This Data Transfers Addendum (the “Addendum”) is entered into between Donna Technologies Pty Ltd (ACN 691 287 457) (“Donna”) and the Customer that has accepted the Donna Platform Agreement (the “Customer”). It forms part of, and is governed by, the Platform Agreement and the Data Processing Addendum (the “DPA”). Capitalised terms not defined in this Addendum have the meanings given to them in the Platform Agreement, the DPA or the Privacy Policy.
At a glance
Donna processes and stores all Customer Data in Australia. Hosting runs on Microsoft Azure in Australia East (Sydney), with Australia Southeast (Melbourne) for disaster recovery. AI inference runs on Azure OpenAI Service in Australia East and on Amazon Bedrock in the AWS Asia Pacific (Sydney) region. Donna does not transfer Customer Data outside Australia and does not disclose it to overseas recipients in providing the Platform. Where a Customer subject to the GDPR, the UK GDPR or the Swiss FADP sends Personal Information to Donna in Australia, the EU Standard Contractual Clauses Module 3 (the “EU SCCs”), the UK International Data Transfer Agreement (the “UK IDTA”) or the Swiss-adapted EU SCCs govern that transfer into Australia, as described in section 5.
1.Scope
This Addendum records Donna’s commitment that Customer Data is processed and stored in Australia only, by Donna and by each of its Subprocessors. It also governs the case where Personal Information whose home jurisdiction is outside Australia (for example, Personal Information of a data subject in the European Economic Area (the “EEA”)) is sent to Donna in Australia by or on behalf of the Customer.
Personal Information of an Australian data subject processed and stored in Australia is not otherwise within scope, although the Australian Privacy Principles continue to apply on their own terms. Personal Information of an EEA data subject is within scope when it reaches Donna, because it is processed and stored in Australia; the GDPR continues to apply on its own terms.
This Addendum is read together with the DPA and is binding on the parties from the Effective Date set out at the top of this page, or such later date as the Customer accepts the Platform Agreement.
2.Order of precedence
If there is any conflict between the documents that govern a particular transfer within scope of this Addendum, the following order of precedence applies, with the higher-listed document prevailing to the extent of the conflict:
- a set of Standard Contractual Clauses or an International Data Transfer Addendum that the parties have separately executed in original signed form for a specific transfer;
- this Addendum;
- the DPA;
- the Platform Agreement; and
- the Privacy Policy.
Despite the order set out above, this Addendum is to be interpreted, where reasonably possible, in a manner that gives effect to applicable Data Protection Laws and to the rights of data subjects. Where a provision of this Addendum is, or becomes, inconsistent with a mandatory requirement of Data Protection Laws, the mandatory requirement prevails and the parties will negotiate in good faith to bring this Addendum into compliance without otherwise altering the commercial bargain.
Nothing in this Addendum is intended to derogate from any data subject right that is conferred by Data Protection Laws and that cannot lawfully be excluded by contract.
3.Processing locations
The table below sets out where Personal Information processed through the Platform is located. Every location is in Australia. The authoritative current list of Subprocessors and their locations is published at /legal/subprocessors.
| Country | Recipient | Role | Processing activity | Safeguard |
|---|---|---|---|---|
| Australia | Microsoft Azure (Australia East / Australia Southeast); Donna personnel based in Australia. | Hosting Subprocessor; controller/processor personnel. | Storage and processing of all Customer Data. Operational access by Donna personnel. | Domestic processing. APP 11 security obligations apply to Donna directly. |
| Australia | Azure OpenAI Service (Australia East). | AI inference Subprocessor. | Inference for GPT-class models. No training on Customer Inputs or Outputs. | Domestic processing. Written contract with flow-down of the DPA. |
| Australia | Amazon Bedrock, Amazon Web Services (Asia Pacific (Sydney)). | AI inference Subprocessor. | Inference for Claude models. No training on Customer Inputs or Outputs, and Inputs and Outputs are not shared with the model developer. | Domestic processing. Written contract with flow-down of the DPA. |
| Australia | Auth0 by Okta (Australian region). | Identity Subprocessor. | Signs Authorised Users in: names, email addresses and sign-in events. No matter content. | Domestic processing. Written contract with flow-down of the DPA. |
Donna does not fail over or route Customer Data, including inference traffic, to any region outside Australia. Any future change to the locations in this table would be made only through the Subprocessor change-notification process described in the DPA and at /legal/subprocessors, including at least 30 days’ prior notice and the Customer’s right to object, and this Addendum would be updated before the change took effect.
4.No overseas disclosure
Donna does not disclose Personal Information collected in Australia to an overseas recipient in providing the Platform. Because Customer Data is processed and stored in Australia by Donna and by Subprocessors operating in Australia, the overseas-disclosure rules in Australian Privacy Principle 8 and section 16C of the Privacy Act 1988 (Cth) are not engaged by the ordinary operation of the Platform.
Customer authorisation of Subprocessors
By engaging with the Platform and accepting the DPA, the Customer authorises Donna to disclose Personal Information to the Subprocessors listed at /legal/subprocessors and in section 3 of this Addendum, in the Australian locations identified, for the purpose of providing the Platform. That authorisation is a documented instruction for the purposes of the DPA.
State and territory health information laws
Where the Health Records and Information Privacy Act 2002 (NSW) or the Health Records Act 2001 (Vic) applies to Customer Data, the Customer remains the relevant health service provider or organisation for the purposes of those Acts and for the transfer rules under those Acts. Donna assists the Customer to comply, including by keeping that information in Australia as described in this Addendum.
