Data Processing Addendum

1. Roles

For personal information about your employees and other individuals that you submit to the Service (for example, a contract you upload for analysis, or details you put into a chat thread), you act as the controller / APP entity and we act as a processor on your behalf. For personal information about your account holder (e.g. the email address you sign up with), we act as the controller — see our Privacy Policy.

2. Scope and purpose

We process customer-uploaded personal information only to:

• Provide and operate the Service (chat, document analysis, templates).
• Maintain the security and integrity of the Service.
• Comply with our legal obligations.
• Carry out your documented instructions (including those given through your use of the product).

3. Confidentiality and AI training

We do not use customer content to train our own AI models, and our AI providers are contractually prohibited from using your inputs or outputs to train their models. Access to customer content is restricted to authorised personnel on a need-to-know basis.

4. Sub-processors

We use a small number of sub-processors (cloud hosting, AI inference, email delivery, payments). A current list is available at /sub-processors. We require each sub-processor to maintain appropriate security and confidentiality obligations.

5. International transfers

Some sub-processors are located outside Australia. Where personal information is transferred overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including via contractual safeguards.

6. Security

We maintain technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure or destruction. Details are summarised on our Trust & Security page.

7. Data subject requests

Where you receive a request from an individual to access, correct or delete personal information that is held within your account, we will, at your request and cost (if any), provide reasonable assistance to help you respond.

8. Notifiable data breaches

If we become aware of a personal information breach affecting your account that is likely to result in serious harm, we will notify you without undue delay and provide information reasonably necessary to help you meet your obligations under the Privacy Act 1988 (Cth).

9. Return and deletion

On termination of your account, we will delete your personal information within a reasonable period, subject to any retention required by law or for backup cycles. You can also request earlier deletion via privacy@mypockethr.com.au.

10. Contact

Data protection / privacy queries: privacy@mypockethr.com.au.