Skip to content
Data Processing Addendum (DPA)

Revision August 2026

This Data Processing Addendum (“DPA”) forms part of the Master Service Agreement or the Subscription Agreement or other written terms between Infomedia and the entity or person(s) identified as Customer in the relevant Agreement (“Customer”) for the purchase of services (“Services”) from Infomedia (the “Agreement”) and records the parties’ written agreement relating to the Processing of Personal Data (both as defined below). 

1. DEFINITIONS AND INTERPRETATION

1.1 Definitions. The following capitalised terms shall have the meaning given in this DPA:

Affiliates means, with respect to a legal entity, any other legal entity that directly or indirectly Controls, is Controlled by, or is under common Control with that legal entity, provided that no investment fund, fund manager, general partner or portfolio company shall be deemed an Affiliate solely by virtue of being under common ownership or investment management by the same investment fund, fund manager or general partner.

Applicable Data Protection Laws means all data protection, privacy or personal information laws or regulations in any jurisdiction applicable to the Processing of Personal Data under the Agreement, as updated, amended, replaced or superseded from time to time.

Australian Data Protection Laws means: (a) Privacy Act 1988 (Cth), including the Australian Privacy Principles contained in Schedule 1 of that Act and the Notifiable Data Breaches Scheme under Part IIIC of that Act; (b) Spam Act 2003 (Cth); (c) Telecommunications (Interception and Access) Act 1979 (Cth), to the extent applicable to the Processing of Personal Data; and (d) any other applicable Australian federal or state laws or regulations relating to the Processing of Personal Data, in each case as updated, amended, replaced or superseded from time to time.

Canadian Data Protection Laws means: (a) Personal Information Protection and Electronic Documents Act (PIPEDA) (and any successor legislation, including the Consumer Privacy Protection Act (CPPA) if and when in force), (b) Québec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), (c) Alberta’s Personal Information Protection Act, (d) British Columbia’s Personal Information Protection Act, and all subordinate legislation, binding regulations, and guidance issued thereunder, in each case as udpated, amended, replaced or superseded from time to time.

Control means the direct or indirect power to direct or cause the direction of the management and policies of a legal entity, whether through the ownership of voting securities, the right to appoint or remove a majority of the board of directors (or equivalent governing body), by contract or otherwise, and Controlled and Controlling have corresponding meanings.

Controller means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

Customer Personal Data means any Personal Data provided by, or on behalf of, Customer to Infomedia in connection with the Services, and includes for the avoidance of doubt, any Personal Data included in the attachments provided by Customer or its Data Sharers in any technical support requests.

Data Sharer means any individual or entity, including but not limited to the Customer’s clients, customers, end users or other third parties, which are authorised by the Customer to submit, share, or otherwise provide Personal Data or other information to the Customer, and where such Personal Data or information may be Processed by Infomedia in connection with the Services.

Deidentified Data means data that cannot reasonably be used to infer information about, or otherwise be linked to, a data subject.

Europe means the Member States of the European Economic Area.

European Data Protection Laws means: (a) Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (the “EU GDPR“); and (b EU Directive 2002/58/EC on Privacy and Electronic Communications, in each case as updated, amended, replaced or superseded from time to time.

Information Security Compliance Terms means Infomedia’s standard form security and compliance terms, found at www.infomedia.com.au/legal/information-security-and-compliance-terms (as updated, amended, replaced or superseded from time to time) and which forms part of the Agreement.

Infomedia means the Infomedia group entity which is a party to this DPA, being the entity which is the party to the Agreement.

New Zealand Data Protection Laws means: (a) the Privacy Act 2020 (NZ), including the Information Privacy Principles contained therein and the mandatory privacy breach notification obligations under Part 6 of that Act; and (b) any other applicable New Zealand laws or regulations relating to the Processing of Personal Data, in each case as updated, amended, replaced or superseded from time to time.

Personal Data Breach means any act or omission that materially compromises either the security, confidentiality or integrity of Customer Personal Data Processed by Infomedia that is likely to create a risk to the privacy rights or harm to any individual. Without limiting the foregoing, a material compromise shall include unauthorised access to or disclosure or acquisition of Personal Data.

