Legal Data processing agreement.

Version: 17 October 2026

Provider: Louis Pont trading as Kybos (ABN 40 798 701 909) ("Kybos").

Customer: The legal person named in the applicable signed master services agreement, accepted quote or order ("Customer").

1. Purpose, scope and order of documents

1.1 This Data Processing Agreement ("DPA") forms part of the agreement under which Kybos provides the Site Atlas service and any related hosting, capture, processing or support identified in an accepted order (the "Services" and the "Agreement"). It applies when Kybos handles Customer Personal Data on Customer's behalf. It does not automatically apply to a person merely viewing a public demo or sending a general enquiry to Kybos.

1.2 Customer Personal Data means personal information in material Customer or its users submit to the Services, or that Kybos captures or receives for Customer's project under the Agreement, including information in Site Atlas project records and visitor interest or report requests, to the extent it relates to an identifiable individual. The processing details in Schedule 1 form part of this DPA.

1.3 The parties use controller for the party that determines the purposes and essential means of handling Customer Personal Data and processor for the party that handles it on that party's behalf. These are contractual descriptions of their functions; they do not change either party's direct duties under the Privacy Act 1988 (Cth), Australian Privacy Principles (APPs), Notifiable Data Breaches scheme or other applicable law. For Customer Personal Data, Customer is ordinarily the controller and Kybos is ordinarily the processor, unless Schedule 1 identifies a different arrangement for a specific activity.

1.4 Kybos handles its own business contact, quote, account, billing, support, website, security and compliance information for its own purposes under its Privacy Policy. Customer remains responsible for its own notices and lawful use of any Site Atlas visitor lead after receipt. A visitor's submission to a client project may create obligations for both parties in their respective roles.

1.5 If this DPA conflicts with the Agreement on handling Customer Personal Data, this DPA controls to that extent. The Agreement otherwise continues to govern fees, service scope, intellectual property, liability, dispute resolution and governing law. Any non-excludable right or duty under applicable law prevails. An order may specify more protective data-handling requirements but must do so expressly.

2. Customer instructions and responsibilities

2.1 Customer instructs Kybos to process Customer Personal Data only to provide, secure and support the Services; to follow the documented settings and actions of Customer's authorised users; to carry out the additional written instructions agreed by both parties; or as required by applicable law. The Agreement, this DPA, Schedule 1 and Customer's authorised configuration are Customer's initial documented instructions. Kybos will promptly tell Customer if it reasonably believes an instruction would breach applicable privacy law, unless prohibited by law, and may pause the affected processing while the parties resolve the issue.

2.2 Customer is responsible for deciding what project material to supply, which project areas and people may be captured, who may access a project, how long the project should be hosted, and whether any Site Atlas content or lead forms should be available under Off, Password or Open sharing settings. Password mode uses a shared project password, so Customer must manage its distribution and change it when needed. Customer must assess whether Open access is suitable for any personal information in the project. In practice, Off shows "not found" and serves no files; Password shows a password page at the project's own address, refuses files until a correct password is entered, keeps a visitor signed in for up to 30 days and asks search engines not to list the page; Open lets anyone with the link view the project. Changing the password signs everyone out.

2.3 Customer will provide any privacy notices and obtain any permissions, consents or other lawful basis needed for its instructions, files, capture locations, project publication, sharing and follow-up with visitors. Customer will take reasonable steps to minimise unnecessary personal information, remove credentials or sensitive details from uploads, and tell Kybos before sending special-risk material so the parties can agree whether and how it can be handled. Customer will not instruct Kybos to capture or publish areas or information for which Customer lacks lawful authority. These responsibilities do not remove Kybos' own legal duties or liability for its own breach.

2.4 Customer will maintain appropriate security for its accounts, authorised users, links and shared passwords and will promptly tell Kybos of suspected misuse. Customer may request a change in sharing settings or removal of specific content, subject to technical constraints and the Agreement.

3. Kybos' processing commitments

3.1 Kybos will process Customer Personal Data only on the instructions described in clause 2.1, except where Australian law or another law binding on Kybos requires different processing. If legally permitted, Kybos will tell Customer before such compelled processing.

3.2 Kybos will ensure that people it authorises to handle Customer Personal Data are subject to confidentiality obligations and access it only as needed for their work. Kybos will not sell Customer Personal Data or use it for unrelated advertising, marketing to Site Atlas visitors, or unrelated model training. Kybos may use genuinely de-identified, aggregated operational information only where re-identification is not reasonably practicable and the use does not disclose Customer confidential information; Customer Personal Data remains subject to this DPA until that standard is met.

