1. The Parties acknowledge that the Customer is the Data Controller and Humanised is a Data Processor of Customer Personal Data. 
2. This Data Processing Addendum only applies to the processing of Customer Personal Data by Humanised in connection with the Services under the Agreement. The categories of Data Subjects and types of Customer Personal Data processed are set out in  Schedule 1 hereto. Customer Personal Data is processed for the purpose of providing the Services and other purposes as identified in the “processing activities” section of  Schedule 1  hereto.  Humanised  shall process Customer Personal Data for the duration of the Agreement (or longer to the extent permitted by Applicable Law).
3. Each party warrants that in relation to this Data Processing Addendum, it is compliant with and will remain compliant with all applicable Laws. Customers shall ensure that it has a provided notice to data subjects and that there is a valid lawful basis under European Data Protection Laws for all Customer Personal Data that is disclosed to Humanised in connection with the Agreement for the data processing activities envisaged by the Agreement and this Addendum.
4. Notwithstanding anything to the contrary in the Agreement, in relation to Customer Personal Data, Humanised shall:
   
   
   1. process Customer Personal Data only in accordance with the Customer’s instructions as established in the Agreement or as provided in writing by the Customer from time to time, provided such instructions are reasonable and subject to Humanised’s  right to charge additional sums at its current rates should the scope of the agreed services be exceeded. Notwithstanding the foregoing, Humanised may process Customer Personal Data as required under Applicable Laws. In this situation, Humanised will take reasonable steps to inform the Customer of such a requirement before Humanised processes the data, unless the law prohibits this;
   2. notify Customer immediately, if in Humanised’s opinion, an instruction from the Customer infringes European Data Protection Law;
   3. ensure only its (or its Sub-Processors) personnel who are contractually bound to respect the confidentiality of Customer Personal Data shall have access to the same;
   4. implement appropriate technical and organizational measures to protect against unauthorized or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data. These measures shall be appropriate to the harm which might result from any unauthorised or unlawful processing, accidental loss, destruction, damage or theft of Customer Personal Data and having regard to the nature of the Customer Personal Data which is to be protected and shall be as set forth in Schedule 1. Customers acknowledge that Humanised may change the security measures through the adoption of new or enhanced security technologies and authorises Humanised to make such changes provided that they do not materially diminish the level of protection. Humanised shall make information about the most up to date security measures applicable to the Services available at ïnsert security measures
   5. at the Customer’s reasonable request and at the Customer’s cost, taking into account the nature of the processing, assist the Customer by implementing appropriate technical and organisational measures, insofar as this is possible, to assist with the Customer’s obligation to respond to requests from Data Subjects of Customer Personal Data seeking to exercise their rights under European Data Protection Law (to the extent that the Customer Personal Data is not accessible to the Customer through the Services provided under the Agreement);
   6. at the Customer’s reasonable request and at the Customer’s cost, taking into account the nature of processing and the information available to Humanised, assist the Customer with its obligations under Articles 32 to 36 of the GDPR; and 
   7. upon request by the Customer, delete or return to the Customer any such Customer Personal Data within the agreed period of time after the end of the provision of the Services as set out in the Agreement (or within a reasonable period of time if the Agreement is silent on this point), unless Applicable Laws requires storage of the Customer Personal Data. Unless otherwise provided in the Agreement, Humanised reserves the right to charge for such deletion or return of such Customer Personal Data. Customer acknowledges and agrees that Humanised may use Customer Personal Data for analytics, research, development and product improvement purposes.
   8. The Customer agrees that Humanised may transfer Customer Personal Data or give access to Customer Personal Data to Sub-Processors for the purposes of providing the Services or other purposes identified in the ‘Processing activities’ section of the Appendix to the Agreement, provided that Humanised complies with the provisions of this Clause. Humanised shall remain responsible for its Sub-Processor’s compliance with the obligations of this Data Processing Addendum. Humanised shall ensure that any Sub-Processors to whom Humanised transfers Customer Personal Data enter into written agreements with Humanised requiring that the subcontractor abide by terms no less protective, in any material respect, than this Data Processing Addendum. A current list of Sub-Processors approved as at the date of this Data Processing Addendum is available in the privacy policy. Humanised can at any time and without justification appoint a new Sub-processor provided that the Customer is given fifteen (15) days’ prior written notice and the Customer does not legitimately object to such changes within that timeframe. Legitimate objections must contain reasonable and documented grounds relating to a Sub-processor’s non-compliance with applicable European Data Protection Law. If Humanised is unable to make available such change within a reasonable period of time, which shall not exceed sixty (60) days, Customer may terminate the applicable Services which cannot be provided by Humanised without the use of the objected-to new Sub-Processor by providing written notice to Humanised. Humanised will refund Customer any prepaid fees covering the remainder of the term of the Services following the effective date of termination with respect to such terminated Services.
5. The Customer acknowledges that as part of the Services the Customer Personal Data may be located in or accessed from Australia or another Relevant Country. Where this involves Humanised or its Affiliates, the Standard Contractual Clauses in Attachment 1 of this Data Processing Addendum will apply in addition to the terms of this Data Processing Addendum. For other Sub-Processors based in Relevant Countries, the parties shall take steps to ensure that there is adequate protection for any such transfers of Customer Personal Data as defined in European Data Protection Laws. Where the Standard Contractual Clauses apply, the Customer acknowledges the following:
   
