Data Processing Agreement

1. Scope

This Data Processing Agreement ("DPA") is between FastFlowUp (ABN 14 677 767 458), trading as ImmiIQ ("ImmiIQ", "we") and the firm that holds an ImmiIQ account (the "Customer", "you"). It forms part of our Terms of Service and applies whenever we process personal information on your behalf in providing the Service.

It applies in the same way whether you pay us directly or buy through an authorised ImmiIQ reseller. If this DPA and the Terms conflict about personal information in Customer Data, this DPA prevails.

2. Definitions

• Customer Data - everything you or your users put into the Service: client records, documents, messages, notes and the like.
• Personal Information - has the meaning in the Privacy Act 1988 (Cth).
• Eligible Data Breach - has the meaning in Part IIIC of the Privacy Act 1988 (Cth).
• Subprocessor - a third party we engage that processes Customer Data for us.

3. Roles and Instructions

You decide what Customer Data goes into the Service and why. We process it only to provide, secure and support the Service for you, in accordance with your instructions. Your instructions are the Terms, this DPA, the settings you choose in the Service and anything your users do in it.

You are responsible for having a lawful basis to collect the Personal Information you put into the Service and for your own obligations as a registered migration agent or legal practitioner, including to your clients.

4. Our Obligations

We will:

• process Customer Data only on your instructions unless the law requires us to do otherwise;
• not sell Customer Data or use it for any purpose other than providing, securing and supporting the Service;
• ensure everyone we allow to access Customer Data is bound to keep it confidential;
• handle Personal Information in Customer Data in accordance with the Australian Privacy Principles; and
• tell you if we believe an instruction breaches the Privacy Act.

5. Security

We protect Customer Data with the measures described at /data-security, including per-organisation AES-256-GCM encryption at rest, TLS in transit, least-privilege access for our engineers and logging of access. We may improve these measures, but will not materially reduce the protection they give.

Security is shared: the controls your firm is responsible for, such as who you give access to and what happens to data once it leaves the Service, are set out on the same page.

6. Subprocessors

You authorise us to use the Subprocessors listed in the "Data Sharing" section of our Privacy Policy. Each is bound by written terms that protect Customer Data at least as well as this DPA. We remain responsible for them.

We will update that list at least 14 days before a new Subprocessor begins processing Customer Data. If you reasonably object, tell us within that period; if we cannot address the objection, you may cancel the affected part of the Service.

An authorised reseller or referral partner is not a Subprocessor. It has no access to Customer Data (see section 11).

7. Where Data Is Kept

Customer Data is stored in Australia. Where a Subprocessor processes limited data outside Australia (for example, payment details), it does so as described in our Privacy Policy and on terms consistent with Australian Privacy Principle 8.

8. Data Breaches

If we become aware of unauthorised access to, disclosure of or loss of Customer Data, we will tell you without undue delay, give you the information we have about it and take reasonable steps to contain it.

We will work with you to assess whether it is an Eligible Data Breach and, where it is, to notify the Office of the Australian Information Commissioner and the people affected under the Notifiable Data Breaches scheme. Report a suspected issue to security@immiiq.com.

9. Assistance and Information

The Service lets you find, correct, export and delete Customer Data yourself. Where you need more to answer a request from a client or a regulator, we will give you reasonable help.

We will answer your reasonable written questions about how we protect Customer Data, including a security questionnaire once a year.

10. Return and Deletion

You can export your Customer Data at any time with the Service's export tools. When your account ends and you ask us to, we delete Customer Data from the live system within 30 days. Encrypted backups age out within a further 90 days. We keep only what the law requires us to keep, such as audit records. We keep it only for as long as the law requires. See /data-deletion.

11. Firms Buying Through a Reseller

If you buy ImmiIQ through an authorised reseller, this DPA is still directly between you and ImmiIQ. The reseller bills and supports you. It sees only what it needs to bill you: your firm's name, plan, number of users and usage. It has no access to Customer Data unless you add one of its people as a user of your own account.

If the reseller stops reselling ImmiIQ, your account moves to direct billing with us. You keep your account, users and all Customer Data, without interruption.

12. General

This DPA lasts for as long as we process Customer Data for you. Each party's liability under it is subject to the limits in the Terms. It is governed by the law of New South Wales, Australia. We may update it as the Terms allow and will give notice of any material change.

Questions: support@immiiq.com.