Personal Data means information about an identified or identifiable natural person, or which otherwise constitutes “personal data”, “personal information”, “personally identifiable information” or similar terms as defined in the Applicable Data Protection Laws.

Processing (and Process and Processed) means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Processor means an entity which Processes Personal Data on behalf of the Controller.

Restricted Transfer means a transfer of Customer Personal Data that is subject to (a) European Data Protection Laws from a country within Europe to a country outside Europe that is not subject to an adequacy decision by the European Commission, (b) Swiss Data Protection Laws from Switzerland to a country outside Switzerland that is not subject to an adequacy recognition by the Swiss Federal Data Protection and Information Commissioner, and (c) UK Data Protection Laws from a country within the UK  to a country outside the UK that is not subject to an adequacy decision by the Information Commissioner’s Office as applicable. 

SCCs means the standard contractual clauses annexed to the European Commission’s Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to the EU GDPR. 

Special categories of personal data or sensitive data means any Customer Personal Data: (a) revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; (b) that is genetic data, biometric data, data concerning health, or data concerning a natural person’s sex life or sexual orientation; and (c) relating to criminal convictions and offences. 

Sub-processor means any processor engaged by Infomedia to assist in fulfilling its obligations with respect to providing the Services pursuant to the Agreement where such entity Processes Customer Personal Data. Sub-processors may include Infomedia’s Affiliates or other third parties. 

Swiss Data Protection Laws means the Swiss Federal Act on Data Protection (as revised and in force from 1 September 2023) and its implementing ordinances, including the Data Protection Ordinance, in each case as updated, amended, replaced or superseded from time to time.

UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0, in force 21 March 2022) issued by the Information Commissioner’s Office under S119(A)(1) of the UK’s Data Protection Act 2018, as amended, superseded or replaced from time to time. 

UK Data Protection Laws means the EU GDPR as incorporated into UK law pursuant to Section 3 of the European Union (Withdrawal) Act 2018, together with the UK’s Data Protection Act 2018 and Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426), in each case as updated, amended, replaced or superseded from time to time.

UK means England, Scotland, Wales and Northern Ireland.

US Data Protection Laws means all data protection or privacy laws and regulations applicable to Customer Personal Data in force within the United States as updated, amended, replaced or superseded from time to time, including but not limited to, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations (the “CCPA”), and any rules or regulations implementing the foregoing. 

1.2 Interpretation.

(a) Capitalised terms used but not defined in this DPA shall have the meanings given to them in the Agreement.

(b) In the event of any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of such conflict.

(c) In the event of any conflict between the SCCs and the Agreement (including this DPA), the SCCs shall prevail to the extent of such conflict.

2. TERM

The term of this DPA coincides with the term of the Agreement and terminates upon expiration or earlier termination of the Agreement (or, if later, the date on which Infomedia ceases all Processing of Customer Personal Data).

3. PROCESSING OF PERSONAL DATA

3.1 Description of Roles. For the purposes of this DPA and the Agreement, the parties agree that:

(a) Customer is either a Controller of Customer Personal Data, or a Processor of Customer Personal Data acting on the instructions of another Controller (i.e. a Data Sharer or Customer’s Affiliate when passing Processing instructions to Infomedia); and

(b) Infomedia is a Processor (or where applicable a Sub-Processor) in respect of its processing of Customer Personal Data disclosed to Infomedia for the purpose of Infomedia providing the Services.

3.2 Prohibited Data. Customer will not disclose (and will not permit any Data Sharer to disclose) any special categories of personal data or sensitive data (including “Protected Health Information” as defined by the United States Health Insurance Portability and Accountability Act) to Infomedia for Processing.

