Data Processing Agreement

1. Definitions

In this Data Processing Agreement ("DPA"), the following terms have the meanings set out below. "Controller" means the customer that decides why and how personal data in its Kumry organisation is processed. "Processor" means PMOAid Pty Ltd (ABN 88 654 942 757) trading as Kumry, of Level 7, 90 Phillip Street, Parramatta NSW 2150, Australia, which processes personal data on behalf of the Controller. "Personal Data" means personal information as defined in the Privacy Act 1988 (Cth). "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure and erasure. "Sub-processor" means a third party engaged by the Processor to process personal data on behalf of the Controller.

"Australian Privacy Principles" or "APPs" refers to the privacy principles set out in Schedule 1 of the Privacy Act 1988 (Cth). "Notifiable Data Breach" has the meaning given in Part IIIC of the Privacy Act 1988 (Cth). "Eligible Data Breach" has the meaning given in section 26WE of the Privacy Act 1988 (Cth).

2. Scope and Purpose

This DPA applies to personal data the Processor processes on behalf of the customer in providing the Kumry accounting service. It forms part of the Kumry Terms of Service. If this DPA and the Terms of Service conflict on a data processing matter, this DPA prevails to the extent of the conflict.

The Processor shall process personal data only as needed to provide the services described in the Terms of Service and in line with the Controller's documented instructions, which include the Controller's use and configuration of the Service. The Processor shall not process personal data for any other purpose unless Australian law requires it, in which case the Processor shall tell the Controller of that requirement before processing, unless the law prohibits this.

The Controller is responsible for having the notices, consents and authority the Privacy Act 1988 (Cth) and other applicable laws require before it provides personal data to the Processor, and for the lawfulness of its instructions. The Processor shall tell the Controller if, in its opinion, an instruction breaches Australian privacy law.

3. Processing Details

The categories of personal data processed include: business contact information (names, email addresses, phone numbers, addresses), financial transaction data (invoices, bills, payments and bank statement lines), employee payroll data (names, tax file numbers, superannuation details, bank details and pay), customer and supplier records, customer portal users' names and email addresses, and uploaded documents. The categories of data subjects include the Controller's users, employees, contractors, customers and suppliers.

Processing activities include: importing data from bank statement files, from other accounting systems the Controller connects or exports from, and from uploaded documents; suggested categorisation and reconciliation; report generation; compliance calculations such as GST and BAS; the customer portal; and storage and backup. Processing continues for the term of the Terms of Service and the retention periods set out in our Privacy Policy.

Where the Processor processes sensitive information (as defined in the Privacy Act 1988), it does so only as needed to provide the services and in line with the Controller's instructions. The Processor shall collect, store, use and disclose tax file numbers only for purposes permitted by taxation, personal assistance or superannuation law, and in line with the Privacy (Tax File Number) Rule 2015.

4. Sub-processors

The Controller gives general authorisation for the Processor to engage sub-processors on the following conditions. The current list of sub-processors, with what each receives and where, is published at /legal/subprocessors. The Processor shall notify the Controller by email at least 30 days before engaging a new sub-processor or replacing an existing one, and shall update that list.

The Controller may object to a new sub-processor by written notice within 14 days of being notified. If the Controller objects and the parties cannot reach a reasonable resolution, the Controller may cancel the affected services without penalty and receive a refund of the unused part of any period it has paid for. The Processor shall impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible for the acts and omissions of its sub-processors.

5. Security Measures

The Processor shall implement and maintain appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include encryption of data in transit, multi-factor authentication, separation of each customer's data from other customers' data, role-based access controls and audit logging of defined security and product events. Personal data is hosted on infrastructure the Processor operates in Australia.

The Processor shall ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The specific security measures are described in our Security Policy, which forms part of this DPA.

The Processor shall review its security measures periodically and may update them over time, provided that any update does not materially reduce the overall level of protection given to personal data.

6. Data Breach Notification

If the Processor becomes aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, the Processor shall notify the Controller without undue delay and, where practicable, within 72 hours of becoming aware of it.

The notification shall include, as far as is then known: a description of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to deal with the breach and reduce its effects. The Processor shall provide further information as it becomes available, and shall cooperate with the Controller in meeting any obligations under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).

