Release summary: Seller and payment-loss responsibility; annual liability caps and conditional Australian Consumer Law remedies; contracting identity; eligible payment channels; closure and credit deadlines; material provider changes.
This addendum forms part of the business terms. It governs customer information handled by Joseph Jack Nutt trading as HumanKindly, ABN 93 140 434 991, in providing BusinessThing to the accepting organization.
1 Responsibilities and scope
1.1 Customer information includes identifiable purchaser, attendee, registration, order, ticket, payment-status, communication, consent and attendance information processed for the organization's operations. It includes staff information where used to administer that organization. Our own billing, support, account security and necessary platform administration are also explained in the Privacy Policy.
1.2 You decide the legitimate purposes and appropriate content of your event and customer operations. We handle information to provide and secure the Service and follow your lawful instructions. Instructions include the agreement, supported configuration and verified support requests. We will raise an instruction we reasonably consider unlawful and may pause the affected processing while it is resolved.
1.3 These are contractual responsibilities, not a declaration that only one party has legal obligations. Australian law does not provide a general exemption merely because a party is called a processor. Each party remains responsible for duties applying to its actual collection, holding, use and disclosure. Organizers are Australian businesses, but their shoppers may be overseas. International offering, tracking and information handling must be assessed against applicable law; this addendum does not establish an exemption from foreign requirements.
1.4 You must provide appropriate collection notices, obtain required consent, minimize data and control staff access. We will provide reasonable product information and assistance. We will not knowingly act on an instruction that requires unlawful processing.
2 Permitted handling
2.1 We may collect, record, organize, store, retrieve, transmit and otherwise handle information as reasonably needed for enabled functions, support, security, fraud prevention, lawful financial reconciliation, the service diagnostics and usage analysis described in the Privacy Policy, legal compliance and your lawful instructions, subject to applicable law and any required consent. De-identified aggregates are subject to section 2.3; masked replay and pseudonymous usage records are not represented as de-identified aggregates. We will not sell customer lists or use identifiable customer information for unrelated advertising. We will not train a general-purpose AI model on customer information under this agreement.
2.2 Access is limited to authorized people and providers with a work-related need and appropriate confidentiality obligations. We will take reasonable steps to ensure those people understand the relevant restrictions. Customer data is not made available to another organizer without authority or another lawful basis.
2.3 Aggregates used for service analysis or improvement must be genuinely de-identified for the circumstances and permitted by law and the agreement. We will assess reasonable re-identification risks, avoid attempts to re-identify and impose appropriate recipient restrictions. Pseudonymous identifiers, hashes, small groups and masked replay are not automatically anonymous.
3 Sensitive information and children
3.1 Injury, medical and other sensitive information are outside the agreed beta scope. Do not design registration questions or uploads to request it. Collect only necessary ordinary booking information. Free text, imagery or correspondence can nevertheless contain unsolicited sensitive information; restrict unnecessary access, notify us securely and coordinate lawful assessment and removal or other required handling. Both parties retain their own applicable obligations for information actually held.
3.2 A consent to participate, a liability waiver, a privacy notice and consent to collect health information are different matters. Do not combine them into a statement suggesting that statutory rights are waived by agreeing to data collection.
3.3 Child information and authority to act for a child require an assessment of capacity, authority and safety under applicable law. The supported guardian declaration is evidence of what was declared, not independent verification or a guarantee a parent can waive a child's rights. Both parties will coordinate on disputed authority or a safety concern and restrict unnecessary disclosure.
4 Security measures
4.1 We will maintain technical and organizational measures reasonably appropriate to the information and risk, including authenticated staff access, organization-scoped authorization, secure transport, protection of secrets, provider-backed storage safeguards, controlled deployment, audit and incident handling, and recovery arrangements. Specific certifications, absolute security and recovery-time guarantees are not promised by this addendum.
4.2 We will review hosting and storage configuration, privileged access, provider arrangements, recovery and monitoring periodically and when material changes occur. We will provide reasonable information about relevant safeguards on a verified customer request, subject to confidentiality and protection of security-sensitive details.
4.3 Payment credentials are handled by the relevant payment provider. Neither party should send full card details, authentication secrets or live capability links through ordinary support channels. Exported information must be transferred securely with access limited to the authorized recipient. Staff Mobile stores operational copies and pending work on devices for supported offline workflows. You must secure permitted devices, manage staff access and synchronize pending work. We will maintain the supported local-storage and access controls and provide reasonable instructions for loss, revocation and cleanup; remote revocation alone is not a guarantee of immediate deletion from an offline device.
