Data Processing Addendum

This addendum is part of the Terms of Use between Cactive Pty Ltd (“we”) and an organisation that uses Cactive (“the customer”). It applies to personal information in the customer’s workspace that we handle on its behalf (“customer personal information”).

The customer decides why and how that information is handled; we handle it to provide the services. In the language of the GDPR, the customer is the controller and we are its processor. A separate agreement signed with us takes priority over this addendum.

• Only on the customer’s instructions: these terms, how its administrators set up and use the services, and any other instructions it gives in writing that we agree to. If the law requires us to do otherwise, we’ll tell the customer first unless the law prevents it.
• Not for our own purposes, not for advertising, not sold, and not used to train AI models.
• Only by people who need it to provide the services and are bound to keep it confidential.
• In line with the Privacy Act 1988 (Cth) and, where they apply, the EU and UK General Data Protection Regulations.

• The customer authorises us to use the service providers listed in our Privacy Policy (Who we disclose it to), with what each receives and where.
• We update that list before a new provider receives customer personal information. A customer can object on reasonable grounds; if we can’t resolve it, the customer can cancel and we’ll refund the unused part of a period it has paid for.
• We use providers whose terms require them to protect the information, and we remain responsible for their work.

We protect customer personal information with the measures in our Security and Vulnerability Disclosure page, including encryption in transit and at rest, separation between organisations, multi-factor authentication for our own access and audit logs, and keep them appropriate to the risk.

If we become aware of a breach of security affecting customer personal information, we’ll tell the customer’s owners without undue delay, with what we know about it, and keep them updated. We’ll help the customer assess it and meet its own duties to notify, under the Notifiable Data Breaches scheme or the GDPR.

• Administrators can see, export, correct and delete the workspace’s information with the tools in the services. If someone asks us directly about information in a customer’s workspace, we’ll refer them to the customer.
• We’ll give reasonable help with requests from individuals, privacy impact assessments and questions from regulators, as far as the information we hold allows.
• We’ll make available the information reasonably needed to show we meet this addendum. Audits beyond that are by agreement, with reasonable notice and at the customer’s cost.

• The customer’s owners and administrators can export its data at any time.
• When its subscription ends, its data is kept for 90 days so it can still be exported or the subscription restarted, and then deleted. Owners can delete the organisation sooner, once it’s empty.
• Deleted information stays in backups until they expire, within a year. We keep what the law requires us to, such as invoices, and the organisation’s audit log until its retention period ends.

Customer personal information is stored in Australia and, while our move to Sydney finishes, also in the United States, and our service providers handle it in the countries the Privacy Policy lists. For information the EU or UK GDPR covers, the European Commission’s standard contractual clauses (controller to processor, or processor to processor) and the UK’s addendum to them apply to transfers from the customer to us, and are part of this addendum.

For customer personal information the EU or UK GDPR covers, the sections above set out the terms Article 28(3) requires. In particular, we:

• handle it only on the customer’s documented instructions, including for transfers
• ensure the people who handle it are bound to confidentiality
• take the security measures Article 32 requires
• engage sub-processors only as described above, on terms that protect the information as these do
• help the customer respond to individuals exercising their rights
• help the customer with security, breach notification and data protection impact assessments
• delete or return it when the services end, unless the law requires us to keep it
• make available what’s needed to show we comply, and allow for audits as described above

Details of the processing

• Subject matter and duration: providing the services, for as long as the customer uses them, and the retention above.
• Nature and purpose: hosting, storing, sending, displaying and otherwise processing it to provide and secure the services.
• Kinds of personal information: whatever the customer and its members put in the services, such as names, contact details, messages, files, calendars, customer records and sign-in records.
• People it’s about: the customer’s members, and the people its members communicate with or keep records about.

The Terms of Use’s liability terms apply to this addendum. Questions go to legal@cactive.com.au.