Data Processing Addendum

1. Roles

For workspace content, you are the controller (the APP entity responsible for the personal information) and we are the processor, handling it only on your instructions and to provide the service. For your own account and billing records we act as controller.

2. Subject matter and duration

Processing lasts for the term of your subscription plus the deletion grace period. Categories of data subject: your personnel, contractors, visitors, vendor contacts and any individuals named in records you enter. Categories of data: identifiers and contact details, employment and training records, health and safety incident details, and whatever else you choose to store.

3. Our obligations

• Process only on your documented instructions, and tell you if we believe an instruction is unlawful.
• Maintain the security measures described in the Privacy Policy and not weaken them during the term.
• Ensure personnel with access are bound by confidentiality and have access only as needed.
• Assist you with data subject access, correction and deletion requests.
• Notify you without undue delay on becoming aware of a personal data breach affecting your data.
• On termination, delete your data on an approved request, subject to the retained audit log and any documented legal or regulatory preservation obligation.

4. Sub-processors

Sub-processor	Purpose	Location
Google Cloud	Hosting, database, file storage, scheduling, secret management	Australia
Anthropic, via Google Cloud Vertex AI	AI features described in the Terms. Prompts are not used for model training	Australia
Stripe	Subscription billing. Handles payment details; we do not store card numbers	United States (card data only)
Transactional email provider	Invitations, verification and notification email	To be confirmed

We will give 30 days' notice before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds.

5. Systems you connect

If you connect Google Workspace or Microsoft 365, you instruct us to read the files and directory data you grant access to. Access is read-only, except for one optional, explicitly enabled feature that creates new template files in your own Drive. We never modify or delete your existing files. Disconnecting revokes the grant and destroys the stored credential.

6. Audit and assurance

On reasonable notice, and no more than once in any 12-month period, you may request information reasonably necessary to confirm our compliance with this addendum.

7. International transfers

Primary processing is in Australia. Where a sub-processor transfers data overseas, we take reasonable steps to ensure it handles the information consistently with the Australian Privacy Principles, as required by APP 8.