Data processing agreement

1. Scope and roles

This agreement forms part of the terms of service between Brandrail (“Processor”) and the customer organisation (“Customer”). It applies to personal information in Customer Data that Brandrail processes on the Customer's behalf: mainly the names and email addresses of members and invitees, and the audit log.

The Customer decides why and how that information is processed. Brandrail processes it only to provide the service, following the Customer's documented instructions (these terms, settings in the dashboard, and requests from organisation owners). It applies the Privacy Act 1988 (Cth) and, where the Customer is subject to them, the GDPR and UK GDPR.

2. Details of processing

3. Brandrail's obligations

• process personal information only on the Customer's instructions, and tell the Customer if an instruction appears to break the law;
• make sure anyone with access is bound by confidentiality;
• keep the security measures in section 5 in place;
• help the Customer respond to requests from individuals and meet its own obligations, as far as the service allows;
• not sell personal information or use it to train AI models.

4. Subprocessors

The Customer authorises the subprocessors listed on the security page. Brandrail binds each one to data protection terms at least as protective as these and stays responsible for them. Brandrail will email organisation owners at least 30 days before adding or replacing a subprocessor that handles personal information; the Customer may object on reasonable grounds, and if we can't resolve it, end the affected service with a refund of prepaid fees for it.

5. Security measures

• encryption in transit (TLS 1.2+) and at rest (AES-256);
• row-level security isolating each organisation, and role-based access inside it;
• two-factor authentication, hashed and expiring API keys, rate limits and an audit log;
• encrypted nightly backups kept for 30 days;
• an automated security audit on every code change, and dependency monitoring;
• access by Brandrail staff limited to support and operations, with two-factor authentication.

6. Data breaches

Brandrail will notify the Customer without undue delay, and within 72 hours where practical, after becoming aware of a breach affecting the Customer's personal information. The notice will describe what happened, the information and people likely affected, and what Brandrail is doing about it, and Brandrail will help the Customer meet its own notification duties.

7. Overseas transfers

Personal information is stored in Singapore (AWS ap-southeast-1) and processed by the subprocessors in the regions listed. Brandrail takes reasonable steps, including contracts, to make sure overseas recipients handle it consistently with the Australian Privacy Principles. Where the GDPR applies, transfers rely on the European Commission's standard contractual clauses or another lawful mechanism.

8. Return and deletion

When the agreement ends the Customer has 30 days to export its data. Brandrail then deletes Customer Data from the live service, and from backups within a further 30 days, unless the law requires it to be kept.

9. Information and audits

On request, Brandrail will answer the Customer's reasonable security questionnaire once a year and provide the information needed to show it meets this agreement. Further audits can be agreed in an Enterprise order form.

10. Signed copy

This agreement applies automatically when you accept the terms. If your organisation needs a countersigned copy, email privacy@brandrail.com.au.