Data processing,
in writing.

Scope & Roles

These Data Processing Terms (“these Terms”) form part of the Hermia Service Agreement and the Terms of Service between Hermia (ABN 75 434 177 026) and each client (“the Client”). They apply whenever Hermia processes personal information on the Client’s behalf to provide the Service (“Client Personal Data”). If these Terms and the Service Agreement differ about Client Personal Data, these Terms apply.

The Client decides why and how Client Personal Data is processed. The Client is the controller, business or APP entity, and Hermia is the processor, service provider or contractor, as those words are used in the law that applies, such as the GDPR and UK GDPR, the California Consumer Privacy Act and other United States state privacy laws, Canada’s privacy laws, the Privacy Act 2020 (NZ) and the Privacy Act 1988 (Cth). Where the Client is itself a processor for another business, Hermia is its sub-processor, and the Client confirms that its instructions are authorised by that business.

Hermia’s own records about the Client and its people — account, billing, support and agreement records, including the name, position, business legal name and email given when paying — are handled by Hermia for its own purposes under the Privacy Policy, not under these Terms.

What Is Processed

Sensitive information. The Service is not designed for health information, financial account details, government identity numbers or other sensitive or special category information. The Client must not set Hermia up to ask for it unless Hermia agrees in writing. Hermia never asks for identity documents, and a finance business’s customers are never messaged by Hermia.

Hermia’s Commitments

For Client Personal Data, Hermia will:

• Follow instructions. Process it only on the Client’s documented instructions — this Agreement, the Client’s configuration and the Client’s written requests — including for any transfer to another country, unless a law requires otherwise (Hermia will tell the Client first unless that law forbids it). Hermia will tell the Client if it believes an instruction breaks a data protection law.
• Keep it confidential. Make sure everyone who can access it for Hermia is bound to keep it confidential.
• Keep it secure. Maintain the security measures in section 4, designed for the risks of this processing.
• Use only approved providers. Use other service providers only as section 5 allows, under written terms that protect the information at least as well as these Terms.
• Use it for nothing else. Not sell or rent it; not use it for Hermia’s own marketing or to build customer lists; not combine it with other information except to provide the Service; and not use it, or allow its providers to use it, to train artificial intelligence models.
• Help the Client. Help the Client meet its own obligations for individuals’ requests, security, incident notices, impact assessments and consultation with regulators, as sections 7 and 8 describe.
• Return or delete it. Return or delete it at the end of the Service, as section 10 sets out.
• Show its compliance. Give the Client the information needed to show that these Terms are met, and allow audits, as section 9 sets out.

Security Measures

Hermia keeps the following measures in place, and improves them as risks and technology change.

• Separation. Every record is tied to one client’s account, and Hermia’s systems check that link before anything is read, changed or sent.
• Encryption. Information is encrypted in transit, and Hermia’s main database and file storage are encrypted at rest.
• Closed by default. The database is closed to public access: only Hermia’s own server systems can read it, using secret keys kept in encrypted secret stores, never in code. Links that show an enquiry or its photos are long, unguessable and private.
• Access. Access is limited to authorised people who need it. Administrator accounts must use two-factor authentication.
• Checked messages. Incoming WhatsApp messages and payment notices are checked for a valid signature before they are trusted, and other connections use secret keys. Spam is filtered, and use is rate-limited.
• Careful records. Logs are kept for a short time and limited to what is needed to run and fix the Service. Agreement acceptance records and job history records are append-only, so they cannot be quietly changed.
• Safe changes. Changes to the Service’s code are tested before release, and each release is checked against the live version it replaces.
• Monitoring. Hermia monitors the Service and is alerted to faults and failed deliveries.
• Least information. The Service asks only for what the Client’s questions need, never asks for identity documents, and keeps enquiry records for plans only as long as the Privacy Policy says.

Service Providers

The Client gives Hermia general authorisation to use service providers (sub-processors) to run the Service, in these categories: cloud hosting and network delivery; database and file storage (the main database is in Australia); artificial intelligence and speech-to-text services; maps and address lookup; email delivery; the messaging channels the Client chooses, such as WhatsApp, email and social messaging; payment processing for the Client’s own account; and integration services that connect the Client’s business systems. Hermia keeps a current list of these providers and where they process information, and sends it to the Client on request to info@hermia.au.

Hermia will email the Client at least 14 days before adding or replacing a provider that processes Client Personal Data. The Client may object on reasonable data protection grounds within that time. The parties will discuss it in good faith; if they cannot resolve it, the Client may end the affected Service without any early-termination charge. Hermia remains responsible to the Client for how its providers handle Client Personal Data.

Hermia uses artificial intelligence services only under business terms that do not allow the provider to use the information to train its models.

The CRM, inbox, calendar and other accounts that the Client connects are the Client’s own systems, used on the Client’s instructions.

Transfers Between Countries

Hermia’s main database is in Australia. Some providers process information in other countries, mainly the United States and countries in the European Union. Hermia transfers Client Personal Data only as these Terms allow and with the protections the law requires.

European Union, European Economic Area and Switzerland. Where the GDPR applies to the Client’s processing and Client Personal Data is transferred to Hermia or its providers in a country without an adequacy decision (Australia does not have one), the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 apply and form part of these Terms: Module Two (controller to processor), or Module Three (processor to processor) where the Client is a processor. In them, the Client is the data exporter and Hermia the data importer; the optional clause 7 does not apply; in clause 9(a), option 2 applies with the notice period in section 5; the optional wording in clause 11 does not apply; in clause 13, the supervisory authority is the one competent for the Client; in clauses 17 and 18, the law and the courts of Ireland are chosen; Annex I is completed by sections 1 and 2 of these Terms, Annex II by section 4, and Annex III by the list described in section 5. For Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, the Federal Data Protection and Information Commissioner is the competent authority, and “Member State” includes Switzerland so that people there can enforce their rights.

