Data Processing Agreement

This agreement is between HAMANI PTY LTD (ACN 696 864 981) (“HAMANI”, the processor) and [Customer legal name, ABN/ACN] (the controller). It supplements the Terms of Serviceand governs HAMANI’s processing of personal information contained in the customer’s contact lists and campaigns.

Under the Privacy Act 1988 (Cth)and the Australian Privacy Principles (APPs), the customer decides the purpose and means of processing its audience’s personal information; HAMANI processes that information only on the customer’s documented instructions (its use of the product), except where Australian law requires otherwise.

Subject-matter: operation of the HAMANI Marketing platform. Duration:the term of the customer’s account, plus the retention periods in clause 7. Nature & purpose: storing contact lists, composing and sending marketing messages the customer configures, recording consent and delivery/opt-out status, and billing. Categories of data subject: the customer’s own contacts. Categories of personal information: contact name, email address, mobile number, preferred language, the consent basis the customer recorded, and message delivery/opt-out status.

• Process personal information only on the customer’s instructions (its use of the product) and not for HAMANI’s own purposes.
• Not use customer data to train any AI model.The customer’s contact list and individual contact details are never sent to the AI. The assistant sends the campaign text the customer asks it to draft or translate, plus an aggregate audience summary (a contact count and top tag labels — never names or emails), to our AI sub-processor’s API, which does not train on it.
• Keep personal information confidential and ensure personnel are bound by confidentiality.
• Apply the technical and organisational measures in clause 5 (and the Security page).
• Assist the customer, taking into account the nature of processing, with data-subject requests, security, and breach notification.
• At the customer’s choice, delete or return personal information at the end of the service, subject to legal retention (clause 7).

The customer authorises HAMANI to engage the sub-processors below. Each is bound to data-protection obligations no less protective than this DPA. HAMANI will give [30] days’ notice of any intended change so the customer may object on reasonable data-protection grounds.

HAMANI applies the measures described on the Security page and the Trust Centre, including: encryption in transit (HTTPS/HSTS) and at rest; per-tenant isolation with deny-by-default database rules; passwords stored only as a PBKDF2-SHA256 (100,000 iterations) one-way hash; signed HttpOnly session cookies; rate limiting; and audit logging. Enterprise tenants may additionally federate their own identity provider (SAML 2.0 / OIDC) — HAMANI remains the system of record.

HAMANI operates under the Notifiable Data Breaches (NDB) schemein Part IIIC of the Privacy Act 1988 (Cth). On becoming aware of an eligible data breach affecting the customer’s personal information, HAMANI will notify the customer without undue delay and in any case within [72] hours, with the information the customer reasonably needs to meet its own obligations to the OAIC and affected individuals. The parties will cooperate on assessment and remediation.

The customer’s contact lists and campaign content belong to the customer. On termination, or on the customer’s request, HAMANI will delete the customer’s personal information via its verifiable hard-delete (erasure is re-checked and a deletion record is retained as proof), except records HAMANI must keep by law (e.g. GST tax invoices) and one-way-hashed opt-out records kept specifically so no unsubscribed person can be re-contacted. Retention periods are published on the Trust Centre.

Primary application data is provisioned in Sydney, Australia (Google Cloud australia-southeast1), verified at go-live. Some sub-processors may process limited data outside Australia; where they do, HAMANI takes reasonable steps consistent with APP 8 so the recipient handles the information consistently with the APPs. Country-specific detail is listed in the sub-processor table and on the Trust Centre.

On reasonable written notice and no more than [once per year] (or after a breach), HAMANI will make available the information reasonably necessary to demonstrate compliance with this DPA, which may include its then-current security documentation and, if available, third-party attestations. On-site audits, if any, are conducted on [terms to be agreed] so as not to disrupt other customers.

This DPA is governed by the laws of [New South Wales], Australia, consistent with the Terms of Service, and nothing in it limits rights that cannot be excluded under the Privacy Act 1988 (Cth) or the Australian Consumer Law.