Data Processing
Effective 31 May 2026 · Version 1.2
This Data Processing Agreement ("DPA") forms part of the Terms of Service between True North Analytics (ABN 24 726 502 584) ("we", "us", "Processor") and the Customer ("you", "Controller") and governs our processing of Personal Information on your behalf in connection with Accorda (the "Service").
By using the Service, the Customer is deemed to have entered into this DPA. The Customer may also request a counter-signed copy by emailing info@accorda.com.au.
In the event of any conflict between this DPA and the Terms of Service, this DPA prevails to the extent of the conflict on matters of personal information processing.
In this DPA:
Other capitalised terms used but not defined here have the meanings given in the Terms of Service.
The parties agree that, in respect of Customer Personal Information:
The subject matter of this DPA is the processing of Customer Personal Information through the Service. This DPA continues for as long as we process Customer Personal Information in connection with the Service.
We process Customer Personal Information to provide and operate the Service for the Customer, including:
Customer Personal Information may relate to:
Customer Personal Information typically includes:
We do not solicit and do not knowingly process sensitive information (as defined by the Privacy Act). However, incident records may naturally contain or reference sensitive information, including health information or information about safeguarding concerns, especially in regulated sectors such as healthcare, aged care, NDIS, childcare, and similar services. The Customer must not upload sensitive information to the Service except where: (1) it is strictly necessary for the stated compliance or incident management purpose, (2) the Customer has a documented lawful basis under Australian privacy law and any applicable overseas law, (3) where required by law, the Customer has obtained appropriate consent, and (4) the upload is in compliance with the AUP. The Customer is solely responsible for determining the lawful basis and obtaining necessary consents.
We will process Customer Personal Information only on the Customer's documented instructions. The Terms of Service, this DPA, and the Customer's configuration of the Service constitute the Customer's documented instructions.
The Customer may provide additional instructions in writing (including by email). We will follow such instructions to the extent technically feasible and lawful. If we consider an instruction to be unlawful, we will notify the Customer.
If applicable law requires us to process Customer Personal Information beyond the Customer's instructions, we will inform the Customer of that requirement before processing, unless we are prohibited from doing so by that law.
We will ensure that any personnel or contractors authorised to process Customer Personal Information:
We will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. The current measures are described in Annex A below.
We will review and update the security measures from time to time as appropriate having regard to the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.
Notwithstanding our security obligations, the Customer is responsible for:
The Customer authorises us to engage Subprocessors to assist us in providing the Service, subject to the conditions in this Section 6.
The current Subprocessors are listed in Annex B. The list is updated from time to time and the current version is available in our Privacy Policy.
We will provide the Customer with reasonable advance notice (at least 30 days, where practicable) before engaging any new Subprocessor that will process Customer Personal Information. Notice may be given by email to the Customer's primary administrator or by updates to our Privacy Policy or this DPA.
If the Customer objects to a new Subprocessor on reasonable, privacy-related grounds, the Customer must notify us in writing within 14 days of our notice. The parties will discuss the objection in good faith. If we cannot reasonably accommodate the objection, the Customer's sole remedy is to terminate the Subscription as it relates to the affected service, with a pro-rata refund of any pre-paid fees for the unused portion.
We will impose on each Subprocessor obligations no less protective than those in this DPA in respect of the protection of Customer Personal Information, and remain responsible to the Customer for the Subprocessor's compliance.
We will provide reasonable assistance to the Customer in responding to requests from Data Subjects to exercise their rights under applicable privacy law (including rights of access, correction, deletion, and complaint).
If we receive a request from a Data Subject in connection with Customer Personal Information, we will (without responding to the request beyond an acknowledgement):
The Customer is responsible for responding to Data Subject requests substantively. We provide tools within the Service (including data export, account deactivation, and audit logs) to assist the Customer.
Where assistance under this Section 7 requires more than minimal effort on our part, we may charge a reasonable fee, which we will notify in advance.