3.3 Processing in accordance with Customer Instructions. Infomedia shall Process Customer Personal Data as necessary to perform its obligations under the Agreement and strictly in accordance with the documented lawful instructions of Customer (including the terms of the Agreement), or as otherwise agreed in writing by the parties (the “Customer Instructions”). Infomedia shall not use, disclose or otherwise Process the Customer Personal Data for any other purpose other than the Customer Instructions, except where otherwise required by any law applicable to Infomedia, and shall not “sell” the Customer Personal Data within the meaning of the CCPA or otherwise. Infomedia shall notify Customer, without undue delay, if it becomes aware that Customer Instructions infringe Applicable Data Protection Laws.

3.4 Details of the Processing. Infomedia’s Processing of Customer Personal Data is performed in relation to the Services (subject matter). The categories of Personal Data, duration, nature and purpose of the Processing are detailed in Annex 1 to this DPA.

3.5 Security. Infomedia shall implement appropriate technical and organisational measures to protect Customer Personal Data against a Personal Data Breach and to preserve the security integrity, availability and confidentiality of Customer Personal Data. Customer acknowledges that Infomedia’s security measures are subject to technical progress and development and that Infomedia may update or modify these from time to time, provided that such updates and modifications do not materially decrease the overall security of the Customer Personal Data during the terms of the Agreement.

3.6 Personal Data Breach. Upon becoming aware of a Personal Data Breach, Infomedia shall notify Customer without undue delay by written notice with all relevant details reasonably available of the Personal Data Breach to allow Customer to fulfil its data breach reporting obligations under Applicable Data Protection Laws. Infomedia shall take further reasonable steps to contain, investigate and mitigate the effects of the Personal Data Breach. Infomedia’s notification of or response to a Personal Data Breach in accordance with this Section 3.6 will not be construed as an acknowledgement by Infomedia of any fault or liability with respect to the Personal Data Breach.

3.7 Confidentiality. Infomedia shall take reasonable steps to ensure that it has appropriate policies and procedures in place in relation to any person that it authorises to process Customer Personal Data (including Infomedia’s employees, agents and Sub-processors) and to ensure that such persons are subject to a duty of confidentiality.

3.8 Deletion or return of Customer Personal Data. Upon written request from Customer, Infomedia shall within ninety (90) days, anonymise, delete or return to Customer all Customer Personal Data in its possession or control. Notwithstanding the foregoing, Infomedia may retain Customer Personal Data (i) as required by applicable laws or (ii) in accordance with its standard backup or record retention policies, provided that, in either case Infomedia shall isolate and protect the Customer Personal Data from further Processing except to the extent required by such law until deletion is possible, and Infomedia will maintain the confidentiality of, and otherwise comply with the applicable provisions of this DPA with respect to, retained Customer Personal Data. Customer acknowledges that there may also be circumstances in which one or more of its Data Sharers are Data Sharers of one or more other customers and in such circumstances, Infomedia will continue to Process the applicable Customer Personal Data related to such Data Sharer(s) until a written request from such Data Sharer(s) is received by Infomedia in accordance with this Section 3.8.

3.9 Cooperation and data subjects’ rights. Infomedia shall provide reasonable assistance to Customer (at Customer’s expense) to enable Customer to respond to: (a) any request from a data subject to exercise any of its rights under Applicable Data Protection Laws (including its rights of access, correction, objection, erasure, and data portability, as applicable); and (b) any other correspondence, enquiry or complaint received from a data subject, regulator or other third party, in each case in respect of Customer Personal Data that Infomedia Processes on Customer’s behalf. In the event that any request, correspondence, enquiry or complaint is made directly to Infomedia, Infomedia shall promptly notify Customer and provide it with a copy of the request, unless legally prohibited from doing so.

3.10 Data Protection Impact Assessment. Infomedia shall provide reasonable assistance to Customer (at Customer’s expense) with undertaking an assessment of the impact of Processing Customer Personal Data, and with any consultations with a data protection authority, if and to the extent an assessment or consultation is required to be carried out under the Applicable Data Protection Laws.

4. Audits

4.1 Infomedia shall maintain an audit program to monitor its compliance with its obligations relating to Customer Personal Data and shall make available to the Customer information which demonstrates compliance with its obligations under Applicable Data Protection Laws as detailed in this Section 4.

4.3 Customer may conduct audits of Infomedia to assess its compliance with this DPA. Customer agrees that Customer shall exercise its rights under Clause 8.9 of the SCCs by instructing Infomedia to comply with the audit measures described in this Section 4.

4.4 Customer must give Infomedia at least thirty (30) days’ notice of any requested audit.

4.5 Customer’s right to audit under this paragraph shall be exercised no more than once per calendar year, unless Customer has a material compliance concern which it can demonstrate justifies an audit, in which case an additional audit may be performed on not less than fourteen (14) days’ prior written notice to Infomedia, limited in scope to the specific concern identified. 

4.6 Before exercising its right to audit under this paragraph, Customer shall attempt to obtain/request all the information it requires from Infomedia and only proceed with its audit request in relation to matters which are not adequately addressed by the information provided on request.

4.7 All audits conducted by Customer: 

(a) must be performed in accordance with ISO 27001 or SOC 2; 

(b) shall be limited to a review of relevant documentation and evidence reasonably necessary to demonstrate compliance; and

(c) must be conducted through the exchange of written responses, supporting documentation, and relevant summaries of third-party reports. 

4.8 Where Infomedia, acting reasonably, believes the scope or execution of a proposed audit poses a risk to the security of Infomedia Systems (as defined under the Information Security and Compliance Terms) or the security, integrity and confidentiality of another customer’s Personal Data, Intellectual Property Rights or Infomedia Material, Infomedia has the right to limit the scope and/or execution of the audit to mitigate such risk.  

4.9 The audit report, audit details and other information arising in relation to the audit shall constitute Confidential Information of Infomedia and may only be shared with a third party in accordance with and subject to the terms of the Agreement (or with Infomedia’s prior written consent). 

4.10 Audits shall be conducted during business hours and in a way which minimises the impact on Infomedia’s operations.  

4.11 Each party shall be liable for its own costs in relation to any audit.   

5. CUSTOMER OBLIGATIONS

Without limiting Customer’s other obligations under the Agreement, Customer shall:

5.1 comply at all times with the Applicable Data Protection Laws in its Processing of Customer Personal Data, including (but not limited to) when Customer discloses Customer Personal Data to Infomedia under the Agreement, and provides Infomedia with such cooperation, assistance and information as Infomedia may reasonably request to comply with its obligations under the Applicable Data Protection Laws;

5.2. ensure that any Customer Instructions it issues to Infomedia comply with the Applicable Data Protection Laws;

5.3 not provide any special categories of data to Infomedia unless that information is necessary for Infomedia to perform its obligations under the Agreement and Infomedia has provided its prior written consent.

5.4 ensure that it has provided notice and obtained (or will obtain) all consents legal bases and rights necessary under Applicable Data Protection Laws to Process Customer Personal Data (including, but not limited to, any special categories of data) and to enable Infomedia to provide the Services pursuant to the Agreement (including this DPA);

5.5 ensure that any Customer Personal Data provided to Infomedia is limited to only what is necessary in order for Infomedia to provide the Services and such Customer Personal Data is accurate and up-to-date to the best of Customer’s knowledge at the time that it is provided to Infomedia;

5.6 use all reasonable endeavours to promptly notify Infomedia upon becoming aware that Customer Personal Data has become inaccurate or out of date;

5.7 not do or permit to be done anything within its knowledge or control which may cause or otherwise result in Infomedia being in breach of the Applicable Data Protection Laws; and

5.8 be responsible for ensuring that its Processing instructions as set out in the Agreement and this DPA, including its authorisations to Infomedia for the appointment of Sub-processors in accordance with this DPA, have been authorised by the relevant Controller. Customer shall also be solely responsible for forwarding any notifications received from Infomedia to the relevant Controller where appropriate.

6. SUB-PROCESSORS

6.1 General Authorisation. By entering into this DPA, Customer provides a general authorisation for Infomedia to engage Sub-processors to Process Customer Personal Data. Infomedia shall ensure that: (a) there is a written agreement in place with each Sub-processor that imposes terms and conditions that require the relevant Sub-processor to protect Customer Personal Data to the standard required by the Applicable Data Protection Laws and to the same standard as this DPA; and (b) it remains responsible to Customer for the performance of such Sub-processor’s data protection obligations under such terms and conditions.

6.2 Current Sub-Processors and notice of new Sub-Processors. Infomedia’s Sub-processor list is available to Customer on request by emailing security@infomedia.com.au. Customers can subscribe to notifications of new sub-processors by emailing security@infomedia.com.au. Infomedia shall notify subscribed Customers if it adds or replaces any new Sub-processors as soon as reasonably practicable (and no less than 30 days before the commencement of a proposed Sub-processor that Processes Personal Data in any of the following capacities, to provide the Customer with the opportunity to raise any reasonable objections on grounds of data protection (e.g. concerns regarding the Sub-processor’s ability to comply with Applicable Data Protection Laws, security or location in a high-risk jurisdiction).

(a) storing, hosting, or otherwise retaining Personal Data;

(b) accessing Personal Data for purposes of analysis, profiling, enrichment, or reporting;

(c) transmitting or transferring Personal Data across national or jurisdictional borders;

(d) using Personal Data to train, fine-tune, or improve any algorithm, model, or automated system; or

(e) any other Processing that is not merely incidental to the delivery of the Services and that involves access to Personal Data beyond what is strictly necessary for infrastructure or operational support.

6.3 Objections. Objections raised under Section 6.2 must be made within 30 days of receiving such notice and cannot be made for arbitrary reasons or those which do not relate to data protection. If Customer objects to the appointment of any new Sub-processor and Infomedia is unable to perform its Services without this new Sub-processor and cannot propose a suitable alternative Sub-processor, Customer shall as it sole and exclusive remedy have the right to terminate the Customer’s use of the only the Service(s) subject to the Sub-processing under the Agreement.

7. RESTRICTED TRANSFERS.

The parties agree that when the transfer of Customer Personal Data from Customer (as “data exporter”) to Infomedia (as “data importer”) is a Restricted Transfer and Applicable Data Protection Laws require that appropriate safeguards be put in place, it shall be subject to the SCCs, which shall be deemed incorporated into and form part of this DPA, as follows:

7.1 European Restricted Transfers

In relation to Restricted Transfers of Customer Personal Data protected by the EU GDPR and Processed by Infomedia as a Processor in accordance with Section 3 of this DPA, the SCCs shall apply and be completed as follows:

(i) Module Two will apply;

(ii) in Clause 7, the optional docking clause will apply;

(iii) in Clause 9(a), Option 2 will apply, and the time period for prior notice of Sub-processor changes is as set out in Section 6.2 of this DPA;

(iv) in Clause 11, the optional language will not apply;

(v) in Clause 17, Option 1 will apply, and the SCCs will be governed by the laws of Ireland;

(vi) in Clause 18(b), disputes will be resolved before the courts of Germany; and

(vii) the Annexes of the SCCs shall be populated with the information set out in the corresponding Annexes to this DPA;

7.2. United Kingdom Restricted Transfers

In relation to Restricted Transfers of Customer Personal Data protected by the UK GDPR, the SCCs will apply as completed in accordance with Sections 7.1 of this DPA and are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming a part of this DPA. In addition, Tables 1 to 3 in Part 1 of the UK Addendum are deemed completed with the relevant information set out in Sections 7.1(a) and (b) of this DPA, as well as the Annexes to this DPA and Table 4 in Part 1 of the UK Addendum is deemed completed by selecting “neither party”. Any conflict between the terms of the SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum;

7.3. Swiss Restricted Transfers

In relation to Restricted Transfers of Customer Personal Data that is subject to Swiss Data Protection Laws, the SCCs will apply in accordance with Sections 7.1(a) and (b) of this DPA, with the following amendments:

(a) any references to “Regulation (EU) 2016/670” will be replaced with references to the Swiss Data Protection Laws, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent Article(s) or Section(s) of the Swiss Data Protection Laws;

(b) any references to “EU”, “Union”, “Member State” and “Member State Law” will be replaced with references to Switzerland and Swiss Law, as applicable;

(c) Clause 13 will be amended to provide that the Federal Data Protection and Information Commissioner (“FDPIC”) of Switzerland will have authority over data transfers governed by the Swiss Data Protection Laws;

(d) references to the “competent supervisory authority” and “competent courts” will be replaced with references to the FDPIC and competent courts in Switzerland, respectively;

(e) Clause 17 is amended to provide that the SCCs will be governed by the laws of Switzerland;

(f) Clause 18(b) is amended to provide that disputes will be resolved before the applicable courts of Switzerland; and

(g) All references to Member State will be interpreted to include Switzerland and Data Subjects in Switzerland are not excluded from enforcing their rights in their place of habitual residence in accordance with Clause 18(c) of the SCCs.

8. OVERSEAS TRANSFERS UNDER AUSTRALIAN AND NEW ZEALAND PRIVACY LAWS

8.1. In relation to transfers of Customer Personal Data subject to Australian Data Protection Laws to an overseas recipient, Infomedia will take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in respect of that Customer Personal Data, in accordance with Australian Privacy Principle 8.2, unless an exception under the Australian Data Protection Laws applies.

8.2. In relation to transfers of Customer Personal Data subject to New Zealand Data Protection Laws to an overseas recipient, Infomedia will take reasonable steps to ensure that the overseas recipient protects the Customer Personal Data in a manner that, overall, provides comparable safeguards to those required under the New Zealand Data Protection Laws, in accordance with Information Privacy Principle 12, unless an exception under the New Zealand Data Protection Laws applies.

8.3. For the purposes of Sections 8.1 and 8.2, where Infomedia has entered into contractual arrangements with overseas Sub-processors that impose data protection obligations equivalent to those required under the applicable Australian or New Zealand Data Protection Laws, Infomedia shall be deemed to have taken reasonable steps for the purposes of this Section.

9. US DATA PROTECTION LAWS

The following terms apply where Infomedia Processes Customer Personal Data subject to the US Data Protection Laws:

9.1. To the extent Infomedia Processes Customer Personal Data as a Processor (or “Service Provider” as defined under the CCPA) on behalf of Customer, Infomedia will Process and protect such Customer Personal Data in accordance with the US Data Protection Laws and Customer Instructions, as necessary for the limited and specified purposes identified in Annex 1: Description of Processing.

9.2. Infomedia will not:

(a) retain, use, disclose or otherwise Process such Customer Personal Data for a commercial purpose other than Customer’s Instructions or as otherwise permitted under US Data Protection Laws;

(b) “sell” or “share” such Customer Personal Data within the meaning of US Data Protection Laws; and

(c) retain, use, disclose or otherwise Process such Customer Personal Data outside the direct business relationship with Customer and not combine such Customer Personal Data with personal data that it receives from other sources, except as permitted under US Data Protection Laws.

9.3. Infomedia will inform Customer if it determines that it can no longer meet its obligations under US Data Protection Laws

9.4. Customer may take reasonable and appropriate steps to stop and remediate any unauthorised Processing of Customer Personal Data.

9.5. To the extent Customer discloses or otherwise makes available Deidentified Data to Infomedia or to the extent Infomedia creates Deidentified Data from Customer Personal Data, in each case in its capacity as a Processor or Service Provider, Infomedia will maintain and use such Deidentified Data in a de-identified form and to not attempt to re-identify the Deidentified Data, or permit any third party to re-identify the Deidentified Data.

10. CANADIAN DATA PROTECTION LAWS

The following terms apply where Infomedia Processes Customer Personal Data subject to the Canadian Data Protection Laws:

10.1. Infomedia will Process and protect such Customer Personal Data in accordance with the Canadian Data Protection Laws and Customer Instructions, as necessary for the limited and specified purposes identified in Annex 1: Description of Processing.

