Data processing agreement

1. Parties and how this agreement applies

This data processing agreement (“DPA”) is between the customer who has accepted the terms & conditions (“you”, the controller) and Lucas William Brown, trading as Systemly (ABN 41 165 831 752) (“we”, the processor).

It forms part of the terms and applies automatically whenever we process Customer Personal Data. You do not need to sign anything. If you need a signed copy for your records, email privacy@systemly.com.au.

If you are an agency acting for your own clients, you may be a processor for them; in that case we are your sub-processor, and you are responsible for passing on to your clients what this DPA provides.

2. Definitions

• Customer Personal Data: personal information or personal data that you or your users put into the service, or that the service collects on your behalf — for example through your forms, booking pages, inbox or published sites.
• Data Protection Law: every law that applies to the processing, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, and equivalent laws elsewhere.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Sub-processor: a third party we engage to process Customer Personal Data.

Words such as controller, processor, data subject and processing have the meaning given by the GDPR, and apply equally under other Data Protection Law.

3. Processing on your instructions

• We process Customer Personal Data only to provide the service, and only on your documented instructions. The terms, this DPA, and your use and configuration of the service — sending a campaign, running an automation, asking the AI assistant — are your complete instructions.
• We will tell you if we believe an instruction breaches Data Protection Law, unless the law prevents us from telling you.
• We do not sell Customer Personal Data, use it for our own purposes, or use it to train machine-learning models.
• We may process it otherwise only where the law requires us to, and will tell you first unless the law forbids it.

4. Your obligations

You are responsible for having a lawful basis for the data you put into the service and the messages you send, for giving people the notices the law requires, and for the accuracy of your instructions. You must not instruct us to process special category data (such as health information) beyond what the service is designed for, unless you have the legal grounds and safeguards to do so.

5. Confidentiality

Anyone we authorise to access Customer Personal Data is bound by a duty of confidentiality, and has access only to the extent needed to run, support or secure the service.

6. Security

We maintain technical and organisational measures appropriate to the risk, as required by Article 32 of the GDPR and Australian Privacy Principle 11. They are described in Annex 2 and on the security overview. We may update them, but not in a way that lowers the overall level of protection.

7. Sub-processors

• You give general authorisation for us to engage sub-processors. The current list is in Annex 3 and on the sub-processors page.
• We will give you at least 14 days’ notice by email before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that time. If we cannot address the objection, you may terminate the affected service and receive a pro-rata refund of fees paid for the unused period.
• Each sub-processor is bound by written terms that protect Customer Personal Data at least as well as this DPA. We remain responsible to you for their performance.
• Services you connect with your own account — your social networks, calendars, or your own Stripe, Twilio, Resend or AI provider account — are engaged by you, not us, and are not our sub-processors.

8. International transfers

We are based in Australia, and the service is hosted in the United States. You agree to Customer Personal Data being transferred to and processed in those countries, and in the countries where our sub-processors operate.

Where the GDPR applies and you transfer Customer Personal Data to us, the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 are incorporated into this DPA by reference: Module Two where you are a controller, Module Three where you are a processor. For those clauses, the optional docking clause (Clause 7) applies; Option 2 of Clause 9 applies, with the notice period in section 7 above; the optional wording in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland; and Annexes I and II are completed by Annexes 1 and 2 of this DPA.

Where the UK GDPR applies, the International Data Transfer Addendum issued by the UK Information Commissioner applies to those clauses, with the tables completed by this DPA and either party able to end it as the Addendum allows. If the clauses and this DPA conflict, the clauses prevail.

Where the Privacy Act 1988 (Cth) applies, we take reasonable steps to ensure overseas recipients handle Customer Personal Data consistently with the Australian Privacy Principles.

9. Helping with data subject requests

The service lets you find, export, correct and delete the records you hold, so you can answer most requests yourself. Where you cannot, we will help as far as is reasonable. If a data subject contacts us directly about Customer Personal Data, we will refer them to you and will not respond ourselves unless you tell us to or the law requires it.

10. Personal Data Breaches

• We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
• The notice will describe, as far as we then know, what happened, the data and people affected, the likely consequences, and what we are doing about it, and we will update it as we learn more.
• We will take reasonable steps to contain the breach and help you meet your own obligations to notify regulators and individuals, including under the Australian Notifiable Data Breaches scheme and Articles 33 and 34 of the GDPR.
• Notifying you of a breach is not an admission of fault.

11. Other assistance

Taking into account what we know about the processing, we will give you reasonable help with data protection impact assessments and prior consultation with a regulator, where the law requires them.

12. Deletion and return

You can export Customer Personal Data at any time while your account is open, and for 30 days after you ask for it to be closed. After that we delete it, except where the law requires us to keep it. Deleted data may remain in backups until those expire on their rolling cycle; it stays protected by this DPA until then, and is not restored except to recover the service.

13. Information and audits

We will make available the information reasonably needed to show that we meet this DPA, by answering written questions and security questionnaires, and by sharing our sub-processors’ independent audit reports where they allow it. If that is not enough to meet a regulator’s requirement or the law, you may audit our compliance once a year, on at least 30 days’ notice, during business hours, at your cost, and subject to confidentiality. An audit may not give access to other customers’ data.

14. Liability and precedence

Each party’s liability under this DPA is subject to the limits in the terms, except where Data Protection Law or the Standard Contractual Clauses do not allow it to be limited. If this DPA conflicts with the terms on the processing of Customer Personal Data, this DPA prevails.

15. Term and changes

This DPA lasts as long as we process Customer Personal Data for you. We may update it to reflect changes in the law or the service, and will give 30 days’ notice of a change that materially reduces your protection. It is governed by the law that governs the terms, except where the Standard Contractual Clauses require otherwise.

Annex 1 — Details of processing

Annex 2 — Security measures

• Encryption in transit with TLS, and at rest by our hosting providers.
• Connected-service credentials additionally encrypted with AES-256-GCM.
• Passwords hashed with bcrypt; session tokens, API keys and recovery codes stored only as hashes.
• Every query scoped to a workspace resolved from a checked membership on the server, with role and per-person permission checks on each action, and automated tests of the boundary between customers.
• Two-factor authentication for accounts, and rate limits on authentication.
• A strict Content Security Policy, protection against requests to internal networks, and sandboxing for customer-published sites.
• Records of changes made by the AI assistant, and of our own staff’s actions.
• Continuous database backups with point-in-time restore.
• Error reporting that removes personal data before it leaves the service.
• A breach response process meeting the commitments in section 10.

Annex 3 — Sub-processors