Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Smart Scheduler AI Terms & Conditions between you ("Controller") and Suiviro Pty Ltd t/a Smart Scheduler AI ("Processor") where the Processor processes personal data on behalf of the Controller in connection with the Service.

1. Subject matter

Processor processes personal data to provide the Service - including scheduling, travel-time computation, notifications, and support - as instructed by the Controller through the Service's ordinary operation.

2. Duration

Processing lasts for the term of the Controller's subscription.

3. Nature and purpose

Storing, retrieving, transmitting, analysing, and displaying personal data entered by the Controller and its authorised users.

4. Categories of data subjects and data

• Controller's staff, contractors, and customers.
• Contact details, addresses (for geocoding), scheduling metadata, calendar busy-time metadata.

5. Subprocessors

A current list is on our Privacy Policy. We give 30 days' notice of new subprocessors via the Service or by email.

6. Security

Processor maintains technical and organisational measures appropriate to the risk, including access controls, encryption in transit, encryption of sensitive secrets at rest, row-level authorisation, logging, and staff confidentiality obligations.

7. Data subject rights

Processor assists Controller in responding to data subject requests through the Service's export and deletion features and, where necessary, via manual support.

8. International transfers

Where personal data is transferred outside Australia or the EEA/UK, the transfer is protected by Standard Contractual Clauses or equivalent safeguards.

9. Breach notification

Processor notifies Controller without undue delay after becoming aware of a personal data breach affecting Controller's data.

10. Deletion

On termination, Processor deletes or returns Controller's personal data within 30 days, subject to legal retention.

11. Contact

privacy@smart-scheduler.com. A countersigned copy of this DPA is available on request.