Data Processing Agreement

This Data Processing Agreement applies between The Trustee for Ug Lea Family Trust trading as Very Lucky Ventures, ABN 26 847 081 003 (Very Lucky Ventures, we, our or us) and the client identified in the applicable Consultancy Agreement or Service Package (Client, you or your).

This Data Processing Agreement sets out the terms on which we collect, access, use, disclose, store or otherwise process Personal Information in connection with the services we provide to you under the applicable Consultancy Agreement and Service Package (Services).

This Data Processing Agreement forms part of the applicable Consultancy Agreement and Service Package governing the Services. If there is any inconsistency between this Data Processing Agreement and that agreement in relation to the processing, security, retention or disclosure of Personal Information, this Data Processing Agreement prevails to the extent of the inconsistency.

1. Reading and Accepting This Agreement

Capitalised words and phrases have the meanings given to them in this Data Processing Agreement or in the applicable Consultancy Agreement or Service Package.

By signing, accepting or otherwise entering into the applicable Consultancy Agreement or Service Package, you agree to be bound by this Data Processing Agreement where it is incorporated into or provided in connection with that agreement.

Any variation to this Data Processing Agreement must be agreed in writing by the parties.

2. Data Hosting and Security

We may use third-party hosting and other service providers to store or process Personal Information for the purpose of providing the Services.

We will take reasonable steps to protect Personal Information in our possession or control from misuse, interference, loss and unauthorised access, modification or disclosure, including by maintaining appropriate technical and organisational safeguards having regard to the nature of the Personal Information and the circumstances of the processing.

Without limiting the above, we will take reasonable steps to:

• restrict access to Personal Information to Personnel and service providers who reasonably require access for the purposes of providing the Services;
• require Personnel with access to Personal Information to keep that information confidential;
• use appropriate access controls and security measures for systems used to store or process Personal Information, including passwords, login credentials, API keys, access tokens and similar system-access information provided or made available by you (Credentials); use Credentials only for the authorised Services; and restrict access to Credentials to Personnel who reasonably require access for those Services; and
• maintain reasonable backup, recovery and business continuity measures appropriate to the Services.

Our use of third-party service providers, including any storage or processing of Personal Information outside Australia, is subject to the provisions of this Data Processing Agreement dealing with subcontractors, subprocessors and overseas processing.

3. Client Responsibilities

You are responsible for ensuring that your collection and disclosure of Personal Information to us, and any instructions you give us in relation to that Personal Information, comply with applicable Privacy Laws.

You must:

• have all rights, authorities, notices and consents reasonably necessary to provide or make Personal Information available to us for the purposes of the Services, including Personal Information relating to your Personnel, clients and other third parties;
• ensure that Personal Information you provide or make available to us is collected and disclosed lawfully and, where reasonably practicable, is accurate, complete and up to date;
• make individuals whose Personal Information is provided or made available to us aware of that processing where required by applicable Privacy Laws;
• only instruct us to process Personal Information in a manner permitted by applicable Privacy Laws and the agreement governing the Services; and
• notify us as soon as reasonably practicable if you become aware that any instruction given to us, or Personal Information provided or made available to us, may result in a breach of applicable Privacy Laws.

We are not required to act on an instruction to the extent we reasonably consider that doing so would breach applicable Privacy Laws or another legal obligation.

4. Permitted Processing

We may process Personal Information made available to us by or on behalf of you only to the extent reasonably necessary to:

• provide the Services and perform our obligations under the agreement governing the Services;
• act on your documented instructions in connection with the Services;
• access, configure or otherwise interact with third-party systems that you authorise us to access for the purposes of providing the Services, provided that we are not responsible for unauthorised access or use arising from circumstances outside our reasonable control, including compromise of Credentials caused by your negligence or a third-party breach beyond our reasonable control;
• use service providers, including AI-assisted tools for analysis, assistance, and meeting transcription or summarisation, where reasonably necessary to provide the Services and subject to the requirements of this Data Processing Agreement; and
• comply with applicable laws or binding requirements of a court, regulator or government authority.

We may also use information derived from data processed in connection with the Services to create aggregated and de-identified statistics, benchmarks and insights, provided that the resulting information does not identify you, your business or any individual.

We must not sell Personal Information or use, or permit an AI subprocessor to use, Personal Information processed in connection with the Services to train, fine-tune or improve any general-purpose artificial intelligence or machine learning model unless you expressly authorise that use in writing and the use is permitted by applicable law.

Except as expressly permitted by this Data Processing Agreement or the agreement governing the Services, we must not use Personal Information for our own independent purposes.

5. Subprocessors

We may engage third parties to process Personal Information on our behalf where reasonably necessary to provide the Services, including providers of hosting, cloud infrastructure, software, analytics, communications, AI-assisted tools and other operational services. We will give you reasonable prior notice of any materially new Subprocessor, including the nature and location of its processing, and you may object on reasonable privacy or security grounds before the proposed engagement; the parties will then work in good faith to resolve the objection, and we will not engage that Subprocessor for your Personal Information unless the objection is reasonably resolved or we offer a commercially reasonable alternative.

We must take reasonable steps to ensure that any third party that processes Personal Information on our behalf:

• processes the Personal Information only for the purposes for which we have engaged it;
• is subject to contractual obligations regarding privacy, confidentiality and security that are appropriate having regard to the nature of the Personal Information and the services it provides; and
• provides reasonable assistance to us where required for us to comply with our obligations under this Data Processing Agreement.

We remain responsible for managing our subprocessors in accordance with this Data Processing Agreement.

Where a subprocessor stores, accesses or processes Personal Information outside Australia, the provisions of this Data Processing Agreement dealing with overseas processing also apply.

