Data Processing Agreement (DPA)

1. Definitions and Parties

This Data Processing Agreement ("DPA") is entered into between the Client (the "Controller") and Barbevexaxo Pty Ltd, represented by Director Charlotte Williams, located at 142 Eagle Street, Brisbane QLD 4000 (the "Processor").

The Processor agrees to process personal data only on documented instructions from the Controller, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Subject Matter and Duration

The subject of this processing is the provision of professional photography services, including corporate team portraits and product catalogues. The duration of the processing is limited to the term of the service agreement and the mandatory storage periods defined in our Terms and Conditions.

3. Categories of Data and Subjects

The Processor handles the following categories of data:

• Data Subjects: Employees, executives, and representatives of the Controller.
• Data Types: Names, corporate email addresses, professional titles, and visual imagery (photographs).
• Client Materials: Product samples and brand guidelines provided for catalogue shoots.

4. Obligations of the Processor

Barbevexaxo Pty Ltd commits to:

• Process data solely for the purpose of delivering the commissioned photography services.
• Ensure that personnel authorised to process the data have committed themselves to confidentiality.
• Assist the Controller in fulfilling obligations to respond to data subject requests.
• Avoid any processing that violates the Australian Consumer Law.

5. Sub-processors

The Processor engages the following trusted sub-processors to ensure service delivery:

• Micron 21 Pty Ltd: Hosting provider located at Unit 2, 7 Eastspur Court, Kilsyth South VIC 3137.
• FormSubmit: Service used for the secure transmission of enquiry data (data may be processed in the USA).

The Processor ensures that sub-processors are bound by data protection obligations no less stringent than those in this DPA, adhering to APP 8 regarding overseas disclosures.

6. Security Measures

The Processor implements appropriate technical and organisational measures to protect data against unauthorised or unlawful processing and accidental loss. These include encrypted transfers, secure access controls to the studio servers, and regular backups via Micron 21 Pty Ltd.

7. Incident Notification

In the event of a data breach, the Processor shall notify the Controller without undue delay. We will provide a description of the nature of the breach and the measures taken to mitigate its effects, facilitating the Controller's reporting obligations to the Office of the Australian Information Commissioner (OAIC).

8. Return and Deletion of Data

Upon termination of services, the Processor shall, at the choice of the Controller, delete or return all personal data. In accordance with our business rules, RAW files are stored for 6 months before permanent deletion, unless otherwise agreed in writing. All deletions are performed securely to prevent recovery.

9. Audit and Compliance

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA. The Controller may conduct audits of the Processor's data handling practices with reasonable prior notice and during business hours.

10. Governing Law and Jurisdiction

This Agreement is governed by the laws of Queensland, Australia. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts in Brisbane.

For further enquiries, contact us at [email protected] or call (07) 3539 8495. Complaints may also be directed to the OAIC (GPO Box 5288, Sydney NSW 2001).