Data Processing Agreement

1. Purpose

This Data Processing Agreement (DPA) applies between SideMind (ABN 14 649 487 237) as the data processor and the Client as the data controller. It governs the processing of personal data that SideMind handles on behalf of the Client in connection with the services provided.

2. Definitions

• Personal Data: Any information relating to an identified or identifiable individual, including names, phone numbers, email addresses, and conversation records
• Data Controller: The Client, who determines the purposes and means of processing personal data
• Data Processor: SideMind, which processes personal data on behalf of the Client
• Processing: Any operation performed on personal data, including collection, storage, use, and deletion

3. Data We Process on Your Behalf

In delivering the SideMind service, we process the following categories of your customers' personal data:

• Phone numbers (web form leads, SMS leads, and inbound callers where voice features are deployed)
• Names and email addresses (where provided during qualification conversations)
• SMS conversation content from lead qualification and quote follow-up workflows
• Quote details and follow-up status
• Appointment booking details
• Lead qualification responses relevant to your business (service interest, timing, budget range, contact preference)
• Call recordings and transcripts where AI voice agent features are deployed for a specific client

4. Our Obligations as Data Processor

SideMind agrees to:

• Process personal data only on your documented instructions and for the purposes of delivering the service
• Ensure all personnel with access to personal data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures
• Assist you in responding to individuals exercising their privacy rights
• Delete or return personal data upon termination of the service as instructed
• Notify you without undue delay upon becoming aware of a personal data breach affecting your customers' data
• Provide reasonable assistance to help you comply with applicable privacy laws

5. Sub-Processors

We use third-party hosting, messaging, telephony, scheduling and payment providers as sub-processors to deliver the service. They fall into the categories below. By agreeing to these terms, you authorise their use:

• Customer management and messaging providers: customer records, phone numbers, SMS and voice messaging, call recordings where voice features are deployed, and booking
• SMS delivery providers: sending and receiving text messages, and sender ID
• Integration providers: moving data between systems
• Data storage and calendar providers: storing data and managing calendars
• Scheduling providers: appointment booking
• Website hosting providers: website hosting
• Payment providers: payment processing
• AI processing providers: processing messages and conversations

Some sub-processors store or process data outside Australia, including in the United States. A current list of our sub-processors, with their names and locations, is available on request by emailing kevin@sidemind.com.au. We will notify you of any intended changes to sub-processors with reasonable advance notice.

6. Your Obligations as Data Controller

As the data controller, you are responsible for:

• Ensuring you have a lawful basis for collecting and processing your customers' personal data
• Providing appropriate privacy notices to your customers about how their data is used
• Ensuring your use of SideMind complies with applicable privacy laws in your jurisdiction
• Only instructing us to process data in ways that are lawful

7. Data Retention

We retain customer data processed on your behalf for the duration of your service agreement plus 90 days. After this period, data is securely deleted unless you request earlier deletion or we are legally required to retain it.

8. Security

We implement the following security measures to protect personal data:

• Access controls limiting data access to authorised personnel only
• Encryption of data in transit via industry-standard TLS
• Use of reputable, security-certified third-party platforms
• Regular review of access permissions and data handling practices

9. Contact

For data processing enquiries, contact kevin@sidemind.com.au.