Data Processing Addendum
1. Scope and parties
This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between you (“Customer”) and the AppliFlo company named in the Terms (“AppliFlo”). It applies whenever AppliFlo processes Personal Data contained in Customer Data on Customer’s behalf. Terms not defined here have the meaning given in the Agreement or in the Data Protection Laws.
“Data Protection Laws” means all laws that apply to the processing, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles; Regulation (EU) 2016/679 (“GDPR”); the GDPR as it forms part of UK law, and the UK Data Protection Act 2018 (“UK GDPR”); the Swiss Federal Act on Data Protection; the California Consumer Privacy Act, as amended (“CCPA”); and similar US state laws.
2. Roles
Customer is the controller (or, under the CCPA, the “business”) of Personal Data in Customer Data. AppliFlo is its processor (or “service provider”). Where Customer itself acts as a processor for its own client, AppliFlo is a sub-processor, and Customer confirms that its client has authorised this DPA. Annex 1 describes the processing.
3. Customer’s instructions
AppliFlo processes Personal Data only on Customer’s documented instructions, unless the law requires otherwise. If it does, AppliFlo will tell Customer first where the law allows. The Agreement, Customer’s use and configuration of the Service, and this DPA are Customer’s complete instructions. AppliFlo will tell Customer if it believes an instruction breaks Data Protection Laws.
Customer is responsible for the lawfulness of the Personal Data and its instructions. That includes giving notices to, and obtaining any consents from, the individuals concerned, including for the AI processing described in the AI Terms.
4. Confidentiality
AppliFlo ensures that everyone it authorises to process Personal Data is bound by confidentiality obligations. Staff access to Customer Data is limited to what is needed to provide support, keep the Service secure, or comply with law. Every access is logged.
5. Security
AppliFlo implements and maintains the technical and organisational measures in Annex 2. These measures are designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. AppliFlo may update the measures, but will not materially reduce the overall level of protection.
6. Sub-processors
Customer generally authorises AppliFlo to use sub-processors, including AppliFlo’s related companies and those listed on the Sub-processors page. AppliFlo will:
- impose data-protection terms on each sub-processor that are at least as protective as this DPA;
- remain responsible for its sub-processors’ performance; and
- give at least 30 days’ notice before adding or replacing a sub-processor, by updating the Sub-processors page and emailing subscribers to it. In an emergency, such as replacing a failed provider, the notice may be shorter, and AppliFlo will give it as soon as possible.
Customer may object to a new sub-processor on reasonable data-protection grounds within that notice period. The parties will discuss the objection in good faith. If it cannot be resolved, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees.
7. Assistance
Taking into account the nature of the processing, AppliFlo will reasonably help Customer:
- respond to requests from individuals exercising their rights. If AppliFlo receives such a request directly, it will pass it to Customer and will not respond itself unless Customer asks it to;
- carry out data protection impact assessments and consult regulators; and
- meet its security and breach-notification obligations.
Customer can export, correct and delete Customer Data using the Service. Any other help may be charged at reasonable cost, if it goes beyond what is normal.
8. Personal data breaches
AppliFlo will notify Customer without undue delay, and in any event within 72 hours after becoming aware of a breach of security affecting Customer’s Personal Data. The notice will include what AppliFlo knows about the nature of the breach, the data and individuals affected, the likely consequences, and the steps taken. AppliFlo will provide updates as it learns more. It will take reasonable steps to contain the breach and reduce harm, and will cooperate with Customer’s assessment under the Australian Notifiable Data Breaches scheme and other notification laws. Notifying Customer is not an admission of fault.
9. Deletion and return
When the Agreement ends, Customer may export Customer Data for 30 days. AppliFlo will then delete Customer Data within 60 days, and from backups when they expire within a further 35 days, unless the law requires it to keep some of it. Retained data stays protected by this DPA. See Data Retention & Deletion.
10. Audits
AppliFlo will make available the information reasonably needed to show compliance with this DPA, such as answers to a security questionnaire once a year, and third-party audit reports when it has them. If that information is not enough, or a regulator requires it, Customer may audit AppliFlo’s compliance itself or through an independent auditor bound by confidentiality, no more than once a year. The audit needs 30 days’ notice, takes place during business hours, and is at Customer’s cost.
11. International transfers
Customer Data is hosted in the region described in our Privacy Policy, currently Australia. AppliFlo and its sub-processors may process it in the other countries listed there.
