Data Processing Agreement

This Data Processing Agreement ("Agreement" or "DPA") is incorporated into and forms part of the Platform Terms of Use ("Principal Agreement") between the Customer and Feezy Pty Ltd (ACN 661 267 385) of Level 1, 63–73 Ann Street, Surry Hills NSW 2010, Australia, trading as HE Comply ("HE Comply", "Processor").

This Agreement applies to all Customers of HE Comply, a single platform used by institutions and agencies. In this Agreement, "Customer" means any institution or agency that has entered into a Principal Agreement with Feezy Pty Ltd to use HE Comply. The Customer is the Controller and HE Comply is the Processor.

WHEREAS:

(A) the Customer acts as a Controller in respect of Personal Data processed through the Platform;

(B) the Customer wishes to engage HE Comply to process certain Personal Data on its behalf as part of the Services;

(C) the Parties seek to implement an agreement that complies with applicable Data Protection Laws, including the EU GDPR, UK GDPR, and the Australian Privacy Act 1988 (Cth); and

(D) the Parties wish to record their respective rights and obligations.

IT IS AGREED AS FOLLOWS:

1. Definitions and Interpretation

1.1 Unless otherwise defined, capitalised terms have the meanings set out below or in the Principal Agreement:

Agreement means this Data Processing Agreement, including all Annexes.

Applicable Laws means all laws applicable to the Processing, including the Data Protection Laws.

Business Day means a day other than a Saturday, Sunday, or public holiday in Sydney, New South Wales.

Cessation Date means the date on which HE Comply ceases to provide Services to the Customer under the Principal Agreement.

Company Personal Data means any Personal Data Processed by HE Comply (or a Subprocessor) on behalf of the Customer under the Principal Agreement.

Confidential Information has the meaning given in the Principal Agreement or, if the Principal Agreement does not define it, means information disclosed by one Party to the other in connection with this Agreement that is marked as confidential or would reasonably be regarded as confidential.

Contract means an agreement or other document uploaded to, imported into, created in, or executed through the Platform by or on behalf of the Customer.

Controller means the entity that determines the purposes and means of Processing Personal Data.

Data Protection Laws means the EU GDPR; the UK GDPR and Data Protection Act 2018; the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles; and any national or state laws implementing, supplementing, or replacing any of them, in each case as amended or replaced from time to time.

Data Subject means an identified or identifiable natural person to whom Personal Data relates.

EEA means the European Economic Area.

EU GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

Party means the Customer or HE Comply, and Parties means both of them.

Personal Data means any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Laws.

Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

Platform means the HE Comply software-as-a-service platform, currently made available at https://app.hecomply.com.

Processing means any operation or set of operations performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.

Processor means Feezy Pty Ltd, which Processes Personal Data on behalf of the Customer.

Restricted Transfer means a transfer of Personal Data from the EEA or UK to a country not deemed adequate under the EU GDPR or UK GDPR.

SCCs means the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as set out in Annex D.

Services means the services HE Comply provides to the Customer under the Principal Agreement, including access to and use of the Platform.

Subprocessor means any processor engaged by HE Comply to Process Company Personal Data on HE Comply's behalf.

Supervisory Authority means a public authority competent for the supervision of the Processing of Personal Data under applicable Data Protection Laws.

UK Addendum means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner's Office (version B1.0, 21 March 2022), as set out in Annex E.

UK GDPR means the EU GDPR as retained in UK law by the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

1.2 In the event of any inconsistency or conflict between this Agreement (including the Annexes) and the Principal Agreement, in relation to the Processing of Personal Data this Agreement prevails. In the event of any inconsistency or conflict between this Agreement and the SCCs or UK Addendum, the SCCs and UK Addendum prevail to the extent required by applicable Data Protection Laws.

2. Duration

2.1 This Agreement commences on the effective date of the Principal Agreement and continues until the Cessation Date. Obligations relating to confidentiality, data protection, and the deletion or return of Personal Data survive termination as set out in this Agreement.

3. Processing of Company Personal Data

3.1 Processing

3.1.1 HE Comply shall:

(a) Process Company Personal Data only on the documented instructions of the Customer (including as set out in this Agreement and the Principal Agreement), and notify the Customer if HE Comply considers that any instruction infringes applicable Data Protection Laws;

(b) comply with all applicable Data Protection Laws in connection with its Processing of Company Personal Data;

(c) maintain records of Processing activities as required by Article 30(2) of the EU GDPR or equivalent provisions of applicable Data Protection Laws; and

(d) ensure that all staff with access to Company Personal Data are subject to enforceable obligations of confidentiality and have received appropriate data protection training.