The Processor shall document all personal data breaches, including the facts, their effects and the remedial action taken, and make this documentation available to the Controller on request. The Processor shall take all reasonable steps to reduce the effects of a breach and to prevent it happening again. Where the breach is an Eligible Data Breach under the Privacy Act, the Processor shall assist the Controller in preparing any notification to the Office of the Australian Information Commissioner (OAIC) and to affected individuals.

7. Individuals' Requests

The Processor shall assist the Controller in responding to requests from individuals exercising their rights under the Australian Privacy Principles, including requests for access to or correction of personal data, and complaints about how it has been handled.

The Processor shall promptly tell the Controller if it receives a request directly from an individual about the Controller's data, and shall not respond to it except on the Controller's documented instructions, unless the law requires it. The Processor shall implement appropriate technical and organisational measures to help the Controller respond to such requests.

Where the Controller is subject to additional regulatory requirements about individuals' rights, such as a sector-specific privacy code, the Processor shall cooperate with the Controller to meet them. The Processor shall respond to the Controller's requests for assistance within five business days.

8. Audit Rights

The Processor shall make available to the Controller the information reasonably needed to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections, by the Controller or an auditor the Controller appoints who is bound by confidentiality. The Controller shall give at least 30 days' written notice before an audit.

Audits shall be conducted during normal business hours and shall not unreasonably interfere with the Processor's operations or with other customers' data. The Controller shall bear the costs of any audit unless it reveals a material breach of this DPA by the Processor. The Processor may first answer audit requests with written responses and relevant documentation, and an on-site inspection is needed only if those do not reasonably answer the Controller's questions.

The Controller may conduct no more than one audit in any twelve-month period unless a material breach has been identified or a regulator requires another. The Processor shall respond to written audit questions within 15 business days. Both parties shall treat audit findings and communications as confidential.

9. Return and Deletion of Data

The Controller can export personal data at any time while its subscription is active, and for 7 years after it ends, using the report-level exports available in the Service (CSV/Excel/PDF). The Processor shall provide reasonable assistance to the Controller in moving its data to a replacement provider.

After that period, personal data is deleted from live systems and removed from backups as they expire within 35 days, except where Australian law requires the Processor to keep it. Where personal data is kept because of a legal obligation, the Processor shall tell the Controller the legal basis on request, and shall keep protecting the data under this DPA until it is deleted.

The Processor shall confirm the deletion of personal data in writing on the Controller's request.

10. Overseas Disclosure, Governing Law and Changes

We disclose personal data overseas only to the sub-processors listed at /legal/subprocessors, taking the steps required by Australian Privacy Principle 8. The Processor shall tell the Controller, on request, where personal data is processed.

This DPA is governed by the laws of New South Wales, Australia, and the parties submit to the non-exclusive jurisdiction of its courts and the Federal Court of Australia. If any provision of this DPA is unenforceable, the rest continues to apply.

We may change these standard terms in the same way as the Terms of Service, with at least 30 days' notice by email. A DPA signed by both parties can be changed only by written agreement signed by both parties.

Together with the Terms of Service, this DPA is the whole agreement between the parties about data processing. Questions about this DPA should be sent to support@kumry.com.

11. Privacy Impact Assessments

The Processor shall provide reasonable assistance to the Controller in conducting privacy impact assessments where required by law, or where the Controller reasonably believes that a processing activity is likely to create a high risk to individuals' privacy. This may include information about the Processor's processing, security measures and sub-processors.

Where the Processor identifies a processing activity that it believes may create a high risk to individuals, it shall tell the Controller and cooperate in any assessment or mitigation. The Processor shall not begin a new processing activity that materially changes the risk to the Controller's personal data without first notifying the Controller, under section 4 where it involves a new sub-processor.

12. Liability

Each party is responsible for loss caused by its own breach of this DPA or of the Australian Privacy Principles. The Processor shall compensate the Controller for loss arising from a breach of this DPA by the Processor or its sub-processors. Each party's liability under this DPA is subject to the limits in the Terms of Service, which apply to both parties.

Nothing in this DPA limits either party's liability for death, personal injury, fraud, or any other liability that cannot be excluded or limited by law. The parties agree to cooperate in good faith to resolve any dispute under this DPA before starting formal proceedings.