending clarification.
10. Confidentiality
TDS shall ensure persons authorised to process Customer Personal Data:
- are subject to appropriate contractual or statutory confidentiality obligations; and
- process Customer Personal Data only as necessary for their authorised functions.
11. Security
11.1
TDS shall implement appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful:
- destruction;
- loss;
- alteration;
- unauthorised disclosure; or
- access.
11.2
Security measures may include, where appropriate:
- access controls;
- authentication controls;
- encryption;
- logging;
- monitoring;
- credential protection;
- network security;
- vulnerability management;
- incident response;
- backup and recovery procedures; and
- organisational security controls.
12. Sub-Processors
12.1
The Customer authorises TDS to appoint Sub-processors reasonably necessary to provide TDS Risk.
12.2
TDS shall ensure that each Sub-processor processing Customer Personal Data is bound by written contractual obligations which provide protections materially consistent with the applicable requirements imposed on TDS under this Schedule.
12.3
TDS remains responsible for the performance of its Sub-processors to the extent required by applicable Data Protection Law.
12.4
Where required by applicable law, TDS shall:
- maintain information identifying relevant Sub-processors; and
- provide notice of material additions or replacements.
12.5
Where the Customer has a statutory right to object to a new Sub-processor, the parties shall work in good faith to address the Customer’s reasonable data-protection concerns.
13. Data Subject Rights
13.1
Taking into account the nature of Processing, TDS shall provide reasonable assistance to the Customer, using appropriate technical and organisational measures where possible, to enable the Customer to respond to requests relating to Data Subject rights.
13.2
If TDS receives a Data Subject request relating specifically to Customer Personal Data for which TDS acts solely as Processor, TDS may direct the individual to the Customer unless applicable law requires TDS to respond directly.
14. Assistance To The Customer
Taking into account the nature of Processing and information available to TDS, TDS shall reasonably assist the Customer with applicable obligations relating to:
- security of Processing;
- Personal Data Breaches;
- Data Protection Impact Assessments;
- prior consultation with the Supervisory Authority where required; and
- other obligations for which Processor assistance is required by applicable Data Protection Law.
15. Personal Data Breaches
15.1
TDS shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data processed by TDS as Processor.
15.2
TDS shall provide information reasonably available to it concerning:
- the nature of the breach;
- categories of affected Personal Data;
- categories of affected Data Subjects;
- likely consequences where known;
- measures taken or proposed; and
- other information reasonably required by the Customer to comply with applicable law.
15.3
Information may be provided in stages where it is not immediately available.
16. Return And Deletion
16.1
Following termination of relevant Processing, TDS shall, at the Customer’s choice and subject to applicable law:
- delete Customer Personal Data processed solely on the Customer’s behalf; or
- return such Personal Data to the Customer,
and delete remaining copies unless applicable UK law requires continued storage.
16.2
This requirement does not prevent TDS retaining information:
- which TDS processes as an independent Controller;
- which must be retained under applicable law;
- required for the establishment, exercise or defence of legal claims; or
- otherwise lawfully retained under applicable Data Protection Law.
17. Audits And Compliance Information
17.1
TDS shall make available to the Customer information reasonably necessary to demonstrate compliance with applicable Processor obligations.
17.2
TDS shall allow for and contribute to audits or inspections as required by applicable Data Protection Law.
17.3
The parties may agree reasonable:
- notice periods;
- confidentiality requirements;
- security restrictions;
- scope;
- frequency;
- method; and
- cost arrangements
for audits, provided such arrangements do not prevent the Customer from exercising mandatory legal rights.
17.4
Where appropriate, TDS may first satisfy reasonable audit requests through:
- security documentation;
- compliance reports;
- independent audit reports;
- certifications;
- policies; or
- written responses,
before permitting intrusive on-site inspections.
18. International Transfers
18.1
TDS shall not transfer Customer Personal Data outside the United Kingdom except:
- on documented instructions from the Customer;
- where necessary to provide the agreed service and permitted under these Terms; or
- where otherwise permitted by applicable Data Protection Law.
18.2
Where an international transfer requires a transfer mechanism, TDS shall ensure an appropriate lawful mechanism is in place.
