Where Schedule 2 or the Statement of Work determines so, this Data Processing Addendum, including its Schedules (“DPA”) forms part of the Terms and Conditions to reflect the parties’ agreement with regard to the processing of Your personal data.
| Data Breach | means, in respect of any of Your Personal Information in the Customer Data held by Us under the Agreement, any (i) unauthorised access to, modification or disclosure of; or (ii) any interference with loss or misuse of; such data; |
| Personal Information | means information or an opinion about an identified individual, or an individual who is reasonably identifiable; |
| Privacy Policy | means the Aspire Digitel Group Privacy Policy |
| Privacy Laws | means any applicable laws that deals with the regulation, storing and using of Personal Information in Australia. |
1.2. Where a defined term is used in this DPA and a definition is omitted from this DPA, that defined term will take on the definition given in the Terms and Conditions.
1.3. The notice provisions at clause 8.4 of Schedule 1 of the Terms and Conditions shall not apply to this DPA. Instead, where there is an obligation to notify in this DPA, an email to the primary contact each party has on file for the other will suffice.
2.1. We must comply with the Privacy Laws in respect of all Personal Information disclosed to Us by You.
2.2. You must comply with the Privacy Laws in respect of all Personal Information which is disclosed to Us, or collected by the You in relation to Your use of the Aspire Digitel Group Products and or Services.
2.3. Where You disclose or input any Personal Information in connection with the Aspire Digitel Group Products and or Services, You warrant that You have the express written consent of the relevant individuals to disclose or input that Personal Information.
2.4. Any Personal Information We collect or hold in providing the Aspire Digitel Group Products and or Services will be handled in accordance with Our Privacy Policy. You agree that You consent to the collection, use and disclosure of Personal Information by Us in accordance with Our Privacy Policy. If the Aspire Digitel Group Product’s log-in page incorporates a separate privacy policy, the Aspire Digitel Group Product’s specific privacy policy shall take precedence over the Privacy Policy to the extent of any inconsistency.
2.5. If You obtain Third Party Product that requires access to, or transfer of, Customer Data, You acknowledge that any such access or transfer is between You and the Third Party Provider pursuant to the Third Party Provider’s privacy notices and policies.
2.6. At any time, You may provide Us Notice authorising Us to provide Customer Data requested by the Third Party Product. We are not responsible for any modification, loss, damage or deletion of Customer Data by Third Party Product.
2.7. In the event of a Data Breach, We will:
2.7.1. promptly notify You in writing;
2.7.2. promptly take all reasonable steps to remediate the Data Breach and mitigate the risk of harm (if any) to any individuals affected by the Data Breach; and
2.7.3. co-operate with You in investigating what has occurred and the circumstances of the Data Breach, including by providing all information reasonably requested by You for the purpose of determining the likelihood that the Data Breach will result in serious harm to any individual affected by the Data Breach.
2.8. If either You or Us determine or has reasonable grounds to believe that a Data Breach is serious and reportable to the privacy authority, then the Parties will work together to coordinate any notifications required under applicable Privacy Laws. You must not make any required notification unless You have first obtained Our prior written consent (such consent not to be unreasonably withheld).
2.9. If We provide Aspire Digitel Group Products over the internet via networks We only partially control. Our obligations under this clause 2 extend only to networks and equipment within Our control and We are not responsible for any delay, loss, interception or alteration of Customer Data on a network or infrastructure outside Our control.
2.10. Nothing in this clause 2 requires a party to take any action, or refrain from taking any action, that would result in that party breaching its obligations under any applicable Privacy Laws.
