Data Processing Addendum

1. Introduction

This Data Processing Addendum ("DPA") forms part of the agreement between Vivacity Coaching and Consulting Pty Ltd (ABN 40 140 059 016), trading as ComplyHub ("Processor", "we", "us"), and the customer organisation ("Controller", "you", "your") for the provision of the ComplyHub platform and services ("Services").

This DPA sets out the terms governing the processing of personal data by the Processor on behalf of the Controller, in compliance with applicable data protection laws including the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs).

This DPA applies where the Processor processes personal data on behalf of the Controller in connection with the Services. In the event of conflict between this DPA and the Terms of Service, this DPA prevails to the extent of the inconsistency regarding data processing matters.

2. Definitions

• "Controller" means the entity that determines the purposes and means of processing personal data. For the purposes of this DPA, the Controller is the customer organisation subscribing to the Services.
• "Processor" means the entity that processes personal data on behalf of the Controller. For the purposes of this DPA, the Processor is ComplyHub (Vivacity Coaching and Consulting Pty Ltd).
• "Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller.
• "Personal Data" means any information relating to an identified or identifiable natural person that is processed in connection with the Services.
• "Data Breach" means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, and deletion.

3. Roles and Responsibilities

3.1 Controller Responsibilities

The Controller is responsible for:

• Determining the lawful basis for processing personal data
• Ensuring personal data is collected lawfully and with appropriate consent where required
• Providing clear and accurate instructions to the Processor regarding data processing
• Ensuring personal data provided to the Processor is accurate and up to date
• Responding to data subject requests (access, correction, deletion)
• Notifying affected individuals and regulators of data breaches where required
• Conducting data protection impact assessments where appropriate
• Complying with applicable privacy laws in the Controller's jurisdiction

3.2 Processor Responsibilities

The Processor shall:

• Process personal data only on documented instructions from the Controller
• Ensure persons authorised to process personal data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures
• Assist the Controller in responding to data subject requests
• Notify the Controller of data breaches without undue delay
• Assist the Controller with compliance obligations, including impact assessments
• Delete or return personal data upon termination, at the Controller's choice
• Make available information necessary to demonstrate compliance

4. Processing Details

4.1 Subject Matter

The subject matter of processing is the provision of compliance management services to Registered Training Organisations, including document management, governance tracking, trainer records, and audit evidence management.

4.2 Duration

Processing shall continue for the duration of the Services agreement and for such period thereafter as required for data return or deletion.

4.3 Nature and Purpose

The nature and purpose of processing includes:

• Storage and retrieval of compliance documentation
• Management of trainer and assessor records
• Student support and enrolment record keeping
• Audit evidence organisation and reporting
• User authentication and access management
• Platform analytics and service improvement

4.4 Categories of Data Subjects

Personal data may relate to:

• Employees and staff of the Controller
• Trainers and assessors
• Students and learners
• Contractors and third-party service providers
• Governance and board members

4.5 Categories of Personal Data

Types of personal data processed may include:

• Contact information (name, email, phone, address)
• Employment information (job title, qualifications, work history)
• Educational records (enrolments, assessments, completions)
• Identification documents (as uploaded by the Controller)
• Support records (notes, accommodations, interventions)
• System usage data (login times, activity logs)

5. Security Measures

The Processor implements appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These measures include:

5.1 Technical Measures

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256
• Role-based access controls and row-level security policies
• Multi-factor authentication options for user accounts
• Automated security monitoring and vulnerability scanning
• Regular security updates and patch management
• Automated backup with point-in-time recovery capabilities
• Secure deletion procedures for data removal

5.2 Organisational Measures

• Staff confidentiality agreements and training
• Access limited to personnel requiring access for service delivery
• Incident response procedures and escalation protocols
• Regular security assessments and reviews
• Vendor security due diligence for sub-processors
• Business continuity and disaster recovery planning

6. Sub-processors

6.1 Authorisation

The Controller authorises the Processor to engage sub-processors to assist in providing the Services, subject to the requirements in this section.

6.2 Sub-processor Obligations

The Processor shall ensure that sub-processors are bound by written agreements imposing data protection obligations no less protective than those in this DPA. The Processor remains liable for the acts and omissions of its sub-processors.

6.3 Current Sub-processors

The following sub-processors are engaged as of the date of this DPA:

6.4 Changes to Sub-processors

The Processor shall notify the Controller at least 30 days before engaging a new sub-processor or making material changes to existing sub-processors. The Controller may object to the change by providing written notice within 14 days. If the parties cannot resolve the objection, the Controller may terminate the affected Services.

7. Data Breach Notification

7.1 Notification

The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a data breach affecting Controller personal data.

7.2 Notification Contents

The breach notification shall include, where available:

• Description of the nature of the breach
• Categories and approximate number of data subjects affected
• Categories and approximate number of records affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact point for further information

7.3 Assistance

The Processor shall cooperate with the Controller to investigate and remediate the breach, and to fulfil the Controller's obligations to notify affected individuals and regulators.

8. Data Subject Rights

The Processor shall assist the Controller in responding to requests from data subjects exercising their rights, including:

• Right of access to personal data
• Right to correction of inaccurate data
• Right to deletion (where applicable)
• Right to data portability

If the Processor receives a request directly from a data subject, it shall promptly notify the Controller and await instructions before responding, unless legally required to respond directly.

9. Data Return and Deletion

9.1 Upon Termination

Upon termination or expiry of the Services agreement, the Processor shall, at the Controller's written request:

• Return all personal data to the Controller in a structured, commonly used format; or
• Delete all personal data and certify deletion in writing

9.2 Retention Period

The Controller must request data return within 30 days of termination. After this period, the Processor may delete all Controller personal data without further notice.

9.3 Legal Retention

The Processor may retain personal data to the extent required by applicable law, provided such data remains subject to the confidentiality and security obligations of this DPA.

10. International Data Transfers

Primary data storage is located in Australia (AWS Sydney region). Where personal data is transferred to sub-processors located outside Australia, the Processor ensures that:

• The recipient is bound by contractual obligations equivalent to this DPA
• Appropriate safeguards are in place as required by applicable law
• The transfer is necessary for the performance of the Services

11. Audit and Compliance

The Processor shall make available to the Controller information necessary to demonstrate compliance with this DPA. The Controller may, upon reasonable notice and during business hours:

• Request evidence of security measures and compliance controls
• Review audit reports and certifications held by the Processor
• Conduct or commission an audit, subject to confidentiality obligations

Audits shall be conducted at the Controller's expense and shall not unreasonably interfere with the Processor's business operations.

12. Term

This DPA shall remain in effect for the duration of the Services agreement and shall automatically terminate upon termination of the Services, subject to the Processor's obligations regarding data return and deletion.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service, except that neither party excludes liability for fraud or wilful misconduct.

14. Contact

For questions about this Data Processing Addendum, please contact: