Data Processing Agreement

Last updated: November 2026

This Data Processing Agreement (“DPA”) forms part of the StockUnify Terms of Use (the “Terms”) between StockUnify Pty Ltd (ABN 32 699 041 293) (“StockUnify”, “we”, “us”) and the customer that has accepted the Terms (“Customer”, “you”). It applies when we process Customer Personal Data on your behalf. Capitalised terms not defined in this DPA have the meanings given in the Terms.

1. Definitions

• “Data Protection Laws” means all privacy and data protection laws that apply to the processing of Customer Personal Data under the Terms. These may include the Privacy Act 1988 (Cth), the UK GDPR, the EU GDPR, the New Zealand Privacy Act 2020, POPIA, and US state privacy laws.
• “Customer Personal Data” means personal data or personal information contained in Your Data.
• “Security Incident” means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• “Sub-processor” means a third party that we engage to process Customer Personal Data.
• “SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• “controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in the applicable Data Protection Laws. Where the CCPA applies, “processor” includes “service provider”.

2. Roles and scope

2.1 You are the controller of Customer Personal Data and we are your processor.

2.2 The details of the processing are set out in Annex 1.

2.3 You are responsible for ensuring that you have a lawful basis for the processing, and for giving all required notices and obtaining all required consents.

3. Our obligations

We will:

• (a) process Customer Personal Data only on your documented instructions. The Terms, your use and configuration of the Services, and any other written instructions you give us are your instructions. The only exception is where the law requires us to process the data otherwise, in which case we will inform you before processing, unless the law prohibits this;
• (b) tell you if, in our opinion, an instruction infringes Data Protection Laws;
• (c) ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations;
• (d) implement the security measures described in Annex 2;
• (e) not sell or share Customer Personal Data, or use it for any purpose other than providing the Services, including for targeted advertising;
• (f) taking into account the nature of the processing, assist you by appropriate measures to respond to data subject requests;
• (g) assist you with data protection impact assessments, prior consultations with regulators and security obligations, to the extent reasonably required and taking into account the information available to us;
• (h) at the end of the Services, delete or return Customer Personal Data in accordance with clause 7.5 of the Terms, unless the law requires us to keep it; and
• (i) make available information reasonably necessary to demonstrate compliance with this DPA, as described in clause 6.

4. Sub-processors

4.1 You give us general authorisation to engage Sub-processors. The current Sub-processors are listed in Annex 3.

4.2 We will:

• (a) impose data protection obligations on each Sub-processor that are no less protective than this DPA; and
• (b) remain responsible for each Sub-processor’s performance.

4.3 We will update Annex 3 at least 30 days before a new Sub-processor begins processing Customer Personal Data. You may object to the new Sub-processor on reasonable data protection grounds by notifying us within that period. If we cannot reasonably address your objection, you may terminate the affected Services and receive a pro-rata refund of any prepaid Access Fees for the unused period.

5. Security Incidents

5.1 We will notify you within 48 hours after becoming aware of a Security Incident.

5.2 Our notification will include the information reasonably available to us that you need to meet your own notification obligations, such as:

• the nature of the incident;
• the categories and approximate number of records and data subjects affected;
• the likely consequences; and
• the measures taken or proposed.

5.3 Our notification of a Security Incident is not an admission of fault or liability.

6. Audits

6.1 On written request, no more than once in any 12-month period, we will answer reasonable written questions about our compliance with this DPA and provide relevant documentation.

6.2 If that information is not sufficient to demonstrate compliance, or a regulator requires it, you may carry out an audit on these conditions:

• (a) you give at least 30 days’ notice;
• (b) the audit takes place during business hours;
• (c) the auditor is bound by confidentiality obligations; and
• (d) you pay the costs of the audit.

7. International transfers

7.1 Customer Personal Data is hosted in the AWS Asia Pacific (Sydney) region in Australia. Some Sub-processors may process Customer Personal Data in the other locations listed in Annex 3.

7.2 Where Customer Personal Data subject to the EU GDPR is transferred to us in Australia, the SCCs are incorporated into this DPA by reference and apply as follows:

• (a) Module 2 (controller to processor) applies;
• (b) Clause 7 (docking clause) applies;
• (c) Option 2 (general authorisation) of Clause 9(a) applies, with the notice period in clause 4.3 of this DPA;
• (d) the optional wording in Clause 11 does not apply;
• (e) for Clauses 17 and 18, the law and courts of Ireland apply; and
• (f) Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA.

7.3 Where Customer Personal Data subject to the UK GDPR is transferred to us, the UK Addendum is incorporated into this DPA by reference. The information required by Tables 1 to 3 of the UK Addendum is set out in this DPA and its Annexes. For Table 4, either party may end the UK Addendum as set out in its Section 19.

7.4 Where Customer Personal Data subject to the New Zealand Privacy Act 2020 or POPIA is transferred to us, we will protect it in a way that, overall, provides comparable safeguards to those laws.

7.5 If there is any conflict between this DPA and the SCCs or UK Addendum, the SCCs or UK Addendum prevail.

8. Liability and term

8.1 Each party’s liability under this DPA is subject to the limitations of liability in the Terms, except where Data Protection Laws or the SCCs prohibit this.

8.2 This DPA continues for as long as we process Customer Personal Data under the Terms.

Annex 1 – Details of processing

Annex 2 – Security measures

• Encryption of data in transit using TLS.
• Hosting on Amazon Web Services, which maintains industry-recognised certifications (such as ISO 27001 and SOC 2) for its physical and infrastructure security.
• Logical separation of each customer’s data.
• Role-based access controls in the application, with administrator control over Invited Users.
• Staff access to production systems and Customer Personal Data restricted on a need-to-know basis.
• Daily backups, stored in the same AWS region.
• Monitoring and logging of system activity, and a security incident response process.
• Confidentiality obligations for all staff and contractors.

Annex 3 – Sub-processors

When you connect a Third-Party Service (for example Shopify, Xero or ServiceM8), you instruct us to exchange data with that service. Third-Party Services are your own providers and are not our Sub-processors.