Data Processing Agreement

Parties

1. Background

1.1 The Customer wishes to use the ChatNexus platform to create and deploy AI agents that will process personal information on behalf of the Customer.

1.2 The nature of the Customer's use case involves one or more of the following (tick all that apply):

•   Health data or medical information
•   Tenant histories or tenancy screening data
•   Financial credentials or bank/card numbers
•   Processing by an entity subject to privacy regulation (health provider, government contractor, tenancy DB operator, or similar)
•   Other (describe):  

1.3 This Agreement sets out the terms on which the Provider will process personal information on behalf of the Customer.

2. Definitions

3. Customer Obligations (Controller)

3.1 The Customer warrants that:

• It has a lawful basis under the Australian Privacy Act 1988 (and any other applicable law) to collect and process the personal information it intends to submit to the Platform.
• It has provided appropriate privacy notices to end-users and obtained all necessary consents before submitting personal information to the Platform.
• It has disclosed in its own privacy policy that ChatNexus and the applicable LLM provider(s) act as data processors for the Customer.
• The use case described in clause 1.2 is accurate and complete. The Customer will notify the Provider promptly if the use case changes materially.

3.2 The Customer indemnifies the Provider against any claim, loss, liability, or expense arising from the Customer's failure to comply with clause 3.1.

4. Provider Obligations (Processor)

5. Sub-processors

5.1 The Customer authorises the Provider to engage the Sub-processors listed in Schedule 1.

5.2 The Provider will flow down equivalent data protection obligations to each Sub-processor.

6. International Transfers

6.1 Personal information may be transferred to and processed in the United States by the Sub-processors listed in Schedule 1.

6.2 The Provider maintains contractual safeguards (standard contractual clauses or equivalent measures) with each Sub-processor.

7. Security Incidents

7.1 The Provider will notify the Customer without undue delay (and within 72 hours where feasible) after becoming aware of a Security Incident involving the Customer's personal information.

7.2 The notification will include, to the extent known at the time:

• The nature of the Security Incident
• Categories and approximate number of individuals and records affected
• Likely consequences of the incident
• Measures taken or proposed to address the incident

7.3 The Customer remains responsible for its own breach notification obligations to affected individuals and the Office of the Australian Information Commissioner (OAIC).

8. Data Retention and Deletion

8.1 The Provider retains personal information for as long as the Customer's account is active or as needed to provide the service.

8.2 Upon the Customer's written request, the Provider will delete primary account data within 30 days. Backups containing deleted data are purged within 90 days.

8.3 Billing records are retained for up to 7 years as required by Australian tax law.

9. Audit Rights

9.1 The Provider maintains an immutable audit log of compliance events (questionnaire submissions, consent records, blocked submissions, and DPA clearances).

9.2 The Customer may request a summary of audit events relating to its account by contacting support@chatnexus.cloud. The Provider will respond within 14 days.

10. Liability

10.1 The Provider's liability under this Agreement is limited to the amount paid by the Customer in the 12 months preceding the event giving rise to the claim.

10.2 Nothing in this Agreement excludes liability for fraud or death/personal injury caused by negligence.

11. Term and Termination

11.1 This Agreement commences on the date of signing and continues until the Customer's subscription to ChatNexus is terminated.

11.2 Either party may terminate this Agreement with 30 days' written notice.

11.3 Termination does not affect accrued rights or obligations.

12. Governing Law

This Agreement is governed by the laws of New South Wales, Australia.

Schedule 1 - Approved Sub-processors