Data processing agreement

1. Scope and roles

This data processing agreement (DPA) forms part of the service agreement when incorporated in an accepted order or agreement between Argonix Digital, ABN 50 878 724 301 (Provider), and the customer business identified in that order (Customer). It applies to personal information within Customer’s tenant data processed to deliver ArcSolar.

Customer determines the purposes of that processing and provides lawful instructions. Provider processes that information on Customer’s behalf. Where a law uses controller and processor terminology, Customer is the controller and Provider is the processor for this processing. Each party remains separately responsible for processing for its own lawful business purposes, described in the Privacy policy.

This DPA prevails over inconsistent general service terms on processing of Customer personal information. Mandatory privacy law prevails over any inconsistent contract term. It does not itself grant access to another tenant or authorise an international transfer that requires a separate legal mechanism.

2. Documented instructions

Provider must process Customer personal information only to provide, secure, maintain and support the agreed services, in accordance with this DPA, the order, Customer’s authorised configurations and other documented lawful instructions. This includes instructions about connected services, sharing, export and deletion.

Provider must not sell Customer personal information, disclose tenant content to unrelated tenants, use it for public marketing or train general-purpose models on it without a separate lawful written authorisation. Provider must notify Customer if an instruction appears to infringe applicable privacy law and may pause that instruction while the parties resolve it.

If law requires processing beyond Customer’s instructions, Provider must inform Customer before that processing unless prohibited by law. Provider must limit the processing to what is required. Customer must provide the necessary notices and lawful authority for the information and instructions it supplies, including communications, recordings and sensitive information.

3. Confidentiality and access

Provider must ensure that people authorised to process Customer personal information are bound by confidentiality obligations and receive access only as reasonably necessary for their role. Access must be removed when no longer required. Support access must be authorised and limited to the task.

Tenant scope must be enforced in the application and data-access layers. A user’s membership in another business does not by itself permit cross-tenant access. Shared installer or partner access requires an independent authorised grant to the relevant business and work. Customer remains responsible for its deliberate sharing instructions and authorised user permissions.

4. Security measures

Provider must maintain reasonable technical and organisational measures appropriate to the nature of the information and the risk, taking account of the state of technology, implementation costs and applicable law. The measures in Schedule 2 are contractual requirements; the parties may agree additional measures in an order or security schedule.

Provider must review the measures as risks and services change and must not materially reduce the agreed level of protection during the service term. Customer must use available security controls, manage authorised users and notify Provider of suspected compromise. No statement in this DPA promises absolute security or an unverified certification.

5. Subprocessors and connected services

Customer authorises Provider to engage subprocessors reasonably necessary to deliver the agreed service, subject to this section. Provider must maintain a current register identifying each relevant subprocessor, its processing purpose and processing locations, and make it available to Customer through a confidential customer process or on request to privacy@argonix.net. Confidentiality must not prevent a disclosure required by privacy law.

Before a new or replacement subprocessor processes Customer personal information, Provider must give reasonable advance written notice, ordinarily at least 30 days where practicable. Customer may object on reasonable data-protection grounds within that notice period. The parties must work in good faith on an alternative or safeguards. If no reasonable solution is available, Customer may terminate the affected service without an additional termination penalty and receive a proportionate refund of prepaid unused fees for it.

Provider must impose written data-protection and confidentiality obligations on subprocessors consistent with the relevant obligations in this DPA and remains responsible for their performance of those obligations. A service independently contracted and controlled by Customer may instead act under its own agreement; Provider must clearly distinguish that role and limit data exchange to Customer’s authorised instructions.

6. Processing locations and transfers

Processing locations and any agreed residency restriction must be identified in the order or processing schedule and current subprocessor register. Provider does not promise that all processing occurs in Australia unless expressly agreed in writing.

Provider must comply with applicable requirements for overseas disclosure or restricted transfers, including reasonable steps and contractual safeguards where required. If EU or UK law applies and requires an approved transfer mechanism, the parties must identify and complete the applicable standard clauses, addendum or other lawful mechanism before that restricted transfer. This public DPA does not represent that an uncompleted annex or transfer instrument has been executed.

