Partner Data Processing Agreement

This Partner Data Processing Agreement (“DPA”) is between Cloutly Co Pty Ltd (ACN 637 155 045) (“Cloutly”, “we”, “us”) and the Partner that has accepted the Partner Terms (“Partner”, “you”). It forms part of the Partner Terms. Capitalised terms not defined here have the meaning given in the Partner Terms or, failing that, the Customer Terms.

• Annex 1: Description of the processing
• Annex 2: Sub-processor categories
• Annex 3: Security measures
• Annex 4: GDPR and UK GDPR terms (conditional)

1. Roles and scope

1.1 Client Data. For personal information held in a Client’s workspace (“Client Data”), the Client is the entity responsible for it under applicable privacy law (the “controller”), you process it on the Client’s behalf to provide your services to that Client, and Cloutly processes it on your and the Client’s behalf as a processor (where you are the Client’s processor, Cloutly is a sub-processor). This DPA governs that processing.

1.2 Partner Account Data. Information about you, your team and your billing (your partner account, contact details, usage of the partner portal, payment references, and the emails we send you) is handled by Cloutly as a controller under our Privacy Policy. This DPA does not apply to it.

1.3 Connected Services. Where you or a Client connects a third-party service to the Service (for example a business-listing or review platform, a social network, or a booking, point-of-sale or CRM system), that service is the Client’s own provider and is not a Cloutly sub-processor. Data flows to and from it on the Client’s instruction under that provider’s terms.

1.4 Applicable law. This DPA is written for the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”). Where the Client is subject to the New Zealand Privacy Act 2020, the parties apply this DPA in a way consistent with that Act’s information privacy principles. Where Client Data includes personal data of people in the European Economic Area or the United Kingdom, Annex 4 also applies.

1.5 You act for your Clients. You represent that you are authorised by each Client to give Cloutly instructions about its Client Data, to receive notices on its behalf, and to agree this DPA for its benefit. You must flow this DPA, or terms no less protective, down to each Client (Partner Terms 7.2 and 11.2).

2. Details of the processing

The subject matter, duration, nature and purpose of the processing, the types of personal information and the categories of individuals are set out in Annex 1.

3. Our obligations as processor

3.1 Instructions. We process Client Data only on documented instructions from you or the Client. The Partner Terms, the Customer Terms, this DPA, the settings and actions taken in the Service, and any written instruction sent to partners@cloutly.com are documented instructions. We will tell you if we consider an instruction breaches applicable privacy law, and we may suspend that instruction until it is resolved. We may process Client Data where required by law, in which case we tell you first unless the law prevents it.

3.2 Purpose limitation. We do not use Client Data for our own purposes. In particular we do not sell it, use it to market to the Client’s customers, use it to build profiles across Clients, or use it to train generative AI models. AI model providers we engage are used through their business interfaces on terms that prohibit them from training their models on the data we send.

3.3 Aggregate service data. We may create and use statistics about use of the Service that do not identify any individual, Client or Partner, for operating and improving the Service.

3.4 Personnel. Only personnel who need access to provide, support or secure the Service have it. Staff access to a Client workspace through the Service is recorded. Staff cannot use the Service’s “log in as” function to take payment actions on your behalf.

3.5 Compliance assistance. We assist you and the Client, as far as the Service allows and taking into account the nature of the processing, with the obligations in clauses 6, 8, 9 and 11.

4. Your obligations

4.1 You and each Client are responsible for the lawfulness of the Client Data you provide and of the instructions you give, including collecting Contact Data lawfully, giving the notices and obtaining the consents the APPs and any other applicable law require (including for cross-border disclosure under APP 8), and keeping Client Data accurate.

4.2 You must configure and use the Service, and ensure each Client does, in accordance with the Acceptable Use Policy. You must not upload personal information that the Service is not designed to hold, including government identifiers, financial account details, health information or other sensitive information, except where a feature expressly collects it with the individual’s consent.

4.3 You must tell us promptly, at partners@cloutly.com, if you become aware of a data-subject request, complaint, regulator contact or breach that concerns Client Data, so far as it needs our assistance.

5. Confidentiality

5.1 We keep Client Data confidential and ensure that the people we authorise to process it are bound by written confidentiality obligations or an appropriate statutory duty.

5.2 Client Data is not disclosed to anyone other than our personnel, our sub-processors under clause 7, the Client, you, and the people or services the Client instructs us to send it to (for example a Review Recipient or a Review Platform), except where the law requires.

6. Security

6.1 We implement and maintain appropriate technical and organisational measures to protect Client Data against unauthorised or unlawful processing and against accidental loss, destruction or damage, taking into account the state of the art, the costs of implementation and the nature of the processing. The current measures are summarised in Annex 3.

6.2 We may update the measures from time to time, provided the update does not materially reduce the overall level of protection during the term.

6.3 We hold no third-party security certification such as ISO 27001 or SOC 2, and this DPA does not represent that we do.

7. Sub-processors

7.1 Authorisation by category. You, on your own behalf and on behalf of each Client, give general written authorisation for us to engage sub-processors in the categories listed in Annex 2, for the purposes and in the regions stated there. Annex 2 describes every category of sub-processor that processes Client Data; we do not engage a sub-processor outside those categories without notice under clause 7.4.

7.2 The named list. We keep a current list of our sub-processors by name, with each one’s purpose and processing location. We provide it to you, or to a Client through you, within 10 business days of a written request to partners@cloutly.com. The list is our confidential information: you may use it only to assess and document your own and your Clients’ privacy compliance, may share it with a Client, its privacy adviser or a regulator for that purpose, and must not publish it or use it for any other purpose. We do not publish the list, because it describes the components of the Service.

7.3 Terms. We engage each sub-processor under a written contract that imposes data-protection obligations no less protective than those in this DPA, so far as relevant to the services it provides. We remain responsible to you for the sub-processor’s performance of those obligations.

7.4 Notice of changes. We give you at least 30 days’ notice, by email to your partner account owner, before: (a) a sub-processor in a new category not listed in Annex 2 processes Client Data; or (b) a change of sub-processor, purpose or processing location that materially affects the protection of Client Data, including a move of primary hosting out of the European Union or a new processing location outside Australia, New Zealand, the European Economic Area, the United Kingdom or the United States. A partner that has requested the named list under clause 7.2 is also told, by the same means and within the same period, of every addition to or replacement on that list while the Partner Terms are in force, whether or not the change is material.

7.5 Objection. You may object to a change notified under clause 7.4 on reasonable data-protection grounds within the notice period. We will discuss the objection in good faith and may offer a change to the Service or its configuration that avoids the sub-processor. If we cannot address the objection before the change takes effect, you may terminate the affected part of the Service, or the Partner Terms, without penalty, and clause 10 then applies. Using the Service after the notice period without objecting is acceptance of the change.

7.6 Emergency replacement. Where a sub-processor must be replaced urgently to keep the Service secure or available, we may do so on shorter notice and tell you as soon as practicable; clause 7.5 then runs from that notice.

8. Personal-data breaches

8.1 We notify you without undue delay, and in any event within 72 hours of becoming aware, of a personal-data breach affecting Client Data (“Breach”), by email to your partner account owner. The notice includes what we know at the time: the nature of the Breach, the categories and approximate number of individuals and records affected, the likely consequences, the measures taken or proposed, and a contact point. We provide further information in phases as it becomes available.

8.2 We take reasonable steps to contain and remediate a Breach and to assist you and the affected Clients to meet their own notification obligations, including under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth). As between us, you are responsible for passing the notice to affected Clients and for deciding, with them, whether and how to notify individuals and the Office of the Australian Information Commissioner.

8.3 Our notice is not an admission of fault or liability.

9. Assistance with data-subject requests and assessments

9.1 Requests. The Service lets a Client view, correct, export and delete contact records, unsubscribe a contact from messaging, and delete feedback and conversations. Those tools are the primary means of answering an access, correction, deletion or opt-out request. Where a request cannot be met through the Service, we assist on written request within a reasonable time.

9.2 Direct requests. If an individual contacts us directly about Client Data, we tell them which business holds their information (the Client, or you where the Client cannot be identified) and, where we can, pass the request to you. We do not answer it ourselves unless the law requires.

