1.1 For Personal Information within Customer Data (including Captured Data), you are the collecting organisation responsible for the lawful basis of collection, and we handle it for the purposes in clause 8.2 of the Master Services Agreement and this Schedule.
1.2 For Personal Information we collect in our own right (accounts, billing, telemetry, marketing), our Privacy Policy applies and we are the responsible organisation.
1.3 We will handle Personal Information within Customer Data in accordance with Privacy Laws, this agreement, and your reasonable documented instructions given through the Services' controls and configuration. Where a law of an Australian state or territory or of New Zealand requires you, as a public-sector organisation, to ensure that a contracted service provider deals with such records consistently with the information privacy principles that bind you, we will deal with those records consistently with those principles to the extent they apply to the services we provide.
2.1 CORE production and staging data, including Captured Data synchronised to CORE, is hosted in Amazon Web Services' Sydney region, with backup copies in the Melbourne region.
2.2 Our service providers and related entities may access or process certain information from outside Australia as described in our Privacy Policy; our current subprocessors are listed in the Trust Centre (clause 6).
3.1 We maintain an information security management system certified to ISO/IEC 27001:2022 covering the Services.
3.2 We maintain the following measures for the Cloud Platforms:
3.3 Our published control posture, certifications and security documentation are available through the Aero Ranger Trust Centre.
4.1 Evidence of our certifications and control posture is available through the Trust Centre.
4.2 The assurance in clause 4.1 is provided in place of on-site audit rights, which are not granted.
5.1 We maintain a data-incident response process. If a data breach occurs involving Personal Information within your Customer Data, we act in accordance with our legal obligations — including the Notifiable Data Breaches scheme (Privacy Act 1988 (Cth)) and, where applicable, the Privacy Act 2020 (NZ) — and will provide you with the information reasonably necessary for you to meet yours.
5.2 We will not make a public statement naming you in connection with a data breach without your consent, except as required by law.
5.3 Nothing in this clause limits either party's own statutory notification obligations.
6.1 The Services are delivered using subprocessors, listed in the Trust Centre as updated from time to time. We remain responsible for the performance of our subprocessors.
7.1 Export. Export is self-service: you are responsible for downloading your own Customer Data using the export features of the Services, and may do so at any time during the term and, while the relevant platform remains available (retirement of a platform is dealt with in clauses 6 and 7 of Schedule 1), for 30 days after termination or expiry of the relevant Services, provided all amounts due and payable to us (other than amounts disputed in accordance with clause 6.3 of the Master Services Agreement, with the undisputed balance paid) have been paid in full. We are not obliged to perform exports, extractions or migrations for you, and access (including export) is unavailable while any such amount remains unpaid or while access is suspended. This clause deals with access by you and your Users; it does not affect the handling of requests by individuals under Privacy Laws.
7.2 Decommissioning. After the export window, your organisation's tenancy and user access are decommissioned. Customer Data we continue to hold is handled under clause 8 of the Master Services Agreement and clause 3 of this Schedule.
7.3 Nothing in this clause 7 limits clauses 8.2–8.5 of the Master Services Agreement. Models, Derived Data and De-identified Data are unaffected by this clause.
We deal with legally binding demands for Customer Data in accordance with law, disclose no more than the demand requires, and where lawful and practicable refer requesting parties to you.