Provider must notify Customer, where lawful, of a binding public-authority demand for Customer data and disclose only what is legally required. Provider must consider available lawful challenges where a demand appears invalid or disproportionate.

7. Personal information incidents

Provider must notify Customer without undue delay after becoming aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer personal information. Notification must not be delayed until a final investigation is complete.

As information becomes available, Provider must describe the nature of the incident, affected information and people, likely consequences, mitigation and the contact for follow-up. Provider must take reasonable containment and remediation steps, preserve relevant evidence and provide updates and reasonable assistance for Customer’s assessment and notification obligations.

Each party is responsible for notifications required of it by law. Provider must coordinate with Customer before notifying affected individuals about tenant data where practicable and lawful, without delaying a mandatory notification. An incident notice is not by itself an admission of liability.

8. Rights requests and assistance

Taking account of the processing and information available, Provider must reasonably assist Customer with access, correction, deletion, restriction and other applicable individual-rights requests, privacy impact assessments, regulator enquiries and security obligations. Provider must promptly forward a request relating to tenant data to Customer unless prohibited by law and must not independently disclose that data without authority.

Customer may request information reasonably necessary to demonstrate compliance with this DPA. Where that information is insufficient, the parties must arrange a proportionate audit by Customer or an independent confidential auditor, with reasonable notice, scope and security protections. Audit arrangements must protect other customers’ information and operational security without preventing a lawful regulator’s access. Any non-routine assistance charges must be reasonable and agreed in advance; Provider may not charge Customer to remedy Provider’s own breach.

9. Return and deletion

During the service, Provider must retain Customer personal information only for the agreed purposes and period. At termination, Customer may instruct Provider to return it in a commonly usable format or delete it, subject to the agreed export and retention schedule. The parties must document the completion timing and any exceptions; Provider must confirm completion on reasonable request.

Where retention is legally required, Provider must identify the basis and duration, restrict access and use, and delete when that requirement ends. Backup copies may remain until the applicable documented backup cycle expires, with restricted access and no further business use. If a backup is restored, the deletion instruction must be reapplied. Data must not be kept indefinitely simply because it is in a backup.

Schedule 1. Processing details

Subject and duration. Hosting and operating the contracted ArcSolar business workspace for the service term, followed by agreed export, deletion and restricted legal/backup retention.

Purpose and operations. Customer-directed collection, organisation, storage, retrieval, display, communications, workflow processing, authorised sharing, export and deletion for CRM, quoting, delivery, payments records, rebates and other contracted modules.

People. Customer’s staff and authorised users; prospects and customers; installers, subcontractors, supplier contacts and other people whose information Customer lawfully supplies.

Information. Names and business/contact details; site and project details; quotes and customer documents; communications and recordings where enabled lawfully; appointments, assignment and workflow records; payment references and statuses; and information in authorised uploads. Full card credentials and bank login passwords are not intended tenant data. Special-category or sensitive information is not requested by default and requires an expressly agreed lawful purpose and safeguards.

Customer-specific details. The order and processing schedule identify selected modules, relevant processing locations, authorised connections, retention periods and any additional restrictions. Customer may update its instructions through authorised channels.

Schedule 2. Required safeguards

• Access control based on authenticated identity, authorised role and tenant/work scope, including independent grants for shared access.
• Appropriate protection of information in transit and at rest, with secrets and privileged credentials restricted to authorised personnel and systems.
• Confidentiality obligations, proportionate staff access, secure development and change management, vulnerability remediation and dependency maintenance.
• Risk-appropriate logging, monitoring, incident response and recovery arrangements that minimise unnecessary personal information in diagnostic records.
• Documented backups, restoration procedures, retention and deletion handling, with proportionate testing and access restrictions.
• Subprocessor diligence and contractual controls, authorised export handling and a process for privacy requests and security enquiries.