We will notify the Customer of any Personal Information Breach affecting Customer Personal Information without undue delay, and in any event within 72 hours of becoming aware of the breach. Notification will include, to the extent then known:
We will co-operate with the Customer's investigation of the breach and provide reasonable assistance in fulfilling the Customer's notification obligations to Data Subjects, regulators (including the Office of the Australian Information Commissioner), and other parties.
A notification under this Section 8 does not constitute an admission of fault or liability by us.
The Customer is responsible for any notification it must make to Data Subjects, regulators, or other parties as a result of a Personal Information Breach. The Customer must not publicly attribute a breach to us without our prior consent, except where required by law.
We will provide reasonable assistance to the Customer in the conduct of any data protection impact assessment ("DPIA") or similar privacy impact assessment that the Customer is required to undertake in respect of its use of the Service. Where such assistance requires more than minimal effort on our part, we may charge a reasonable fee.
We will maintain records of the categories of processing activities carried out on behalf of the Customer, sufficient to demonstrate compliance with this DPA. These records will be made available to the Customer on reasonable request.
The Customer may, on reasonable advance written notice (not less than 30 days, except in the case of an actual or suspected Personal Information Breach), request an audit of our compliance with this DPA. Audits are subject to the following conditions:
We may satisfy the audit obligation by providing the Customer with relevant documentation, certifications, or audit reports that we hold from third-party assessors.
The Customer bears its own costs of conducting an audit. We bear our own costs of co-operating with reasonable audit requests, except where the audit is initiated more frequently than the limits in this Section 11 permit, in which case the Customer reimburses us for the reasonable additional costs.
Customer Personal Information is primarily hosted in the Asia Pacific (Sydney) region.
We may transfer Customer Personal Information outside Australia where:
Where transfers occur, we rely on the protections offered by the recipient's privacy programme, contractual safeguards, and applicable law.
In accordance with APP 8 (cross-border disclosure of personal information), the Customer acknowledges that some Subprocessors may process Customer Personal Information outside Australia, including in jurisdictions whose privacy laws may differ from Australia's. By engaging us, the Customer is taken to consent to such disclosures within the scope of this DPA.
On termination of the Customer's Subscription, we will, at the Customer's choice:
The Customer has 30 days from termination to make this choice and to extract Customer Personal Information through the Service.
After the 30-day grace period, we will delete Customer Personal Information from active systems within 30 days, and from backups within 90 days.
We may retain Customer Personal Information as required by applicable law, in which case we will continue to protect it in accordance with this DPA for as long as it is retained.
The limitation of liability provisions in the Terms of Service apply to this DPA.
This DPA takes effect when the Customer first uses the Service after its publication, and continues until the Customer's Subscription ends and the obligations relating to return or deletion of data have been completed.
We may update this DPA from time to time. Material changes will be notified to the Customer's primary administrator by email and reflected in our published version. Continued use of the Service after a material change constitutes acceptance.
Notices under this DPA may be given by email:
This DPA is governed by the laws of New South Wales, Australia.
We implement and maintain the following technical and organisational measures, updated from time to time:
We do not maintain physical infrastructure for Customer Data; security of physical infrastructure is the responsibility of our Subprocessors (notably Supabase and Vercel), which operate certified data centres.
The following Subprocessors process Customer Personal Information in connection with the Service. The list is updated from time to time, with the current version available in our Privacy Policy.
| Subprocessor | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication, storage | Asia Pacific (Sydney) |
| Vercel | Application hosting | Multi-region (primary: Sydney; edge: global) |
| Stripe | Payment processing | Global |
| Anthropic | AI inference (assistant, policy review, policy mapping) | United States |
| Resend | Transactional email | Global |
| Sentry | Error monitoring | European Union |
Each Subprocessor is bound by contractual obligations to handle Customer Personal Information only for the purposes of operating the Service.
True North Analytics ABN 24 726 502 584 Email: info@accorda.com.au
