Data Processing

This Data Processing Agreement ("Agreement" or "DPA") governs the processing of Personal Information by Vexion on behalf of customers in connection with the provision of Services.

This DPA forms part of the contractual agreement between you ("Customer", "Controller", "you", or "your") and Vexion ("Processor", "we", "us", or "our").

This Agreement applies where Vexion processes Personal Information on behalf of customers.

• "Personal Information" means information relating to an identified or identifiable individual.
• "Processing" means collection, storage, access, transmission, or other handling of Personal Information.
• "Controller" means the entity determining the purpose and means of Processing.
• "Processor" means the entity Processing Personal Information on behalf of the Controller.
• "Services" means infrastructure, hosting, and related services provided by Vexion.

Customers act as Controllers of Personal Information.

Vexion acts as a Processor of Personal Information only to the extent necessary to provide Services.

Customers are responsible for ensuring lawful Processing of Personal Information.

Vexion may process Personal Information solely for the purpose of providing Services.

Processing may include:

• Storage;
• Transmission;
• Backup;
• Infrastructure operations;
• Security monitoring.

Vexion does not determine the purpose of Processing.

Customers are responsible for:

• Compliance with applicable privacy laws;
• Obtaining necessary consents;
• Lawful collection of Personal Information;
• Ensuring lawful use of Services.

Vexion implements reasonable technical and organizational safeguards designed to protect Personal Information.

Security measures may include:

• Access controls;
• Encryption where applicable;
• Monitoring systems;
• Infrastructure protections.

No system can guarantee complete security.

Vexion personnel are subject to confidentiality obligations.

Vexion may engage third-party subprocessors to provide Services.

Subprocessors may include infrastructure providers and payment processors.

Vexion will take reasonable steps to ensure subprocessors implement appropriate safeguards.

Personal Information may be transferred to jurisdictions outside Australia.

Customers consent to such transfers where necessary to provide Services.

Where required by law, Vexion will notify customers of confirmed data breaches affecting Personal Information under its control.

Vexion will provide reasonable assistance to customers in fulfilling legal obligations, where technically feasible.

Upon termination of Services, Vexion may delete Personal Information without liability.

Customers are responsible for exporting data prior to termination.

Customers retain full responsibility for Personal Information contained within Customer Content.

Vexion does not control Customer Content.

To the maximum extent permitted by law, Vexion is not liable for Processing conducted on behalf of customers.

Customers assume responsibility for lawful Processing.

Both parties agree to comply with applicable privacy laws.

Vexion may modify this DPA at any time.

Changes become effective upon publication.

Continued use of Services constitutes acceptance.

This Agreement survives termination of Services.

This Agreement is governed by the laws of Queensland, Australia.

You submit to the exclusive jurisdiction of Queensland courts.