Data Processing Agreement

Version: Australia & New Zealand · Last updated: [DATE] · Effective from: [DATE]

This version applies to customers established in Australia, New Zealand and the Pacific, and to everyone else where no other version applies. The version that governs your organisation is chosen from the country it is registered in, and is shown in Organisation settings → Region.

---

This DPA forms part of the Terms of Service between NethuneX, ABN 56 137 797 320 (the "Processor"), and the Customer (the "Controller").

It applies whenever the Processor processes Personal Data on behalf of the Controller. The Privacy Act does not require a written processing agreement, but customers handling crew records expect one and it records the APP 8 and APP 11 commitments we make.

---

1. Definitions

Terms in this DPA have the meaning given in the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), unless defined here.

• "Personal Data" — any information relating to an identified or identifiable natural person.
• "Processing" — any operation performed on Personal Data: collection, recording, storage, retrieval, disclosure, deletion and so on.
• "Sub-processor" — any third party engaged by the Processor that processes Personal Data on behalf of the Controller.
• "Personal Data Breach" — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

2. Processing details

Subject matter	The provision of the NethuneX platform
Duration	The term of the Customer's subscription, plus the 30-day post-termination export window
Nature and purpose	Storing and processing operational maritime data (vessels, crew, voyages, incidents, maintenance, payroll, connected email) so the Customer can run its fleet
Categories of data subjects	The Customer's employees, contractors, crew members, agents and vendors
Categories of Personal Data	Names, contact details, employment information, certificates and identity documents, medical fitness records, payroll data, email correspondence
sensitive information (APP 3)	Crew medical fitness records; identity documents

3. Processor's obligations

The Processor will:

3.1. Process Personal Data only on the Controller's documented instructions — in practice, the Controller's use of the Service — unless the law requires otherwise, in which case the Processor will tell the Controller first where it may.

3.2. Ensure that everyone it authorises to process Personal Data is bound by confidentiality.

3.3. Implement the technical and organisational measures in Annex II.

3.4. Help the Controller respond to requests from data subjects (access, correction, deletion, portability, objection) through the self-service tools in the Service and, where those do not suffice, within 10 business days of a request.

3.5. Notify the Controller without undue delay, and within 24 hours of becoming aware, of a Personal Data Breach affecting the Controller's data, with enough detail for the Controller to meet its own obligation to notify the OAIC and affected individuals as required by the Notifiable Data Breaches scheme; our target is 72 hours from confirming an eligible breach.

3.6. Help the Controller with data-protection impact assessments and prior consultation with a regulator, where the Controller reasonably needs it.

3.7. At the end of the engagement, delete all Personal Data after the 30-day export window, unless the law requires retention, and confirm deletion in writing on request.

3.8. Make available the information needed to demonstrate compliance with this DPA, and allow for and contribute to audits as set out in Section 6.

4. Sub-processors

4.1. The Controller authorises the Processor to engage the Sub-processors in Annex III.

4.2. The Processor will give the Controller at least 30 days' notice before adding a Sub-processor that will process Personal Data.

4.3. The Controller may object on reasonable data-protection grounds; if the Processor cannot accommodate the objection, the Controller may terminate the affected part of the Service without penalty.

4.4. The Processor binds each Sub-processor to data-protection obligations no less protective than this DPA, and remains liable to the Controller for its Sub-processors' performance.

5. International transfers

5.1. Personal Data is stored in Sydney, Australia (ap-southeast-2).

5.2. Some Sub-processors process data outside Australia (Annex III names the country for each).

5.3. Transfer mechanism: APP 8: before disclosing personal information to an overseas recipient we take reasonable steps to ensure the recipient handles it in line with the APPs, and we remain accountable for it.

6. Audits

6.1. Once a year, the Controller may request a written report on the Processor's security and data-protection practices. The Processor will provide its current independent assurance report where one exists (ISO 27001 or SOC 2), and otherwise written answers to a reasonable security questionnaire within 20 business days.

6.2. Where the law or a regulator requires more, the Controller (or an independent auditor it appoints, bound by confidentiality) may audit the Processor on 30 days' notice, during business hours, no more than once a year unless a Personal Data Breach has occurred, at the Controller's expense.

7. Liability

This DPA is subject to the liability provisions of the Terms of Service, except that nothing limits the consumer guarantees under the Australian Consumer Law that cannot be excluded.

8. Governing law

This DPA is governed by the laws of Queensland, Australia, and the courts of Queensland, Australia have jurisdiction.

---

Annex I — Description of processing

See Section 2.

Annex II — Technical and organisational measures

Domain	Measure
Encryption	TLS 1.3 in transit. AES-256 at rest (managed by the hosting provider). Connected-mailbox credentials encrypted with AES-256-GCM under a key held only by the application.
Access control	Row-level security in the database enforces per-customer isolation at the data layer, not only in application code. Role-based access control within each customer organisation: profiles, roles and permission sets configured by the customer's administrator. Crew medical records sit behind a separate permission.
Authentication	Email and password through the hosting provider's authentication service, with two-factor authentication available to every user and visible to administrators.
Audit logging	Sensitive operations are logged with user, timestamp and source IP, and retained for 7 years.
Backups	Daily snapshots retained according to the hosting plan; point-in-time recovery where the plan includes it.
Personnel	Everyone with production access is bound by confidentiality; production access is limited to the founder and any named operations staff.
Vendor management	Sub-processors are bound to equivalent data-protection standards (Section 4.4).
Vulnerability management	Automated dependency alerts reviewed on merge; security patches applied on a severity-based timeline.
Incident response	Documented runbook (operations/runbook-ndb.md) with a 24-hour Controller-notification target.
Data segregation	Each customer's data is isolated by row-level security; the database refuses cross-customer reads even if application code had a bug.
Network security	Provider-managed firewall; no direct database connections from end-user browsers; API access only with scoped keys and rate limits.
AI processing	Requests to AI providers carry only the data the request refers to, for the duration of the request; crew medical records are never sent.

Annex III — Authorised Sub-processors

The Processor's sub-processors, by category and location of processing, are:

Category	Location of processing	Status
Cloud database, authentication and file storage	Australia (Sydney)	Approved
Web hosting and content delivery	United States (edge locations worldwide; served from Australia)	Approved
Error monitoring (personal identifiers removed before sending)	United States	Approved
Payment processing	United States; Ireland for EU customers	Approved — from the first paid plan
Transactional email delivery	United States	Approved
Map tiles (receives the browser's IP when a tile loads)	Switzerland	Approved
AI model providers, chosen by the Controller's region	United States; France for EU organisations' email extraction	Approved
Live vessel-position (AIS) feed — vessel identifiers only	No personal information processed	Approved
Document scanning (OCR)	France	Pending — added under Section 4.2 when scanning is switched on

The named list — each sub-processor, its purpose, the data it sees, its location and status — forms part of the signed agreement (the table below in the executed copy), is available to the Controller's administrators at any time in the Service (Settings → Organisation → Security & data → Sub-processors), and is provided on request. The Processor notifies the Controller's administrators by email of any addition under Section 4.2, stating the date it takes effect and the objection window; the list in the Service is the current list for the purposes of this Annex.