3.1.2 The Customer instructs HE Comply to Process Company Personal Data as necessary to perform the Services and as otherwise set out in Annex A (Processing Particulars).

3.1.3 HE Comply shall not use Company Personal Data for its own purposes or for any purpose other than those documented by the Customer or set out in this Agreement.

3.2 Anonymised and Aggregated Data

3.2.1 HE Comply may derive anonymised and aggregated insights from data processed through the Platform (including from Company Personal Data) for the purposes of product development, analytics, security monitoring, and service improvement, including for use in machine learning and artificial intelligence systems, provided that:

(a) such use is performed exclusively on data that has been irreversibly anonymised such that no individual person, customer, institution, or agent is identifiable from or through the data, consistent with Recital 26 of the EU GDPR; and

(b) HE Comply does not attempt to re-identify any individual from anonymised or aggregated data.

3.2.2 Properly anonymised data is not Personal Data. The Customer instructs HE Comply to carry out the anonymisation described in clause 3.2.1. HE Comply's use of the resulting anonymised data is not Processing of Personal Data and requires no further instruction. HE Comply will not use identified Personal Data to train, fine-tune, or otherwise develop AI or machine learning models without the Customer's explicit prior written consent.

4. Customer Obligations

4.1 The Customer shall:

(a) provide Company Personal Data to HE Comply lawfully, fairly, and transparently;

(b) ensure that it has a valid legal basis under applicable Data Protection Laws for all transfers of Company Personal Data to HE Comply; and

(c) provide all required notices to Data Subjects in accordance with applicable Data Protection Laws, including notifying Data Subjects that their Personal Data may be processed by HE Comply as described in this Agreement.

5. Personnel

5.1 HE Comply shall take reasonable steps to ensure the reliability of all employees, agents, and contractors who have access to Company Personal Data, ensuring that access is strictly limited to those who need it to perform the Services.

5.2 All persons with access to Company Personal Data shall be subject to enforceable confidentiality obligations or professional obligations of confidentiality.

5.3 HE Comply shall implement data minimisation measures to limit access to Company Personal Data to only what is necessary for the performance of the Services.

6. Security

6.1 HE Comply shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of Processing, having regard to the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, including as required by Article 32 of the EU GDPR. The measures in place are described in Annex B (Security Measures).

6.2 In assessing the appropriate level of security, HE Comply shall take into account the risks presented by the Processing, in particular the risk of a Personal Data Breach.

7. Subprocessing

7.1 The Customer hereby grants general authorisation for HE Comply to engage the Subprocessors listed in Annex C. HE Comply shall ensure that each Subprocessor is bound by written data protection obligations no less protective than those in this Agreement.

7.2 HE Comply shall provide at least 15 days' prior written notice of any intended addition, replacement, or other material change to its Subprocessors ("Change Notice").

7.3 The Customer may object to any proposed Subprocessor change on reasonable data protection grounds by written notice within the Change Notice period. If the Parties cannot agree on a commercially reasonable mitigation within 30 days of the objection, the Customer may terminate the affected Services without penalty.

7.4 HE Comply remains fully liable for the acts and omissions of each Subprocessor as if they were HE Comply's own.

8. Data Subject Rights

8.1 Taking into account the nature of the Processing, HE Comply shall assist the Customer, through appropriate technical and organisational measures, to fulfil the Customer's obligations to respond to Data Subject requests to exercise their rights under applicable Data Protection Laws.

8.2 HE Comply shall promptly notify the Customer if it receives a request from a Data Subject in respect of Company Personal Data and shall not respond to that request except on the Customer's documented instructions or as required by applicable law.

9. Personal Data Breach

9.1 HE Comply shall notify the Customer without undue delay, and in any event within 48 hours of becoming aware, of any Personal Data Breach affecting Company Personal Data. The notification shall include such information as is required by Article 33 of the EU GDPR (or equivalent) as it becomes available.

9.2 HE Comply shall cooperate with the Customer and take reasonable steps directed by the Customer to assist in the investigation, mitigation, and remediation of any such Personal Data Breach.

9.3 Where a Personal Data Breach is likely to result in a high risk to the rights and freedoms of Data Subjects, HE Comply shall provide the Customer with such information and reasonable assistance as the Customer requires to fulfil its obligations to communicate the breach to affected Data Subjects under Article 34 of the EU GDPR or equivalent provisions of applicable Data Protection Laws.

10. Data Protection Impact Assessments

10.1 HE Comply shall provide reasonable assistance to the Customer with any data protection impact assessments or prior consultations with Supervisory Authorities that the Customer reasonably considers to be required by Article 35 or 36 of the EU GDPR or equivalent provisions of applicable Data Protection Laws, to the extent they relate to the Processing of Company Personal Data by HE Comply.

