Data processing agreement

What this is

This agreement forms part of the terms of service between the customer organisation (you) and Get Frank Pty Ltd (we, us). It governs personal information contained in the content you put into the service. It applies automatically; it does not need a separate signature, though we will countersign a copy on request.

Australian privacy law does not divide the world into controllers and processors. In its terms: you are the entity that collected the information and decides what it is used for; we hold and handle it on your behalf, for the purpose of delivering the service to you and for nothing else. This agreement is written under Australian law. Where your information comes to us from a place whose law restricts sending it to Australia, Transfers outside Australia says which clauses apply to it; if your organisation needs anything else under another regime, raise it before contracting.

What we process, and why

Get Frank references your systems of record; it does not become one. It stores provenance pointers to your records rather than copying the rows, and the bytes of a file you upload are a transit artefact held for your configured retention window, 30 days by default and never more than 365, then erased. The evidence footprint is deliberately small.

Our obligations

We will:

• handle personal information in your content only on your documented instructions, which are these terms, the terms of service, and any written instruction you give us through your authorised users, unless the law requires otherwise, in which case we tell you first where we lawfully can;
• not use it for our own purposes, not sell it, not use it to train machine-learning models, and not use one customer’s content to build or improve anything for another;
• ensure that everyone who handles it for us is bound by confidentiality obligations at least as strict as these;
• apply the security measures in Security and keep them under review;
• engage only the sub-processors on the published list, on the terms it sets out for changes and objections;
• send it outside Australia only as Transfers outside Australia sets out;
• help you meet your own obligations to the people concerned, as Requests from individuals sets out;
• tell you about incidents as Incidents sets out;
• return or delete the information as Return and deletion sets out;
• give you what you need to check that we are doing these things, as Verification sets out.

Your obligations

Each time your organisation supplies content to the service, you warrant that:

• you collected the personal information in it lawfully and fairly;
• the law allows you to disclose it to us for the purpose of delivering the service to you, including what is sent or reachable from outside Australia as Transfers outside Australia sets out, and you hold any consent that disclosure needs;
• the people it concerns have been given whatever notice the law requires, including of that disclosure; and
• supplying it to us does not breach a duty of confidence or another obligation you owe.

Each of these is measured against the law that applies to your organisation. Where the Australian Privacy Principles bind you, that includes them; where they do not, for example because the small business exemption applies to you, we do not ask you to take on by contract duties the law does not give you.

Whatever law applies to you, and whether or not it would let you hold it, your content contains no sensitive information as the Privacy Act 1988 (Cth) defines it: the service is not built to hold it. Where it arrives regardless, Sensitive information received applies.

If something already in the service stops meeting these commitments, because a consent is withdrawn for example, remove it or tell us and we will help you remove it.

You decide what goes into the service and you remain responsible for it. Where you connect the service to one of your systems, you are responsible for the scope of what that connection exposes. Where a feed lets you keep things back from a service the product asks, what you keep back is your decision and your responsibility, including anything whose name identifies a person: the product cannot tell which names say whose they are, or whether a name is a person’s, and sends everything you have not kept back, as the sub-processors and hosting page sets out.

Sensitive information received

A governance record can carry sensitive information without anyone intending it to: a health detail inside an incident narrative, a background check inside a supplier file. A prohibition on uploading it does not change what we hold once it has arrived, so this is what happens when it does.

• Containment. From the moment either of us becomes aware of it, we handle it only to remove it. It is not used to derive posture, is not shown in any export we generate for you after that point, and is not touched for any other purpose. Access to it is limited to the named individuals removing it.
• Notification. If we become aware of it first, we tell your security contact within 2 business days, with where it sits and what we propose to do. If you become aware first, tell us through a support request and we act on that.
• Removal. Within 5 business days of either notice we remove it from working data: the file bytes are erased regardless of your retention window, and the derived record is edited or removed as you instruct, keeping the upload record (name, size, content hash, mapping) so that your assurance history stays intact. We confirm to you in writing what was removed and when.
• Backups. A copy persists in every backup taken while we held the material: the database’s point-in-time backups and the nightly dump of the database, held with a second provider, both listed on the sub-processors and hosting page. We delete each nightly dump ourselves within seven days of it being taken; the point-in-time backups are kept for the seven days the hosting provider states and then removed by it. Until then each is used for nothing but restoring the service. If we restore from any backup or dump taken before the removal, we repeat the removal before the service is returned to you.
• Your side. We do not assess whether the information should have been collected, or by whom; that is yours. Where it is an eligible data breach for you, Incidents sets out how we help.

