How we process personal data on your behalf.

“Applicable Data Protection Law”

All laws and regulations applicable to a party's processing of Personal Data under this DPA, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles and, where applicable, the GDPR and other equivalent laws.

“Customer Data”

The Personal Data the Customer or its users upload to, or process using, the Services.

“Controller, Processor, Data Subject, Personal Data, Personal Data Breach, processing”

Have the meanings given under Applicable Data Protection Law (and, where it applies, the GDPR).

“Platform Controls”

The security features, configuration options and tools that Navigate Network makes available for the Customer to use in securing and managing its own environment and Customer Data.

“Standard Contractual Clauses”

The contractual clauses for the transfer of personal data approved under Commission Implementing Decision (EU) 2021/914 (controller-to-processor or processor-to-processor, as applicable), together with the UK International Data Transfer Addendum and any Swiss amendments where relevant.

“Sub-processor”

A third party engaged by Navigate Network to process Customer Data.

This DPA applies where Customer Data is processed by Navigate Network. In that context, the Customer is the Controller (or a processor acting for a third-party controller) and Navigate Network is the Processor. Because the Services include bare-metal and infrastructure offerings, the Customer retains direct control of, and responsibility for, the operating system, applications and Customer Data running on the infrastructure, and Navigate Network does not access Customer Data except as set out in Section 4.

This DPA and the Agreement (including the Customer’s use of Platform Controls and configuration options) are the Customer’s complete and documented instructions for Navigate Network’s processing of Customer Data. Navigate Network will process Customer Data only on those instructions, except where required by law (in which case it will notify the Customer unless legally prohibited). Instructions outside the documented scope require prior written agreement, including on any additional fees. If Navigate Network forms the view that an instruction infringes Applicable Data Protection Law, it will promptly inform the Customer, who may then withdraw or modify the instruction.

Navigate Network will not access, use, or disclose Customer Data to any third party except as necessary to provide or maintain the Services, or as required to comply with the law or a valid and binding order of a governmental body. If a governmental body demands Customer Data, Navigate Network will, where lawfully able, attempt to redirect the body to seek the data directly from the Customer, and may provide the Customer’s basic contact details for that purpose. If compelled to disclose, Navigate Network will give the Customer reasonable prior notice to allow it to seek a protective order, unless legally prohibited from doing so.

Navigate Network restricts access to Customer Data to personnel who need it to provide the Services, and ensures those personnel are bound by appropriate obligations of confidentiality and trained on their data-protection and security responsibilities.

Navigate Network will implement and maintain the technical and organisational measures described in Annex 2, designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, and unauthorised disclosure or access. Navigate Network may update those measures provided the level of protection is not materially reduced. The Customer is responsible for assessing whether those measures, together with its own use of Platform Controls, meet its requirements.

• Configuring the Services and its environment securely, and managing access to its accounts and credentials;
• Encrypting Customer Data and managing keys as it considers appropriate;
• Backing up and archiving Customer Data so it can restore availability after an incident;
• Ensuring it has a lawful basis and any necessary consents for the Customer Data it processes using the Services.

The Customer provides general authorisation for Navigate Network to engage Sub-processors. Navigate Network will: (a) restrict each Sub-processor’s access to what is necessary to provide the Services; (b) enter a written agreement imposing data-protection obligations no less protective than this DPA; and (c) remain responsible for each Sub-processor’s performance. A current list of Sub-processors is at Annex 3. Navigate Network will give the Customer at least 30 days’ notice before adding or replacing a Sub-processor, and the Customer may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Customer may stop using the affected part of the Services or terminate the relevant Order Form.

Taking into account the nature of the processing, Navigate Network will assist the Customer (including through Platform Controls) to respond to requests by Data Subjects to exercise their rights. If a Data Subject makes a request directly to Navigate Network, Navigate Network will promptly forward it to the Customer and will not respond to the substance of the request itself, except to confirm that it has been forwarded.

Navigate Network will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data, take appropriate measures to mitigate and remediate it, and provide the Customer with the information then available to help the Customer meet its own notification obligations. The Customer is responsible for determining whether the breach requires notification to a regulator or Data Subjects and for making any such notification.

Unsuccessful security events that result in no unauthorised access to Customer Data — such as failed log-in attempts, port scans, pings, or blocked denial-of-service attempts — are not Personal Data Breaches under this Section. Navigate Network’s notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

Taking into account the nature of the processing and the information available to it, Navigate Network will provide reasonable assistance to the Customer with data-protection impact assessments and any prior consultation with a supervisory authority, primarily by making available the information in this DPA and the materials referred to in Section 12.

Navigate Network uses independent third parties to assess its security measures at least annually and, on the Customer’s written request and subject to confidentiality, will make available its current certifications and summary audit reports so the Customer can verify compliance with this DPA. The Customer’s audit rights under Applicable Data Protection Law are satisfied by the provision of those reports. Where Applicable Data Protection Law or a supervisory authority nonetheless requires an on-site audit, it will be conducted on reasonable prior notice, during business hours, no more than once per year (absent a regulator requirement or a known breach), subject to confidentiality, and without compromising other customers’ security, with each party bearing its own costs.

The Customer may specify the region(s) in which Customer Data is processed. Navigate Network and its Sub-processors may process Customer Data in countries outside the Customer’s region — including the United States, the EEA, and Asia-Pacific — only as necessary to provide the Services or to comply with law. Where a transfer of Personal Data subject to the GDPR is made to a country without an adequacy decision, the applicable Standard Contractual Clauses apply (controller-to-processor where the Customer is a controller, processor-to-processor where the Customer is a processor), supplemented by the UK Addendum or Swiss amendments where relevant. For Personal Data subject to the Privacy Act, Navigate Network will take reasonable steps consistent with Australian Privacy Principle 8 before disclosing it overseas. The Standard Contractual Clauses will not apply where Navigate Network adopts an alternative recognised transfer mechanism.

If Customer Data becomes subject to confiscation, or to bankruptcy or insolvency proceedings or similar third-party measures while being processed by Navigate Network, Navigate Network will inform the Customer without undue delay and will notify the relevant parties that the Customer Data is the Customer’s property and under the Customer’s sole control.

On termination of the Agreement, and for up to 90 days afterwards, Navigate Network will, at the Customer’s choice, return or delete Customer Data, except where retention is required by law. After that period, Navigate Network may delete Customer Data remaining in its systems.

Each party’s liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement.

This DPA takes effect on the Effective Date and continues until the Agreement ends. It incorporates the Standard Contractual Clauses by reference where they apply, and nothing in this DPA varies them. Except as amended here, the Agreement remains in effect; if there is a conflict on data-protection matters, this DPA prevails.