11. Deletion and Return of Company Personal Data

11.1 Within 10 Business Days of the Cessation Date, at the Customer's written election, HE Comply shall either:

(a) return to the Customer all Company Personal Data in a commonly used, machine-readable format and thereafter delete all remaining copies; or

(b) securely delete all Company Personal Data and certify such deletion in writing.

11.2 Where applicable laws require HE Comply to retain Company Personal Data beyond the Cessation Date, HE Comply shall notify the Customer of the legal requirement, isolate and protect the retained data from further processing, and delete it promptly once the legal requirement ceases.

11.3 HE Comply shall not retain Company Personal Data for longer than is necessary for the provision of the Services, except as required by applicable law.

11.4 Despite clause 11.1, copies of Company Personal Data held in backups are deleted in the ordinary course within 35 days of their deletion from HE Comply's live systems.

12. Audit Rights

12.1 HE Comply shall, on reasonable written request (and no more than once per calendar year unless a Personal Data Breach has occurred), make available to the Customer all information reasonably necessary to demonstrate compliance with this Agreement and shall cooperate with audits and inspections by the Customer or an auditor appointed by the Customer.

12.2 Audits shall be conducted during normal business hours with at least 30 days' prior written notice and shall be subject to reasonable confidentiality obligations. The Customer shall bear the costs of any audit unless the audit reveals a material non-compliance by HE Comply.

13. Data Transfers

13.1 HE Comply stores and processes Customer data as follows:

(a) uploaded files, AI-assisted reading, and draft records are processed in the AWS region that matches the uploading user's account country: Dublin, Ireland, for users located in the EEA or the United Kingdom, and Sydney, Australia, for all other users;

(b) once a Contract is created, its files are stored in Dublin, Ireland, if any party to the Contract is located in the EEA or the United Kingdom, and otherwise in Sydney, Australia. Where a party located in the EEA or the United Kingdom joins a Contract after it is created, its files are copied to Dublin, Ireland, at that point, and the copies in Sydney, Australia, are deleted within 30 days of a successful copy;

(c) structured Contract records, including party names, dates, commercial terms, contact details, and text extracted from Contract documents, are stored in Sydney, Australia, for all Contracts, and application logs, which may contain Personal Data, are stored mainly in Sydney, Australia;

(d) uploaded files held before a Contract is created are deleted automatically within 3 days;

(e) where the Customer selects AI-assisted reading for an upload, that processing is carried out using Amazon Bedrock in the region of upload under paragraph (a). Requests from the Dublin region are processed only within AWS's European Union regions, and requests from the Sydney region are processed only within Australia; and

(f) Subprocessors process Company Personal Data in the locations listed in Annex C.

13.2 To the extent that any transfer of Company Personal Data from the EEA to a third country constitutes a Restricted Transfer, the Parties shall rely on the SCCs set out in Annex D (Module 2: Controller to Processor). The SCCs apply automatically to any such Restricted Transfer without further action by the Parties.

13.3 To the extent that any transfer of Company Personal Data from the UK to a third country constitutes a Restricted Transfer under the UK GDPR, the Parties shall rely on the UK Addendum set out in Annex E, which supplements and modifies the SCCs for the purposes of UK transfers.

13.4 HE Comply shall implement any supplementary technical and organisational safeguards required in connection with a Restricted Transfer and shall conduct a transfer risk assessment prior to initiating any new Restricted Transfer, the results of which shall be made available to the Customer on request.

13.5 HE Comply may update the SCC and UK Addendum references in this Agreement to reflect any replacement clauses formally adopted by the European Commission, UK ICO, or other competent authority, with notice to the Customer.

14. Confidentiality

14.1 Each Party shall keep this Agreement and all Confidential Information received from the other Party in connection with this Agreement confidential and shall not use or disclose such Confidential Information without the other Party's prior written consent, except:

(a) to the extent required by applicable law, court order, or regulatory authority; or

(b) to the extent the information is already in the public domain through no fault of the receiving Party.

15. General

15.1 This Agreement (including its Annexes) constitutes the entire agreement between the Parties regarding the Processing of Personal Data and supersedes all prior representations or agreements on the same subject.

15.2 No third party has rights under this Agreement, except where Data Protection Laws confer enforceable rights on Data Subjects.

15.3 All notices under this Agreement must be in writing to the addresses set out in the Principal Agreement. Notices to HE Comply for data protection matters should be directed to legal@hecomply.com.

