1. Purpose and Scope

This Data Processing Addendum (“Addendum”) forms part of, and is incorporated into, the Programa Terms of Service or other agreement governing your use of the Services (the “Agreement”). This Addendum applies only to the extent that Programa Processes Personal Data on your behalf as a Data Processor or Service Provider in connection with the provision of the Services and in accordance with the functionality of the Services.

This Addendum does not apply to Personal Data that Programa Processes as an independent Data Controller, including Personal Data processed for Programa’s own business purposes, product operations, security, analytics, compliance or other purposes described in the Privacy Policy.

In the event of any conflict between this Addendum and the Agreement, this Addendum will govern with respect to the Processing of Personal Data under this Addendum, except to the extent that the Agreement or applicable law requires otherwise.

1. Definitions

Capitalised terms used but not defined in this Addendum have the meanings given to them in the Agreement or, where applicable, under relevant data protection or privacy laws

For the purposes of this Addendum, “Personal Data” means any information relating to an identified or identifiable individual that Programa Processes on your behalf as a Data Processor or Service Provider in the course of providing the Services and does not include information that Programa Processes as an independent Data Controller.

“US Data Protection Laws” means the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and other similar comprehensive US state privacy laws that apply to Programa’s Processing of Personal Data in connection with the Services, as amended from time to time.

The terms “Processing, “Controller”, “Processor”, “Service Provider”, “Subprocessor” and “Data Subject” shall have the meanings assigned to them under applicable data protection or privacy laws, to the extent such laws apply to the Processing of Personal Data under this Addendum.

1. Roles of the Parties

You act as the Controller or Business, as applicable, of the Personal Data that you provide to Programa or make available through the Services, and you determine the purposes and means of the Processing of such Personal Data. Programa acts as a Processor and/or Service Provider solely to the extent that it Processes Personal Data on your behalf in connection with the provision of the Service and in accordance with this Addendum.

Each party is responsible for complying with its respective obligations under applicable Data Protection Laws.

1. Details of Processing

The general nature, scope, purpose, and duration of the Processing of Personal Data under this Addendum, together with the categories of Data Subjects and types of Personal Data involved, are described in Appendix 1 to this Addendum and are limited to what is necessary to provide the Services in accordance with the Agreement.

Programa may aggregate, anonymise, or de-identify Personal Data in a manner intended to prevent the identification of an individual, and may Process such aggregated, anonymised or de-identified data for lawful purposes, including service improvement, analytics, security, and operational purposes, as permitted by applicable law. Where Programa applies de-identification measures, it will take reasonable steps to ensure that the data is not used in a manner intended to re-identify individuals.

1. Processor Obligations (General)

When Processing Personal Data on your behalf, Programa will Process the Personal Data only as necessary to provide the Services in accordance with the Agreement and the documented functionality of the Services, or as otherwise required by applicable law. Where Processing is required by law for purposes other than providing the Services, Programa will notify you of such requirement to the extent permitted by law.

Programa will implement and maintain reasonable technical and organisational measures designed to protect Personal Data against unauthorised or unlawful Processing and against accidental loss, destruction, damage, alteration, or disclosure, taking into account the nature of the Services and the risks associated with the Processing. Programa will ensure that personnel authorised to Process Personal Data are subject to appropriate confidentiality obligations.

Programa will notify you without undue delay after becoming aware of and confirming a Personal Data breach affecting Personal Data Processed under this Addendum and will provide information reasonably available to Programa to assist you in understanding the nature of the breach and its likely impact.

Programa will provide reasonable cooperation, consistent with the nature of the Services and the information available to Programa, to support your response to requests from individuals relating to Personal Data Processed under this Addendum, to the extent required by applicable law.

Upon termination of the Agreement, Programa will take reasonable steps, consistent with its technical capabilities and legal obligations, to delete or anonymise Personal Data Processed on your behalf within a reasonable period of time, subject to applicable legal retention requirements, backups and technical limitations.

1. Subprocessors

You grant Programa general written authorisation to engage third parties (“Subprocessors”) to Process Personal Data on your behalf in connection with the provision of the Services. Programa will exercise reasonable care in the selection of Subprocessors and will take reasonable steps to ensure that Subprocessors engaged to Process Personal Data are subject to contractual obligations designed to protect Personal Data in a manner appropriate to the nature of the Services and the Processing performed.