5 Providers and overseas handling
5.1 You authorize the service providers in the accepted provider register, subject to this section. We will assess provider terms, security, confidentiality, permitted use, onward handling and return/deletion where relevant. Some payment and identity providers also act independently under their own terms; calling them providers does not make them subordinate processors for every activity.
5.2 We will give reasonable advance notice, ordinarily at least 30 days, of a material new provider receiving customer information or a material change to an existing provider arrangement, including a materially different processing location, purpose, onward recipient access or protection. Urgent security, legal or replacement needs may require shorter notice, with explanation as soon as practicable. On reasonable privacy grounds you may object; we will discuss a reasonable alternative. If the objection cannot reasonably be resolved, you may end the affected service with appropriate unused-period relief and data return, without an additional termination penalty. A general reference to global processing does not remove this process. We will communicate a material change we learn of late as soon as practicable and explain the available protection and exit options.
5.3 Information may be handled outside Australia for hosting, storage, email, support, analytics, identity and payments. We will identify likely recipient countries where practicable and take the steps required by applicable law. The legal distinction between controlled provider use and an overseas disclosure depends on the actual arrangement. Australian database hosting alone does not establish that all copies, logs, files, support access and backups remain in Australia.
6 Requests and cooperation
6.1 You handle requests about your customer relationship and records in the first instance; we assist with supported searches, exports, corrections, restrictions and lawful deletion. We will also respond to requests concerning information for which we have our own responsibilities. Referring a person to an organizer does not end our own applicable duties.
6.2 We will verify authority proportionately before disclosure or alteration and coordinate promptly to meet applicable deadlines. We will explain any lawful refusal or retention and available complaint route. We do not promise unrestricted deletion of all transaction, consent, legal or financial evidence on demand.
6.3 Ordinary privacy-request assistance is included. Any genuinely exceptional work and proposed charge must be agreed in advance and lawful; a fee must not obstruct a request we must handle without charge. We will make reasonable security and handling information available for a proportionate due-diligence request, using documents or a confidential discussion before an intrusive audit.
7 Incidents
7.1 Each party will notify the other without undue delay after becoming aware of an incident affecting shared customer information where coordination is needed, and provide available information about scope, containment and next steps. Do not wait for a complete forensic report before an initial useful notice. Notification is not an admission of fault.
7.2 We will contain and investigate incidents within our responsibility, preserve appropriate evidence and assist with remediation. The parties will coordinate notifications without preventing either from fulfilling its own legal duties. Where the Notifiable Data Breaches scheme applies, the 30-day assessment requirement is not permission to delay a required notification once the threshold is established.
8 Closure and retention
8.1 Closure takes effect under business terms section 11.1; an outstanding or disputed bill does not postpone this timetable. For at least 30 calendar days after effective closure you may request return of available customer information through support in a reasonably usable format. We will arrange verified, secure delivery and confirm scope and expected timing. A timely return request will not be defeated by deleting the requested information while delivery is being arranged. Continued Portal access is not promised. Tell us earlier if a known legal deadline requires faster handling.
8.2 Following that request period, we will take reasonable steps to delete or de-identify customer information no longer needed for a lawful purpose, ordinarily within a further 90 days. We will explain exceptions and material delays.
8.3 Exceptions include necessary financial records, unresolved refunds/disputes, valid legal holds, proportionate security evidence and records required by law. Retained data is restricted to its remaining purpose. We will not use a cancelled account's retained customer information to resume unrelated operations or marketing.
8.4 Backup copies follow the verified provider rotation/expiry schedule and are isolated from ordinary use. If a backup is restored, completed deletion/restriction instructions must be reapplied before ordinary access resumes. We will explain the relevant backup constraint rather than promise immediate deletion from every copy.
9 Duration and responsibility
9.1 This addendum applies while relevant information is held. Liability and dispute provisions in the business terms apply, subject to mandatory law. It does not assign away statutory liability or bind a regulator or individual to a contractual allocation.
9.2 Processing details: data subjects are purchasers, attendees, authorized signers and staff; handling occurs continuously as enabled services are used; the purposes are service delivery, support, security and permitted legal/financial administration; data categories are those described in section 1 and the privacy inventory. Child data and unsolicited sensitive information require the additional assessment in section 3.
