Data Processing Addendum

1. About this Data Processing Addendum

1.1 This Data Processing Addendum (“Addendum” or “DPA”) forms part of the Agreement between Tradie View Pty Ltd (“TradieView”, “we”, “us” or “our” or “Processor”) and the Customer (“Controller”) and applies where TradieView processes personal information on behalf of the Customer in the course of providing the Platform.

1.2 This Addendum should be read together with the Terms & Conditions, Privacy Policy and Product Terms.

1.3 Where there is a conflict between this Addendum and any other TradieView contractual document specifically regarding the processing of personal information, this Addendum prevails.

1.4 Capitalised terms not defined in this Addendum have the meaning given in the Terms & Conditions or Privacy Policy.

2. Roles of the Parties

2.1 The Customer is the controller (or equivalent) of Customer Data. The Customer determines the purposes and means of processing personal information entered into the Platform.

2.2 TradieView acts as a processor (or equivalent) and processes personal information only on documented instructions from the Customer, except where required to do so by applicable law.

2.3 The Customer is responsible for ensuring that it has all necessary notices, permissions and lawful bases to collect and process the personal information it enters into the Platform, and for complying with all applicable privacy and data-protection laws in respect of that information.

2.4 Where the Customer is subject to the GDPR or UK GDPR and requires additional processor terms, the parties may agree those terms under an SOW or separate addendum.

2.5 Where Section 2.4 applies, TradieView will provide the Customer on request with a GDPR/UK GDPR-compliant processor addendum incorporating Article 28(3) processing terms and, where required for an international transfer, the applicable Standard Contractual Clauses or UK International Data Transfer Addendum.

3. Processing Instructions and Assistance

3.1 TradieView will process personal information only in accordance with the Customer’s documented instructions as set out in the Agreement and this Addendum, unless required to do otherwise by applicable law (in which case TradieView will inform the Customer unless prohibited by law).

3.2 The Customer’s instructions are deemed to include the processing necessary to provide, secure, support, maintain and improve the Platform as described in the Agreement and Privacy Policy.

3.3 The Customer is primarily responsible for responding to requests from individuals exercising their rights under applicable privacy law in respect of Customer Data.

3.4 TradieView will provide reasonable technical assistance to the Customer, using the Platform’s available export and administration tools, to help the Customer respond to a request from an individual to access, correct or delete their personal information.

4. Confidentiality and Personnel

4.1 TradieView will ensure that persons authorised to process personal information are subject to appropriate confidentiality obligations.

4.2 TradieView will restrict access to Customer Data to personnel and service providers who need access for legitimate purposes connected with the provision of the Platform, support, security, maintenance or legal compliance.

4.3 TradieView will ensure that personnel with such access are subject to appropriate confidentiality obligations, whether by contract or as a matter of professional or statutory duty.

5. Sub-processors

5.1 The Customer authorises TradieView to engage sub-processors to assist in providing the Platform. A current list of material sub-processors is maintained at https://tradieview.com/legal/sub-processors.

5.2 TradieView will impose data-protection obligations on sub-processors that are no less protective than those in this Addendum, to the extent applicable to the services provided by the sub-processor.

5.3 TradieView will provide at least 30 days’ advance notice of a new sub-processor by updating the Sub-Processor List and, on request, by email to the Customer’s nominated contact.

If the Customer has a reasonable data-protection objection to a new sub-processor, the Customer may raise it within that 30-day period. The parties will work in good faith to resolve the objection. If the objection cannot be resolved, the Customer may terminate the affected service without penalty for the remainder of any committed term, and TradieView will refund a pro-rata portion of any prepaid Fees for the unused remainder of the term.

6. International Transfers

6.1 Personal information may be processed in countries outside Australia, including by sub-processors, as described in the Privacy Policy and Sub-Processor List.

6.2 Before disclosing personal information to an overseas recipient, TradieView takes reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles in relation to that information, including through contractual data-protection terms with providers and sub-processors.

Where TradieView is not reasonably able to take such steps in relation to a particular disclosure, that disclosure will only be made where an exception under APP 8.2 applies, or with the Customer’s or individual’s informed consent.

7. Security

7.1 TradieView will implement and maintain appropriate technical and organisational measures designed to protect Customer Data against unauthorised or unlawful processing and against accidental loss, destruction or damage, taking into account the nature of the processing and the risks involved.

7.2 Further details of TradieView’s security measures are set out in the Privacy Policy and may be supplemented by information provided under Section 9.

8. Return and Deletion of Customer Data

8.1 On termination or expiry of the subscription, the Customer may export Customer Data during the post-termination export period described in the Terms & Conditions and Privacy Policy (normally up to 30 days, subject to payment of outstanding Fees and technical limitations).

8.2 After the export period, TradieView will delete or de-identify Customer Data from active production systems in accordance with its retention practices, except where retention is required by law or for legitimate residual purposes (such as security logs or legal holds).

8.3 Residual copies may remain in backups until overwritten in the ordinary backup cycle.

8.4 On written request made within a reasonable time after the export period, TradieView will provide the Customer with written confirmation that Customer Data has been deleted or de-identified from active production systems, noting that residual copies may remain in backups until overwritten in the ordinary backup cycle.

9. Audit and Information Rights

9.1 On reasonable request, TradieView will make available a summary of its security practices and, where available, current independent security certifications or audit reports (for example SOC 2 or ISO 27001, if and when obtained), which the Customer may rely on to satisfy most due-diligence and security-questionnaire requirements.

9.2 Where a Customer reasonably requires further verification beyond the materials in Section 9.1 (for example because of a specific regulatory requirement or a suspected incident), TradieView will discuss a reasonable audit scope, method and timing. Any such audit may include a third-party auditor bound by confidentiality and may be subject to fees, confidentiality obligations and reasonable scheduling limits (normally no more than once per 12 months absent a suspected incident).

10. Data Breach Notification

10.1 TradieView will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide information reasonably required to help the Customer meet its own notification obligations under applicable law.

10.2 TradieView’s notification obligations are subject to the requirements of the Australian Notifiable Data Breaches scheme and any other applicable law.

11. General

11.1 This Addendum is governed by the laws of Queensland, Australia, unless the parties agree otherwise in an SOW.

11.2 Liability arising under or in connection with this Addendum is subject to the limitations and exclusions of liability in the Terms & Conditions.

Schedule 1 — Processing Details

Item	Detail
Categories of data subjects	Customer’s employees, contractors, subcontractors, clients and suppliers whose information is entered into the Platform
Types of personal information	As described in Section 4 of the main Privacy Policy (account and identity information, business and operational information, communications, location information, and other categories the Customer chooses to enter)
Nature and purpose of processing	Provision, security, support, maintenance and improvement of the Platform, as described in the Agreement and Privacy Policy
Duration of processing	For the term of the subscription, plus the export and retention periods described in this Addendum and the Privacy Policy

12. Contact

DPA-related enquiries and security notifications should be directed to support@tradieview.com.