Programa remains responsible for its own compliance with this Addendum in relation to the Processing of Personal Data and does not assume responsibility or liability for the independent acts or omissions of Subprocessors, except to the extent required by applicable law.

Where required by applicable law, Programa will provide reasonable notice of material changes to its Subprocessors. If you object to a Subprocessor on reasonable grounds relating to data protection and no commercially reasonable alternative is available, you may terminate the Agreement in accordance with its terms.

1. United States Data Protection Laws

This section applies only to the extent that applicable United States state privacy laws apply to Programa’s Processing of Personal Data in connection with the Services, and only where you act as a Business or Controller and Programa Processes Personal Data on your behalf.

Programa does not represent or warrant that the Services or its Processing activities comply with the California Consumer Privacy Act, the California Privacy Rights Act, or other United States state privacy laws in all respects. Where required by applicable law and in light of its role as a Service Provider or Processor, Programa Processes Personal Data for purposes related to providing, operating, supporting, securing, and improving the Services, subject to the technical and operational limitations of the Services and as otherwise permitted by applicable law.

Programa does not Process Personal Data on your behalf for purposes unrelated to the Services and does not intentionally Process such Personal Data for cross-context behavioural advertising. Programa may disclose or combine Personal Data where reasonably necessary to provide, maintain, secure or improve the Services, to comply with legal obligations or where otherwise permitted by applicable law.

You acknowledge and agree that you are solely responsible for determining whether the Services are appropriate for your compliance obligations under applicable United States data protection laws. You represent and warrant that you have provided all required notices, obtained all required consents, and honoured any applicable opt-out rights in connection with your disclosure of Personal Data to Programa.

1. Audits and Assessments

Programa does not provide audit rights, on-site inspections or bespoke compliance assessments in connection with this Addendum. Nothing in this Addendum requires Programa to submit audits, inspections, or certifications conducted by or on behalf of you or any third party.

Where required by applicable law, Programa may make available reasonable information regarding its data security practices, which may include high-level descriptions of technical and organisational measures, security policies, or third-party audit summaries made generally available to customers. Any such information will be provided subject to confidentiality obligations and shall not include disclosure of sensitive security details.

1. Limitation of Liability

To the maximum extent permitted by applicable law, any liability arising out of or in connection with this Addendum, including any liability relating to the Processing of Personal Data, shall be subject to the limitations of liability set out in the Agreement. This Addendum does not create any additional liability, remedies or rights beyond those expressly set out in the Agreement.

Nothing in this Addendum limits or excludes liability that cannot be limited or excluded under applicable law.

1. Changes to this Addendum

Programa may amend this Addendum from time to time by posting an updated version on its website or otherwise making it available to you. Any such amendment will take effect on the data specified in the updated Addendum.

Your continued use of the Services after an updated Addendum becomes effective constitutes your acceptance of the amended Addendum. If you do not agree to an amended Addendum, you must stop using the Services.

1. Governing Law

This Addendum is governed by and construed in accordance with the laws of Victoria, Australia, without regard to conflict of laws principles. Any disputes arising out of or relating to this Addendum shall be subject to the exclusive jurisdiction of the courts of Victoria, Australia, unless otherwise required by applicable law.

Appendix 1 – Details of Processing

Nature and Purpose of Processing

The Processing of Personal Data under this Addendum is limited to what is necessary to provide, operate, support, secure and improve the Services in accordance with the Programa Terms of Service and any other agreement into which this Addendum is incorporated. Processing may also occur as reasonably necessary to respond to support requests, maintain service functionality, ensure platform security and comply with applicable legal obligations, or as otherwise initiated through your use of the Services.

Subject Matter, Types of Personal Data, and Categories of Data Subjects

The subject matter of the Processing consists of Personal Data relating to individuals whose data is submitted to or generated through the Services by you or on your behalf, including your customers, end users, and authorised account users. The types of Personal Data processed, and the categories of Data Subjects depend on how the Services are configured and used by you and may include account information, transactional data, communications, and related usage data.

Duration of Processing

Personal Data will be Processed for the duration of the Agreement and for a reasonable period thereafter, consistent with Programa’s data retention practices, backup procedures, technical limitations, and legal obligations. Following termination of the Agreement, Programa will take reasonable steps to delete or anonymise Personal Data Processed on your behalf where feasible, subject to applicable legal requirements and operational constraints.