9.3 Opt-outs we action automatically. A reply of STOP (or a listed equivalent) to an SMS sent through the Service unsubscribes that number from messaging in that Client’s workspace automatically. Unsubscribe links in email are honoured automatically. Other wording in an inbound message is shown to the Client to action.

9.4 Assessments. We provide the information reasonably needed for a Client’s privacy impact assessment or a security questionnaire, to the extent it concerns our processing and is not already in this DPA, its Annexes, the Privacy Policy or our published documentation.

10. Deletion and return

10.1 During the term. A Client may delete contacts, feedback, conversations and other records through the Service at any time, and may close its account. Deleted records are removed from the live database on deletion or on a short delay set by the feature, and from backups on the backup cycle in Annex 3.

10.2 On termination. For 30 days after the Partner Terms end (or a Client workspace is closed), you and the Client may export Client Data using the Service’s export features or on written request (Partner Terms 18.5). After that period we delete Client Data on request, and otherwise in the ordinary course of our data-retention processes, subject to the backup cycle and to any legal retention obligation, and provide confirmation on request.

10.3 Front Desk conversations. Front Desk chat threads carry an automatic retention date set by the Service and are deleted when it passes, with visitor records removed once no retained thread refers to them. A conversation flagged as a complaint is kept for no more than 90 days from when it started.

10.4 Records we must keep. We may retain the minimum information needed to meet legal, accounting or audit obligations, to evidence this agreement, or to maintain suppression lists so that an opted-out contact is not messaged again.

11. Audits and information

11.1 On written request no more than once in any 12-month period (or more often following a Breach or where a regulator requires it), we make available the information reasonably necessary to demonstrate compliance with this DPA: this DPA and its Annexes, our security measures, the named sub-processor list under clause 7.2, summaries of any independent assessments we hold, and written answers to reasonable questions.

11.2 Where that information is not sufficient to demonstrate compliance, you (or an independent auditor you appoint who is bound by confidentiality and is not a competitor of ours) may conduct a remote, documentary audit on at least 30 days’ notice, during business hours, limited in scope to the processing of Client Data, and without access to other customers’ data or to our production systems. On-site audits are only where the law requires. You bear your own audit costs and reimburse our reasonable costs of assisting beyond one business day per audit.

11.3 You must give us a copy of any audit report, and the parties treat it as confidential information.

12. International transfers

12.1 Where Client Data is held. The Service’s primary database, file storage and application servers run with a major cloud-infrastructure provider in the European Union (Belgium). Video files (video testimonials and video review requests) are stored with the same provider in its Asia region. Some supporting services of that provider, and some sub-processors in the categories in Annex 2, operate in the United States, the United Kingdom, Australia and New Zealand, as stated against each category.

12.2 APP 8. Because Client Data is stored and processed outside Australia, you and each Client must have taken the steps APP 8 requires before disclosing personal information to us, including telling the individuals concerned that their information may be disclosed to overseas recipients and the countries in which those recipients are likely to be located (Partner Terms 7.2(d)). The countries are those stated in Annex 2, and the named list under clause 7.2 gives the location of each sub-processor where a Client needs it for its own APP 8 assessment. We take reasonable steps to ensure each overseas sub-processor handles Client Data in a way consistent with the APPs.

12.3 EU and UK data. Where Annex 4 applies, transfers out of the EEA or the UK rely on the mechanisms set out there.

12.4 Government access. We do not voluntarily disclose Client Data to a government authority. If we receive a legally binding request, we notify you where the law allows, limit the disclosure to what is required, and challenge requests we reasonably consider unlawful.

13. Liability and precedence

13.1 Each party’s liability under this DPA is subject to the limits and exclusions in clause 16 of the Partner Terms, except that nothing limits liability that applicable privacy law does not allow to be limited.

13.2 In respect of personal information, this DPA prevails over the Partner Terms and the Customer Terms to the extent of any conflict (Partner Terms 19.4). Nothing in this DPA reduces a protection the Customer Terms give a Client in respect of its Customer Data.

