Data Processing Agreement (DPA)

1. Definitions and Parties

This Data Processing Agreement ("DPA") is entered into between the Client (the "Controller") and Klepticelyx Pty Ltd, represented by Director Oliver Wood, located at 412 Crown Street, Sydney NSW 2010 (the "Processor").

The Processor agrees to process personal data only on behalf of the Controller and in accordance with the instructions provided in the service agreement, adhering to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Subject Matter and Duration

The subject of this processing is the management of client information necessary for the execution of custom bookbinding, restoration, and production services. This agreement remains in effect for the duration of the business relationship and continues until all data is deleted according to the rules specified in Section 8.

3. Scope of Processing

The categories of data processed include contact details, delivery addresses, and specific content provided for binding (e.g., manuscripts, corporate reports). Data subjects are typically employees or representatives of the B2B Controller.

Processing is limited to the purpose of order fulfillment, invoicing, and communication regarding the production process.

4. Obligations of the Processor

Klepticelyx Pty Ltd undertakes to:

• Process data only on documented instructions from the Controller.
• Ensure that personnel authorised to process the data have committed themselves to confidentiality.
• Assist the Controller in meeting their obligations under the Privacy Act 1988 (Cth).
• Adhere to the terms of service as outlined in our Terms and Conditions.

5. Sub-processors

The Processor engages the following trusted sub-processors to ensure service delivery:

• Micron 21 Pty Ltd: Hosting provider located at Unit 2, 7 Eastspur Court, Kilsyth South VIC 3137.
• FormSubmit: Third-party service used for processing contact enquiries (data transferred to the USA).

The Processor ensures that sub-processors provide guarantees sufficient to implement appropriate technical and organisational measures in accordance with APP 8.

6. Security Measures

The Processor implements technical and organisational measures to protect data against unauthorised access or loss. This includes encrypted communication, secure server environments provided by Micron 21, and restricted physical access to the workshop at 412 Crown Street.

7. Incident Notification

In the event of a data breach, the Processor will notify the Controller without undue delay. The Processor will cooperate with the Controller in notifying the Office of the Australian Information Commissioner (OAIC) if required by the Notifiable Data Breaches scheme.

8. Return and Deletion of Data

Upon termination of the service or at the written request of the Controller, the Processor shall return or delete all personal data. In accordance with our business rules, completed orders and related data are stored for 30 days after delivery to facilitate final adjustments before permanent deletion, unless statutory retention periods apply.

9. Audit and Compliance

The Controller has the right to request information regarding the Processor's data handling practices to verify compliance with this DPA. The Processor shall provide necessary documentation upon reasonable notice.

10. Final Provisions

This DPA is governed by the laws of New South Wales. Any disputes arising from this agreement shall be subject to the exclusive jurisdiction of the courts in Sydney.

For enquiries, please contact: [email protected] or call (02) 8351 4894.

For further information on our general data handling, please see our Privacy Policy.