Data Processing Addendum

Effective date: 19 October 2026 Version: 1.0

This Data Processing Addendum (the "Addendum") is between [[LEGAL_ENTITY_NAME]] (ABN [[ABN]]) ("AtmoJob", "we", "us", "our") and the business that subscribes to AtmoJob (the "Business", "you", "your"). It forms part of our Terms of Service (the "Terms"). It sets out how we handle personal information that we process for the Business when we provide the Service. It should be read with our Privacy Policy.

1. How this Addendum applies

1.1 This Addendum applies automatically when you accept the Terms or use the Service. You do not need to sign it.

1.2 If you want a signed copy for your records, email [email protected] A signed copy has the same terms as this page.

1.3 This Addendum applies only to Customer Personal Data (defined in section 2). It does not apply to personal information for which we are responsible, such as the details used to set up and pay for your Account, our own marketing, and usage and diagnostic data. Our Privacy Policy covers that information.

1.4 Words that start with a capital letter and are not defined here have the meaning they have in the Terms.

2. Definitions

APPs means the Australian Privacy Principles in the Privacy Act.
Customer Personal Data means personal information in Your Data that we process for the Business when we provide the Service. Annex A describes it.
Data Breach means unauthorised access to, unauthorised disclosure of, or loss of Customer Personal Data while we or our Subprocessors hold it.
Data Subject means the individual that Customer Personal Data is about.
GDPR means the EU General Data Protection Regulation (Regulation (EU) 2016/679), and UK GDPR means the GDPR as it applies in the United Kingdom.
NDB scheme means the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.
Privacy Act means the Privacy Act 1988 (Cth).
Privacy Laws means the Privacy Act and the APPs, and any other privacy or data protection law that applies to the processing of Customer Personal Data, such as the Privacy Act 2020 (NZ), the GDPR and the UK GDPR.
Process means any operation on personal information, such as collecting, recording, storing, using, changing, disclosing or deleting it.
Standard Contractual Clauses or SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (UK).
Subprocessor means a third party that we engage to process Customer Personal Data.

Where the GDPR or UK GDPR applies, "controller", "processor", "personal data" and "personal data breach" have the meaning they have in that law. "Personal information" includes "personal data".

3. Roles

3.1 The Business decides why and how Customer Personal Data is collected and used. The Business is the controller of Customer Personal Data. In Australian terms, it is information that the Business collects and holds for its own business.

3.2 We process Customer Personal Data for the Business, as its service provider. We are a processor of Customer Personal Data.

3.3 The Business is responsible for:

having a lawful basis, and giving the notices and getting the consents, that Privacy Laws require for Customer Personal Data, including the notices to Workers and End Customers in section 8 of the Terms;
the accuracy of Customer Personal Data, and the questions it asks on its forms;
making sure that its instructions to us comply with Privacy Laws;
not putting into the Service the data that section 6.5 of the Terms does not allow.

3.4 We will process Customer Personal Data in a way that is consistent with the APPs and with the Privacy Laws that apply to us as a processor.

4. Processing only on your instructions

4.1 We process Customer Personal Data only on the Business's documented instructions. The Business gives its instructions through:

the Terms and this Addendum;
the way the Business and its Authorised Users set up and use the Service, including the settings and integrations they turn on;
any other written instructions that we agree with the Business.

4.2 We will tell the Business if we think an instruction breaks a Privacy Law. We do not have to follow that instruction until the Business confirms or changes it.

4.3 If a law requires us to process Customer Personal Data in a way that is not on the Business's instructions, we will tell the Business before we do so, unless the law does not allow us to tell it.

4.4 We do not:

sell Customer Personal Data;
use Customer Personal Data for advertising or for our own marketing;
send Customer Personal Data to a third-party artificial intelligence provider, or use it to train AI models.

4.5 We may create statistics that are aggregated or de-identified so that they do not identify the Business, its Authorised Users or its End Customers, as section 7.3 of the Terms allows.

5. Confidentiality of our staff

5.1 We give access to Customer Personal Data only to staff and contractors who need it to provide, support or secure the Service.

5.2 Each of them is bound to keep Customer Personal Data confidential, by contract or by law.

5.3 AtmoJob staff do not look at Customer Personal Data except to give support, keep the Service secure, deal with reports of abuse, or comply with the law.

6. Security

6.1 We use reasonable technical and organisational measures to protect Customer Personal Data against misuse, interference, loss, and unauthorised access, change or disclosure. These measures take into account the nature of the data and the risks of the processing.

