Data Processing Terms

These Data Processing Terms form part of the Terms between Sine and you and apply when we process Personal Data on your behalf in the course of providing the Services. These Data Processing Terms do not apply where we are the Controller. Defined and/or capitalized terms not defined here have the meanings given them in the Terms. If not defined in the Terms, capitalized terms have the meaning given them, or an equivalent term, in applicable data protection, privacy or security laws (“Privacy Laws”).These Data Processing Terms take precedence over any other terms of the Terms in relation to the Processing of Personal Data.

1. Processing.  With respect to the Processing of Personal Data, you act as a Controller, “business”, or Processor and Sine is a Processor or “service provider”. We will only Process Personal Data as permitted under the Terms and applicable Privacy Laws. We will not “sell” Personal Data. You agree that the Terms represents your complete instructions to us and any additional changes you require must be mutually agreed. We will inform you if we believe that any of your instructions violate law, unless prohibited on important grounds of public interest. Details regarding the Processing of Personal Data are specified in Annex 1. You are solely responsible for complying with Privacy Laws regarding the Processing of Personal Data (including obtaining consents) and warrant that you comply with the same. You shall indemnify us, our Affiliates, subcontractors, and licensors from all third-party claims or losses arising from the Processing of Personal Data in accordance with the Terms.

• Subprocessors.  You authorize us to use other Processors, including Sine affiliates and service providers, (“Subprocesors”) in any jurisdiction to Process Personal Data, so long as they are required to abide by terms substantially similar to these Data Processing Terms. We will be liable to you for the performance of our Subprocessor’s obligations under the Terms. On written request, we will provide you with a list of Subprocessors and will notify you of any changes, giving you five business days to object after receipt of the notification. If you legitimately object to a Subprocessor on reasonable data protection grounds and we do not resolve the matter within one month following notification, we may terminate the Terms with respect to the Services impacted by the new Subprocessor, without penalty, upon written notice.

• Security.  We will implement appropriate technical and organizational measures to protect Personal Data, as described in Annex 2 (“Security Measures”). We may update or modify the Security Measures, so long as the overall security level of the Services is maintained. You are solely responsible for determining whether the Security Measures meet your requirements. You agree that the level of security provided by the Security Measures is appropriate to the risk inherent in the Services. You are responsible for configuring the Services in a manner which enables you to comply with applicable Privacy Laws. We will ensure that only authorized personnel who are under written obligations of confidentiality or are under an appropriate statutory obligation of confidentiality may access Personal Data. The Services is not designed to Process Special Categories of Data (except with respect to facial recognition in connection with Face Check and limited health data, where available), cardholder data subject to the Payment Card Industry Security Standard (“PCI DSS”), protected health information under HIPAA, children’s Personal Data, or other Personal Data inappropriate for the nature of the Services (collectively, “Prohibited Data”). You shall not submit Prohibited Data to us or to the Services, unless authorized to do so in writing by Sine.

• Security Incident. We will notify you without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorized access, disclosure or use of Personal Data while processed by us (each a “Security Incident”) in relation to the Services under the Terms. We will investigate the Security Incident and provide you with relevant information about the Security Incident as required under Privacy Laws.  We will use reasonable efforts to assist you in mitigating, where possible, the adverse effects of any Security Incident.

• Compliance. On written request and subject to obligations of confidentiality, we will provide to you information reasonably necessary, including relevant certifications, to demonstrate our compliance with these Data Processing Terms. Where required by applicable Privacy Laws, you (or an independent auditor mandated by you) may audit our compliance with such obligations once per year at the applicable facility ("Audits"). Audits will only be performed following your written request at least ninety (90) days prior to the proposed start date and you providing a reasonably detailed audit plan describing the proposed scope, start date and duration. Before the Audit, the Parties will agree on a final Audit plan. Audits will be conducted during Sine's regular business hours, subject to the published policies of the audited facility, and may not unreasonably interfere with business activities. The personnel conducting the Audit on your behalf or an independent auditor mandated by you must enter into an appropriate written confidentiality agreement acceptable to us prior to conducting the Audit and will be accompanied by at least one member of our staff at all times. To preserve the security of the Sine organization and our customers, we reserve the right to not share information that could expose or compromise its security, privacy, employment policies or obligations to other customers or third parties or share confidential information. Records may not be copied or removed from our facilities. You will generate and provide us with an audit report within three months after the Audit. All information obtained or generated in connection with an Audit, including audit reports, must be kept strictly confidential and may only be used for the purposes of confirming our compliance with its obligations under these Data Processing Terms. Customer will pay or reimburse our reasonable costs for allowing for and contributing to Audits. With respect to Subprocessors, we may fulfil our responsibilities under this Section 5 by providing you with audit reports or certifications provided by such Subprocessors.

