Data Processing Addendum

This addendum forms part of the Terms of Service between Beige Orca Pty Ltd (ABN 64 693 498 298) ("we", the processor) and the customer who holds an Issued team ("you", the controller). It applies when we process personal information on your behalf through Issued. If it conflicts with the Terms, this addendum takes priority for personal information.

1. Roles

You decide why and how personal information in your team is processed. We process it only on your behalf to provide Issued. Each of us will comply with the data protection laws that apply to it, including, where relevant, the UK GDPR, the EU GDPR, the Australian Privacy Act 1988 and the New Zealand Privacy Act 2020.

2. Instructions

We process personal information only on your documented instructions. The Terms, this addendum and your use and configuration of Issued are your instructions. If we believe an instruction breaks data protection law, we'll tell you. If the law requires us to process information in another way, we'll tell you first unless the law forbids it.

3. Confidentiality

Everyone we authorise to process personal information is bound by confidentiality obligations.

4. Security

We maintain appropriate technical and organisational measures, including:

• encryption in transit (TLS) and at rest;
• private document storage served only through short-lived signed links;
• removal of scripts and auto-run actions from uploaded PDFs;
• access to production systems restricted to authorised personnel, with two-factor authentication;
• audit logging of document access, approvals and signatures;
• regular backups of the database; and
• deleting data at the end of the retention periods in section 9.

5. Sub-processors

You authorise us to use the following sub-processors:

Sub-processor	Purpose	Location
Laravel Cloud	Application and database hosting	Sydney, Australia
Cloudflare	Document storage (R2), network, email routing	Near Australia, and global network
Resend	Email delivery	United States
Paddle	Payments, as merchant of record (billing data only)	United Kingdom and United States
Laravel Nightwatch	Error and performance monitoring	United States
exe.dev	PDF processing, with no copies retained	Hosted service

We'll give you at least 30 days' notice of a new sub-processor by email or on this page. If you have a reasonable data protection objection, tell us during that time. If we can't address it, you can cancel and receive a pro-rata refund of prepaid fees for the remaining period. We impose data protection terms on each sub-processor that are at least as protective as this addendum, and we remain responsible for them.

6. International transfers

Our primary hosting is in Australia. Where personal information subject to the UK GDPR or EU GDPR is transferred to a country without an adequacy decision:

• for EU personal information, the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor), are incorporated by reference, with you as data exporter and us as data importer; clause 7 (docking) applies; option 2 of clause 9 applies with the notice period in section 5; the optional wording in clause 11 doesn't apply; clauses 17 and 18 select the law and courts of Ireland; and Annex I and II are completed by the annex below and section 4;
• for UK personal information, the UK International Data Transfer Addendum (version B1.0) to those clauses applies, and the information it requires is in this addendum.

We ensure our sub-processors' onward transfers use equivalent safeguards.

7. Helping you

Taking into account the nature of the processing, we'll help you:

• respond to requests from people exercising their data protection rights (Issued lets you view, correct, export and delete team data, and we'll forward any request we receive directly to you);
• meet your security, breach notification and data protection impact assessment obligations.

8. Personal data breaches

We'll notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting your data. We'll give you the information we have and update you as we learn more, and take reasonable steps to contain it.

9. Deletion and return

You can export your team's data at any time while it's active or read-only. When a paid subscription ends, the team is read-only for 90 days and then deleted. When a trial is cancelled or a team is deleted, its data is deleted straight away. Backups are overwritten within 30 days. After deletion we keep only the SHA-256 fingerprint and issue date of each sealed PDF, which contain no personal information, so the public verify page still works. We may keep information the law requires us to keep, protected as described here.

10. Audits

We'll make available the information reasonably needed to show we comply with this addendum, including answers to reasonable security questionnaires, no more than once a year unless a breach or a regulator requires it. If that information isn't enough to show compliance, you may audit us at your own cost, on 30 days' notice, during business hours and subject to confidentiality.

11. Liability

Each party's liability under this addendum is subject to the limits in the Terms, to the extent the law allows.

Annex: details of the processing

• Subject matter and duration: providing Issued, for the duration of the subscription and the retention periods in section 9.
• Nature and purpose: storing, displaying and sharing documents; collecting comments, approvals and electronic signatures; sending notifications; producing sealed PDFs and audit certificates.
• Data subjects: your team members, and the client stakeholders and other people you invite or whose details appear in your documents.
• Personal information: names, email addresses, job titles and organisations; comments, approvals, signatures and decline reasons; IP addresses, browser details and timestamps; and any personal information in documents you upload.
• Special categories: none intended. Don't upload special category or sensitive information unless you've assessed that it's appropriate.
• Frequency: continuous.
• Competent supervisory authority: as determined by clause 13 of the EU Standard Contractual Clauses, or the UK Information Commissioner for UK transfers.
• Contacts: for us, [email protected]; for you, the team owner's email address.