Data Processing Addendum (v2.0)
Draft pending final legal review. This Addendum forms part of, and is governed by, the Course Content Licence & Service Agreement.
Between Integrity RTO Solutions Pty Ltd (ABN 67 669 731 659) ("we", as processor of the data described below) and the Licensee ("you").
1. Scope & roles
This Addendum applies where we process personal information on your behalf in providing the service. You determine the purpose of processing learner personal information held in your LMS; we process only the limited data needed to deliver and enforce the licence.
2. What we process
Your account/billing contact details; and the learner identifier(s) your LMS passes to the Dispatch Package at launch (used to enforce seat counts and record completions back to your LMS). We do not require learner names, contact details or sensitive information, and ask that you do not pass them.
3. Purpose & instructions
We process this data only to provide the service, enforce the licence (seats/expiry), and meet legal obligations — and otherwise on your documented instructions. We do not sell personal information or use it for advertising.
4. Australian Privacy Principles
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
5. Data location (Australian residency)
Our primary database is hosted in Australia (Supabase, Sydney region). Where a sub-processor processes data outside Australia in transit (e.g. global edge networks), we take reasonable steps to ensure comparable protection.
6. Sub-processors
We use reputable sub-processors to provide the service, currently: Cloudflare (edge compute, storage and delivery), Supabase (database, Australian region), Stripe (payment processing), and Resend (delivery of our emails to you, processed in Japan; it handles your name, email address and licence details only for that purpose). We remain responsible for their compliance and will give notice of material changes.
7. Security
We apply reasonable technical and organisational measures appropriate to the data, including access controls, encryption in transit, least-privilege service credentials, and an append-only audit log of administrative actions.
8. Data breach notification
We will notify you without undue delay after becoming aware of an eligible data breach affecting your data, and cooperate as required under the Notifiable Data Breaches scheme.
9. Assistance & access requests
We will provide reasonable assistance with your obligations, including responding to individuals' access/correction requests and any privacy regulator enquiry, so far as the data is within our systems.
10. Retention & deletion
We retain licence and billing records as required for legal, tax and audit purposes. On request or on termination, we will delete or de-identify learner identifiers we hold that are no longer required, within a reasonable period, except where retention is legally required.
11. Sub-processor & audit
On reasonable written request you may seek confirmation of our compliance with this Addendum; intrusive on-site audits are by separate written agreement for enterprise customers.
12. Precedence
If this Addendum conflicts with the Agreement on data protection, this Addendum prevails to the extent of the conflict.