6. Confidentiality and Access

We must keep Personal Information confidential and must not use or disclose it except as permitted by this Data Processing Agreement, the applicable Consultancy Agreement and Service Package, or applicable laws.

We must take reasonable steps to ensure that access to Personal Information is limited to our Personnel and subprocessors who reasonably require access for the purposes of providing the Services and that those persons are subject to appropriate confidentiality obligations.

We must ensure that our Personnel who access Personal Information are informed of their obligations regarding the privacy, confidentiality and security of that information.

Any actual or suspected unauthorised access to, disclosure of, loss of or other compromise of Personal Information will be dealt with under the Data Breach provisions of this Data Processing Agreement.

7. Compliance with Privacy Laws

Each party must comply with the Privacy Laws that apply to it in connection with the collection, use, disclosure, storage and other processing of Personal Information under or in connection with the Services.

We must process Personal Information in accordance with this Data Processing Agreement and, where applicable, our Privacy Policy.

Nothing in our Privacy Policy expands our rights to process Personal Information beyond the rights expressly permitted under this Data Processing Agreement.

If we become aware that an instruction from you would require us to process Personal Information in a manner that we reasonably consider would breach applicable Privacy Laws, we may suspend only the affected processing for so long as reasonably necessary, must promptly notify you of the reasons, and must reasonably cooperate with you to determine an appropriate lawful course of action.

8. Data Breaches

If we become aware of a Data Breach affecting Personal Information processed under or in connection with the Services, we must notify you as soon as reasonably practicable after becoming aware of it.

Our notice must include, to the extent reasonably available at the time:

• the nature and circumstances of the Data Breach;
• the categories of Personal Information affected;
• the known or reasonably anticipated consequences of the Data Breach; and
• the steps taken or proposed to contain, investigate and remediate the Data Breach.

We must take reasonable steps to contain, investigate and remediate the Data Breach and provide reasonable assistance and information required for you to assess and respond to the Data Breach.

Each party is responsible for determining and complying with its own notification obligations under applicable Privacy Laws. The parties must reasonably cooperate in relation to any notification to affected individuals, the Office of the Australian Information Commissioner or another regulator.

9. Overseas Processing

Personal Information may be stored, accessed or processed outside Australia where reasonably necessary for the Services, including through our use of subprocessors, provided that we give you reasonable prior notice of any material change to the countries in which your Personal Information is processed and consider in good faith any reasonable privacy or security objection.

Where we disclose Personal Information to an overseas recipient in circumstances to which the Privacy Act 1988 (Cth) applies, we will take reasonable steps required by applicable Privacy Laws to ensure that the recipient handles the Personal Information consistently with those laws.

Without limiting the above, we will take reasonable steps to ensure that relevant subprocessors are subject to appropriate contractual obligations concerning the permitted use, confidentiality and security of Personal Information and any onward disclosure of that information.

Where you direct or authorise us to disclose Personal Information to a third-party platform, service or provider selected by you, you acknowledge that the handling of that Personal Information by the third party may also be subject to that provider’s terms and privacy practices.

10. Privacy Assistance

Taking into account the nature of the Services and the Personal Information available to us, we will provide reasonable assistance to you where reasonably required in connection with:

• requests by individuals to access or correct their Personal Information;
• privacy complaints relating to Personal Information processed by us in connection with the Services;
• enquiries, investigations or requests from the Office of the Australian Information Commissioner or another regulator relating to that Personal Information; and
• your compliance with applicable Privacy Laws in relation to our processing of that Personal Information.

If we receive a request, complaint or regulatory enquiry that primarily relates to Personal Information we process on your behalf, we may refer the matter to you and will not respond on your behalf unless required by law or otherwise agreed with you.

11. Retention, Return and Deletion

We will retain Personal Information only for as long as reasonably necessary to provide the Services, comply with this Data Processing Agreement or satisfy applicable legal or regulatory requirements.

On termination or expiry of the applicable Consultancy Agreement or Service Package, or earlier if the Personal Information is no longer required for the Services, we will, at your written election, return or securely delete Personal Information in our possession or control within a reasonable period, except to the extent that:

• we are required by applicable law, or reasonably need for the establishment, exercise or defence of legal claims, to retain it;
• it is contained in backups or archives maintained in accordance with our ordinary backup and disaster recovery processes and cannot reasonably be deleted separately; or
• the information has been aggregated or de-identified so that it no longer identifies you, your business or any individual.

Any Personal Information retained after termination or expiry remains subject to the privacy, confidentiality and security obligations in this Data Processing Agreement for as long as we retain it.

Personal Information retained only in backups or archives will not be restored or otherwise processed except where reasonably necessary for disaster recovery, security, legal or compliance purposes and will be deleted in accordance with our ordinary retention cycles.

12. Evidence of Compliance

On reasonable written request, we will provide information reasonably available to us that is necessary to demonstrate our compliance with the privacy, confidentiality and security obligations in this Data Processing Agreement.

Any request under this clause must be reasonable having regard to the nature of the Services and must not require us to disclose information that is confidential to another client or third party, compromise the security of our systems or provide information that we are prohibited from disclosing by Law or another binding obligation.

The parties must first seek to satisfy any reasonable compliance request through existing policies, security information, certifications, reports or other documentation reasonably available to us where that material is reasonably sufficient to demonstrate compliance, before requesting any further review or assessment.

13. Definitions

14. Schedule of Processing

This Schedule of Processing forms part of this Data Processing Agreement and describes the subject matter and purpose of processing, its duration, the categories of individuals and Personal Information, processing activities, systems and sources, hosting and processing locations, and subprocessors. If there is any inconsistency between an operative provision of this Data Processing Agreement and this Schedule of Processing, the operative provision prevails to the extent of the inconsistency unless this Data Processing Agreement expressly states otherwise.