• Data Transfers. You authorize us and our Subprocessors to transfer Personal Data to locations outside of its country of origin for the performance of the Terms, provided that we implement appropriate transfer safeguards to comply with applicable Privacy Laws. If we transfer Personal Data from the European Economic Area (“EEA”), UK, Switzerland or from any other jurisdiction that restricts the cross-border transfer of Personal Data to locations outside that jurisdiction, you shall be bound by the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 including the provisions in Modules 2 and 3, as applicable, (“SCCs”) in the capacity of “data exporter”, and Sine in the capacity of “data importer” as those terms are defined therein. The SCCs will be deemed to have been signed by each Party and are hereby incorporated by reference into the Terms in their entirety as if set out in full as an annex to these Terms. The Parties acknowledge that the information required to be provided in the appendices to the SCCs is set out in Annex 1 below as a “Description of the Transfer” and “Security Measures” as a “Description of the Technical Organizational Measures” in Annex 2. Audits under Section 8.9 of the SCCs shall be carried out in accordance with the above Section 5. The SCCs will prevail over these Data Processing Terms or the Terms, in the event of conflict.

• Cooperation. We will cooperate with you to respond to requests, complaints or inquiries from data subjects, supervisory authorities, or other third parties, conduct a privacy impact assessment and prior consultation with supervisory authorities, provided that you reimburse us for all reasonably incurred costs. If we receive a data subject request relating to Personal Data, we will provide it to you. We will not respond to the data subject request unless required by applicable law.

• Termination. Upon termination of the Terms, we will return, delete or anonymize Personal Data except to the extent (i) we are required by applicable law to retain Personal Data or (ii) for compliance, audit or security purposes, in which case these Data Processing Terms will continue to apply to the retained Personal Data. Any certification of deletion will be provided to you only upon your written request.

Last Updated 4 November 2021; Version 1

ANNEX 1

DESCRIPTION OF THE PROCESSING AND TRANSFER

(MODULE 2: CONTROLLER TO PROCESSOR)

A. LIST OF THE PARTIES
Controller / Data Exporter	You and your Affiliates, as set forth in the Terms.
Processor / Data Importer	Name: Sine Group Pty Ltd A.C.N. 167 296 219. Address: 100 Pirie Street, Adelaide, South Australia 5000 Contact: Privacy Officer Email: [email protected]
B. DETAILS OF PROCESSING/TRANSFER
CATEGORIES OF DATA SUBJECTS	The Personal Data processed and transferred is determined and controlled by you in your sole discretion and may include, without limitation, the following categories of Data Subjects: (i) employees, contractors and temporary workers (current, former, prospective) of data exporter; (ii) channel partners, distributors, sales partners, and business partners (iii) advisors, trainers, consultants, service providers and other third parties; (iv) Users of the Services; (v) any other data subject as described in the Terms.
CATEGORIES OF PERSONAL DATA	The Personal Data processed and transferred is determined and controlled by you in your sole discretion and may include, without limitation, the following categories of data: name, email address, job title, country of residence, mobile phone number, username, password, security question, IP addresses, unique identification numbers and signatures, voice, video and data recordings, location data, and device identification (e.g., UUID, IMEI-number, SIM card number, MAC address).
SPECIAL CATEGORIES OF DATA	The Services is not intended for the Processing of Special Categories of Data or Prohibited Data, and you shall not transfer, directly or indirectly to us, except with respect to facial recognition in connection with Face Check and limited health data, where applicable.
1. FREQUENCY	The Personal Data transfers under the Terms will take place on a continuous basis.
2. NATURE OF THE PROCESSING	Sine and its Subprocessors are providing the Services or fulfilling contractual obligations to you, as described in the Terms. These Services may include the processing of Personal Data by Sine and/or its Subprocessors.
PURPOSE OF PROCESSING / TRANSFER	Your Personal Data is processed and transfer is made for the following purposes: (i) providing the Services and facilitating communication with customers, employees and Users; (ii) administration and management of channel partners, distributors and/or sales partners; (iii) identity management and security; (iv) managing product and service development, improving existing and developing new products and services, research and development; (v) research; (v) any other scope and purpose as described in the Terms.
RETENTION	Your Personal Data will be retained in accordance with the Terms unless applicable law requires storage of the Personal Data for a longer period.
TRANSFER TO SUBPROCESSORS	Sine may process and transfer Personal Data to Subprocessors in relation to the performance of the Terms and in accordance with the following scope: Subject Matter : The subject matter of the processing under the Terms is the Personal Data. Nature of the processing : Sine and its Subprocessors are providing services or fulfilling contractual obligations to you, as described in the Terms. These services may include the processing of Personal Data by Sine and/or its Subprocessors. Duration : The duration of the processing under the Terms is determined by you and as set forth in the Terms.
C. COMPETENT SUPERVISORY AUTHORITY
For the purposes of Clause 13 of the SCCs, the competent supervisory authority for the Customer shall be the supervisory authority applicable to the Customer in its EEA country of establishment or, where it is not established in the EEA, in the EEA country where its representative has been appointed pursuant to Article 27(1) of Regulation (EU) 2016/679.
D. GOVERNING LAW AND CHOICE OF FORUM
GOVERNING LAW	For the purposes of Clause 17 of the SCCs, the parties select the law of Ireland.
CHOICE OF FORUM	For the purposes of Clause 18 of the SCCs, the parties agree that the courts of Ireland will have jurisdiction.
E. OTHER
Where the SCCs identify optional provisions or provisions with multiple options the following will apply:	For Clause 7 (Docking Clause), the optional provision will apply.
	For Clause 9(a), option 2 will apply. The parties will follow the process agreed in Section 2 (Subprocessors).
	For Clause 11(a) (Redress), the optional provision will not apply.
	For Clause 12 (Liability), the limitation of liability in the Terms applies to these Data Processing Terms.