6.2 Annex B lists the measures we use today. We may change them over time, but we will not make a change that materially reduces the protection of Customer Personal Data.

6.3 Many measures are settings that the Business controls, such as roles, sign-in rules, two-step sign-in and remote wipe. The Business is responsible for choosing settings that suit its risks, and for the security of its own devices and login details.

6.4 No system is completely secure. We do not promise that a Data Breach can never happen.

7. Subprocessors

7.1 General authorisation. The Business gives us a general authorisation to use Subprocessors. Annex C lists the Subprocessors we use today, what they do, what they receive, and where they are. The same list is in section 9 of our Privacy Policy.

7.2 Notice of changes. We will give the Business at least [[SUBPROCESSOR_NOTICE_DAYS]] days' notice before we add or replace a Subprocessor that will process Customer Personal Data. We give notice by updating Annex C and the Privacy Policy, and by email or in the Service.

7.3 Right to object. The Business may object to a new Subprocessor on reasonable grounds about data protection, by email to [[PRIVACY_CONTACT_EMAIL]] within the notice period. We will discuss the objection in good faith and try to find a solution. If we cannot resolve a reasonable objection, the Business may end its subscription before the change applies, and we will refund prepaid Fees for the unused period.

7.4 Flow-down. We will have a written contract with each Subprocessor, which can be its standard terms or data protection agreement. That contract will require the Subprocessor to protect Customer Personal Data to a standard at least equal to this Addendum, and to use it only to provide its service to us.

7.5 Our responsibility. We remain responsible to the Business for the work of our Subprocessors, under this Addendum and the Terms.

7.6 Services the Business chooses. When the Business connects another service, such as its own Stripe account or its advertising accounts, that service is not our Subprocessor. It handles the data under the Business's agreement with it, as section 10 of the Terms says.

8. Data outside Australia

8.1 Our main database, file storage, sign-in service and sync service run on servers we manage in Australia ([[HOSTING_CITY]]).

8.2 Some Subprocessors are in the United States or operate global networks. Annex C shows where each one is. This means Customer Personal Data may be sent to, stored in or accessed from those countries.

8.3 Australian law (APP 8). Before we disclose Customer Personal Data to a Subprocessor outside Australia, we take reasonable steps to make sure that it handles the data in a way that is consistent with the APPs. We do this through the contracts in section 7.4. The Business must tell its Workers and End Customers in its own privacy notice that their information may be stored or processed outside Australia, as section 8.3.1 of the Terms requires.

8.4 EU data. Where the GDPR applies to the Business's processing and Customer Personal Data is transferred to us in Australia, the SCCs are incorporated into this Addendum by reference, as follows:

Module 2 (controller to processor) applies, with the Business as data exporter and AtmoJob as data importer;
in Clause 7, the docking clause does not apply;
in Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 7.2;
in Clause 11, the optional wording does not apply;
in Clause 13, the competent supervisory authority is the one that Clause 13(a) points to for the Business;
in Clauses 17 and 18, the law and the courts are those of Ireland;
Annex I of the SCCs is completed by section 1 of this Addendum and Annex A, Annex II by Annex B, and Annex III by Annex C.

8.5 UK data. Where the UK GDPR applies, the UK Addendum is incorporated into this Addendum by reference. It amends the SCCs as set out in section 8.4. The tables in Part 1 of the UK Addendum are completed with the details in this Addendum and its Annexes. Either party may end the UK Addendum as its section 19 allows.

8.6 Onward transfers. When a Subprocessor processes EU or UK Customer Personal Data in a country without an adequacy decision, we will put in place a transfer method that the GDPR or UK GDPR allows, such as the SCCs.

8.7 If the SCCs or the UK Addendum conflict with this Addendum or the Terms, the SCCs or the UK Addendum apply.

9. Help with requests and assessments

9.1 Requests from individuals. Many requests can be handled by the Business directly in the Service, for example by correcting or deleting a record, or by exporting data. Where the Business cannot do this itself, we will give reasonable help so that it can respond to a Data Subject who asks to access, correct, delete, restrict, transfer or object to the use of their information.

9.2 If we receive a request directly from a Data Subject about Customer Personal Data, we will pass it to the Business without undue delay. We will not answer the request ourselves, except to tell the person that we have passed it on, unless the Business asks us to or the law requires it.

9.3 Assessments and regulators. We will give the Business reasonable information and help with:

privacy impact assessments and data protection impact assessments about its use of the Service;
consultation with a privacy regulator that is about our processing of Customer Personal Data;
its own obligations to keep Customer Personal Data secure.

9.4 We may charge a reasonable fee for help under this section that takes a lot of time, if we tell the Business first. We will not charge where the help is needed because we breached this Addendum.

10. Data breaches

10.1 Notice to the Business. If we become aware of a Data Breach, we will tell the Business without undue delay, and in any case within 48 hours after we become aware of it. We will send the notice to the email address of the owner or admins on the Account.

10.2 What we will tell the Business. As far as we know it at the time, we will describe:

what happened, and when;
the kinds of Customer Personal Data involved, and about how many people and records;
the likely effects for the people involved;
what we have done, and will do, to contain the breach and reduce harm;
a contact person for more information.

If we do not know all of this at first, we will give the rest as we learn it.

10.3 Notifiable Data Breaches scheme. We will work with the Business so that each of us meets the NDB scheme. We will give the Business the information it needs to assess whether the breach is an eligible data breach within the 30 days the scheme allows. If the breach is an eligible data breach, we will agree with the Business which of us will notify the Office of the Australian Information Commissioner (OAIC) and the people affected. Unless we agree otherwise, the Business will notify, and we will help it. The same applies to a notifiable privacy breach under the Privacy Act 2020 (NZ), and to a personal data breach under the GDPR or UK GDPR.

10.4 We will take reasonable steps to contain the breach, find its cause and stop it from happening again.

10.5 We will not tell a regulator or the people affected about a Data Breach that involves Customer Personal Data without first talking to the Business, unless the law requires us to.

10.6 Our notice of a Data Breach is not an admission of fault or liability.

10.7 We will not charge the Business for help under this section where the breach was caused by us or our Subprocessors.

11. Return and deletion at the end

11.1 Export. The Business can export Your Data at any time from the web app at Settings > Business > Advanced > Data export. After the agreement ends, the Business can still sign in and export Your Data for [[EXPORT_WINDOW_DAYS]] days.

11.2 Deletion. After that export window, we delete Customer Personal Data, as section 19.3 of the Terms sets out. If the owner deletes the business Account, deletion starts after the 30-day waiting period in section 19.3 of the Terms.

11.3 Backups. Copies in our backups are overwritten as backups roll over, within about 9 weeks. Until then, we keep them secure and do not use them except to recover from a disaster.

11.4 What we may keep. We may keep data that a law requires us to keep, only for as long as it requires, and we will keep it confidential and secure. We also keep a record that a Business was deleted, with no names or email addresses, to show that the deletion happened.

11.5 If the Business asks, we will confirm in writing that we have deleted Customer Personal Data.

12. Information and audits

12.1 Information first. We will give the Business the information it reasonably needs to show that we meet this Addendum. This includes this Addendum, our Security and data controls page, and written answers to a reasonable security questionnaire.

12.2 Audits. If the information in section 12.1 is not enough to answer a reasonable question, or if a regulator requires it, the Business may audit our compliance with this Addendum. An audit:

needs at least 30 days' written notice, unless it follows a Data Breach or is required by a regulator;
takes place no more than once in any 12-month period, unless it follows a Data Breach or is required by a regulator;
happens during business hours, under an audit plan that we agree in advance, and in a way that does not disrupt the Service;
can be done by the Business or by an independent auditor it appoints, who must agree to keep our information confidential;
does not give access to other customers' data, to our Subprocessors' facilities, or to information that would put the security of the Service at risk.

12.3 The Business pays its own costs of an audit, and our reasonable costs for staff time, unless the audit shows that we materially breached this Addendum.

12.4 The Business will give us a copy of the audit report, and will keep its results confidential.

13. Liability

13.1 Each party's liability under or in connection with this Addendum is subject to the limits and exclusions in section 16 of the Terms. This Addendum does not create a separate liability cap.

13.2 Nothing in this section limits a party's liability to a Data Subject under the SCCs or the UK Addendum, where those clauses do not allow it.

14. Term, changes and order of precedence

14.1 This Addendum continues while we process Customer Personal Data for the Business, including during the export window and until deletion under section 11.

14.2 We may change this Addendum in the same way as section 20 of the Terms allows us to change the Terms. We will not make a change that materially reduces the protection of Customer Personal Data, unless a law requires it.

