Data Processing Agreement

1. Definitions and Scope

This Data Processing Agreement ("DPA") is entered into between the Client (the "Controller") and Bandboxybots Pty Ltd, represented by Director Thomas Johnson, located at 241 Queen Street, Brisbane QLD 4000 (the "Processor").

The purpose of this agreement is to ensure that the processing of personal data conducted by the Processor on behalf of the Controller complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This DPA is an integral part of the general Terms of Service.

2. Obligations of the Processor

The Processor agrees to:

• Process data only on documented instructions from the Controller.
• Ensure that persons authorised to process the data have committed themselves to confidentiality.
• Assist the Controller in responding to requests from data subjects regarding their rights under the Privacy Act.
• Maintain a record of processing activities as required by the agreed scope of work.

3. Categories of Data and Subjects

The processing is limited to the following:

• Data Subjects: Employees, executives, and stakeholders of the Controller's company.
• Data Categories: Names, professional titles, contact details, and interview transcripts provided for the purpose of creating corporate stories or website copy.

4. Sub-processors

The Processor engages the following trusted sub-processors to ensure service delivery:

• Conetix Pty Ltd: Hosting provider located at 142 Brisbane Street, Ipswich QLD 4305.
• FormSubmit: Service provider used for the transmission of contact enquiries (data may be processed in the USA).

The Processor ensures that sub-processors are bound by data protection obligations no less stringent than those set out in this DPA, in accordance with APP 8.

5. Security and Incident Notification

The Processor implements technical and organisational measures to protect data against unauthorised access or loss. In the event of a data breach, the Processor will notify the Controller without undue delay to allow for notification to the Office of the Australian Information Commissioner (OAIC) if required.

6. Data Retention and Deletion

Upon completion of the services and full payment, the Processor shall return or delete all personal data. In accordance with our business rules, drafts and working materials are stored for a period of 6 months to facilitate potential revisions, after which they are permanently erased.

Further details on data handling can be found in our Privacy Policy.

7. Audit and Compliance

The Controller has the right to request reasonable evidence of compliance with this DPA. The Processor shall provide necessary information to demonstrate that processing is performed according to the Australian Privacy Principles.

8. Final Provisions

This agreement is governed by the laws of Queensland. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts in Brisbane.

For enquiries, contact us at [email protected] or call (07) 3750 1941.

Supervisory Authority: Office of the Australian Information Commissioner (OAIC), GPO Box 5288, Sydney NSW 2001.