   
   1. Instructions: For the purposes of Clause 5(a) of the Standard Contractual Clauses, processing in accordance with the Agreement or as provided in writing by the Customer from time to time (subject to the data importer’s right to charge additional sums at its current rates should the scope of the agreed services be exceeded is deemed to be an instruction by the Customer to process Customer Personal Data);
   2. Sub-Processors: Pursuant to Clause 5(h) of the Standard Contractual Clauses the Customer acknowledges that data importer may engage third party Sub-processors in connection with the provision of the Services and that Humanised shall make available to the Customer the current list of all Sub-processors as set out in Clause 2.5 above. Humanised will notify the Customer of any new Sub-processors engaged by the data importer as set out in Clause 2.5 above;
   3. Copies of Sub-Processor Agreements. The Customer agrees that copies of any Sub-processor agreements that must be provided to the Customer pursuant to Clause 5(j) of the Standard Contractual Clauses may have all commercial information or clauses unrelated to the Standard Contractual Clauses or their equivalent removed by the data importer beforehand; and that such copies will be provided by the data importer in a manner to be determined in its discretion, only upon request by the Customer via email support@humanisedtech.com; 
   4. Audits: The Customer agrees that the audits described in Clause 5(f) and Clause 12(2) of the Standard Contractual Clauses shall be carried out in accordance with Clauses 2.7-2.9 below;
   5. Certification of Deletion: To the extent applicable and required, the parties agree that the certification of deletion of personal data that is described in Clause 12(1) of the Standard Contractual Clauses shall be provided by the data importer only upon the Customer’s written request via email to support@humanisedtech.com; and

Conflict: In the event of any conflict or consistency between the body of this Data Processing Addendum and any of its Schedules (not including the Standard Contractual Clauses) and the Standard Contractual Clauses in Attachment 1, the Standard Contractual Clauses will prevail (unless this would result in the invalidity of this Data Processing Addendum under European Data Protection Laws (in which case the relevant term(s) of this Data Processing Addendum shall prevail).

1. Humanised shall notify the Customer, without undue delay, if Humanised becomes aware of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data transmitted, stored or otherwise processed by Humanised (“Security Incident”) and take such steps as the Customer may reasonably require, within the timescales reasonably required by the Customer, to remedy the Security Incident and provide such further information as the Customer may reasonably require. Humanised’s assistance under this Clause 2.6 shall be chargeable, as incurred, at Humanised’s then current rates unless and to the extent that the Customer demonstrates that such assistance is required because of a failure by Humanised to comply with the obligations under this Data Processing Addendum.
2. Humanised shall audit the security of the computers and computing environment that it uses in processing Customer Personal Data and the physical locations from which it processes Customer Personal Data (including that of its Sub-Processors). This audit: (a) will be performed at least annually; and (b) may be performed by independent third-party security professionals at Humanised’s selection and expense. 
3. Humanised shall respond, no more frequently than annually, to any reasonable security questionnaire provided by Customer which seeks to assist Customer’s assessment of Humanised’s compliance with the security obligations under this Data Processing Addendum. Such security questionnaires may request copies of any third-party compliance certificates or audit reports (or equivalent) held by Humanised and which may be applicable to the Services. The responses to such questionnaires and any supporting evidence provided by Humanised shall be considered confidential information of Humanised. 
4. If the Customer desires to change this instruction regarding exercising the audit right or the provision of information in order to demonstrate compliance with Article 28 of the GDPR, then the Customer has the right to change this instruction to the extent so required to ensure compliance, which shall be requested in writing via email to support@humanisedtech.com, provided that Humanised shall have no obligation to provide commercially confidential information.
5. [If the Customer’s request for information or access relates to a sub-processor, or information held by a sub-processor which Humanised cannot provide to the Customer itself,  Humanised will promptly submit a request for additional information in writing to the relevant sub-processor(s). The Customer acknowledges that access to the sub-processor’s premises or to information about the sub-processor’s previous independent audit reports is subject to agreement from the relevant sub-processor, and that Humanised cannot guarantee access to that sub-processor’s premises or audit information at any particular time, or at all].
6. The parties acknowledge and agree that any liability arising under this Addendum is subject to the liability sections of the Agreement (including as applicable Section 12 and 13 of the Humanised Platform Terms and Conditions and/or Section 7 of the Humanised Payroll Terms and Conditions ).