14.3 If there is a conflict about the processing of Customer Personal Data, the documents apply in this order:

the SCCs and the UK Addendum, where they apply;
this Addendum;
the Terms.

14.4 This Addendum is governed by the law of [[GOVERNING_STATE]], Australia, as section 22.1 of the Terms provides. Section 22.2 of the Terms (disputes) also applies. This does not change what the SCCs or the UK Addendum say about their own governing law and courts.

15. Contact us

[[LEGAL_ENTITY_NAME]] (ABN [[ABN]]) [[REGISTERED_ADDRESS]] Privacy and this Addendum: [[PRIVACY_CONTACT_EMAIL]] Security and data breaches: [[SECURITY_CONTACT_EMAIL]]

Annex A - Details of the processing

Subject matter. The processing of Customer Personal Data to provide the Service to the Business under the Terms.

Duration. For the term of the Business's subscription, then the export window of [[EXPORT_WINDOW_DAYS]] days, then until deletion under section 11 (with backups overwritten within about 9 weeks).

Nature of the processing. Collecting, recording, storing, syncing to phones, organising, displaying, changing, sending and deleting data, as the Business uses the Service. This includes:

storing and syncing jobs, clients, sites, forms, quotes, invoices, schedules, chat and files;
recording a Worker's location while on duty, when a Worker takes a job photo, and when a Worker starts or stops a job timer;
sending emails and SMS for the Business, such as invoices, receipts and reminders, and recording when an email is opened or a link is clicked;
receiving enquiries through the Business's lead and enquiry forms;
taking online invoice payments through Stripe, to the Business's own Stripe account;
sending notifications to Authorised Users;
backing up, securing and supporting the Service.

Purpose. To provide, secure and support the Service for the Business, and to do what the Business and its Authorised Users ask the Service to do.

Frequency. Continuous, while the Business uses the Service.

Categories of Data Subjects.

The Business's staff and contractors who use the Service (Authorised Users, including Workers).
The Business's clients and their contacts, including site contacts.
People who send an enquiry to the Business through its lead or enquiry forms.
People who view a quote or invoice, or pay an invoice, in the customer portal.
Other people named or shown in Your Data, for example in job notes, photos or videos.

Categories of personal information.

Data Subjects: Authorised Users; Personal information: Name, email address, phone number, job title, time zone, username, a hashed sign-in PIN, trade licence numbers they add, role, sign-in and session records, device information, chat messages, time entries and leave
Data Subjects: Workers (location); Personal information: GPS position, its accuracy, the time and on-duty status, recorded while on duty; the position where a job photo was taken; the position where a job timer was started or stopped
Data Subjects: Clients and contacts; Personal information: Name, email address, phone number, street address and site details; job notes, checklists and forms; quotes, invoices and payment status; actions in the customer portal, such as accepting a quote; email open and click records, with a hashed IP address
Data Subjects: Enquirers; Personal information: Answers on the form, how they arrived at the form, their IP address (deleted after 30 days), a hashed IP address, and browser type
Data Subjects: Anyone in job records; Personal information: Photos and videos (including the sound recorded with a video), documents, and signatures captured on forms

Sensitive information. The Service is not designed for sensitive information, such as health information. The Business must not put it into the Service beyond what its trade work truly needs and the law allows (see section 6.5 of the Terms).

Retention. As set out in section 11 of our Privacy Policy. For example, on-duty location history is deleted after 90 days, and the IP address from an enquiry form is deleted after 30 days.

Annex B - Security measures

Where data is kept

Our main database, file storage, sign-in service and sync service run on servers we manage in Australia.
All traffic to and from the Service passes through Cloudflare's network for security.

Data in transit

Every connection between a browser or phone and our network uses HTTPS (TLS).
The mobile app refuses connections that are not secure.

Data on phones

The mobile app's database on the phone is encrypted with SQLCipher and a 256-bit key made on the phone.
There is a separate key for each person in each workspace.
The key is kept in the iPhone Keychain or the Android Keystore, not in the database file, and is left out of phone backups and device transfer.
This covers the app's database only. We do not claim that photos, videos or downloaded files on the phone are encrypted.

Lost and unused phones

An admin can remotely wipe AtmoJob data from a phone from the web app. The wipe deletes that workspace's data and destroys its key when the phone next connects.
A wiped phone stays locked out until an admin reactivates it.
A wipe log records who asked for each wipe, when, and the result.
The Business can turn on an automatic wipe for phones that do not connect for 30 days or more.
The Business can limit how many phones each person uses.