3.3 Kybos may use project imagery and the project's name in its marketing unless Customer opts out (Terms of Service, clause 6.3), uses Customer's name or logo only with permission, and will not publish personal information about an individual (for example a face, a name or a vehicle registration) without the permission the law requires.

3.4 Kybos will use reasonable care and skill in providing the Services and will handle Customer Personal Data in accordance with laws applicable to Kybos. Neither party may use this DPA to waive rights or obligations that cannot lawfully be excluded.

4. Security

4.1 Kybos will take technical and organisational steps reasonable in the circumstances to protect Customer Personal Data from misuse, interference, loss and unauthorised access, modification or disclosure, having regard to the nature of the data, risks, current technology and the Services. Kybos will periodically review those steps and its access permissions and incident procedures. The actual, verified controls and any agreed project-specific requirements must be recorded in Schedule 2 before this DPA is relied on as a security assurance. This clause does not warrant that incidents cannot occur.

4.2 Kybos will limit access to authorised personnel and service providers who need it for the Services, will use appropriate confidentiality arrangements, and will require its subprocessors to provide protection substantially equivalent to the obligations Kybos owes Customer under this DPA. Kybos remains responsible to Customer for a subprocessor's performance of its delegated processing obligations.

4.3 Kybos will maintain reasonable processes to identify, assess, contain and investigate a security incident involving Customer Personal Data. Customer is responsible for the security of its own systems, its upload decisions, users and any externally shared link or password, except to the extent a loss is caused by Kybos' act or omission.

5. Security incidents and notification

5.1 A Customer Data Security Incident is confirmed or reasonably suspected unauthorised access to, disclosure of, loss of, or material alteration of Customer Personal Data in Kybos' or a subprocessor's control. Routine unsuccessful probes that do not compromise Customer Personal Data are not incidents under this clause.

5.2 Kybos will notify Customer without undue delay after becoming aware of a Customer Data Security Incident, using the incident contacts in Schedule 1, and in any event within 48 hours. Initial notice may contain incomplete information; Kybos will provide material updates as reasonably available. Notice will, to the extent then known, describe the incident, affected data or projects, likely consequences, containment steps and a contact for coordination. Notice is not an admission of fault.

5.3 Kybos will take reasonable steps to contain, investigate and remediate the incident and preserve relevant evidence. The parties will cooperate in assessing whether notification to individuals, the OAIC or another authority is required. Neither party may prevent the other from making a notification required by law. Each party remains responsible for its own statutory assessment and notification obligations. The Australian Notifiable Data Breaches scheme's 30-day period is an assessment limit in relevant circumstances, not the incident notice period owed under this DPA.

5.4 Customer will not make a public statement attributing fault to Kybos before giving Kybos a reasonable opportunity to provide relevant facts, unless a legal deadline or urgent risk makes that impracticable. This does not delay any legally required notification or prevent truthful communication to affected people.

6. Subprocessors and overseas handling

6.1 Customer authorises the subprocessors listed in Schedule 3 for the functions and locations described there. The schedule must be completed before signature or first production processing; no named vendor, hosting country or Australian-only storage commitment is implied while it is blank. Kybos will keep an up-to-date list available to Customer.

6.2 Kybos will give Customer 15 business days' advance written notice of a material addition or replacement of a subprocessor that will handle Customer Personal Data, including its function and processing location, unless an urgent replacement is needed to address an outage or security issue. In that case, Kybos will notify Customer as soon as reasonably practicable. Customer may object within that period on reasonable privacy or security grounds. The parties will work in good faith on a practical alternative; if none is available, Customer may stop the affected processing or terminate the affected Services in accordance with the Agreement and applicable law.

6.3 Kybos will bind each subprocessor by written obligations appropriate to the processing, including confidentiality, security, incident reporting, assistance with requests and deletion or return of information. Kybos will take reasonable steps to assess the provider before access is granted and monitor material changes relevant to the protection of Customer Personal Data.

6.4 Kybos will identify in Schedule 3 any country outside Australia where a subprocessor is likely to receive Customer Personal Data or access it for support. Kybos will take the steps required by APP 8 where it applies to an overseas disclosure, including reasonable contractual and due-diligence measures unless a lawful exception applies. Customer's authorisation of a transfer does not, by itself, eliminate either party's APP obligations. Kybos will give notice before materially changing those countries and will not make a restricted international transfer without a lawful basis and any additional transfer terms the parties are required to sign.

