Data Processing Agreement
The contractual terms for how we process data on your behalf.
- You are the Controller of your data; we are the Processor acting on your instructions.
- Your data is processed for one purpose only: delivering BIQc services to you.
- Sub-processors are bound to equivalent protections, and each one is named, with its country, in our Privacy Policy.
- On termination, your account can be recovered for 30 days and its data is then permanently deleted from our live systems; backups expire within 90 days. Billing records are kept for 7 years, and other data only where another legal obligation applies (section 6).
1. Scope
This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between Business Intelligence Quotient Centre Pty Ltd (ABN 98 695 595 978) ("Processor") and the customer ("Controller") and governs the processing of business data through the BIQc platform.
2. Roles
- Data Controller: the customer, who determines the purpose and means of processing.
- Data Processor: Business Intelligence Quotient Centre Pty Ltd, processing data on the Controller's behalf.
3. Processing purpose
Data is processed solely for the purpose of providing governed business intelligence services as described in the BIQc service agreement.
4. Data categories
- Financial data.
- CRM data.
- Operational data.
- Email messages (content and metadata) and calendar events from Google or Microsoft accounts the Controller's users connect.
- Questions asked in BIQc, uploaded documents and AI outputs.
5. Sub-processors
We maintain a current list of sub-processors used in data processing, including AI model providers operating under training restrictions. Some sub-processors, including AI model providers, may process data outside Australia; cross-border handling is managed in line with Australian Privacy Principle 8. All sub-processors are subject to equivalent data protection obligations. The current list, with each sub-processor's location, is published in our Privacy Policy, and we update it within 30 days of any change.
6. Data retention
Data is retained for the duration of the service agreement. On termination or account deletion, the account can be recovered for 30 days; after that its data is permanently deleted from live systems. Backups are overwritten within 90 days of deletion from live systems. Billing records are kept for 7 years as Australian tax law requires, and other data is kept longer only where another legal obligation applies.
7. Security measures
- AES-256 encryption at rest.
- TLS 1.2+ encryption in transit (TLS 1.3 preferred).
- Role-based access controls, checked on the server for every request, with database row-level security as a second layer.
- Incident response initiated within 72 hours of detection.
- Notice to the Controller without undue delay, and within 72 hours of confirming that the Controller's data was affected by a security incident.