# POL-096 — The policy must state who the business is

> The privacy policy must identify the business: legal name, any DBA, postal address, email address and phone number.

- **Rule ID:** POL-096
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `privacy policy identity block`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** GDPR, Twilio, TCR
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-096/

## Why this rule exists

The identity block is the mechanism by which a vetter binds a policy to a brand record — without it, the document could belong to anyone, and a reviewer comparing it against the registration has nothing to compare. It is also what a consumer needs in order to exercise any of the rights the rest of the document grants them: a policy that promises deletion and names nobody to ask is not a promise.

## How to fix it

Add a "Who we are" block carrying the registered legal name, the trading name, the postal address, a privacy email and a phone number, and make those values the same as the brand record. Done when a reader can identify and contact the business without leaving the document.

## Example of a compliant value

```text
Acme Coffee Co, LLC, trading as Acme Coffee · 1240 Mission St, Suite 400, San Francisco, CA 94103 · support@acmecoffee.com · 415-555-0134
```

## Common mistakes

- A contact form link is not a contact route for this purpose — the address and at least one direct channel have to be in the text, because the reviewer is matching strings against the brand record.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Bandwidth/DCA | `807` | yes |