19. Processing Records
TDS shall maintain records of Processing activities where required by applicable Data Protection Law.
20. Customer Responsibilities
The Customer remains responsible for:
- identifying its lawful basis;
- providing required privacy information;
- ensuring submitted Personal Data is relevant and necessary;
- ensuring it has authority to instruct TDS to process the information;
- complying with applicable Data Subject rights;
- determining appropriate retention periods within its own systems;
- maintaining appropriate decision-making practices;
- maintaining appropriate technical and organisational security; and
- ensuring use of TDS Risk results complies with applicable law.
Schedule 2
Current Service Pricing
Unless a different price is displayed or separately agreed in writing:
Trust Score
£0.35 per check + VAT
No minimum volume.
No long-term contract required unless separately agreed.
Mobile KYC
£0.45 per check + VAT
No minimum volume.
No long-term contract required unless separately agreed.
TDS Audit
Included with eligible TDS Risk verification checks at no additional charge.
Risk Recall
Included with eligible TDS Risk verification checks at no additional charge.
Additional Services
Session Intelligence, Trust Score+ and other future products will be charged at the price displayed by TDS or separately agreed with the Customer when those products become available.
Schedule 3
Product Principles And Interpretation
For the avoidance of doubt:
Signals, Not Decisions
TDS Risk provides signals, not decisions.
The Customer remains responsible for all decisions made using those signals.
Coverage
Availability of a particular mobile, telecommunications or identity signal does not guarantee complete network or population coverage.
No Result
A “no result”, “unknown”, unavailable or unmatched response does not establish that an individual or submission is fraudulent or inaccurate.
TDS Audit
TDS Audit records evidence relating to a verification event and associated processing context.
It does not certify the Customer’s legal or regulatory compliance.
Risk Recall
Risk Recall provides access to qualifying original verification evidence.
It does not recreate information which was not originally returned or which TDS is no longer legally or contractually permitted to retain.
Privacy-Policy Evidence
Recording a privacy-policy version associated with a verification provides evidence of the policy information associated with the processing event.
It does not itself prove that an individual accepted, consented to or read that policy.
Smart Alerts
Smart Alerts identify potentially relevant patterns or anomalies.
They are not guarantees of fraud detection and must not be treated as decisions made by TDS.
Schedule 4
Service-Specific Commercial Principles
1. No Minimum Volume
Unless separately agreed in writing, Customers are not required to commit to a minimum monthly number of checks.
2. No Long-Term Contract
Unless separately agreed in writing, Customers may use TDS Risk on a pay-as-you-go basis without committing to a fixed long-term service term.
3. Transparent Pricing
Standard pricing is displayed publicly or within the TDS Risk platform.
4. Charging For Requests
Unless expressly stated otherwise, Customers are charged for each valid processed request, regardless of whether the underlying service returns:
- a positive match;
- a negative match;
- no match;
- unknown;
- no available data; or
- another supported response.
5. Product Routing
TDS may provide guidance suggesting that Customers do not make a particular downstream check where another TDS Risk result indicates that the additional check is unlikely to provide useful information.
Such guidance is intended to help Customers use the platform efficiently and does not guarantee a particular downstream result.
6. Enterprise Arrangements
TDS may agree bespoke commercial arrangements with Customers that commit to:
- minimum volumes;
- prepayment;
- contractual terms;
- minimum spend;
- specific service levels; or
- other commercial commitments.
Such arrangements do not affect the standard pay-as-you-go terms available to other Customers unless expressly stated.
Acceptance
By creating or using a TDS Risk account, creating an API key, purchasing credits, submitting a live verification request or otherwise using TDS Risk after being presented with these Terms, the Customer confirms that:
- it has read and agrees to these TDS Risk Terms of Service;
- the individual accepting these Terms is authorised to bind the Customer;
- the information supplied during onboarding is accurate to the best of its knowledge;
- the Customer will use TDS Risk only for legitimate and lawful purposes;
- the Customer is responsible for selecting and maintaining an appropriate lawful basis and use case; and
- where Schedule 1 applies, the Customer agrees to the Data Processing Terms.