15.4 This Agreement is governed by the laws of New South Wales, Australia, except that the SCCs and UK Addendum are governed by the laws specified therein (EU Member State law and the laws of England and Wales respectively).

ANNEX A - Processing Particulars

A.1 Subject Matter

The subject matter of the Processing is HE Comply's provision of the Platform, a software-as-a-service (SaaS) platform used by institutions and agencies for contract upload, AI-assisted reading and structuring of contract data, management, eSigning, and compliance, including storage, retrieval, and processing of contract data.

A.2 Duration

Processing continues for the term of the Principal Agreement between HE Comply and the Customer, including any renewal periods, and until completion of deletion or return of Personal Data in accordance with clause 11.

A.3 Nature and Purpose of Processing

HE Comply processes Personal Data as necessary to:

(a) provide and operate the Platform, including user account creation, authentication, and access management (including team permissions);

(b) enable contract upload, storage, lifecycle management (including expiry tracking and renewal reminders), and retrieval;

(c) where the Customer selects it for an upload, carry out AI-assisted reading and structuring of contract data using Amazon Bedrock;

(d) facilitate eSigning envelope creation, distribution, and execution via the DocuSign integration;

(e) enable co-management of Contracts between institutions and agencies, and maintain records of sub-agents and partner agencies;

(f) communicate with Customer contacts via transactional and support communications;

(g) provide analytics, reporting (including emailed analytics reports), and platform monitoring; and

(h) provide support, maintenance, security monitoring, and compliance with applicable law.

A.4 Types of Personal Data

The Personal Data processed may include (without limitation):

(a) Identification data: names, job titles, roles, digital signatures, user identifiers;

(b) Contact data: email addresses, telephone numbers, business addresses;

(c) Authentication data: login credentials, IP addresses, session activity logs;

(d) Contract data: commission agreements, agency partnership contracts, eSigned documents, and any personal data contained within those documents; and

(e) Usage data: system logs, device information, and Platform activity data.

A.5 Categories of Data Subjects

The categories of Data Subjects may include:

(a) Customer personnel (employees, contractors, and authorised users);

(b) Counterparties to Contracts (e.g. signatories, contract representatives, agents);

(c) Students, to the limited extent that the Customer uploads student identifiers or placement data through the Platform; and

(d) Any other natural persons whose Personal Data is contained within contract documents or other records on the Platform.

A.6 Obligations and Rights of the Controller

The Controller's obligations and rights include: the right to issue documented processing instructions; the right to require assistance with Data Subject rights, data protection impact assessments, and breach notifications; the right to audit HE Comply's compliance with this Agreement; and the right to require deletion or return of Personal Data.

ANNEX B - Security Measures

HE Comply implements and maintains the following technical and organisational security measures:

B.1 Access Controls

(a) Role-based access controls applying the principle of least privilege;

(b) Multi-factor authentication enforced for access to HE Comply's cloud infrastructure accounts, and two-factor sign-in available to all Platform users;

(c) Strong password policies and session timeout enforcement;

(d) Comprehensive logging and monitoring of access to Company Personal Data; and

(e) Immediate revocation of access upon termination of employment or contractor engagement.

B.2 Encryption

(a) Personal Data encrypted in transit using TLS 1.2 or higher;

(b) Personal Data encrypted at rest using AES-256 or equivalent; and

(c) Secure encryption key management consistent with FIPS 140-2 standards.

B.3 System Integrity and Availability

(a) Firewalls, intrusion detection systems, and anti-malware protection;

(b) Logical isolation of Customer data from other tenants;

(c) Redundant architecture across multiple AWS availability zones within the applicable AWS region (Dublin, Ireland, and Sydney, Australia, as described in clause 13.1); and

(d) Regular patching and vulnerability remediation of infrastructure and applications.

B.4 Backup and Disaster Recovery

(a) Encrypted backups of Customer data, including continuous point-in-time backups of core data retained for 35 days;

(b) Backups stored in geographically separate availability zones within the same AWS region as the primary data; where cross-region backups are implemented, the applicable regions and transfer safeguards will be documented and made available to the Customer on written request;

(c) Recovery Point Objective (RPO): ≤ 12 hours; and

(d) Recovery Time Objective (RTO): ≤ 24 hours.

B.5 Monitoring and Testing

(a) Continuous monitoring for unauthorised or anomalous activity;

(b) Regular vulnerability scanning and remediation;

(c) Annual penetration testing by independent security professionals; and

(d) Security incident response plan with a 48-hour Personal Data Breach notification capability.