14. Changes to this DPA

14.1 We may update this DPA under clause 19 of the Partner Terms. A change that reduces the protection of Client Data takes effect only with at least 30 days’ notice and your right to terminate under Partner Terms 18.1. Changes to the sub-processor categories in Annex 2 follow clause 7.

---

Annex 1: Description of the processing

Subject matter. Provision of the Service to you and your Clients under the Partner Terms: sending review requests and other customer communications, collecting and displaying reviews and feedback, running the inbox and the Front Desk website assistant, generating insights and AI-drafted content, publishing to Review Platforms on instruction, and the associated support, security and billing.

Duration. The term of the Partner Terms, plus the export and deletion period in clause 10.

Nature of the processing. Collection (from the Client, its connected systems, its customers and public Review Platforms), storage, organisation, transmission by email and SMS, display to the Client and on public pages the Client controls, analysis including automated classification and summarisation by large-language models, retrieval by search, and deletion.

Purpose. To provide the Service as instructed by the Client through its settings and actions, and by you through the partner portal, and to keep the Service secure and available.

Categories of individuals.

• The Client’s customers and prospective customers who are contacted for reviews or feedback, or who reply (“Review Recipients”).
• People who have posted public reviews about the Client on Review Platforms, including their public display name and profile image.
• Visitors to the Client’s website who use Front Desk.
• The Client’s staff and Authorised Users, and your team members who use the Service.
• People who message the Client through connected channels (for example SMS replies or social-media direct messages).

Types of personal information.

• Contact Data: name, email address, mobile number, customer or booking reference, visit or purchase date, assigned staff member, tags, consent and opt-out status, and other fields the Client imports or syncs.
• Communications: the review requests, reminders and follow-ups sent, delivery and open or click status, and inbound replies.
• Review Content and feedback: ratings, review text, reviewer display name and public profile image, photos and video testimonials (voice and likeness) where the Client enables them, the Client’s responses, and AI-drafted response suggestions.
• Front Desk data: chat transcripts, the visitor’s name, phone number and email where the visitor provides them, photos the visitor uploads, enquiry summaries, and follow-up messages sent to the visitor.
• Staff Data: staff names, roles and performance metrics derived from reviews and feedback.
• Technical data: IP address, browser and device information, timestamps, and usage events, collected for security, rate limiting and product analytics.
• Derived data: sentiment, topics, issues and summaries produced from the above.

Sensitive information. The Service is not designed to hold sensitive information. Free-text reviews, feedback and chat messages can incidentally contain it (for example a review of a health-related business). The Client must not solicit it and must not upload it as structured data.

Annex 2: Sub-processor categories

Current as at 2026-10-16. Each category describes a kind of sub-processor that processes Client Data for us, what it does with it, and where. The named sub-processors in each category, with their individual locations, are available under clause 7.2. “Region” is where the sub-processors in the category process Client Data for us, as far as it is evident from our configuration or their documentation.

Services that receive Partner Account Data only. The following categories receive Partner Account Data as controller-side services under our Privacy Policy and never Client Data or anything about a Client’s customers: marketing and onboarding email to partner account owners (United States); internal records of sign-ups (United States); uptime monitoring (no personal data); and business-level enrichment of a company’s public logo, colours and details at sign-up, with no person-level enrichment (United States).

Connected Services the Client authorises (business-listing and review platforms, social networks, booking, point-of-sale and CRM systems, and the third-party AI assistants queried for AI-search measurement) are the Client’s own providers (clause 1.3).

Legacy services that are not used for Partner Workspaces (billing for some long-standing direct accounts and affiliate payouts) are excluded from this Annex. The legacy website chatbot, which Front Desk is replacing, uses the AI model providers category above.

Annex 3: Security measures

A summary of the technical and organisational measures in place. It is intentionally general; it does not disclose configuration detail that would weaken the measures.

Hosting and network. The Service runs in managed Kubernetes with a major cloud-infrastructure provider, behind a content-delivery and network-security layer. Public endpoints are served over TLS. Administrative access to the cluster and database is restricted to named Cloutly personnel using individual credentials and multi-factor authentication, through the provider’s identity and access management.

