Virtual Address/PO Box Address in Privacy Policy and Terms and Conditions

Providing contact information is not only considered a best practice for businesses but is a legal obligation under many privacy laws. In most cases, it involves providing an email address, a customer care phone line, and perhaps most importantly, a physical business address.

If for any reason you don't have a physical business address and you prefer to keep your residential address private, then a virtual address or PO Box can be an effective alternative.

But, how exactly do these types of addresses work, and can they be included in legal documents like your website's Privacy Policy or Terms and Conditions agreement?

We'll answer all these and more in the article below.

Privacy Laws and the Contact Information Clause

Let's get some context by examining what major privacy laws say about the contact information clause in legal documents.

Customer feedback is an invaluable asset for businesses of all types and sizes. As such, it's important that you provide an easy way for your customers to get in touch with your business.

Whether it's for legal purposes, to receive mail, or to boost the credibility of your business, a physical address cannot be overlooked, even in today's ever-expanding digital landscape.

With the proliferation of privacy laws like the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), online privacy is now more deeply regulated than ever before.

Consequently, businesses must actively take essential measures to promote transparency and digital privacy even as they continue to innovate. One such measure is to publish a Privacy Policy agreement on their websites and mobile apps.

Taking things a step further, most privacy laws provide specific details about what clauses must be included in a legally compliant Privacy Policy. This is where the contact information clause comes into play.

According to most privacy laws (and as a smart business move), your Privacy Policy must include some form of contact information to allow customers to express their concerns or ask questions about your use of their personal data.

Needless to say, this will play a huge role in building an image of legitimacy and credibility for your business.

Let's dive a bit deeper and briefly take a look at the contact information requirements in some major privacy laws around the world.

General Data Protection Regulation (GDPR)

The EU's GDPR is the most comprehensive and inclusive data protection regulation in the world right now.

The regulation primarily aims to protect the online privacy of EU citizens by regulating how businesses collect, store, or process their personal information.

In practice, this means the GDPR requires a number of disclosures to be made by businesses, one of which is to provide contact information in certain instances.

Basically, if your business is subject to the GDPR, your Privacy Policy must disclose the following information:

• The physical location where you store or process consumers' personal data, if applicable
• The name and contact information of key personnel such as your Data Protection Officer (DPO) and European Representative, if applicable
• The name and contact information of both the data controller and any data processors, if applicable

California Consumer Privacy Act (CCPA)

The CCPA is a state-level privacy law designed to protect the data privacy rights of Californians. If your business is based in California or offers products or services to residents of California, you may need to comply with the CCPA. The CCPA was formally amended by the California Privacy Rights Act (CPRA), with the amendments taking effect Jan 1 of 2023.

In regard to contact information, the CCPA (CPRA) requires businesses to provide at least two methods for customers to submit requests to have their information disclosed, corrected, or deleted.

Essentially, this means you must provide some contact information to allow customers to communicate their choices regarding their personal data.

Note that to satisfy this requirement, your Privacy Policy must include, at the bare minimum, a toll-free telephone number.

Here's how the CCPA specifies this in section 1798.130:

Personal Information Protection and Electronic Documents Act (PIPEDA)

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's main private-sector privacy regulation. Much like other privacy laws, PIPEDA applies to businesses who process the personal data of Canadians regardless of where they are located.

When it comes to the contact information clause, PIPEDA requires businesses to conspicuously display the following information in their Privacy Policy:

• The name or title and address of the individual who is accountable for your business policies and practices and to whom questions or complaints should be forwarded
• The name or title and address of the individual to whom requests about privacy rights should be forwarded

Usually, both these contact details point to a single representative in most organizations, as seen in HP's Privacy Statement:

This example from HP is more robust than you may need if your business isn't multinational, but the more ways of contact you provide, the better.

In sum, the contact information clause is a vital part of a legally-compliant Privacy Policy, and (as seen above) most privacy laws specifically require businesses to include a physical address in their contact information.

That said, if the nature of your business is such that you don't have a physical business address, then (depending on applicable laws) a virtual address or PO Box can work just as well.

Let's find out more.

A Virtual Address vs a PO Box in Legal Documents

First thing's first, a virtual address is not the same as a PO Box. Simply put, a virtual address is a real street address that you can register and use to receive your business mail and other packages.

With a virtual address, your mail will be filtered by a professional service and any junk or unwanted mail will be disposed of. You can then view and manage your mail online, selecting which mail you would like to have delivered to you elsewhere.

A PO Box, on the other hand, is a lockable box located at the premises of a post office station. It includes an official mailing address and is typically used to receive postal mail or packages on a regular basis.

When it comes to legal documents for your website, two, in particular, stand out. They are a Terms and Conditions agreement and a Privacy Policy.