- EU/EEA: where a transfer of Personal Data subject to the GDPR goes to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”) are incorporated by reference. Module 2 applies when Customer is a controller, and Module 3 when Customer is a processor. Clause 7 (docking) applies. Option 2 (general authorisation) applies in Clause 9, with the notice period in section 6. The optional language in Clause 11 does not apply. Clause 17 is governed by Irish law, and Clause 18 chooses the courts of Ireland. Annexes I and II are Annexes 1 and 2 of this DPA.
- UK: the International Data Transfer Addendum issued by the UK Information Commissioner (version B1.0) is incorporated, completed with the information in this DPA. Either party may end it as permitted by its Section 19.
- Switzerland: the SCCs apply with references to the GDPR read as the Swiss FADP, and the Swiss FDPIC as the competent authority.
- Australia: AppliFlo takes reasonable steps to ensure overseas recipients handle Personal Information consistently with the Australian Privacy Principles (APP 8).
If the SCCs conflict with this DPA, the SCCs prevail.
12. US state privacy laws
To the extent the CCPA or similar laws apply, AppliFlo is a service provider (or processor), and it:
- will not sell or share Personal Information;
- will process it only for the business purpose of providing the Service described in the Agreement;
- will not keep, use or disclose it outside its direct business relationship with Customer, or combine it with personal information from other sources, except as the CCPA permits;
- will comply with the CCPA and provide the same level of privacy protection it requires;
- allows Customer to take reasonable steps to make sure AppliFlo uses Personal Information consistently with Customer’s obligations, and to stop and remedy unauthorised use; and
- will notify Customer if it can no longer meet its obligations under the CCPA.
AppliFlo certifies that it understands these restrictions and will comply with them, and it imposes the same terms on its sub-processors.
13. Australian tax file numbers
Where Customer Data includes tax file number information, AppliFlo will handle it only to provide the Service to Customer. It will protect it with the safeguards required by the Privacy (Tax File Number) Rule 2015, and will not use or disclose it for any other purpose. Customer warrants that it collects TFNs only for a purpose authorised by taxation, personal assistance or superannuation law.
14. Liability and precedence
Each party’s liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the SCCs do not allow this. If this DPA conflicts with the Agreement, this DPA prevails in relation to Personal Data.
Annex 1: Details of processing
| Data exporter | Customer: the contact details and role are those in its account |
|---|---|
| Data importer | AppliFlo, contact privacy@appliflo.com: processor |
| Data subjects | Customer’s users; Customer’s clients, applicants, employees, contacts and their family members; Recipients and signers; other individuals named in documents |
| Categories of data | Identity and contact details; content of forms and documents (for example, date of birth, address, nationality, passport and visa details, employment and education history, financial and tax details); signatures and signing evidence (IP address, timestamps, browser details); CRM records |
| Sensitive data | Whatever Customer chooses to include in documents. This may include government identifiers (TFN, SSN, passport), health declarations, criminal history declarations, or racial or ethnic origin as shown on immigration forms. Safeguards: encryption, access controls and logging, the option to turn AI off, and exclusion from workspace memory. |
| Frequency | Continuous, for the term of the Agreement |
| Nature and purpose | Hosting, field detection, form filling, AI-assisted field mapping and drafting, document routing, electronic signing and sealing, email delivery, integration with Customer’s connected systems, support |
| Duration and retention | The term of the Agreement plus the deletion periods in section 9, or as Customer configures |
| Sub-processors | As listed on the Sub-processors page |
| Competent authority | For SCCs: the Irish Data Protection Commission, unless Customer’s establishment points to another authority |
Annex 2: Security measures
- Encryption: TLS 1.2+ in transit; AES-256 at rest (by the cloud provider); additional application-level encryption for saved personal “Fill as me” details.
- Signing keys: held in Google Cloud KMS backed by a hardware security module, and never exported.
- Workspace isolation: every data query is scoped to the workspace, and automated cross-tenant tests run before each release.
- Access control: email one-time-code sign-in with attempt limits; role-based workspace permissions; members are signed out immediately when they are removed or their role changes; least-privilege service accounts; secrets in a managed secret store; no long-lived deployment keys.
- Application security: security headers on every route; rate limits; sending limits for new workspaces; input validation; documents are rendered to PDF in a separate, sandboxed service that runs as non-root, with scripts disabled and outbound network access blocked.
- Operations: logging of administrative actions with a recorded reason; automated daily database backups; dependency vulnerability fixes; incident response procedures.
- People: confidentiality obligations; access limited to people who need it.
