Data Processing Agreement

This Data Processing Agreement (DPA) is part of the Insites Terms of Use between Insites Platform Pty Ltd (ABN 83 653 729 349) (Insites, we, us) and the customer that holds an Insites account (you). It explains how we handle personal information on your behalf when we provide the Services. Words with a capital letter that are not defined here have the meaning given in the Terms of Use.

1. Definitions

• Privacy Act means the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs).
• Personal Information has the meaning given in the Privacy Act.
• Customer Data means any Personal Information that you, your users or your End Users put into the Services, including the content of your instances and End User Information.
• Subprocessor means a third party we engage that handles Customer Data to help us provide the Services.
• Data Breach means unauthorized access to, unauthorized disclosure of, or loss of Customer Data held by us or a Subprocessor.

2. Roles

You decide what Customer Data goes into the Services and why. We handle Customer Data only to provide the Services to you. You are responsible for having a lawful basis to collect Customer Data, and for the privacy policy and terms of use on each website or application you run on the Services, as section 2.8 of the Terms of Use requires.

3. How we handle Customer Data

• We handle Customer Data only to provide, support, secure and maintain the Services, and in line with your instructions. Your instructions are the Terms of Use, this DPA, how you configure the Services, and the support requests you send us.
• We do not sell Customer Data, and we do not use it for our own marketing.
• We do not disclose Customer Data unless the law requires it, as set out in sections 6.8 and 6.11 of the Terms of Use, or you ask us to in writing.
• Everyone at Insites who can access Customer Data is bound to keep it confidential.
• We comply with the APPs as they apply to us.

4. Security

We take reasonable steps to protect Customer Data from misuse, interference, loss, and from unauthorized access, change or disclosure. These include:

• giving access to Customer Data only to staff and Subprocessors who need it to provide the Services;
• encrypting Customer Data in transit between your users and the Services;
• keeping daily and weekly backups of every instance, held for three months, as section 3.8 of the Terms of Use describes; and
• reviewing these measures as the Services change.

5. Subprocessors

You agree that we may use the Subprocessors below. We require each one to protect Customer Data to a standard no lower than this DPA, and we remain responsible for their work.

We will tell the owners of your account by email at least 30 days before we add or replace a Subprocessor. If you object on reasonable grounds, write to us before the change takes effect. If we cannot resolve your objection, you may close the affected Services before the change takes effect.

You can ask for more detail about any Subprocessor, including the infrastructure hosting provider, by writing to us at the address in section 12.

6. Customer Data outside Australia

Some Subprocessors handle Customer Data outside Australia, as the table in section 5 shows. Before we disclose Customer Data overseas, we take reasonable steps to make sure the recipient handles it in a way that is consistent with the APPs, as APP 8 requires.

7. Data Breaches

• We will tell you without undue delay after we become aware of a Data Breach that affects your Customer Data.
• We will give you the information we have about what happened, what Customer Data is involved and what we are doing about it, and update you as we learn more.
• We will help you assess whether it is an eligible data breach under Part IIIC of the Privacy Act, and work with you on any notice you have to give to the people affected or to the Office of the Australian Information Commissioner.

8. Requests from individuals

If someone asks us to access or correct Personal Information in your Customer Data, or complains about how it is handled, we will pass the request to you and will not answer it ourselves unless the law requires us to. We will help you respond, where the Services do not already let you do so yourself.

9. When your account closes

When your account closes, you can retrieve your content as set out in the Terms of Use. We then delete Customer Data from the Services. Copies held in backups are removed as those backups expire, within three months, unless the law requires us to keep them for longer.

10. Information about our compliance

Once a year, or after a Data Breach, you may ask us in writing for information you reasonably need to show that we comply with this DPA, such as answers to a security questionnaire. We will answer within a reasonable time. We may withhold information that would put the security of the Services or of other customers at risk.

11. Changes to this DPA

We may change this DPA, for example when the law or the Services change. We will email the owners of your account at least 30 days before a material change takes effect, unless the law requires the change sooner. The date at the top of this page shows when it last changed.

12. Contact, precedence and governing law

• Send questions, objections and notices about this DPA to support@insites.io with the subject Legal Notice, as section 22.2 of the Terms of Use describes.
• If this DPA and the Terms of Use disagree about Customer Data, this DPA applies.
• This DPA is governed by the laws of Victoria, Australia, the same as the Terms of Use.