B.6 Organisational Measures

(a) Mandatory data protection and information security training for all staff;

(b) Confidentiality agreements for all staff with access to Personal Data;

(c) Vendor and Subprocessor due diligence, contractual data protection obligations, and ongoing monitoring;

(d) Secure device management policies including encryption, remote wipe, and patching; and

(e) Annual review of security policies and controls against ISO 27001 / NIST CSF benchmarks.

ANNEX C - Subprocessor List

HE Comply engages the following Subprocessors to deliver the Services. HE Comply has entered into data processing agreements with each Subprocessor that impose data protection obligations no less protective than those in this Agreement.

HE Comply maintains an up-to-date list of Subprocessors. Customers will be notified in advance of any addition or replacement in accordance with clause 7.2.

ANNEX D - EU Standard Contractual Clauses

D.1 Incorporation

The Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (Controller to Processor), are incorporated into this Agreement by reference and form part of it as legally binding obligations of the Parties for Restricted Transfers from the EEA to third countries. Only the clauses that apply to Module Two are incorporated. The official text is available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

D.2 Roles

For the purposes of the SCCs, the "data exporter" is the Customer (Controller) and the "data importer" is Feezy Pty Ltd, trading as HE Comply (Processor).

D.3 Selected Options

The Parties make the following selections:

(a) Clause 7 (Docking clause): included;

(b) Clause 9(a) (Use of sub-processors): Option 2 (general written authorisation) applies, and the time period for notice of intended changes is 15 days;

(c) Clause 11(a) (Redress): the optional wording on an independent dispute resolution body is not included;

(d) Clause 13 (Supervision): the competent supervisory authority is determined as set out in Annex I.C below;

(e) Clause 17 (Governing law): Option 1 applies, and the governing law is the law of Ireland; and

(f) Clause 18(b) (Choice of forum and jurisdiction): the courts of Ireland.

D.4 Appendix

The Appendix to the SCCs is completed as follows.

Annex I.A: List of Parties

Data exporter:

(a) Name: the Customer, as identified in the Principal Agreement;

(b) Address and contact details: as set out in the Principal Agreement;

(c) Activities relevant to the transfer: use of the Platform and the Services described in Annex A;

(d) Signature and date: the Customer's entry into the Principal Agreement, which incorporates this Agreement, is treated as its signature of this Annex I.A, on the date of that entry; and

(e) Role: controller.

Data importer:

(a) Name: Feezy Pty Ltd (ACN 661 267 385), trading as HE Comply;

(b) Address: Level 1, 63–73 Ann Street, Surry Hills NSW 2010, Australia;

(c) Contact details: legal@hecomply.com;

(d) Activities relevant to the transfer: provision of the Platform and the Services described in Annex A;

(e) Signature and date: HE Comply's entry into the Principal Agreement is treated as its signature of this Annex I.A, on the date the Customer enters into the Principal Agreement; and

(f) Role: processor.

Annex I.B: Description of Transfer

(a) Categories of data subjects: as set out in Annex A.5;

(b) Categories of personal data: as set out in Annex A.4;

(c) Sensitive data: none intended;

(d) Frequency of the transfer: continuous, for the term of the Principal Agreement;

(e) Nature of the processing: as set out in Annex A.3;

(f) Purposes of the transfer and further processing: as set out in Annex A.3;

(g) Retention period: as set out in Annex A.2 and clause 11; and

(h) Transfers to sub-processors: subject matter, nature, and duration as set out in Annex C and Annex A.2.

Annex I.C: Competent Supervisory Authority

The competent supervisory authority is the supervisory authority identified by applying Clause 13(a) of the SCCs to the data exporter.

Annex II: Technical and Organisational Measures

As set out in Annex B (Security Measures) of this Agreement. The measures by which HE Comply assists the Customer with data subject requests are those described in clause 8 and Annex B.

Annex III: List of Sub-processors

As set out in Annex C (Subprocessor List) of this Agreement.

ANNEX E - UK International Data Transfer Addendum

This Annex sets out the UK International Data Transfer Addendum issued by the UK Information Commissioner's Office (version B1.0, in force 21 March 2022). This Addendum applies to Restricted Transfers of Personal Data from the United Kingdom to a third country and is entered into by the Customer (as Exporter) and HE Comply (as Importer) as a supplement to the SCCs in Annex D.

Part 1: Tables

Table 1: Parties

Table 2: Selected SCCs, Modules and Selected Clauses

Table 3: Appendix Information

"Appendix Information" for this Addendum is as set out in Annexes A (Processing Particulars), B (Security Measures), and C (Subprocessor List) of this Agreement.

Table 4: Ending this Addendum when the Approved Addendum Changes

Part 2: Mandatory Clauses

Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

The full text of the Approved Addendum is available at: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-data-transfer-agreement-and-guidance/