Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between My Journey Analytics Pty Ltd ("we", "Processor") and the Customer ("you", "Controller"). It applies whenever we process Customer Personal Data in providing the Service. Capitalised terms not defined here have the meaning given in the Terms.

1. Definitions

• Data Protection Laws means the laws that apply to the processing of Customer Personal Data under the Terms, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and, where applicable, the EU GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended.
• Customer Personal Data means personal data or personal information within Customer Data.
• Subprocessor means a third party we engage that processes Customer Personal Data.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• "Controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the applicable Data Protection Laws; "service provider" and "business" have the meanings given in US state privacy laws.

2. Roles

You are the controller of Customer Personal Data (or the entity responsible for it under the Privacy Act), and we process it as your processor and service provider. For the Account Data of your staff, we are an independent controller, and our Privacy Policy applies.

You are responsible for having a lawful basis for the processing, for giving End Users the notices the law requires, and for obtaining any consents needed, including for cookies and session recording.

3. Your instructions

We process Customer Personal Data only on your documented instructions. The Terms, your Order, this DPA and your configuration of the Service (including what you collect, masking, and retention settings) are your complete instructions. We will tell you if we believe an instruction breaches Data Protection Laws, unless the law prevents us.

As a service provider, we will not: sell or share Customer Personal Data; use it for any purpose other than providing the Service; or combine it with personal information from other sources, except as Data Protection Laws allow a service provider to do.

4. Our people

We ensure that everyone we authorise to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed to provide, secure or support the Service.

5. Security

We implement and maintain the technical and organisational measures described in Annex 2, appropriate to the risk of the processing. We may update them over time, provided the overall level of protection is not reduced.

6. Subprocessors

You give us general authorisation to engage Subprocessors. Our current Subprocessors are listed on our Subprocessors page.

• We bind each Subprocessor by written terms that protect Customer Personal Data at least as well as this DPA.
• We will give at least 30 days' notice of a new Subprocessor, by updating that page and notifying you by email or in the app.
• You may object on reasonable data protection grounds within that period. We will work with you in good faith to find a solution; if we cannot, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.
• We remain responsible for our Subprocessors' performance of their obligations.

AI model providers process Customer Personal Data only if you use AI features.

7. Data location and international transfers

Customer Personal Data for workspaces in the Australian Region is stored in Sydney, Australia. Some Subprocessors may access or process data from other countries, as shown on the Subprocessors page.

Where Data Protection Laws restrict transfers of personal data out of the European Economic Area, the United Kingdom or Switzerland, the parties agree that:

• the Standard Contractual Clauses approved by the European Commission (Module 2, controller to processor) are incorporated by reference, with Annex 1 and Annex 2 of this DPA completing their appendices;
• for the UK, the International Data Transfer Addendum issued by the UK Information Commissioner applies to those Clauses;
• for Switzerland, references to the GDPR are read as references to Swiss law, and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

Under the Privacy Act, we take reasonable steps to ensure overseas recipients handle Customer Personal Data consistently with the Australian Privacy Principles.

8. Requests from data subjects

The Service lets you find, export and delete data about a person. If we receive a request from one of your End Users, we will pass it to you and will not respond ourselves, except to direct them to you. Where you cannot meet a request using the Service, we will provide reasonable help.

9. Security Incidents

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. We will give you the information we reasonably can to help you assess the incident, meet any obligation to notify regulators or individuals (including under the Notifiable Data Breaches scheme and the GDPR), and limit its effects. Notifying you is not an admission of fault.

10. Assistance

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments and consultations with regulators relating to the Service.

11. Deletion and return

During your subscription you can export and delete Customer Data using the Service. Customer Data is retained according to the retention period of your plan. After the Terms end, we delete Customer Personal Data within 30 days, unless the law requires us to keep it. Data in backups is overwritten in the ordinary backup cycle and kept secure until then.

12. Audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA, such as security documentation and the results of independent assessments where we hold them. If that information is not enough to meet a requirement of Data Protection Laws, you may carry out an audit, or have an independent auditor do so, no more than once a year, with at least 30 days' notice, during business hours, under confidentiality obligations, and at your cost.

13. General

This DPA continues for as long as we process Customer Personal Data. Liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws do not allow it. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail. This DPA is governed by the law that governs the Terms, except where Data Protection Laws or the Standard Contractual Clauses require otherwise.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption: data is encrypted in transit using TLS, and at rest where supported by the underlying storage.
• Access control: production access is limited to authorised staff who need it, protected by multi-factor authentication, and removed promptly when no longer needed.
• Separation: each customer's data is logically separated by project and organisation.
• Infrastructure: hosted with providers that maintain recognised security certifications; network access to databases is restricted to the services that need it.
• Monitoring: infrastructure and access are logged and monitored for unusual activity.
• Resilience: regular backups, kept within the hosting region, and tested restoration procedures.
• Vulnerability management: dependencies and systems are kept patched, and security issues are prioritised by severity.
• Data minimisation: session recordings mask inputs by default, and the Service provides masking, opt-out and deletion controls to the Customer.
• Incident response: a documented process for assessing, containing and notifying Security Incidents.
• Personnel: confidentiality obligations and security awareness for everyone with access to Customer Personal Data.