Crewzon Data Processing Addendum

This Data Processing Addendum (**DPA**) forms part of the Crewzon Terms of Service between NOT ANOTHER APP BUILDER PTY. LTD. (ACN 699 954 071, ABN 92 699 954 071) trading as Crewzon and the Business Account.

It applies to Crewzon's processing of Customer Data for the Business Account. It is designed for Australian business customers. A signed customer agreement may add requirements for another jurisdiction.

Terms defined in the Terms of Service have the same meaning here.

• **Data Protection Law** means privacy, data-protection and data-breach law

applicable to the relevant processing, including the Privacy Act 1988 (Cth) where it applies.

• **Security Incident** means unauthorised access to, disclosure of, loss,

alteration or destruction of Customer Data in Crewzon's control. It excludes unsuccessful attempts that do not compromise Customer Data and incidents caused solely within the Business Account's systems or accounts unless Crewzon contributed to them.

• **Subprocessor** means a third party engaged by Crewzon to process Customer

Data for the Services.

The Business Account determines why and how Customer Data is collected and used and is the controller, principal or equivalent regulated entity. Crewzon processes Customer Data on its behalf as processor, service provider or agent.

Crewzon separately determines the handling of its own account, billing, security, support, product-analytics and business-administration information as described in the Privacy Policy.

The subject matter is the Customer Data submitted to or generated through the Services. Processing continues for the subscription and any lawful retention period. The nature and purposes are hosting, storage, retrieval, transmission, organisation, support, security, deletion and other operations needed to provide the configured Services. Data subjects may include the Business Account's workers, contractors, customers, site contacts, suppliers and other people recorded in its workspace.

Crewzon will process Customer Data only:

• to provide, secure, maintain and support the Services;
• on documented instructions expressed through the agreement, the Business

Account's configuration and lawful directions from authorised users;

• to prevent or investigate fraud, misuse or a Security Incident;
• to create aggregated or de-identified analytics where reasonable steps are

taken to prevent re-identification; or

• as required by law.

Crewzon will notify the Business Account if it reasonably believes an instruction infringes applicable Data Protection Law and may suspend that instruction while the parties resolve it. If law requires processing beyond an instruction, Crewzon will notify the Business Account before processing unless the law prohibits notice.

Crewzon will not sell Customer Data, use it for third-party advertising, or use identifiable Customer Data to train a general-purpose AI model without separate informed agreement from the Business Account.

The Business Account must:

• have a lawful basis, authority and any required consent for Customer Data;
• give required privacy, workplace-surveillance and collection notices;
• ensure its instructions and use of Crewzon comply with law;
• minimise Customer Data and avoid sensitive information unless necessary and

lawful;

• authorise users, configure roles and promptly revoke unnecessary access;
• handle requests and decisions for Customer Data it controls; and
• provide Crewzon with information reasonably needed to meet an instruction or

legal obligation.

Crewzon will treat Customer Data as confidential and limit access to personnel, contractors and Subprocessors with a legitimate need. People authorised by Crewzon to process Customer Data must be bound by confidentiality obligations and receive appropriate security and privacy direction.

Crewzon will maintain technical and organisational measures appropriate to the risk, taking account of the nature of Customer Data, available technology, implementation cost and likely consequences of misuse, interference, loss or unauthorised access, modification or disclosure.

Measures may include encryption in transit, provider-managed encryption at rest, role and tenant access controls, secure authentication, logging and monitoring, backup and recovery processes, secure development practices and personnel access controls. Current and configuration-dependent measures are described in Security and Authentication. Crewzon may evolve the measures provided it does not materially reduce the overall protection of Customer Data during a paid subscription without a valid legal, security or technical reason and appropriate mitigation.

Crewzon will notify the Business Account without undue delay after confirming a Security Incident affecting its Customer Data where notification is required by law or reasonably necessary for the Business Account to meet its obligations. Notice will include reasonably available information about the nature of the incident, likely affected data, containment, assessment and remediation. Initial notice may be supplemented as information becomes available.

Crewzon will take reasonable steps to contain, investigate and remediate the incident and reasonably cooperate with legally required assessment and notice. Notification is not an admission of fault or liability.

Where the Notifiable Data Breaches scheme applies, Crewzon will assess a suspected eligible data breach reasonably and expeditiously, taking reasonable steps to complete the assessment within 30 calendar days, and make any notice for which Crewzon is responsible as soon as practicable after the legal threshold is met.

Taking account of the nature of processing and available functionality, Crewzon will provide reasonable assistance where the Business Account cannot reasonably respond itself to a request for access, correction, deletion or another applicable privacy right. Crewzon may refer a requester to the Business Account where it controls the relevant Customer Data.

Crewzon will provide reasonable information and cooperation for a privacy impact assessment, regulator enquiry or consultation concerning the Services where required by Data Protection Law and not reasonably available to the Business Account. Additional work outside standard functionality may be subject to agreed reasonable fees unless caused by Crewzon's breach.

The Business Account gives general authorisation for the Subprocessors listed in Subprocessors. Crewzon will take reasonable steps to bind each Subprocessor to confidentiality, security and data-protection duties appropriate to its work. Crewzon remains responsible for a Subprocessor's performance of Crewzon's obligations under this DPA to the extent required by the agreement and applicable law.

Crewzon will update the list for a new or replacement Subprocessor that materially affects Customer Data and give reasonable notice where practicable. The Business Account may object on reasonable, documented privacy or security grounds within 14 days after notice or becoming aware of the change. The parties will work in good faith on a reasonable solution. If none is available, Crewzon may decide not to use the Subprocessor for that account or either party may terminate the materially affected paid Service. Any refund will be assessed under the Terms and applicable law.

Customer Data may be processed in Australia and in the likely locations listed for each Subprocessor. Where Australian Privacy Principle 8 applies, Crewzon will take reasonable steps in the circumstances before an overseas disclosure to require appropriate handling unless an exception applies. Crewzon remains accountable for an overseas recipient where section 16C of the Privacy Act 1988 (Cth) applies.

Unless prohibited by law or an immediate security risk, Crewzon will notify the Business Account of a legally binding government or third-party demand directed to Crewzon for its Customer Data. Crewzon will disclose only what it reasonably believes is legally required and may challenge an overbroad demand where there are reasonable grounds and it is proportionate to do so.

During the subscription, the Business Account may use available exports. Subject to law, security and technical feasibility, Crewzon will provide a reasonable opportunity to export available Customer Data before or after termination as described in the Terms.

After termination or a valid instruction, Crewzon will delete, return or de-identify Customer Data when it is no longer required, except for information Crewzon must or may lawfully retain for tax, accounting, security, fraud, dispute, legal-hold or similar purposes. Residual backup copies may remain until ordinary rotation and remain protected and unavailable for routine use. Further detail is in Account Deletion and Data Retention.

On reasonable written request, Crewzon will provide information reasonably necessary to demonstrate compliance with this DPA, including available security documentation or independent assurance when it exists.

If that information is insufficient for a legally required assessment, the Business Account may request a further review no more than once in 12 months, unless a Security Incident or regulator reasonably requires more. A review must be scoped in advance, occur during business hours, avoid access to another customer's data and Crewzon's penetration pathways or secrets, minimise disruption, and be subject to confidentiality. The Business Account bears its cost unless the review identifies a material Crewzon breach.

Liability arising under this DPA is subject to the Terms of Service unless a signed agreement expressly states otherwise. If this DPA conflicts with the Terms, this DPA prevails only for processing of Customer Data. A signed agreement prevails only to the extent it expressly changes this DPA.