ANNEX 2

SECURITY MEASURES

This Annex 2 describes the Security Measures designed to protect and secure our SaaS Services when we Process Personal Data under the Terms. We may update or modify the Security Measures from time to time provided that such updates and modifications do not result in a material degradation of the overall security of the Services provided under the Terms. Beta Services may be subject to different practices.

Categories	Practices
Personnel Security	Sine personnel engaged in data processing are under a written obligation of confidentiality and may not collect, process or use personal data without authorization. Sine follows the Global Data Privacy Policy of Honeywell, which requires employees to comply with Data Protection Laws with respect to the processing of Personal Data. Background or verification checks are performed on personnel (employees and contractors) when appropriate and permitted by local laws. Sine’s annual compliance training includes a requirement for employees to complete an online course and pass an assessment covering information security and data privacy. The security awareness a program may also provide materials specific to certain job functions. Separation of duties between administrators and security personnel.
Physical Security	Sine and its cloud services providers (e.g., Amazon Web Services) take measures to prevent unauthorized physical access to premises and facilities holding Personal Data. This may be accomplished through: Protecting and restricting physical access to data processing equipment Physical security perimeters (fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks and security patrols) are implemented to safeguard sensitive information and information systems Physical access to facilities and data centers is restricted in order to protect hosted information, applications, systems, and infrastructure. Visitor access is subject to approval and is logged. Secure cabinets are leveraged within data centers to secure hosted information, applications, systems, and infrastructure. Identification badges are used, and key card access is required to enter facilities. Where necessary security cameras and security guards are utilized to observe and enforce access controls.
Access Control	Sine has robust Identity and Access Management controls in place with usage of unique user ID and complex password for authentication. Sine follows complex password policy. The protection measures include: Identity and access management systems and processes for authentication & authorization limiting access only to authorized users. Role based access (least privilege). Secure log-in with unique user-ID/password. Periodic access reviews.
Asset Management	Sine’s Asset Management comprises the following: o Information Asset Protection to protect information throughout its lifecycle including creation, use, processing, storage, transmission and destruction. o Continuous Monitoring Strategy with data loss prevention mechanism. o Asset Inventory to maintain inventories of its systems supporting customer information. o Asset Configuration and Control.
Incident Management	Incident response procedures exist for security and data protection incidents, which includes incident analysis, containment, response, remediation, reporting and the return to normal operations. Sine implements logging and analysis of system usage.
Network Security	Network perimeter security through intrusion detection and prevention systems, routers and state of the art firewalls. Usage of DMZ. VPN for remote access and Secure Shell/Layer access as applicable. Anti-malware and anti-virus mechanisms. Vulnerability scanning.