Security

Traffic to and from the service is encrypted in transit and served only over HTTPS. Each customer’s data is isolated from every other customer’s at the database layer. Credentials you give us for connected systems are encrypted at rest. The privileged console we use to support the service runs on a separate origin from the application you use. The application runs as unprivileged processes on read-only filesystems with no host access. Access to production is limited to named individuals, each with individual credentials and multi-factor authentication. The hosting provider keeps point-in-time backups of the database covering the previous seven days, and we keep a nightly dump of the database, each dump deleted within seven days of being taken, with a second provider in Sydney and locked against alteration and early deletion, as the copy that survives the loss of the database cluster or of the hosting provider; because a backup can hold content you have since deleted, neither period is ever set longer than the longest upload retention window in force, and both are stated here so that the real bound on a deleted file, your window plus seven days, is the number you can quote. For the nightly dump that bound is ours to keep, and we keep it by deleting each dump ourselves rather than waiting for the storage provider to; for the point-in-time backups it rests on the hosting provider’s stated retention.

Our own information security management system runs on Get Frank, and its posture is available to you on request in the same form we ask you to produce for others.

Sub-processors

The providers we use, what each does and where data is held are on the sub-processors and hosting page, which is part of this agreement. Before a new or replacement provider handles customer content, or an existing provider’s role, its access to customer content, the kinds of information it handles, or the location where it holds or processes customer content changes materially, we tell your security contact at least 30 days ahead with the proposed text of that page; you may object on reasonable data-protection grounds within that period, and if we cannot resolve the objection you may terminate without penalty. The change is published, and takes effect, only when that period has run. Removals and reductions take effect when published. We remain responsible to you for what a sub-processor does with your information.

Transfers outside Australia

Everything we store of your content is held in Australia, as the sub-processors and hosting page sets out. This section covers information crossing a border in either direction: coming to us from outside Australia, and sent or reachable from outside Australia once we hold it.

Information you send us from outside Australia

Where a law you are subject to restricts sending personal information to Australia, the standard contractual clauses that law recognises form part of this agreement for the personal information in your content that it governs, with you as the data exporter and us as the data importer:

• European Union. The standard contractual clauses in the annex to Commission Implementing Decision (EU) 2021/914: Module Two where you decide what the information is used for, and Module Three where you hold it on behalf of someone else who does.
• United Kingdom. The International Data Transfer Addendum to those clauses issued by the Information Commissioner, version B1.0, in force from 21 March 2022, with its mandatory clauses as the Commissioner revises them.
• Switzerland. The European Union clauses, read with the Federal Act on Data Protection in place of the European law they name, the Federal Data Protection and Information Commissioner as the supervisory authority, and Switzerland counted as a member state for a person’s right to bring a claim where they habitually reside.

Where the clauses leave a choice, it is made as follows:

• Clause 7, which lets a further party accede, is included.
• Clause 9: Option 2, general written authorisation, with the 30 days’ notice and the objection right in Sub-processors.
• Clause 11: the optional wording on an independent dispute resolution body is not included.
• Clause 13: the supervisory authority is the one clause 13(a) designates for you.
• Clauses 17 and 18: Option 1, the law of Ireland, and the courts of Ireland.
• In the United Kingdom addendum, neither party may end it under its section 19.

The annexes are drawn from this agreement, except for the details only you can give. For Annex I, you are the exporter and we are the importer; the transfer is continuous for the term of your agreement, its subject, purpose, kinds of information and people concerned are those in What we process, and why, and how long it is kept is in Return and deletion. Annex II is Security. Annex III is the sub-processors and hosting page. Accepting the terms of service is each party’s signature of the clauses and their annexes.

Accepting the terms does not tell us who and where you are, so Annex I is completed in writing. Before you send us information the clauses govern, tell us through a support request your organisation’s legal name and address; the name, position and contact details of your contact person for the clauses; your representative in the European Union or the United Kingdom, if you have appointed one; and the supervisory authority competent for you under clause 13. Within 5 business days we confirm those details in writing, with our own: our legal name and registered address, and our contact person, reached at [email protected]. That exchange, read with this agreement, is Annex I, and we keep it for as long as the clauses apply to you. Tell us the same way when any of your details changes. If information the clauses govern reaches us before Annex I is completed, the clauses apply to it all the same, and you give us the details as soon as you can. Where the clauses and this agreement conflict, the clauses prevail for the information they govern; elsewhere this agreement applies as written, and the clauses do not change which law governs the rest of it. Where the clauses apply, we pass information on to a sub-processor or to anyone else only as they permit.

