Data Processing Addendum

1. About this Addendum

This Addendum forms part of the Terms of Service between TradeReach AI ("TradeReach", "we") and the business using the Service ("you"). It applies where we handle personal information on your behalf. It is written for Australian law, in particular the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and it is also intended to meet Article 28 of the EU General Data Protection Regulation where that law applies. If it conflicts with the Terms on data protection, this Addendum applies.

"Personal information" has the meaning given in the Privacy Act. "Controller" means the party that decides why and how the information is handled and "processor" the party that handles it on the controller's behalf. "Customer Personal Data" means the personal information we handle on your behalf, described in Annex 1. "Data breach" means unauthorised access to, disclosure of, or loss of Customer Personal Data.

2. Roles

You are the controller of Customer Personal Data and we are your processor. For your account, billing and our website, we are a separate controller, as our Privacy Policy explains. Each of us also complies with other privacy laws that apply to it, including Australia's Privacy Act 1988 where it applies.

3. Your instructions

We process Customer Personal Data only on your documented instructions. Your instructions are these Terms, this Addendum and the way you set up and use the Service. We will tell you if we believe an instruction breaks data protection law. If the law requires us to process Customer Personal Data in another way, we will tell you first unless the law forbids it.

You are responsible for having a lawful basis for the processing and for giving your callers any notice the law requires.

4. Confidentiality

Only people who need access to provide or support the Service may access Customer Personal Data, and they are bound by confidentiality.

5. Security

We take reasonable technical and organisational steps to protect Customer Personal Data from misuse, interference, loss and unauthorised access, modification or disclosure, consistent with Australian Privacy Principle 11. Annex 2 describes the measures in place. We may improve them, but will not reduce overall protection.

6. Subprocessors

You give general authorisation for us to use the subprocessors in Annex 3. We will tell you at least 30 days before adding or replacing a subprocessor. If you object on reasonable data protection grounds and we cannot address the objection, you may end the affected Service without penalty.

We impose data protection obligations on each subprocessor that are equivalent to those in this Addendum, and we remain responsible to you for their performance.

7. Requests from individuals

Taking into account the nature of the processing, we help you respond to requests from people exercising their rights, for example to access, correct or delete their data. If a request comes to us, we will pass it to you without undue delay and will not answer it ourselves unless you ask us to.

8. Other assistance

Taking into account the information available to us, we help you meet your obligations on security, data breaches (including any assessment and notification under the Notifiable Data Breaches scheme), privacy impact assessments and enquiries from regulators.

9. Data breaches

We notify you without undue delay after becoming aware of a data breach affecting Customer Personal Data. We give you the information you need to meet your own obligations as it becomes available, including the nature of the breach, its likely consequences and the measures taken.

10. International transfers

Customer Personal Data may be handled outside Australia by the subprocessors in Annex 3. We take reasonable steps, including binding contractual commitments, so that they handle it consistently with the Australian Privacy Principles, as Australian Privacy Principle 8 expects. Where another law applies to a transfer, we also use the safeguards it requires.

11. Return and deletion

When the Service ends, we will, at your choice, give you a copy of Customer Personal Data in a common electronic format (if you ask within 30 days) and then delete it within 90 days after the Service ends, unless the law requires us to keep it. Backup copies are deleted as they age out of our backup cycle, currently within 30 days. If you ask, we will keep opt-out records so that opted-out people are never texted again from a number we reassign.

12. Audits and information

We make available the information you need to show that this Addendum is met. You, or an independent auditor bound by confidentiality, may audit our compliance once a year on 30 days' notice, or after a data breach or at a regulator's request. Audits are at your cost and must not compromise the security of other customers' data.

13. Liability and duration

Liability under this Addendum is subject to the limits in the Terms, except where the law does not allow it. This Addendum lasts as long as we process Customer Personal Data for you.

14. Annex 1: Details of the processing

Subject matter and purpose

Providing the Service: receiving forwarded missed calls, texting callers, collecting their enquiry details, alerting you and showing leads and conversations in your dashboard.

Duration

The term of your subscription, plus the return and deletion period above.

Nature of processing

Receiving, recording, storing, organising, transmitting, displaying, backing up and deleting.

People concerned

People who call or text your business through the Service, and your staff named in the dashboard.

Types of data

Phone numbers, call times and status, text messages and photos sent where supported, details given by callers (such as name, suburb, job description and preferred callback time), urgency labels and opt-out status.

Special categories

Not intended. You should not use the Service to collect them.

15. Annex 2: Security measures

• All connections encrypted with HTTPS (TLS).
• Passwords stored only as scrypt hashes; login tokens random and stored only as hashes; login cookies HttpOnly, Secure and SameSite.
• The database is reachable only by the application, not from the internet; the application runs with a read-only file system and minimal privileges.
• Administrative access needs an explicitly granted role and a login within the last 12 hours, and administrative actions are logged.
• Repeated failed logins are limited; webhooks from our telecommunications provider are checked for a valid signature.
• Customer personal information is removed from operational event logs.
• Daily database backups with an integrity check, kept for 7 days on the server and up to 30 days off-site, with access restricted.

16. Annex 3: Subprocessors

Twilio Inc. (USA)

Phone numbers, call forwarding handling and SMS delivery.

netcup GmbH (Germany)

Server and database hosting.

Stripe and Resend process our customers' account and billing details, not Customer Personal Data, so they are covered by our Privacy Policy instead.