Data Processing Addendum

01Roles of the parties

Australian privacy law does not use the “controller/processor” distinction found in some overseas regimes; under the Privacy Act, each entity is responsible for its own handling of personal information. For the purposes of this DPA and to make the parties' responsibilities clear:

• The Customer determines the purposes for which, and the manner in which, personal information within Customer Data is handled. The Customer is the entity primarily responsible to individuals and regulators for that Customer Data.
• WattleDB handles Customer Data only to provide the Services on the Customer's behalf and in accordance with the Customer's instructions, acting as the Customer's service provider.

02Definitions

• “Personal Information” has the meaning given in the Privacy Act.
• “Customer Personal Information” means Personal Information contained within Customer Data that WattleDB handles on the Customer's behalf under the Terms.
• “Sub-processor” means a third party engaged by WattleDB to handle Customer Personal Information in connection with the Services.
• “Eligible Data Breach” has the meaning given in Part IIIC of the Privacy Act.

03Scope & instructions

WattleDB will handle Customer Personal Information only: (a) to provide, secure, support and maintain the Services; (b) in accordance with the Customer's documented instructions, including those given through the configuration and use of the Services; and (c) as required by Australian law, or by any other law or lawful order that applies to WattleDB, including a request made under an international agreement to which Australia is a party (in which case WattleDB will, where lawful, inform the Customer). If WattleDB considers an instruction may breach the Privacy Act or other law, it will notify the Customer.

04WattleDB's obligations

• handle Customer Personal Information consistently with the APPs and this DPA;
• not use or disclose Customer Personal Information for its own purposes, and not sell it;
• ensure personnel who handle Customer Personal Information are subject to confidentiality obligations and receive appropriate guidance;
• implement and maintain the security measures described in section 7; and
• assist the Customer, taking into account the nature of the processing, to meet the Customer's own obligations under the Privacy Act as set out in this DPA.

05Customer's obligations

The Customer warrants that: (a) it has collected and handled Customer Personal Information in accordance with the APPs and any other applicable law; (b) it has provided all necessary notices and obtained any required consents for WattleDB to handle Customer Personal Information as contemplated by the Terms; and (c) its instructions to WattleDB are lawful. The Customer is responsible for the accuracy and legality of the Customer Data it submits and for configuring the Services appropriately (including access controls and data-masking features).

06Sub-processors

The Customer authorises WattleDB to engage Sub-processors to help provide the Services, such as Australian-based data-centre and hosting providers, our payment provider (for billing), and our email delivery provider (for transactional messages). WattleDB will: (a) impose data-protection and confidentiality obligations on each Sub-processor that are consistent with this DPA; and (b) remain responsible for each Sub-processor's performance of those obligations. WattleDB will make available an up-to-date list of Sub-processors on request and will give the Customer reasonable notice of any intended addition or replacement of a Sub-processor so the Customer may object on reasonable grounds.

Other third parties engaged in providing the Services. For completeness, WattleDB also engages the following third parties. None of them handles Customer Personal Information, and so none is a Sub-processor as defined in section 02, but WattleDB identifies them here because a customer assessing the Services will reasonably want the full inventory: a fraud-prevention provider (engaged through our payment provider; it receives device and browser characteristics and the IP address of a person viewing an invoice or entering card details, and is located in the United States); an address-lookup provider (Australian; it receives a billing address typed by a signed-in user, and no name, email address or IP address); and a certificate authority (located in the United States; it receives domain and hostname information only, and no personal information). None of these parties has access to any WattleDB database, to Customer Data, to backups or to object storage.

07Security measures

Taking into account the state of the art, the costs of implementation, and the nature, scope and purposes of processing, WattleDB implements appropriate technical and organisational measures to protect Customer Personal Information, including:

• encryption of data in transit (TLS) on all connections, including to backup storage;
• logical access controls and least-privilege administration;
• network, application and infrastructure security controls;
• hashed storage of authentication credentials;
• logging and monitoring of relevant activity;
• regular automated backups and tested restoration; and
• optional customer-controlled features such as data masking for non-production environments.

08Data location & Australian ownership

WattleDB stores and processes Customer Personal Information on Australian-owned infrastructure located in Australia (primary hosting in Sydney and backup in Melbourne). WattleDB will not transfer Customer Personal Information outside Australia in the ordinary course of providing the Services. If any overseas handling ever becomes necessary, WattleDB will take reasonable steps in accordance with APP 8 and will notify the Customer beforehand where practicable.

09Data breach assistance

WattleDB will notify the Customer without undue delay after becoming aware of a data breach affecting Customer Personal Information, and will provide information reasonably available to it to help the Customer assess the breach and meet its obligations under the Notifiable Data Breaches scheme. The parties will cooperate in good faith to investigate, contain and remediate the breach. Nothing in this section is an acknowledgement by WattleDB of fault or liability for a breach.

10Individual rights & requests

Taking into account the nature of the Services, WattleDB will provide reasonable assistance, including through the self-service features of the console, to help the Customer respond to requests from individuals to access, correct or delete their Personal Information, and to complaints and regulator enquiries. If WattleDB receives such a request directly relating to Customer Personal Information, it will, where lawful, refer the individual to the Customer rather than responding itself.

11Return & deletion of data

On expiry or termination of the Services, the Customer may export its Customer Data as described in the Terms. Following the export period, WattleDB will delete Customer Personal Information from active systems, including the backups and archived write-ahead logs held in object storage, which are destroyed at the same time (normally within minutes of the deletion completing), except to the extent WattleDB is required by law to retain it (in which case it will continue to protect it under this DPA).

12Records & audit

WattleDB will maintain records reasonably necessary to demonstrate its compliance with this DPA and will, on reasonable written request and subject to confidentiality, provide the Customer with information reasonably required to verify that compliance. Any on-site audit rights, if agreed, will be set out in a separate written agreement and conducted so as not to compromise the security or confidentiality of other customers' data.

13General

This DPA is subject to the Terms of Service, including the limitations of liability in them. If there is any conflict between this DPA and the Terms in relation to the handling of Customer Personal Information, this DPA prevails to the extent of the conflict. This DPA is governed by the laws of New South Wales, Australia. For any question about this DPA, contact: