Data Processing Agreement

1. Parties and scope

This Data Processing Addendum (DPA) is between Anzoe Pty Ltd, trading as Antozoe (Antozoe), and the Customer that accepted the Terms or an Order Form.

The DPA applies to personal data contained in Customer Content that Antozoe processes on behalf of the Customer to provide the Services.

If this DPA conflicts with the Terms on personal-data processing, this DPA prevails.

2. Definitions

Applicable Data Protection Law means privacy or data-protection law that applies to the relevant processing, including the Privacy Act 1988 (Cth) and Australian Privacy Principles where applicable, and the GDPR or UK GDPR only to the extent they apply.

Customer Personal Data means personal data or personal information contained in Customer Content and processed by Antozoe on behalf of the Customer.

Security Incident means confirmed unauthorised access to, acquisition, use, disclosure, alteration, loss or destruction of Customer Personal Data in Antozoe’s control, excluding unsuccessful attempts and incidents caused solely within Customer-controlled systems.

Subprocessor means a third party engaged by Antozoe to process Customer Personal Data for the Services.

3. Roles and instructions

The Customer determines the purposes and means of processing Customer Personal Data and acts as controller, principal, business or equivalent role under Applicable Data Protection Law. Antozoe acts as processor, service provider or agent on the Customer’s documented instructions.

The Terms, Order Form, Customer configuration and lawful use of the Services are the Customer’s documented instructions.

Antozoe will process Customer Personal Data only to provide, secure and support the Services; comply with documented instructions; prevent misuse; and comply with law.

Antozoe will notify the Customer if it reasonably believes an instruction violates Applicable Data Protection Law, unless prohibited from doing so.

4. Customer obligations

• Provide lawful instructions and a lawful basis for processing.
• Give required privacy notices and obtain required consents or permissions.
• Ensure Customer Personal Data is accurate, relevant and limited to what is necessary.
• Avoid submitting prohibited or unsupported sensitive data.
• Configure permissions, sharing, retention and Client Portal access appropriately.
• Respond to individuals and regulators for matters within the Customer’s control.

5. Confidentiality and personnel

Antozoe will ensure that personnel authorised to process Customer Personal Data are subject to confidentiality obligations and receive access only where reasonably necessary.

Access may be provided to authorised personnel, contractors and Subprocessors for support, security, legal compliance and service delivery.

6. Security measures

Antozoe will maintain reasonable technical and organisational measures appropriate to the risk, taking into account the nature, scope, context and purposes of processing and the state of the art and cost of implementation.

The current measures are summarised in Annex 2. No measure guarantees absolute security.

The Customer acknowledges that Antozoe currently uses application-level tenant scoping and role controls; this DPA does not represent that database row-level security is implemented.

7. Subprocessors

The Customer generally authorises Antozoe to use the Subprocessors listed in Annex 3 and the current online Subprocessor List.

Antozoe may appoint a new Subprocessor and will give reasonable notice of a material addition where the new Subprocessor will process Customer Personal Data.

The Customer may object on reasonable data-protection grounds within 14 days after notice. The parties will work in good faith on a commercially reasonable solution. If none is available, either party may terminate the affected Service and Antozoe will refund prepaid fees for the unused affected period.

Antozoe will impose data-protection obligations on Subprocessors that are materially consistent with the obligations applicable to the relevant processing.

8. International and cross-border processing

The primary production database and file-storage project is hosted in Sydney, Australia.

Customer Personal Data may be processed in the United States and other countries by approved Subprocessors, including AI Providers.

Where Applicable Data Protection Law requires a transfer mechanism or additional safeguards, the parties will cooperate to implement an appropriate mechanism.

This DPA does not by itself constitute the European Commission Standard Contractual Clauses or the UK International Data Transfer Addendum. A Customer subject to those restricted-transfer requirements must obtain and execute the applicable transfer addendum before submitting the affected data.

9. Security incidents

Antozoe will notify the Customer without undue delay after confirming a Security Incident affecting Customer Personal Data.

The notice will provide information reasonably available about the nature of the incident, affected data, likely consequences, containment and remediation, subject to security and legal constraints.

Antozoe will take reasonable steps to contain, investigate and remediate the incident and will cooperate with the Customer’s legally required notifications.

Notification is not an admission of fault or liability.

10. Individual rights requests

If Antozoe receives a request from an individual relating to Customer Personal Data, it may refer the request to the Customer unless legally required to respond directly.

Taking into account the nature of processing, Antozoe will provide reasonable assistance through available product functionality or support so the Customer can respond to access, correction, deletion, objection or portability requests where required by Applicable Data Protection Law.

Antozoe may charge reasonable costs for exceptional assistance that is not included in the Services, after giving notice.

11. Regulatory assistance and impact assessments

Antozoe will provide information reasonably necessary for the Customer to conduct a privacy impact assessment or respond to a regulator where the request relates to Antozoe’s processing and the information is not otherwise available.

The Customer remains responsible for determining whether an assessment, consultation, consent or regulatory approval is required.

12. Return, export, deletion and retention

During an active Subscription, the Customer may use available export functionality.

The Customer should export required data before cancellation. Antozoe does not guarantee a post-termination export window or complete account-level export unless an Order Form states otherwise.

On a verified request or after data is no longer required, Antozoe will take reasonable steps to delete, de-identify or put Customer Personal Data beyond ordinary use, except where retention is required by law or reasonably necessary for security, audit, billing, dispute resolution or legal claims.

Residual data may remain in access-controlled database backups for up to seven days and will be overwritten through the ordinary backup cycle. Backups are not restored for ordinary access or used for unrelated purposes.

Tax, billing, security, audit and legal records may be retained for the period required by law or legitimate business need.

13. Audit information

On reasonable written request, Antozoe will provide available information reasonably necessary to demonstrate compliance with this DPA, such as policies, summaries, questionnaires or independent reports when available.

If that information is insufficient, the Customer may request an audit no more than once in any 12-month period, on at least 30 days’ notice, during business hours, subject to confidentiality, security and non-disruption requirements.

The Customer bears audit costs unless the audit identifies a material breach by Antozoe. Antozoe may require the auditor to be independent, suitably qualified and not a competitor.

14. Required disclosure

If Antozoe is legally required to disclose Customer Personal Data, it will notify the Customer before disclosure where legally permitted and disclose only what is required.

15. Liability and order of precedence

Liability under this DPA is subject to the liability provisions in the Terms or applicable Order Form.

If an executed Order Form includes stricter data-protection terms, those terms prevail for that Order Form.

16. Term and termination

This DPA begins when incorporated into the Customer’s agreement and continues while Antozoe processes Customer Personal Data on the Customer’s behalf.

Clauses concerning confidentiality, deletion, audit, liability and required retention survive as necessary.

17. Governing law

This DPA is governed by the law and jurisdiction stated in the Terms, unless Applicable Data Protection Law requires otherwise.

Annex 1. Processing details

Subject matter: Hosting, storage, authentication, AI-assisted analysis, governance, review, collaboration, export, support, security and billing for the Services.

Duration: For the Subscription term and any limited retention period described in the Terms, this DPA or applicable law.

Nature: Collection, receipt, recording, organisation, storage, retrieval, access, analysis, generation, transformation, transmission, disclosure to authorised Subprocessors, restriction, deletion and de-identification.

Purposes: Providing, securing, supporting and improving the Services in accordance with Customer instructions.

Data subjects: Authorised Users, Administrators, employees, contractors, customers, clients, stakeholders, meeting participants, Client Portal Users and other individuals whose information is included in Customer Content.

Data categories: Names, business contact details, job roles, Account identifiers, meeting and project information, transcripts, comments, approvals, artefact content, technical logs and any other personal data the Customer submits.

Sensitive data: Not intentionally required. The Customer must not submit sensitive or specialised regulated data unless necessary, lawful, authorised and supported by agreed safeguards.

Annex 2. Technical and organisational measures

• Governance: documented security, privacy, incident and access procedures appropriate to Antozoe’s size and maturity.
• Access: individual Accounts, authentication, least-privilege role assignment, application-level organisation and project scoping, and restricted administrative access.
• Encryption: TLS or equivalent encryption in transit and provider-managed encryption at rest where available.
• Development: source control, testing, environment separation, secret-management controls and change records.
• Logging and monitoring: application, security and error monitoring designed to avoid unnecessary Customer Content.
• Resilience: scheduled database backups retained for up to seven days, provider redundancy where available and documented recovery procedures.
• Incident response: investigation, containment, remediation, evidence preservation and notification procedures.
• Subprocessors: due diligence proportionate to risk and contractual data-protection obligations.
• Data lifecycle: retention review, verified manual deletion or de-identification process, and restriction of data that cannot yet be irretrievably deleted.
• Personnel: confidentiality obligations and access limited to people who need it.

Annex 3. Approved subprocessors

Supabase — Database, authentication and file storage — Australia (Sydney primary project); global provider operations

Vercel — Application hosting, deployment, content delivery and runtime logs — Australia and global infrastructure

OpenAI — AI processing where selected — United States and other provider locations

Google — AI processing where selected — United States and other provider locations

xAI — AI processing where selected — United States and other provider locations

Anthropic — AI processing where selected — United States and other provider locations

Stripe — Payments, Subscriptions, invoices and tax — United States and global

Resend — Transactional and marketing email delivery — United States and global

Sentry — Error and performance monitoring — United States and global

Upstash / QStash — Queues, scheduling, delivery and retries — Global infrastructure