Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the TradeOps Terms where TradeOps processes personal information contained in Customer Data for a subscribing business. It does not reduce obligations that law independently imposes on either party.

The Customer determines why its customer/worker/business data is entered into TradeOps and is responsible for the lawfulness of that collection and its instructions. TradeOps processes Customer Data to provide, secure and support the service, on documented product/configuration instructions, and as otherwise required by law. TradeOps may refuse or suspend an instruction that it reasonably believes would require unlawful processing or create a material security risk, while taking reasonable steps to notify the Customer where lawful and practicable.

TradeOps will restrict Customer Data access to authorised personnel and service providers who need access for service delivery, security, support or legal compliance and are subject to appropriate confidentiality obligations.

• Tenant-scoped access controls and role/permission checks.
• MFA requirements for privileged and sensitive operations.
• Server-only credentials and secret handling for provider integrations.
• Audit logging, reconciliation controls, idempotency and stale-write/concurrency protection for material workflows.
• Private or signed access patterns for files and customer portals.
• Reasonable backup/recovery, incident response and vulnerability/dependency management processes.

The Customer authorises TradeOps to use subprocessors reasonably necessary to provide the service. TradeOps will use contractual or other legally appropriate measures to require subprocessors handling Customer Data to protect it consistently with the role they perform, including confidentiality and security obligations where applicable. TradeOps remains responsible for selecting and managing subprocessors to the extent required by applicable law and contracts. Current categories are described in the Subprocessor & Provider List. Material provider changes will be disclosed where reasonably practicable.

Customer Data may be processed in Australia, the United States and other jurisdictions where approved providers or Customer-selected integrations operate. Where APP 8 or another applicable cross-border rule applies to TradeOps, TradeOps will take reasonable steps required by that law.

TradeOps will investigate confirmed security incidents affecting Customer Data and will notify the affected Customer without undue delay where notification is reasonably required to allow the parties to meet legal obligations or mitigate material harm. A notice is not an admission of fault or liability. Where the Australian NDB scheme applies to TradeOps, statutory assessment and notification duties apply independently of this DPA.

Where reasonably possible, TradeOps will assist the Customer with technically appropriate access, correction, export or deletion requests relating to Customer Data. If TradeOps receives a request primarily concerning a Customer's data, TradeOps may direct the person to that Customer unless law requires TradeOps to respond directly.

TradeOps provides data export capabilities. Following termination and subject to applicable retention requirements, TradeOps will delete, de-identify or place Customer Data beyond ordinary use in accordance with its retention practices. Backup deletion may occur on normal backup rotation rather than instant physical erasure.

On reasonable request, TradeOps may provide available security, architecture, policy or provider information reasonably necessary for a Customer's due diligence. This DPA does not grant unrestricted access to systems, source code, other tenants' information or information that would weaken security.

If AI features are enabled, relevant Customer Data may be sent to configured AI providers solely to perform the requested feature and related safety/abuse monitoring permitted by provider terms. TradeOps will not intentionally opt Customer API data into general model training without clear authorisation.

TradeOps will not sell Customer Data as a data-broker product or use Customer Data to build unrelated third-party advertising profiles. TradeOps may use service telemetry and information that has been aggregated or de-identified so it is no longer personal information, where reasonably practicable, to secure, operate and improve the service.