Data Processing Agreement

1. Definitions

“Applicable Data Protection Law” means the Privacy Act 1988 (Cth) and the Australian Privacy Principles and, where it applies, the EU General Data Protection Regulation 2016/679 and the UK GDPR. Terms such as Controller, Processor, Personal Data, Data Subject and Processing take their meanings from Applicable Data Protection Law.

2. Roles and scope

The Customer is the Controller and GMI is the Processor of the Personal Data described in Schedule 1. GMI processes that Personal Data only to provide the Mindset Profiler, and only on the Customer’s documented instructions.

3. GMI’s obligations as Processor

• Instructions. GMI processes Personal Data only on the Customer’s documented instructions, unless required otherwise by law.
• Confidentiality. Everyone GMI authorises to process the Personal Data is bound by a duty of confidentiality.
• Security. GMI maintains the technical and organisational measures set out in Schedule 2, appropriate to the risk, in line with Article 32 of the GDPR.
• Sub-processors. The Customer gives general authorisation to the sub-processors listed in Schedule 3. GMI will give notice of any change and an opportunity to object, will bind each sub-processor to obligations no less protective than these, and remains liable for their performance.
• Data subject requests. GMI will assist the Customer in responding to requests from Data Subjects.
• Assistance. GMI will assist the Customer with security, breach notification, data protection impact assessments and prior consultation.
• Breach notification. GMI will notify the Customer without undue delay, and in any case within 48 hours, of becoming aware of a Personal Data breach.
• Deletion or return. On the Customer’s choice, GMI will delete or return the Personal Data at the end of the services, unless it is required by law to keep it.

4. International transfers

GMI is located in Australia. Where the GDPR applies, transfers are made under the EU Standard Contractual Clauses (2021), Module Two (Controller to Processor), together with the UK International Data Transfer Addendum and a transfer impact assessment.

5. Term

This agreement applies for as long as GMI processes the Customer’s Personal Data.

6. Liability and governing law

Liability under this agreement is subject to the limits in the Principal Agreement. This agreement is governed by the laws of Victoria, Australia.

Schedule 1 — Details of processing

• Subject matter. Provision of the Mindset Profiler and related reporting.
• Duration. The term of the Principal Agreement.
• Nature and purpose. Collecting and processing Mindset Profiler responses to generate individual reports, which are provided by email.
• Types of Personal Data. Name, email address, Mindset Profiler responses and results.
• Categories of Data Subjects. The Customer’s personnel who complete the Mindset Profiler.

Schedule 2 — Technical and organisational measures

The measures set out in the GMI GDPR Compliance Policy and Appendix 2 of Annex 2, which are incorporated into this agreement by reference and available on request.

Schedule 3 — Approved sub-processors

The providers named in our current Sub-processor List.

Contact

To request a signed copy of this agreement, email info@growthmindsetinstitute.org.