Data at rest. The database and file storage are encrypted at rest by the cloud provider. Selected high-sensitivity fields (connected-service credentials and sending-provider tokens) are additionally encrypted at the application layer with a key held outside the database.

Data in transit. TLS for all connections between users and the Service, between the Service and sub-processors, and between the application and its database.

Access control. Role-based access within the Service (owner, team, partner owner and partner team), with each Client’s data isolated to its account and each Partner Workspace isolated to its provider. Partner access to a Client workspace is through an audited “log in as” function limited to the partner’s own Clients. Super-admin actions by Cloutly staff write audit events.

Authentication. Password hashing with a slow, salted algorithm; session tokens with bounded lifetimes; optional single sign-on through established identity providers for account holders; rate limiting and bot detection on sign-in, sign-up and public forms; time-limited, single-use links for password resets and invitations.

Application security. Signature verification on inbound webhooks from payment, SMS and integration providers; outbound calls to vendors routed through a registry with environment guards, so non-production environments cannot send real messages or charge real money; dependency and code review before release; a continuous-integration test suite that gates production deployment.

Secrets. Credentials for sub-processors are held in restricted secret storage and environment configuration, with access limited to named personnel.

Logging and monitoring. Centralised application logs and metrics, uptime monitoring, alerting on payment and activation anomalies, and error monitoring. Logs are retained for a limited period and access to them is restricted.

Backups and resilience. Automated daily database backups retained for seven days, and the application running on at least two replicas.

Personnel. Personnel with access to Client Data are bound by confidentiality, receive security guidance, and have access removed on departure.

Incident response. A defined process for detecting, containing, assessing and notifying security incidents, with the notice commitments in clause 8.

Development and testing. Non-production environments do not send real email or SMS and cannot take payment; production data used for development is limited and refreshed under a documented process.

Annex 4: GDPR and UK GDPR terms (conditional)

This Annex applies only where, and to the extent that, Client Data includes personal data of individuals in the European Economic Area or the United Kingdom, so that Regulation (EU) 2016/679 (“GDPR”) or the UK GDPR and Data Protection Act 2018 (“UK GDPR”) applies to the Client’s processing. Where it applies, the following supplements the body of this DPA.

A4.1 Roles. The Client is the controller. Where you act as the Client’s processor, Cloutly is the Client’s sub-processor engaged by you, and you warrant that your contract with the Client authorises that engagement. Where the Client contracts with Cloutly directly through the Customer Terms, Cloutly is the Client’s processor.

A4.2 Article 28(3) terms. Clauses 3 to 11 of this DPA are intended to satisfy Article 28(3) GDPR and UK GDPR. In particular, Cloutly: processes personal data only on documented instructions, including with regard to international transfers (clause 3.1 and 12); ensures persons authorised to process it are bound by confidentiality (clause 5); takes the measures required by Article 32 (clause 6 and Annex 3); respects the conditions for engaging another processor (clause 7); assists the controller with data-subject rights (clause 9); assists with Articles 32 to 36 (clauses 8 and 9); deletes or returns the data at the end of the services (clause 10); and makes available the information necessary to demonstrate compliance and allows for audits (clause 11).

A4.3 Transfers. Transfers of personal data from the EEA to Cloutly, and onward to sub-processors outside the EEA, are made under the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, which are incorporated by reference, with Cloutly as data importer where it receives data outside the EEA and with the sub-processor terms in clause 7. Transfers from the UK are made under the UK International Data Transfer Addendum to those clauses.

A4.4 Sub-processor authorisation. Clause 7 is the general written authorisation under Article 28(2), and clauses 7.4 and 7.5 give the controller the opportunity to object. Clause 7.3 satisfies Article 28(4). Clause 7.2 makes the named list available to the controller on request.

A4.5 Breach. Clause 8’s 72-hour commitment is intended to allow the controller to meet Article 33.

A4.6 Records and representative. We keep the records Article 30(2) requires.

---

Cloutly Co Pty Ltd (ACN 637 155 045)
WOTSO Workspace, Level 2, 194 Varsity Parade, Varsity Lakes QLD 4227, Australia
Email: partners@cloutly.com · Web: cloutly.com