Data Processing Addendum

1. Parties and scope

Web Answerly is operated from Victoria, Australia. The operating company is being registered. Its legal name, ABN and ACN will appear here, and it will be the party to this document, before the document takes effect. In this document "Web Answerly", "we", "us" and "our" mean that company.

This Data Processing Addendum (DPA) is between Web Answerly and the Customer named in our Terms of Service. It applies whenever we process Customer Personal Data — personal information in Customer Content or End User Data — on the Customer's behalf. It does not cover information we handle as a controller for our own purposes, which our Privacy Policy describes. Terms not defined here have the meanings given in the Terms or in Data Protection Law.

Data Protection Law means every law on personal information that applies to the processing, including the Privacy Act 1988 (Cth), the EU General Data Protection Regulation (GDPR), the UK GDPR and the UK Data Protection Act 2018.

2. Roles

• The Customer is the controller of Customer Personal Data, and Web Answerly is its processor. If the Customer is itself a processor for its own clients (for example, an agency), Web Answerly is its subprocessor, and the Customer confirms its client has authorised this DPA.
• The Customer is responsible for the lawfulness of the processing it instructs: giving End Users the notices, and obtaining any consents, that the law requires; and having the right to provide the data to us.

3. Instructions

• We process Customer Personal Data only on the Customer's documented instructions. The Terms, the Customer's configuration and use of the Service, and any further written instructions we agree to are those instructions. We will not process it for any other purpose, unless the law requires us to; in that case we will tell the Customer first, unless the law prohibits that.
• We will tell the Customer if we believe an instruction breaks Data Protection Law.
• We do not sell Customer Personal Data, use it for advertising, or use it to train AI models. We may use metadata about the use of the Service, such as counts, timings and costs, which does not include the content of Customer Personal Data, to operate, secure, bill for and improve the Service.

4. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by confidentiality, and has access only as needed to provide, support or secure the Service.

5. Security

We maintain the technical and organisational measures in Annex 2, which are designed to provide security appropriate to the risk. We may update them, provided the overall level of protection is not reduced.

6. Subprocessors

• The Customer gives general authorisation for us to use the subprocessors listed on our Subprocessors page (Annex 3).
• We will give at least 30 days' notice of a new subprocessor, as that page describes. The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may terminate the affected service and receive a refund of fees prepaid for the period after termination.
• Each subprocessor is bound by written terms that protect Customer Personal Data at least as well as this DPA. We remain responsible to the Customer for our subprocessors' performance of those obligations.

7. Helping the Customer meet its obligations

• Requests from individuals. The Service lets the Customer view and export conversations and leads, and delete agents (with their conversations), sources and intake briefs. We will carry out other deletions the Customer asks for within 30 days of the request. If we receive a request about Customer Personal Data directly, we will pass it to the Customer without undue delay and will not answer it ourselves unless the Customer asks us to. We will give reasonable help with requests the Customer cannot handle with the Service alone.
• Assessments and regulators. We will give reasonable help with data protection impact assessments and with consultations with regulators, taking into account the nature of the processing and the information available to us.

8. Personal data breaches

We will notify the Customer without undue delay, and within 48 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data. We will describe what happened, what data and individuals are likely to be affected, the likely consequences, and what we are doing about it, adding information as it becomes available. We will take reasonable steps to contain the breach and reduce its effects. Notifying a breach is not an admission of fault.

9. Deletion and return

When the Terms end, the Customer may request an export of Customer Personal Data for 30 days. After that we delete it from our live systems, unless the law requires us to keep it. Backup copies are overwritten on our providers' normal cycle and stay protected by this DPA until then. During the subscription, the Customer can delete data with the Service, or ask us to, as section 7 describes.

10. Information and audits

We will make available the information reasonably needed to demonstrate compliance with this DPA, including answers to reasonable security questionnaires. If that is not enough, or a regulator requires it, the Customer may audit our compliance once in any 12 months, with at least 30 days' notice, during business hours, through an independent auditor bound by confidentiality, at the Customer's cost, and without access to other customers' data. We do not currently hold a third-party security certification.

