This Data Processing Addendum (“DPA”) is incorporated into the SaaS Subscription Agreement (“Agreement”) between Axiom Automation Services Australia (ACN 694 714 693) (“Company”) and the Customer, and applies to processing of personal data carried out by the Company on behalf of the Customer through the SiteWise Services.
a. Roles
For Customer Data entered into SiteWise by or for the Customer, Customer is the APP entity / Data Controller and the Company is the Data Processor under the Privacy Act 1988 (Cth) (using those terms in their common SaaS sense). The Company processes personal data only on documented instructions from the Customer (including use of the Services) and as required by law. Account and billing data collected by the Company for subscription administration may be processed by the Company as an independent APP entity, as described in the Privacy Policy.
b. Scope of Processing
Categories of data processed include: worker identity and contact details; employment and role records; certifications; timesheets and attendance; safety and WHS form submissions; inductions, permits, and incidents; plant/gear/order records; in-app messages; AI feature inputs/outputs and drafts; voice/order metadata where phone order intake is enabled; and subscription-related personal data processed to operate billing.
c. Security Measures
- Encryption in transit (TLS 1.2+) and at rest (AES-256 as provided by hosts)
- Role-based access controls and row-level security policies
- Password and PIN hashing (bcrypt)
- Regular security assessments and vulnerability scanning
- Industry-standard controls oriented to the ASD/ACSC Essential Eight
d. Sub-processors
Customer consents to the Company’s use of the following sub-processors, subject to written agreements imposing appropriate data-protection obligations:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, auth, storage, edge functions | Australia preferred / as configured |
| Stripe | Payments, subscriptions, invoices, portal | Australia / overseas (Stripe) |
| OpenAI | Optional AI-assisted features | Overseas (primarily USA) |
| Resend | Transactional email delivery | Overseas / as configured |
| Google (Maps) | Map embeds and directions | Overseas / Google regions |
| Retell | AI phone order intake (where enabled) | Overseas |
| Web push providers | Push notification delivery | As configured by browser/OS vendors |
The Company will notify Customer before engaging any new material sub-processor and will provide a reasonable opportunity to object. Continued use after notice without timely objection constitutes consent.
e. Cross-Border Data Transfers
The Company may transfer personal data outside Australia where necessary for the Services. Reasonable steps consistent with APP 8 will be taken before overseas disclosure.
f. Data Breach Notification
The Company will notify Customer without undue delay (and in any case within 72 hours of becoming aware) of any eligible data breach likely to result in serious harm, and will provide sufficient details for Customer to assess the breach, notify individuals, and report to the OAIC as required.
g. Deletion and Return of Data
Upon termination, the Company will, at Customer’s election, delete or return personal data within 30 days, except where retention is required by law (including WHS, Fair Work, tax, and similar obligations) or for legal claims. Retention will be restricted to those purposes. Written confirmation of deletion is available on request.
h. Audit Rights
Customer may audit the Company’s compliance with this DPA on reasonable notice during business hours. Audits more than once per year may be at Customer’s reasonable cost. Version 3.0 — August 2026.
In the event of conflict between this DPA and the Agreement regarding personal data processing, this DPA prevails. Related: Terms · Privacy Policy.