The clauses are a lawful way to send information to us, and nothing more. Including them does not mean that Get Frank, or your use of it, meets the General Data Protection Regulation or any other law outside Australia, and we make no such claim. Whether your transfer needs them, and whether they are enough for it, is yours to judge. To help you judge it, we give you on request, within 15 business days, a written account of the Australian laws under which a public authority could require access to your information, and of what we would do if one asked.

Information sent or reachable from outside Australia

Storing your content in Australia does not by itself keep it there. Two kinds of thing take it, or access to it, outside Australia.

Our providers’ staff. Several providers on the sub-processors and hosting page are companies based outside Australia, as the list there shows, and their staff may reach the information they handle for us from outside Australia to run and support what they provide. That access is under our contract with each provider and the commitments that page sets out, and where the clauses apply, it is an onward transfer we permit only as they allow.

Services the product asks. Some of the product’s feeds ask a public service a question about something your content names, so that the answer can reach you. Every service sent anything from your content is listed in the services the product asks section of the sub-processors page, with what it is sent, what that can reveal, where it goes and what you can keep back from it. Your content is sent to one only when your organisation subscribes to the feed that asks it, and only what that section lists. A service is listed there only for a question about something other than a person, such as a piece of software, and we do not add one that asks about people. What it is sent can still identify someone, as a package published under a person’s own name does, and the section says what can and how you keep it back. Keeping it back is yours, as Your obligations says, and where the transfer clauses apply you keep back anything they govern that would identify a person, so that nothing they govern is sent to such a service. Such a service is not a sub-processor: it is not engaged to hold or process anything for us, is not bound by this agreement, and answers under its own terms, which may let it keep what it is sent. Before the product sends anything from your content to a new service, or changes what it sends, we give the notice the sub-processors page sets out.

Requests from individuals

A person named in your content may ask us for access to, or correction of, information about them. We will tell them that you hold the record and notify you within 5 business days that they asked, with what they asked for. We do not alter your records on their behalf. Where you need our help to answer a request, a regulator, or a complaint about information we hold for you, we provide it within 10 business days of your asking, at no charge unless the request is unreasonably repetitive, in which case we quote first.

Incidents

If we become aware of unauthorised access to, or loss, alteration or disclosure of, personal information in your content, we will:

• contain it, and preserve what is needed to understand it;
• notify your security contact in writing within 24 hours of confirming that your content is affected, with what we know: what happened, what information, which people, what we have done, and what we recommend you do. If an outage at one of our providers, outside our control, leaves us no way to reach your security contact within that time, we notify them as soon as a way returns, and say how long the notice was delayed and why;
• give you a written report within 10 business days, and updates as we learn more;
• assess whether it is an eligible data breach under the Notifiable Data Breaches scheme, and where it is, agree with you who notifies the affected individuals and the Office of the Australian Information Commissioner, so that they are told once and consistently.

We record the incident in our own posture as an incident, not as a footnote.

Return and deletion

Your assurance records leave the service as the complete export described in continuity and exit. On termination you have 30 days from the date it takes effect to request it, and we deliver it within that window. We then delete or de-identify everything we hold for you within 30 days of that window closing, except what the law requires us to keep. Deletion removes the information from active storage; a copy in the nightly dump persists until we delete it, within seven days of it being taken, and a copy in a point-in-time backup until the hosting provider’s seven-day retention ends; either is used for nothing but restoring the service.

Verification

Once a year, or after an incident affecting your content, you may ask us for a written account of how we meet this agreement: our current posture from our own information security management system, our sub-processor list, and answers to a reasonable security questionnaire. We answer within 15 business days. Where that is not enough for a regulator or auditor of yours, you may conduct one audit a year, on 30 days’ notice, during business hours, at your cost, scoped to this agreement and conducted so as not to disturb other customers. We may require the auditor to sign a confidentiality undertaking.

Liability

Liability under this agreement is subject to the limits and exclusions in the terms of service. Nothing in this agreement excludes liability that cannot lawfully be excluded.

Changes

We update this agreement as the service evolves, by publishing a new text with a new “Effective from” date; that date at the top is the date the text applies from and says which text applies, and the current text stays in force until the replacement is published. Before we publish a change we send your security contact the full proposed text at least 30 days ahead with the publication date, on the terms, and with the exceptions and the termination right, set out under Changes in the terms of service. Monitor this page for the latest text; earlier texts are available on request.

— Get Frank Pty Ltd