11. International transfers

We process Customer Personal Data in Australia, and our subprocessors in the countries listed in Annex 3. Australia does not have an adequacy decision under the GDPR or the UK GDPR. So, where the GDPR or UK GDPR applies to a transfer to us:

• EU and EEA. The Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 (the SCCs) are incorporated into this DPA, with the Customer as data exporter and Web Answerly as data importer: Module Two (controller to processor), or Module Three (processor to processor) where the Customer is a processor. Clause 7 (docking) applies. Under Clause 9(a), Option 2 (general authorisation) applies, with the notice period in section 6. The optional wording in Clause 11 does not apply. Under Clause 13, the supervisory authority is the one determined by that clause. Under Clauses 17 and 18, the SCCs are governed by Irish law, and disputes go to the courts of Ireland. Annexes I to III of the SCCs are completed by Annexes 1 to 3 of this DPA.
• United Kingdom. The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022, as amended) is incorporated. Table 1: the parties are the Customer and Web Answerly, as above. Table 2: the SCCs as selected above. Table 3: Annexes 1 to 3 of this DPA. Table 4: either party may end the Addendum as allowed by its Section 19.
• Switzerland. The SCCs apply with the adaptations required by the Swiss Federal Act on Data Protection, with the Federal Data Protection and Information Commissioner as the competent authority for transfers subject to it.
• Where we transfer Customer Personal Data onwards to a subprocessor in another country without adequate protection, we put in place a transfer mechanism recognised by Data Protection Law.

If the SCCs or the UK Addendum conflict with this DPA, they prevail.

12. Australian Privacy Act

Where the Customer is bound by the Australian Privacy Principles, we will handle Customer Personal Data in a way that is consistent with them, as they apply to the Customer, and will not use or disclose it for our own purposes. This supports the Customer's obligations, including under APP 8 for any overseas disclosure.

13. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the SCCs do not allow liability to be limited. Where this DPA conflicts with the Terms on the handling of personal information, this DPA prevails. This DPA lasts as long as we process Customer Personal Data.

Annex 1 — Details of the processing

• Subject matter and duration: providing the Service under the Terms, for as long as we process Customer Personal Data.
• Nature and purpose: hosting, crawling, indexing (including creating embeddings), retrieving and generating answers with AI models, storing conversations, sending notifications and emails, delivering human replies, executing actions the Customer configures, booking meetings, and providing analytics and quality reviews to the Customer.
• Categories of individuals: the Customer's End Users (website visitors, people who email or message its agents, people who book or submit forms); the Customer's staff and users; people mentioned in content the Customer indexes.
• Categories of personal data: names, email addresses and other contact details End Users provide; message content and AI replies; page addresses and referrers; random visitor identifiers; booking details; intake answers; identifiers and attributes in verified-identity tokens the Customer issues; email headers and authentication results; Slack user identifiers; voice transcripts; summaries of action results; personal information within indexed content.
• Special categories: none intended. The Customer must not instruct us to process special-category data, or data about criminal offences, unless we agree in writing.
• Frequency: continuous, while the Service is in use.

Annex 2 — Technical and organisational measures

• Tenant isolation: each workspace's data is separated by row-level security in the database; public requests are tied to a workspace only through a verified key, never through anything a browser asserts.
• Encryption: data is encrypted in transit with TLS and at rest by our database provider. Stored third-party credentials (model, integration, calendar and action credentials and signing keys) are additionally encrypted with AES-256-GCM, using a key held outside the database.
• Keys and access: API keys are stored only as hashes and shown once; public widget keys work only on approved domains; workspace roles limit who can change settings, billing and members; email confirmation is required for every account.
• Staff access: platform roles are least-privilege, platform administrative actions are audit-logged, and multi-factor authentication is available to staff.
• Abuse protection: rate limits per key, address and visitor, abuse budgets, and usage allowances.
• Outbound safety: the crawler and actions refuse private network and cloud metadata addresses; action credentials are never sent to a browser or to a different host.
• AI safeguards: retrieved content is treated as untrusted data in prompts; a write action requires confirmation according to the Customer's policy and runs at most once.
• Resilience: managed database backups by our provider; incident response and breach notification under section 8.
• Data minimisation: voice audio is never sent to us; the widget stores nothing optional in the browser without consent; IP addresses used for rate limiting are kept only for the limit window.

Annex 3 — Subprocessors

The subprocessors, their functions and locations are listed on our Subprocessors page, which forms part of this DPA.

Contact

Questions about this DPA, or a signed copy for your records: privacy@webanswerly.com.