Data Processing Agreement (DPA)

1. Parties and Scope

This Data Processing Agreement ("DPA") is entered into between the Business Client (the "Controller") and Bociwuumgroup Pty Ltd, represented by Director Sophie Campbell, located at 142 Rundle Street, Adelaide SA 5000 (the "Processor"). This agreement governs the processing of personal data in the context of professional instrument maintenance and repair services.

2. Subject Matter and Duration

The subject of this processing is the management of client records, instrument specifications, and communication logs required to fulfill service contracts. This agreement remains in effect for the duration of the business relationship and continues until all data is deleted according to the terms in Privacy Policy Section 6.

3. Categories of Data and Subjects

The Processor handles data relating to the Controller's employees or authorized representatives (Data Subjects). Categories include:

• Contact details (name, email, phone number).
• Instrument technical specifications and provenance.
• Billing and payment information.
• Service history and technical reports.

4. Obligations of the Processor

Bociwuumgroup Pty Ltd agrees to process data only on documented instructions from the Controller. We commit to ensuring that persons authorized to process the data have committed themselves to confidentiality. All processing is conducted in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

5. Sub-processors

The Controller acknowledges that the Processor engages the following sub-processors to ensure service delivery:

• Micron 21 Pty Ltd: Hosting provider located at Unit 2, 7 Eastspur Court, Kilsyth South VIC 3137.
• FormSubmit: Service used for processing web-based enquiries (data may be transferred to servers in the USA in accordance with APP 8).

6. Security Measures

The Processor implements technical and organisational measures to ensure a level of security appropriate to the risk, including encrypted data transmission, secure access to workshop logs, and regular backups via the hosting provider. For further details, see our Privacy Policy.

7. Incident Notification

In the event of a data breach, Bociwuumgroup Pty Ltd will notify the Controller without undue delay upon becoming aware of the incident. We will provide a description of the nature of the breach and the measures taken to mitigate its effects, complying with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth).

8. Return and Deletion of Data

Upon termination of services, the Processor shall, at the choice of the Controller, delete or return all personal data. In accordance with our business rules, instruments are stored for 14 days after completion; however, digital records are retained only as long as required for tax compliance or as specified in Terms and Conditions.

9. Audit and Compliance

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and the Australian Privacy Principles. The Controller may conduct audits of the Processor's data handling practices upon reasonable prior notice.

10. Governing Law and Jurisdiction

This agreement is governed by the laws of South Australia. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts in Adelaide. Complaints regarding data handling may be directed to the Office of the Australian Information Commissioner (OAIC), GPO Box 5288, Sydney NSW 2001, or via www.oaic.gov.au.