Both documents are very important for websites to have. But while a Privacy Policy is a legal requirement under many privacy laws, a Terms and Conditions agreement is not.

In other words, a Terms and Conditions agreement (though highly recommended) is optional for businesses.

To better understand the implications of using a virtual address or PO Box in your Terms and Conditions and Privacy Policy, let's break this section down by separately examining each type of address.

Using a Virtual Address in Terms and Conditions and Privacy Policy

To fully understand the use of virtual addresses in your website's legal documents, let's examine each legal document in turn.

Can I Use a Virtual Address in My Terms and Conditions?

The short answer is yes, you can. A virtual address is a real street address and, as such, can be included as part of your contact information in your Terms and Conditions agreement.

It's important to note that including contact information in your Terms and Conditions agreement is optional since having a Terms and Conditions agreement in the first place isn't mandatory.

That said, it's considered good practice to provide your contact information in as many places as possible, including in your Terms and Conditions agreement. This will make it much easier for your customers and the general public to get in touch with your business.

Twitter, for example, provides a real street address and a link to a contact form in its Terms of Service:

Can I Use a Virtual Address in My Privacy Policy?

Yes, you can. A virtual address is a real street address and will therefore satisfy the legal requirements of a Privacy Policy.

For example, here's how Oracle includes a real street address in its Privacy Policy:

Note, however, that a virtual address is not without its limits. For instance, the GDPR requires businesses that collect, process, and store consumers' personal data to disclose the physical location where such data is kept.

If your business falls under the category, you need to provide a physical business address in your Privacy Policy since customer data can't be stored at a virtual address.

Next, let's go over the use of PO Boxes in legal documents.

Using a PO Box Address in Terms and Conditions and Privacy Policy

Generally speaking, it's not a good idea to use a PO Box address as your official business address since a PO Box doesn't provide the address of an office/building. Moreover, most state laws don't support the use of PO Boxes as an official business address.

For this reason, we don't recommend using a PO Box address as the main contact information in your website Terms and Conditions or Privacy Policy.

Another reason to avoid using a PO Box as your main contact address is that it violates Google's terms of service agreement. This means that your website could suffer in Google's rankings, be suspended, or be removed from Google entirely.

With that being said, it's acceptable to include your PO Box address (for mailing purposes only) alongside your physical/virtual address and other forms of contact information in your Terms and Conditions or Privacy Policy.

Here's an example from Arizona Public Service:

Now that we're clear on the implications of using virtual addresses and PO Boxes in legal documents, let's briefly examine the main differences between a virtual address and a PO Box.

Virtual Address vs PO Box Address Practicalities

As mentioned previously, a virtual address differs in several ways from a PO Box address. Understanding these differences can help you better decide which is right for your business.

Without further ado, let's go over their main differences.

Location and Access to Mail

A virtual address is a by-product of a virtual office or virtual mailbox. It gives you the ability and freedom to manage your mail and other packages online at any time without being confined to a single location.

Moreover, virtual addresses often include additional features like package receiving/handling, virtual mail forwarding, and live receptionist services to enhance your professional image. However, this is not the case for PO boxes.

With a PO Box address, you need to make frequent trips to the post office where your PO Box is located in order to retrieve your mail and other packages. Besides, A PO box restricts you from accessing your mail outside business hours and on federal holidays.

Mail and Package Capabilities

A virtual business address allows you to receive mail and other packages from all carriers including delivery services like DHL, FedEx, UPS, and so on. You also don't have to worry about the physical size of your delivery.

On the other hand, a PO Box can only accept mail from the United States Postal Service (USPS) since it's a subdivision of the postal office. Moreover, before certain packages are delivered, you have to consider the size of your PO Box.

Legitimacy and Credibility

Finally, using a virtual address (aka an actual street address) can leave a positive impression on your clients, customers, and even potential investors, as well as contribute to the overall credibility of your business.

In contrast, using a PO Box address as your main contact information can negatively impact the image of your business and make it appear to be illegitimate. Moreover, your online presence can be negatively affected since Google doesn't support this type of address.

Summary

A contact information clause is a must-have for businesses who wish to remain compliant with international privacy laws. Furthermore, most privacy laws require businesses to provide a physical address in their website's Privacy Policy as part of their contact information.

If your business doesn't have a physical location or is being run from your place of residence, you should consider getting a virtual address or PO Box address (for mailing purposes only).

As for what type of address to include in legal documents like your Terms and Conditions agreement or Privacy Policy, we recommend using a virtual business address if you don't have a physical business address.

You should only include a PO Box in your legal documents as a piece of additional contact information for mailing purposes while maintaining a physical/virtual address as your main contact address.

Finally, keep in mind that even a virtual address may not be a feasible solution in the long term, and you may need to provide a physical business address in many instances as your business grows.