Data Processing Addendum

Businesses use Opsicom to hold details about their own clients, agents, crew, suppliers and the people in the files they make. This addendum sets out how Opsicom Holdings Pty Ltd (“Opsicom”, “we”) handles that information for the business that uses Opsicom (“you”).

You decide what personal information goes into your workspace and why. We process it for you and follow your instructions. Under the Australian Privacy Act 1988 we handle it in line with the Australian Privacy Principles. Under the GDPR, the UK GDPR and the Swiss data protection law, you are the controller and we are the processor.

It applies automatically to every customer while they use Opsicom. If this addendum and the Terms disagree about personal information, this addendum wins.

• -We only process Customer Personal Information on your instructions. Your instructions are the Terms, this addendum and how you use and set up Opsicom. If the law makes us do something else, we will tell you first unless the law forbids it
• -We will tell you if we think an instruction breaks Privacy Law
• -Everyone at Opsicom who can access Customer Personal Information is bound to keep it confidential
• -We protect it with the security measures in section 8
• -We help you answer requests from people about their information (section 10)
• -Where it is reasonable, we help you with privacy impact assessments and with questions from privacy regulators
• -We do not sell Customer Personal Information or use it for our own advertising
• -We do not use it to train AI models

• -You have the right to put the information into Opsicom and to have us process it as described here
• -You have told the people concerned, and have their consent where the law needs it
• -Your instructions to us follow Privacy Law

You allow us to use the Sub-processors on our sub-processors page. Each one is bound by a written contract with data protection terms that protect the information at least as well as this addendum. We stay responsible to you for their work.

Before a new Sub-processor starts handling Customer Personal Information, we update that page and email the owner of each workspace at least 30 days ahead. If you have a reasonable privacy objection, tell us at support@opsicom.com within that time. We will try to address it. If we cannot, you can end the affected service and we will refund any prepaid fees for the unused period.

AI features send the content needed to produce an answer to our AI Sub-processors, as set out in our Privacy Policy. Under their commercial terms they do not train their models on that content.

The measures in place today:

• -All traffic to and from Opsicom is encrypted with TLS
• -Our database, file storage and hosting providers encrypt data at rest
• -Row-level access rules in the database limit each person to the workspaces they belong to
• -Customer accounts sign in without a password: an emailed code or link, a passkey, or Apple or Google
• -The database is backed up daily, and the backups stay in Sydney, Australia
• -Payment and billing notifications from Paddle and Stripe are checked against their signatures before we act on them
• -Access to production systems is limited to the people who need it to run the service

We review these measures as Opsicom grows and will not reduce the overall level of protection.

If we become aware of a Data Breach affecting Customer Personal Information, we will tell you without undue delay and within 72 hours. We will tell you what happened, what information and people are affected, the likely consequences and what we are doing about it, and keep you updated as we learn more.

We will help you assess the breach and meet your obligations, including under Australia's Notifiable Data Breaches scheme and the GDPR and UK GDPR.

If someone asks us to see, correct or delete information you hold about them, we will pass the request to you and will not answer it ourselves unless the law requires us to. Opsicom lets you view, correct and delete most records yourself. Where you cannot, we will help you answer the request.

When you stop using Opsicom, tell us at support@opsicom.com whether you want Customer Personal Information deleted or returned. If you ask for it back, we will give you a copy in a common format. We will then delete it within 30 days of your request.

Until you tell us, we keep your workspace so you can come back. Deleted information can remain in database backups for a short time until they are replaced. We may keep information the law requires us to keep, and we keep protecting it under this addendum.

We will give you the information you reasonably need to show that we meet this addendum. You, or an independent auditor bound by confidentiality, may audit our compliance once a year on 30 days written notice, during business hours and at your cost, or more often if a regulator requires it or after a Data Breach. Audits must not put other customers' information at risk.

Customer Personal Information is stored in Sydney, Australia. Some Sub-processors process it in the United States, the United Kingdom, New Zealand, Switzerland and the European Union, and for Vercel and Cloudflare, whichever of their worldwide locations is closest to the person using the service. For disclosures from Australia, we take reasonable steps under Australian Privacy Principle 8 to make sure recipients protect it consistently with the Australian Privacy Principles.

For information that comes from the European Economic Area, the UK or Switzerland, transfers to us in Australia and onward to Sub-processors rely on:

• -An adequacy decision, where one covers the destination country, including the EU-US Data Privacy Framework and its UK and Swiss extensions for Sub-processors certified under it
• -Otherwise, the EU Standard Contractual Clauses (Commission Decision 2021/914), which are incorporated into this addendum: Module 2 where you are a controller and Module 3 where you are a processor. Clause 7 does not apply. Under clause 9 option 2 applies, with the notice period in section 6. The option in clause 11 does not apply. Clauses 17 and 18 choose the law and courts of Ireland. Annex I is section 3 of this addendum, Annex II is section 8, and Annex III is our sub-processors page
• -For the UK, the International Data Transfer Addendum issued by the UK Information Commissioner, added to those clauses
• -For Switzerland, those clauses with the changes the Swiss Federal Data Protection and Information Commissioner requires, with the Commissioner as the competent authority for Swiss transfers

Each party's liability under this addendum is subject to the limits in the Terms, except where Privacy Law or the Standard Contractual Clauses do not allow a limit. This addendum is governed by the laws of New South Wales, Australia, except the Standard Contractual Clauses, which are governed as they state.