Data Processing Terms

These terms form part of our agreement with each customer under our Service Terms. They apply whenever Montra Digital Pty Ltd (ABN 81 698 077 235) ('Montra') handles personal information on a customer's behalf ('Customer Personal Information') in software or websites we host or support. A signed data processing agreement with a customer prevails over these terms.

1. Roles

The customer controls Customer Personal Information and decides why and how it is collected and used. Montra handles it as the customer's service provider. The customer is responsible for having a lawful basis, privacy notices and any consents needed for the information it puts into our systems.

2. How we handle Customer Personal Information

• We use it only to provide, secure, back up and support the services, on the customer's documented instructions (including the way the customer configures and uses the software), or where the law requires it.
• We do not sell it, use it for our own marketing, or use it to train AI models.
• We comply with the Australian Privacy Principles in handling it, as if we were bound by them, regardless of any exemption that may apply to us.
• We limit access to Montra personnel who need it to provide or support the service. They are bound by confidentiality. We do not browse customer data; we access it only to provide support the customer asks for, to fix a fault, to investigate a security incident, or as the law requires.

3. Where data is stored

We host Customer Personal Information in Australia, in Amazon Web Services' Sydney region (ap-southeast-2), including backups. Some supporting services, such as our content delivery network and web application firewall, process limited technical data (such as IP addresses) outside Australia. Our sub-processors page lists these.

Where software is installed in a customer's own cloud environment (for example, its Microsoft 365 tenant), the data stays in that environment, and the customer's agreement with that provider governs where it is stored.

4. Security

We maintain reasonable technical and organisational security measures, described on our security page. These include encryption in transit and at rest, logically separated customer data, access controls with multi-factor sign-in, audit logging, regular backups and prompt application of security updates.

5. Sub-processors

Customers authorise us to use the sub-processors listed on our sub-processors page. We hold each to data protection obligations no less protective than these terms, and remain responsible for them. We will give customers at least 30 days' notice of a new sub-processor that will handle Customer Personal Information. A customer that reasonably objects may end the affected service without penalty before the change takes effect.

6. Data breaches

If we become aware of unauthorised access to, disclosure of or loss of Customer Personal Information, we will tell the customer without undue delay and, where practicable, within 24 hours. We will give the customer the information we have, take reasonable steps to contain the breach, and help the customer assess it and meet its obligations under the Notifiable Data Breaches scheme. Unless the law requires otherwise, the customer decides whether and how to notify affected individuals and the OAIC.

7. Helping customers with requests

If an individual asks us directly to access, correct or delete Customer Personal Information, we will refer them to the customer. We will give the customer reasonable help to respond to such requests, and to regulator enquiries, using the features of the software where possible.

8. Return and deletion

When a service ends, we will provide an export of Customer Personal Information on request for 30 days, as set out in the Service Terms, and then delete it from live systems. Copies in backups are deleted as those backups expire on their normal cycle. Until then they stay protected by these terms. We keep data longer only if the law requires it.

9. Audit

On reasonable written request, and no more than once a year (unless after a breach or a regulator asks), we will answer a customer's reasonable security questionnaire and provide information needed to show we comply with these terms. This does not extend to information about other customers or that would compromise our security.

10. Contact

Privacy and data protection contact: consulting@montra.com.au