10.2. Infomedia will not:

(a) collect, use, or disclose such Customer Personal Data for any purpose other than those specified in the Customer Instructions or as otherwise permitted under Canadian Data Protection Laws;

(b) sell, share, or otherwise disclose such Customer Personal Data to any third party except as required to perform the Services, as directed by Customer, or as required by applicable law; and

(c) use such Customer Personal Data outside of its direct business relationship with Customer, or combine such Customer Personal Data with personal data received from other sources, except as permitted under Canadian Data Protection Laws.

10.3. Infomedia will inform Customer if it determines that it can no longer meet its obligations under Canadian Data Protection Laws, and Customer may take reasonable and appropriate steps to stop and remediate any unauthorised Processing of such Customer Personal Data.

11. THIRD PARTY REQUESTS

Except to the extent prohibited or limited by law, Infomedia will promptly notify the Customer of any valid and enforceable legal process or governmental request requiring disclosure of Customer Personal Data. If Infomedia receives an inquiry or information request from any other third party (including a regulator or data subject) relating to the Processing of Customer Personal Data, to the extent it is permitted to do so by law, Infomedia will refer the inquiry to the Customer and will not disclose any information unless legally required to do so.

12. EXCLUSIONS AND LIMITATIONS OF LIABILITY

Notwithstanding anything to the contrary in the Agreement or this DPA, the liability of each party and each party’s Affiliates under this DPA shall be subject to the exclusions and limitations of liability set out in the Agreement.

ANNEX 1 DESCRIPTION OF THE PROCESSING ACTIVITIES / TRANSFER

ANNEX 1A: LIST OF PARTIES

Data exporter
Name: Customer (as identified in the Agreement).
Address: Customer’s address (as identified in the Agreement).
Contact Person’s name, position and contact details: Customer Contact Name and corresponding details (as identified in the Agreement).
Activities relevant to the transfer: Refer to Annex 1B below.
Role: Controller

Data importer
Name: The Infomedia contracting entity (as identified in the Agreement).
Address: The Infomedia contracting entity’s address (as identified in the Agreement).
Contact Person’s position and contact details: Data Protection Officer, privacy@infomedia.com.au
Activities relevant to the transfer: Refer to Annex 1B below.
Role: Processor

ANNEX 1B: DESCRIPTION OF PROCESSING / TRANSFER

Categories of data subjects
Customer may submit Personal Data in connection with the Services, the extent and nature of which is decided by the Customer in its sole discretion, which may include but is not limited to Personal Data relating to:

  • Individuals who are, or are the contacts for, Data Sharers
  • Individuals who are, or are the contacts for, potential customers, customers, business partners and suppliers to the Customer and Data Sharers
  • Employees, contractors, agents, advisors and other personnel engaged by the Customer and Data Sharers

Categories of personal data
Customer may submit Personal Data in connection with the Services, the extent and nature of which is decided by the Customer in its sole discretion, which may include but is not limited to Personal Data relating to:

  • First and last names
  • Job titles
  • Employer information
  • Contact information including email, phone and physical address
  • ID data
  • Vehicle information, including vehicle usage history and related data
  • Localisation data

Special categories of personal data
None.

Frequency of the transfer
Continuous.

Nature and purpose of the processing
The nature of processing of personal data is to enable the provision of the Services and related support as set out in the Agreement and related documentation.

Purpose of the processing
Infomedia will process the Personal Data in accordance with the Customer’s documented instructions to: (a) provide, support and improve the Services; (b) enforce the Agreement; and (c) comply with its legal obligations.

Duration of the processing
Processing of the personal data will continue for the duration of the Agreement together with any permitted period of use post termination or expiry.

ANNEX 1C: COMPETENT SUPERVISORY AUTHORITY

The data exporter’s competent supervisory authority will be determined in accordance with the Applicable Data Protection Laws.

ANNEX 2

TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

Infomedia implements a variety of technical and organisational security measures, the details of which are set out in the Infomedia Information Security and Compliance Terms.

Infomedia maintains the following information security certifications:

ISO 27001 – Information Security Management System

SOC2 type II – System and Organisation Controls

ANNEX 3

LIST OF SUB-PROCESSORS

Infomedia’s Sub-processor list is available to Customer on request by emailing security@infomedia.com.au.