This policy is provided for review and must be confirmed by legal counsel before public launch.
This Data Processing Agreement (DPA) applies where Airfree processes personal data on behalf of a business customer in the course of providing the Services. It forms part of the agreement between the customer and Airfree and reflects the requirements of the GDPR and the Australian Privacy Act 1988.
1. Roles of the parties
For personal data processed under this DPA, the customer is the data controller (or, where the customer is itself a processor, the processor), and Airfree acts as the data processor (or sub-processor). Airfree processes personal data only on the customer’s documented instructions, including as set out in the agreement and the Services’ configuration.
2. Scope and purpose of processing
The subject matter of the processing is the provision of the Services. The nature and purpose are to host, store, transmit, and process customer data as necessary to deliver the Services. The categories of data subjects and personal data are determined by the customer through its use of the Services.
3. Airfree obligations
Airfree undertakes the following in respect of customer personal data.
- Process personal data only on the customer’s documented instructions, unless required by law (in which case Airfree will inform the customer where permitted).
- Ensure personnel authorised to process the data are bound by confidentiality.
- Implement appropriate technical and organisational security measures, as described in the Security Policy.
- Assist the customer, taking into account the nature of processing, in responding to data-subject requests and in meeting security, breach-notification, and impact-assessment obligations.
- Notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data.
- Delete or return customer personal data at the end of the Services in accordance with the Data Retention Policy.
- Make available information necessary to demonstrate compliance and allow for audits, subject to reasonable confidentiality and security controls.
4. Sub-processors
The customer authorises Airfree to engage sub-processors to support delivery of the Services. Airfree imposes data-protection obligations on each sub-processor no less protective than those in this DPA and remains responsible for their performance. Airfree will provide a means to review its sub-processors and to object to material changes.
5. International transfers
Airfree prioritises data residency in Australia. Where a transfer of personal data subject to the GDPR occurs to a country without an adequacy decision, it is made under appropriate safeguards such as the Standard Contractual Clauses.
6. Term and contact
This DPA applies for as long as Airfree processes personal data on the customer’s behalf. To enter into or request a countersigned copy of this DPA, contact us via /contact.