Data Processing Agreement (DPA)

1. Definitions and Scope

This Data Processing Agreement ("DPA") forms part of the service agreement between the Client and Digadiorcollective Pty Ltd. It ensures that the processing of personal data complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). "Personal Data" refers to any information relating to an identified or identifiable natural person provided by the Client for the purpose of video production services, as detailed in our Privacy Policy.

2. Subject Matter and Duration

The subject of the processing is the creation of video content. This includes the handling of raw footage, interview transcripts, and contact details of individuals appearing in the videos. The duration of the processing shall be for the period necessary to fulfil the obligations of the project and the subsequent archive period defined in our business rules (6 months), as further elaborated in Terms and Conditions Section 3.

3. Obligations of the Processor

Digadiorcollective Pty Ltd agrees to:

• Process data only on documented instructions from the Client.
• Ensure that persons authorised to process the data have committed themselves to confidentiality.
• Assist the Client in responding to requests from data subjects exercising their rights under the Privacy Act 1988 (Cth).
• Implement appropriate security measures to protect data against unauthorised access or loss.

4. Sub-processing

The Client acknowledges that Digadiorcollective Pty Ltd uses the following sub-processors to provide its services:

• Micron 21 Pty Ltd: Hosting provider located at Unit 2, 7 Eastspur Court, Kilsyth South VIC 3137.
• FormSubmit: Third-party service used for processing enquiry forms (data is transmitted to servers in the USA).

5. Technical and Organisational Measures

We maintain a security framework that includes encrypted storage for project files, secure access controls for our production team, and regular backups. All processing is conducted using professional-grade hardware and software to prevent data corruption or leakage.

6. Data Breach Notification

In the event of a personal data breach, Digadiorcollective Pty Ltd will notify the Client without undue delay. We will provide sufficient information to allow the Client to meet any obligations to notify the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches (NDB) scheme.

7. Return and Deletion of Data

Upon termination of the services or the expiry of the 6-month archive period, Digadiorcollective Pty Ltd shall, at the choice of the Client, delete or return all personal data. Any remaining copies will be permanently erased from our production drives and cloud backups, unless retention is required by Australian law.

8. Audit Rights and Jurisdiction

The Client has the right to request reasonable information regarding the data processing activities to verify compliance with this DPA. Any disputes arising from this agreement shall be subject to the exclusive jurisdiction of the courts in Melbourne, Victoria.

For further enquiries or complaints, you may contact the Office of the Australian Information Commissioner (OAIC), GPO Box 5288, Sydney NSW 2001, or visit www.oaic.gov.au.