Data Processing Agreement (DPA)

1. Definitions and Scope

This Data Processing Agreement ("DPA") is entered into by and between the Client (acting as the Data Controller) and Bandhdelta Pty Ltd, represented by Director Olivia Evans, located at 142 Queen Street, Brisbane QLD 4000 (acting as the Data Processor). This agreement governs the processing of personal data and technical specifications in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Subject Matter and Duration

The subject of this processing is the provision of 3D printing, 3D scanning, and design services as detailed in our Services section. This DPA remains in effect for the duration of the business relationship and continues until all data is deleted or returned in accordance with Section 7.

3. Data Categories and Subjects

The Processor shall handle the following categories of data:

• Contact Data: Names, email addresses, and phone numbers of company representatives.
• Technical Data: 3D models (STL, STEP), blueprints, and design specifications provided by the Client.
• Transaction Data: Billing addresses and payment confirmation details.

Data subjects include employees of the Client and designated project coordinators.

4. Obligations of the Processor

Bandhdelta Pty Ltd agrees to:

• Process data only on documented instructions from the Client.
• Ensure that persons authorised to process the data have committed themselves to confidentiality.
• Assist the Controller in meeting obligations under the Privacy Act 1988 (Cth), including responding to data access requests.
• Maintain a strict separation between different clients' technical files to prevent cross-contamination of intellectual property.

5. Sub-processors

The Processor engages the following sub-processors to ensure service delivery:

• Micron 21 Pty Ltd (Unit 2, 7 Eastspur Court, Kilsyth South VIC 3137): Provided for secure web hosting and data storage.
• FormSubmit (USA): Used for the transmission of initial enquiry forms. Data is transferred to the USA under the principles of APP 8.

The Processor ensures that sub-processors are bound by data protection obligations no less stringent than those in this DPA.

6. Security Measures and Incident Notification

Bandhdelta Pty Ltd implements technical and organisational measures to protect data against unauthorised access or loss. In the event of a data breach, the Processor shall notify the Client without undue delay. All notifications will be handled in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth).

7. Data Return and Deletion

Upon termination of the services or at the request of the Client, the Processor shall delete or return all personal data. Specifically, 3D models and project files are stored for a period of 6 months to facilitate re-ordering, after which they are permanently deleted unless otherwise agreed in writing. This process is governed by the rules specified in our Terms and Conditions.

8. Audit Rights and Compliance

The Client has the right to request confirmation of compliance with this DPA. Bandhdelta Pty Ltd shall provide reasonable information to demonstrate that processing is performed in accordance with the Australian Privacy Principles. Any disputes regarding data handling may be referred to the Office of the Australian Information Commissioner (OAIC), GPO Box 5288, Sydney NSW 2001.

9. Governing Law and Jurisdiction

This Agreement is governed by the laws of Queensland, Australia. The parties agree that the courts of Brisbane shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this DPA.

For further enquiries, please contact us at [email protected] or call (07) 3484 1882.