Data Processing Addendum

This addendum forms part of the agreement between TO DO: legal name of the business, e.g. EndExpiry Pty Ltd (ABN TO DO: ABN), trading as EndExpiry ("EndExpiry", "we", "us"), and the business that uses EndExpiry (the "Customer") under our Terms of Service. It sets out how we handle personal information that we hold on the Customer's behalf. If it conflicts with the Terms of Service on the handling of that information, this addendum applies.

1. Words used here

• Customer Personal Information means personal information in the Customer Data (as defined in the Terms of Service), such as information about the Customer's staff, that we hold to provide EndExpiry to the Customer. Annex A describes it.
• Privacy Law means the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and any other law about personal information that applies to a party.
• Data Breach means unauthorised access to, or unauthorised disclosure or loss of, Customer Personal Information.
• Service Provider means a company we use to provide EndExpiry that handles Customer Personal Information. They are listed on our Service providers page.

2. Roles

The Customer decides why Customer Personal Information is collected and how it may be used. We handle it on the Customer's behalf, to provide EndExpiry to the Customer.

3. What we do

3.1 Handle it only as instructed

We handle Customer Personal Information only to provide, support, secure and improve EndExpiry for the Customer, as the agreement and the Customer's reasonable written instructions require, or as the law requires. If the law requires us to do something else with it, we will tell the Customer first, unless the law prevents us from doing so. We do not sell it, and we do not use it for advertising.

3.2 Confidentiality

Only people who need it to run, support or secure EndExpiry can access Customer Personal Information, and they must keep it confidential.

3.3 Security

We protect Customer Personal Information with reasonable security measures, including those in Annex B, and review them as EndExpiry and the risks change.

3.4 Service Providers

• The Customer agrees to our use of the Service Providers listed on our Service providers page.
• We will give the Customer at least 30 days' notice before adding or replacing a Service Provider, by email and on that page. If the Customer reasonably objects on privacy or security grounds, we will discuss it in good faith. If we cannot resolve the objection, the Customer may end the agreement before the change.
• Each Service Provider is bound by contract to protect personal information. We remain responsible to the Customer for what our Service Providers do with Customer Personal Information.

3.5 Information outside Australia

Customer Personal Information is stored in Australia. Some Service Providers may access it from other countries to support and secure their services, as our Service providers page explains. We take reasonable steps, including through our contracts with them, to make sure they handle it consistently with the Australian Privacy Principles.

3.6 Requests from individuals

If a person asks us to access or correct their Customer Personal Information, or complains about how it is handled, we will tell the Customer promptly and, unless the Customer asks us to deal with it directly, help the Customer respond. We will not respond ourselves without the Customer's agreement, unless the law requires us to.

3.7 Data Breaches

• If we become aware of a Data Breach, we will tell the Customer without undue delay, and where practicable within 72 hours.
• We will give the Customer the information we have about what happened, the information involved, the people affected, and the steps we are taking. We will update the Customer as we learn more.
• We will take reasonable steps to contain the Data Breach and reduce the risk of harm, and will help the Customer assess it under the Notifiable Data Breaches scheme.
• The parties will agree on who notifies the people affected and the Office of the Australian Information Commissioner, and what the notices say, so that people are told once and clearly. Neither party will name the other in a public statement about the Data Breach without first consulting it, unless the law requires it.

3.8 Government requests

If a government agency or court asks us for Customer Personal Information, we will tell the Customer, unless the law prevents us from doing so, and disclose only what we are legally required to.

3.9 At the end of the agreement

When the agreement ends, the Customer may ask for a copy of its Customer Data within 30 days. Within 90 days after the agreement ends, we delete Customer Personal Information, unless the law requires us to keep it. Copies in backups are deleted on our Service Providers' schedules and, until then, are kept secure and not used.

3.10 Showing that we comply

At the Customer's reasonable request, no more than once a year (or after a Data Breach), we will answer the Customer's reasonable written questions about how we protect Customer Personal Information. Any other review is by agreement, at the Customer's cost.

4. What the Customer does

The Customer will:

• make sure it may lawfully give us Customer Personal Information and have us handle it as this addendum describes;
• before its staff use EndExpiry, tell them how EndExpiry is used and what it records about them, including their check-ins and the work they do, as privacy and workplace surveillance laws require. Our notice to staff can be used for this;
• give us only lawful instructions;
• keep its Users' access up to date, and remove people who no longer work for it; and
• tell us promptly if it becomes aware of a Data Breach or misuse of EndExpiry.

Annex A: The information we handle

Annex B: Security measures

• Encryption: information is encrypted while it travels between devices and EndExpiry (HTTPS only, enforced by the browser), and encrypted where it is stored by our database provider.
• Separation: each business can reach only its own information. This is enforced by the database itself, not only by the app, and is tested regularly with automated checks that sign in as different people and try to reach information that is not theirs.
• Access: people get only the access their role needs. Staff, managers and head office see different things. Staff need a check-in at the store to add or change stock.
• Accounts: passwords are stored only in scrambled form by our sign-in provider. People given a temporary password must choose their own before doing anything else. Important changes check the session with the sign-in provider.
• Records: stock changes, product changes and markdowns are recorded with who made them and when, in records that people cannot edit.
• Location: a location used to check in, or to confirm the store when logging stock, is compared with the stores' and never stored.
• Files: screenshots sent with problem reports, and photos of printed dates that could not be read, are kept in private storage that only our administrators can see, through links that expire after an hour.
• Providers: our database and app run in Sydney, Australia, with providers that hold recognised security certifications.
• People: our administrators' access is used only to run, support and secure EndExpiry. Our own accounts, in EndExpiry and with our providers, use strong, unique passwords and two-step verification.
• Incidents: we follow a written data breach response plan.