6.5 Where the EU or UK GDPR applies to a particular processing activity, the parties will complete a separate applicable Article 28 and international-transfer schedule before that activity begins. This DPA does not assert that GDPR applies to every Australian project or supply standard contractual clauses by implication.

7. Individual requests and compliance assistance

7.1 If Kybos receives a request to access, correct or delete Customer Personal Data, or an objection or complaint about Customer-controlled processing, Kybos will promptly refer it to Customer where appropriate, unless law requires Kybos to respond directly. Kybos will provide reasonable assistance, taking account of the nature of the processing and information available to it, so Customer can respond to lawful requests. Kybos may verify a requester before disclosing information. Customer decides and documents the substantive response for its own project information, subject to Kybos' direct legal duties.

7.2 On reasonable request, Kybos will provide information available to it about its processing, security measures, subprocessors and incidents that Customer reasonably needs to demonstrate compliance, conduct a privacy impact or security assessment, or respond to a regulator. The parties will agree scope and timing for substantial assistance outside ordinary support, and Customer will pay reasonable agreed costs unless the request arises from Kybos' breach.

7.3 Customer will promptly notify Kybos if it identifies inaccurate project information, an unauthorised upload or a rights request that requires Kybos' action. Each party will cooperate reasonably with the other on correction, de-identification, access restrictions and lawful retention.

8. Audit and evidence

8.1 No more than once in any 12-month period, and additionally after a material Customer Data Security Incident or a regulator's lawful request, Customer may request reasonable evidence of Kybos' compliance with this DPA. Kybos may satisfy an ordinary request with current policies, completed questionnaires, relevant independent reports or other suitable evidence, with sensitive details redacted where necessary to protect security or third-party confidentiality.

8.2 If that evidence cannot reasonably resolve a material concern, the parties will agree a narrowly scoped audit by an independent, qualified auditor subject to confidentiality, reasonable notice, normal business hours, security rules and no access to other customers' data. Customer bears the reasonable audit cost unless it establishes a material breach by Kybos. The audit must not unreasonably disrupt the Services or weaken security.

9. Return, export and deletion

9.1 During the agreed hosting period, Kybos will provide the access or export capability stated in the applicable order. Files Customer can keep (exports and offline copies) are available only where the order includes the offline add-on, in the formats it specifies; the add-on is chosen when the order is accepted because it determines the capture and processing technology used. Otherwise the Services are hosted access only. Customer should retain its own copies of files that it needs independently of the hosted Service. Kybos will not delete active Customer Personal Data solely because a request or complaint is pending without considering any preservation duty.

9.2 On expiry or termination of the affected Services, Kybos will deliver any offline copy included in the order and, subject to lawful retention, delete or de-identify Customer Personal Data within 90 days after the hosting period ends, or within 90 days after delivery where nothing is hosted. Archived backups may be retained temporarily under a documented rotation or legal-hold process and must remain protected and unavailable for ordinary use until overwritten or deleted within a further 90 days.

9.3 Kybos may retain information to the extent required by law, for a legitimate legal claim or to meet direct statutory duties; it will limit use to that purpose, protect it and delete or de-identify it when the basis ends. Kybos may provide written confirmation of deletion on reasonable request. Public or Customer-authorised recipients who previously downloaded or copied an openly shared project are outside Kybos' control, and deletion from Kybos' systems does not retrieve those copies.

10. Liability and general terms

10.1 The Agreement allocates the parties' contractual liability for this DPA, subject to any liability that cannot lawfully be limited or excluded. Nothing in this DPA limits a person's rights under the Australian Consumer Law or a regulator's statutory powers. A party is responsible for its own breach of applicable law and of this DPA to the extent provided by the Agreement and law.

10.2 This DPA remains effective while Kybos handles Customer Personal Data under the Agreement. Clauses concerning confidentiality, security of retained data, deletion, audit records and liability survive to the extent needed to give them effect. Changes must be agreed in writing, except that Kybos may update the subprocessor list through the process in clause 6.2.

10.3 Notices under this DPA may be sent to the contacts in Schedule 1. Legal notices and governing law follow the Agreement unless an order expressly says otherwise.

Schedule 1 — Processing description and contacts

Schedule 2 — Security measures and service configuration

These are the measures in place at the version date. Kybos will tell Customer of any material reduction.

Schedule 3 — Approved subprocessors and processing countries