Effective date: 14 October 2026
9.1 Roles
For the purposes of this DPA, and as between you and Ezyiah, you determine the purposes for which Customer Data is collected and used in connection with your business or professional services, and Ezyiah processes that data on your behalf to provide the Services and in accordance with these Terms. The terms 'controller' and 'processor', where used, are descriptive contractual concepts only and do not alter or replace the roles, responsibilities or obligations imposed by the Privacy Act 1988 (Cth), the APPs or any other applicable law.
9.2 Processing activities
Processing includes collecting, storing and processing Customer Data to provide the Services; generating Output; processing Bank Feed Data through Fiskil; maintaining AI Memory datasets; processing depreciation and asset data; processing Business Records, customer and supplier information, products and services, inventory data and Team Member access information; generating Business Dashboard metrics and AI Insights; and maintaining logs, analytics and security data.
9.3 Our obligations
We process Customer Data only to provide the Services and as instructed; apply appropriate technical and organisational measures, as described in the Terms of Service; ensure personnel are bound by confidentiality; and assist you, so far as reasonable, with access, correction, security and breach-notification obligations
9.4 Sub-processors
We may engage sub-processors, including cloud hosting, Fiskil and AI infrastructure providers, under written terms imposing comparable data-protection and confidentiality obligations. We remain responsible for the processing they perform on our behalf.
9.5 Cross-border transfers
Customer Data may be processed outside Australia, including by infrastructure providers such as Fiskil and our cloud and AI providers, with appropriate safeguards consistent with the APPs.
9.6 Breach assistance
We will notify you without undue delay after becoming aware of a data breach affecting your Customer Data and will assist you with your obligations, as described in the Incident Response and Breach Notification Policy.
9.7 Return and deletion
On termination, we handle Customer Data as set out in the Record Retention and Deletion Policy.
9.8 Compliance
We will comply with the APPs and other applicable privacy laws to the extent they apply to us and will assist you, so far as reasonably practicable and proportionate to the Services, to meet applicable privacy obligations relating to Customer Data processed through the Services.