Access control

Access by role, with 9 roles, so each person sees only what their role needs.
Sign-in methods set per role: email and password, username and PIN, or a one-time code by SMS. PINs are stored only as a hash.
Two-step sign-in with an authenticator app and backup codes, which a Business can require per role.
Session length set per role.
SAML single sign-on and SCIM user sync with the Business's identity provider.
Admins can cut a person's access at once when they leave.
Access to our production systems is limited to the staff who need it.

Records

A wipe log, group history, an email log, a webhook delivery log, and a log of the changes made to each job.

Limiting data

The mobile app records location only while a Worker is on duty, when they take a job photo, and when they start or stop a job timer.
On-duty location history is deleted after 90 days.
The IP address of a person who sends an enquiry form is deleted after 30 days. Email open and click records keep a hashed IP address, not the raw address.
Error reports to Sentry do not collect personal details such as IP addresses, and we do not use screen replay.
The model that scores enquiry spam runs on servers we manage, not on an outside AI service.

Webhooks

Each webhook is signed with a secret that the Business can reveal and rotate.
The Service will not send a webhook to a private network address.

Backups and deletion

We back up our database. Backups are kept for about 9 weeks, then overwritten.
Deletion and export work as set out in section 11.

Breaches

We handle Data Breaches as set out in section 10.

Our Security and data controls page has more detail.

Annex C - Subprocessors

Our main database, file storage, sign-in service and sync service run on servers we manage in Australia ([[HOSTING_CITY]]). We use these Subprocessors:

Subprocessor: Cloudflare; What they do for us: Network security, speed and DNS for all our web addresses; What they receive: All traffic to and from the Service passes through its network; Where: Global network (United States company)
Subprocessor: Sentry; What they do for us: Crash and performance reports; What they receive: Technical error details, the Business's ID, and the user ID for server errors; Where: United States
Subprocessor: PostHog; What they do for us: Usage analytics (sent through our own address, p.atmojob.com); What they receive: Usage events, user ID, Business ID and role; Where: United States
Subprocessor: Stripe; What they do for us: Online invoice payments and payment account setup for Businesses; What they receive: Payment details, amount, and the payer's name and email; when we set up a Stripe account for a Business, its email address and country; Where: United States and other countries where Stripe operates
Subprocessor: Google; What they do for us: Address search and map display, map service on Android, turning addresses into map positions, and the barcode reader in the mobile app (Google ML Kit); What they receive: Address search text, map positions, and the IP address of a browser that loads Google Maps; ML Kit may send Google technical usage and performance data about the barcode reader, but never the images; Where: United States and other countries
Subprocessor: Twilio; What they do for us: SMS sign-in codes, invoice SMS and service SMS; What they receive: Phone number and message text; Where: United States
Subprocessor: Slack; What they do for us: Internal alerts to our team about feedback and new sign-ups; What they receive: Feedback text and its technical details with the user ID and the Business's ID; new Business name, subdomain, industry and time zone; Where: United States
Subprocessor: Browser push services (Google, Apple, Mozilla); What they do for us: Delivering chat notifications to a web browser, if the user allows them; What they receive: A push address for the browser and the notification; Where: Depends on the browser's vendor
Subprocessor: Expo (650 Industries); What they do for us: Delivers push notifications to the AtmoJob phone app, through Apple Push Notification service and Google Firebase Cloud Messaging; What they receive: The phone's push token, and the notification title and text (for example the name on a new lead); Where: United States
Subprocessor: Apple (Apple Push Notification service); What they do for us: Delivers push notifications from Expo to iPhones; What they receive: The phone's push token, and the notification title and text; Where: United States and other countries
Subprocessor: Google (Firebase Cloud Messaging); What they do for us: Delivers push notifications from Expo to Android phones; What they receive: The phone's push token, and the notification title and text; Where: United States and other countries
Subprocessor: NSW Government (OneGov API); What they do for us: Checking trade licence numbers; What they receive: The licence number entered; Where: Australia
Subprocessor: Amazon Web Services; What they do for us: Encrypted file storage; What they receive: [[CONFIRM_WHAT_THE_S3_BUCKET_HOLDS]]; Where: Australia (Sydney)

On iPhone, maps are shown by Apple Maps. Text and barcode reading in the mobile app runs on the phone and does not send images to anyone.

We will update this list, with notice under section 7.2, before we add a new Subprocessor that will process Customer Personal Data.