United Kingdom. Where the UK GDPR applies, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022) applies and forms part of these Terms, completed with the details in this section and section 5. Either party may end it as its Table 4 allows.

Other countries. Where another country’s law requires specific terms for a transfer, Hermia will agree reasonable terms that meet that requirement. If the Standard Contractual Clauses or the UK Addendum differ from these Terms, they apply.

Security Incidents

If Hermia becomes aware of a breach of security that leads to the accidental or unlawful destruction, loss, change, unauthorised disclosure of, or access to, Client Personal Data, Hermia will tell the Client without undue delay, and where possible within 48 hours. Hermia will give the Client what it knows — what happened, the kinds and approximate number of people and records involved, the likely consequences, and what has been done — and more as it becomes available, so the Client can meet its own deadlines, such as 72 hours to notify a regulator under the GDPR and the 30-day assessment under Australia’s notifiable data breaches scheme.

Hermia will contain and fix the problem and cooperate with the Client’s investigation. Unless a law requires Hermia to, Hermia will not tell regulators or the people affected about an incident involving Client Personal Data without first consulting the Client. Telling the Client about an incident is not an admission of fault.

Requests & Assistance

If a person asks Hermia to see, correct, delete, stop using or move information that Hermia holds for the Client, Hermia will pass the request to the Client promptly and will not answer it itself, other than to say it has been passed on. Hermia will help the Client answer such requests, through the Service’s own tools where possible and otherwise with reasonable help.

Hermia will give the Client reasonable help with its security obligations, privacy or data protection impact assessments, and consultation with regulators, taking into account how Hermia processes the information and what Hermia knows.

Audits & Information

Hermia will give the Client the information reasonably needed to show that these Terms are met. The Client may audit Hermia’s compliance with these Terms once a year, and also after an incident affecting Client Personal Data or when a regulator requires it, itself or through an independent auditor bound by confidentiality. An audit needs at least 30 days’ written notice, takes place during business hours at the Client’s cost, and gives no access to other clients’ information or to anything that would weaken security. Hermia may first offer written answers and documents; if the Client still reasonably needs an audit, it goes ahead.

Return & Deletion

The enquiries Hermia delivers into the Client’s CRM, inbox or team email are the Client’s copies. Hermia keeps Client Personal Data only as long as it needs to provide the Service and as the Privacy Policy describes.

When the Service ends, Hermia stops processing Client Personal Data except to keep it as this section allows. Within 90 days, Hermia deletes or de-identifies the Client Personal Data it still holds, or first returns a copy if the Client asks before the Service ends. The exceptions are records Hermia must keep by law or to establish or defend a legal claim, and opt-out records kept so that opt-outs continue to be honoured. Anything kept stays protected by these Terms and is deleted when it is no longer needed. Copies in backups are removed as the backups expire. Hermia will confirm the deletion in writing on request.

United States Privacy Laws

Where the California Consumer Privacy Act (as amended by the California Privacy Rights Act) or another United States state privacy law applies, Hermia is the Client’s service provider, contractor or processor, and:

• processes Client Personal Data only for the business purposes set out in this Agreement;
• does not sell or share it, including for cross-context behavioural advertising;
• does not keep, use or disclose it for any other purpose, or outside the direct business relationship with the Client, except as those laws allow;
• does not combine it with personal information from other sources, except as those laws allow;
• complies with those laws and gives the information the same level of privacy protection that they require;
• lets the Client take reasonable steps to make sure Hermia uses the information consistently with the Client’s obligations, and to stop and fix any unauthorised use; and
• tells the Client if it can no longer meet these obligations.

Hermia certifies that it understands these restrictions and will comply with them. For the processor requirements of other state laws, the instructions, confidentiality, provider, deletion, information and audit terms in these Terms apply.

Other Countries

• Australia. Hermia handles Client Personal Data in line with the Australian Privacy Principles as they apply to the Client, including APP 11 (security) and, for overseas disclosures, APP 8, and will help the Client assess a suspected eligible data breach within the time the Privacy Act 1988 (Cth) allows.
• New Zealand. Hermia holds Client Personal Data only as the Client’s agent, to provide the Service, and does not use or disclose it for its own purposes, as section 11 of the Privacy Act 2020 (NZ) contemplates.
• Canada. Hermia gives Client Personal Data a level of protection comparable to the protection the Client must give it under federal and provincial privacy laws, including Québec’s, uses it only for the Service, and will help with the Client’s privacy impact assessments and breach records.
• Elsewhere. Where another law requires specific terms between a business and its service provider, these Terms are read to include them to the extent required, and Hermia will agree reasonable additional terms the Client needs.

General

Which document applies. For Client Personal Data, the Standard Contractual Clauses and the UK Addendum (where they apply) come first, then these Terms, then the Service Agreement, then the Terms of Service.

Liability. Each party’s liability under these Terms is subject to the limits in the Service Agreement, except where the law, or the Standard Contractual Clauses for the people they protect, do not allow it to be limited.

Changes. Hermia may update these Terms to reflect changes in the law, regulators’ guidance or its service providers. Hermia will email the Client at least 30 days before a change that materially reduces the protection of Client Personal Data, and the Client may end the Service before that change takes effect.

Duration. These Terms apply while Hermia processes Client Personal Data and continue until it has been returned or deleted.

Law. These Terms are governed by the laws of Victoria, Australia, except where the Standard Contractual Clauses, the UK Addendum or a law requires otherwise.