Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between the customer named below (“Customer”) and OneTaskList Pty Ltd (ACN 698 036 798), Level 15, 461 Bourke Street, Melbourne VIC 3000, Australia (“OneTaskList”) for the OneTaskList service (the “Agreement”). It applies when OneTaskList processes personal data on the Customer’s behalf.

In short: the Customer decides how its people’s data is used; OneTaskList processes it only to provide the service, keeps it secure, uses only the sub-processors listed in Annex III, tells the Customer about a breach within 48 hours, helps with requests from individuals, and deletes the data when the Agreement ends. Transfers out of the EU, UK and Switzerland are covered by the Standard Contractual Clauses.

Terms used in data protection law, such as “controller”, “processor”, “personal data”, “processing”, “data subject”, “personal data breach” and “supervisory authority”, have the meaning given in the GDPR. In addition:

• Data Protection Law: the GDPR (Regulation (EU) 2016/679), the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection, the Australian Privacy Act 1988, and any other data protection law that applies to the processing.
• Customer Personal Data: personal data that OneTaskList processes on the Customer’s behalf in providing the service, as described in Annex I.
• Sub-processor: another processor that OneTaskList engages to process Customer Personal Data.
• SCCs: the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0).

• The Customer is the controller of Customer Personal Data, and OneTaskList is its processor.
• OneTaskList is a controller, not a processor, for the personal data it needs to run its own business: billing and account administration with the Customer, and keeping the service secure. Its privacy policy covers that data.
• Connected tools (for example Jira or Microsoft 365) and AI providers that the Customer’s users choose are not OneTaskList’s sub-processors. They act under the Customer’s or the user’s own agreements with them.

• OneTaskList processes Customer Personal Data only on the Customer’s documented instructions. The Agreement, this DPA, the Customer’s configuration of the service, and its users’ actions in the service are those instructions.
• OneTaskList processes Customer Personal Data otherwise only where the law requires it, and tells the Customer first unless that law forbids it.
• OneTaskList tells the Customer straight away if it believes an instruction breaks Data Protection Law.
• OneTaskList never sells Customer Personal Data, never uses it for advertising, and never uses it to train AI models.

OneTaskList ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, and has access only as far as their work requires.

OneTaskList implements the technical and organisational measures in Annex II, taking into account the state of the art, the cost, and the nature, scope, context and purposes of the processing, as well as the risk to people (Art. 32 GDPR). OneTaskList may change those measures as long as the overall level of protection doesn’t go down.

• The Customer authorises OneTaskList to engage the sub-processors in Annex III.
• OneTaskList gives the Customer at least 30 days’ notice before adding or replacing a sub-processor, by [email to the Customer’s contact and an update to onetasklist.com/subprocessors].
• The Customer may object on reasonable data protection grounds within that 30 days. If the parties can’t resolve the objection, the Customer may end the affected part of the service, and OneTaskList refunds any prepaid fees for the unused period.
• OneTaskList puts data protection obligations on each sub-processor that are no less protective than this DPA, and stays responsible to the Customer for its sub-processors’ performance.

• The service lets the Customer’s users download their data (Account settings › Download My Data) and delete their accounts (Delete My Account). Disconnecting a tool deletes the tasks copied from it.
• If OneTaskList receives a request from one of the Customer’s users about Customer Personal Data, it passes the request to the Customer without undue delay and doesn’t answer it unless the Customer asks.
• OneTaskList otherwise helps the Customer, by appropriate technical and organisational measures, to respond to requests from individuals exercising their rights (GDPR Chapter III).

Taking into account the nature of the processing and the information available to it, OneTaskList helps the Customer meet its obligations on security (Art. 32), breach notification (Art. 33–34), data protection impact assessments and prior consultation (Art. 35–36). OneTaskList may charge reasonable costs for help beyond what the service and this DPA provide, if it says so in advance.

• OneTaskList tells the Customer about a personal data breach affecting Customer Personal Data without undue delay, and in any event within 48 hours of becoming aware of it.
• The notice describes, as far as then known, the nature of the breach, the categories and approximate numbers of people and records affected, the likely consequences, the measures taken or proposed, and a contact point. OneTaskList adds information as it becomes available.
• OneTaskList doesn’t notify the Customer’s supervisory authorities or users on the Customer’s behalf, unless the Customer asks or the law requires it.
• A notice is not an admission of fault or liability.

• The Customer chooses the region where its Customer Personal Data is stored: the EU (Netherlands), the UK (London), the US (Virginia) or Australia (Melbourne). Sign-in runs in the EU for every region. Annex I lists where each part of the processing happens.
• OneTaskList is established in Australia and its staff support the service from there. Where Customer Personal Data subject to the GDPR is transferred to OneTaskList (including remote access from Australia), the SCCs apply as follows, and are incorporated into this DPA by reference:

• UK: for data subject to the UK GDPR, the UK Addendum applies. Its tables are completed with the information in this DPA and its Annexes, and either party may end it as Section 19 of the UK Addendum allows.
• Switzerland: for data subject to the Swiss Federal Act on Data Protection, the SCCs apply with these changes: the FDPIC is the competent supervisory authority; references to the GDPR include the Swiss Act; “member state” includes Switzerland, so Swiss data subjects can enforce their rights there.
• OneTaskList transfers Customer Personal Data to sub-processors outside the region only as Annex III describes, with appropriate safeguards.

• OneTaskList makes available the information needed to show it meets this DPA and Art. 28 GDPR.
• The Customer, or an independent auditor bound by confidentiality, may audit OneTaskList’s compliance once in any 12 months, with at least 30 days’ written notice, during business hours, and at the Customer’s cost. An extra audit is allowed after a personal data breach or when a supervisory authority requires it.
• Audits must not give access to other customers’ data or breach OneTaskList’s security.

• During the Agreement, the Customer and its users can export their data at any time.
• When the Agreement ends, OneTaskList deletes Customer Personal Data within 30 days, unless the law requires it to keep some. Copies in backups are deleted within a further 30 days as the backups expire.
• On request, OneTaskList confirms the deletion in writing.

Each party’s liability under this DPA is subject to the limits in the Agreement, except where Data Protection Law or the SCCs don’t allow liability to be limited.

• If documents conflict, the SCCs (and the UK Addendum) win, then this DPA, then the Agreement.
• This DPA lasts as long as OneTaskList processes Customer Personal Data.
• This DPA is governed by the law that governs the Agreement, except that the SCCs and UK Addendum are governed by the law they name.

A. Parties

B. Description of the processing

C. Competent supervisory authority

The supervisory authority of the EU member state where the Customer’s EU representative is established or, if the Customer is established in the EU, the authority competent for the Customer. For UK data: the Information Commissioner. For Swiss data: the FDPIC.

Measures in place on [date]. OneTaskList keeps this list current.

Not sub-processors: the tools the Customer’s users connect, and AI providers users choose with their own keys. They act under the Customer’s or user’s own agreements. When the Customer runs OneTaskList in its own Azure subscription, Microsoft is the Customer’s processor for that hosting, not ours.