5.EU, UK and Swiss transfers into Australia
Donna processes and stores all Customer Data in Australia. Where Personal Information subject to the GDPR, the UK GDPR or the Swiss FADP is sent to Donna in Australia, that transfer is dealt with in this section. The framework set out below activates only on a per-engagement basis; nothing in this section deems Donna to be processing EU, UK or Swiss Personal Information by default.
EU SCCs Module 3 framework
Where the Customer is itself a processor for a third-party controller in the EEA and, in performance of that processor role, discloses EU-origin Personal Information to Donna for further processing, Donna and the Customer are taken to have entered into the Standard Contractual Clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “EU SCCs”) in Module 3 (processor-to-processor), completed on the following selections: Clause 7 (docking) is enabled; Clause 9(a) (sub-processors) operates on Option 2 with thirty (30) days’ notice; Clause 11(a) optional language is not selected; Clause 17 governing law is Option 1 (Ireland); Clause 18(b) forum is the courts of Ireland; the competent supervisory authority is the Irish Data Protection Commission. The Annexes to the EU SCCs are completed by reference to Annex 1 of the DPA (description of processing), Annex 2 of the DPA (technical and organisational measures), and the Subprocessor list at /legal/subprocessors. Where required, Donna will execute physical counterparts of the EU SCCs on the Customer’s reasonable request.
UK and Swiss transfer instruments on request
Where Personal Information subject to the UK GDPR or the Swiss FADP reaches Donna in circumstances requiring a transfer instrument, Donna will execute, on a per-engagement basis, the UK International Data Transfer Agreement issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (the UK IDTA), or the Swiss-adapted EU SCCs (substituting the FADP for the GDPR, the Federal Data Protection and Information Commissioner for the EU supervisory authority, and preserving Swiss data subjects’ rights of action in the Swiss courts). Customers requiring those instruments should contact privacy@bydonna.ai before transferring the relevant Personal Information.
6.Onward transfers
Donna does not make onward transfers of Customer Data outside Australia. Donna engages a small number of Subprocessors to deliver the Platform, each processing Customer Data in Australia. The current list, including each Subprocessor’s legal name, function and processing location, is published at /legal/subprocessors. The principal categories are:
- Cloud infrastructure and Azure OpenAI: Microsoft Corporation and Microsoft Australia Pty Ltd, providing hosting in the Australian Azure regions described in section 3 and access to GPT-class models through the Azure OpenAI Service in Australia East.
- Claude models through Amazon Bedrock: Amazon Web Services, Inc. and Amazon Web Services Australia Pty Ltd, providing inference in the AWS Asia Pacific (Sydney) region under terms that prohibit training on Customer Data. Customer Data sent to Amazon Bedrock is not shared with Anthropic or any other model developer.
- Sign-in through Auth0: Okta, Inc., authenticating Authorised Users from Donna’s Auth0 tenant in the Australian region. Auth0 holds names, email addresses and sign-in events, and does not receive matter content.
- Cloud infrastructure sub-sub-processors: the underlying datacentre, networking, identity and operational tooling that Microsoft and Amazon Web Services use to deliver their services in Australia. These are governed by the Subprocessors’ own published lists and contractual frameworks.
Flow-down of safeguards
Donna’s contracts with each Subprocessor flow down obligations no less protective than those Donna accepts under the DPA and this Addendum. The flow-down covers, in particular:
- the processing limitations and confidentiality obligations contained in the DPA, including the prohibition on training of AI models on Customer Data;
- the technical and organisational measures described in Annex 2 of the DPA, calibrated to the role of the relevant Subprocessor;
- the obligation to process and store Customer Data in Australia only; and
- the cooperation, audit and incident-notification obligations described in the DPA, to the extent reasonably necessary for Donna to discharge its own obligations to the Customer.
7.Government access requests and supplementary measures
Donna recognises that the lawfulness of a transfer of EU, UK or Swiss Personal Information into Australia depends not only on the existence of a transfer instrument but also on the practical ability of the data importer to comply with that instrument in Australia. This is the framework reflected in the judgment of the Court of Justice of the European Union in Data Protection Commissioner v Facebook Ireland and Schrems (Case C-311/18, “Schrems II”), and in equivalent guidance issued by the Information Commissioner’s Office and the FDPIC.
Approach to government access requests
Donna has adopted, and requires its Subprocessors to adopt, the following commitments in relation to requests for access to Personal Information by governmental, regulatory or law-enforcement bodies:
- Donna will assess each request for validity, scope and proportionality. Donna will decline a request that does not bind it, that is overbroad, or that is unlawful in the country of receipt.
- Where a request is binding and lawful, Donna will provide only the minimum amount of Personal Information necessary to comply, and will use available legal mechanisms to narrow the request where it is excessive.
- Donna will challenge requests that appear unlawful or that conflict with applicable Data Protection Laws, including by seeking judicial review where reasonably available.
- Donna will, to the maximum extent permitted by law, push back against gag orders, non-disclosure obligations and similar restrictions, so that Donna is able to notify the affected Customer of the request as soon as practicable.
- Where Donna is permitted to notify the Customer, it will do so promptly. Where Donna is not permitted to notify, it will use commercially reasonable efforts to obtain a waiver of that restriction and will notify the Customer as soon as it lawfully may.
- Donna publishes, or will publish, periodic transparency information about the volume and nature of government access requests it receives, consistent with applicable law.
Supplementary technical measures
In addition to the contractual and organisational measures described above, Donna applies the following supplementary technical measures to reduce the practical risk of unauthorised access:
- Customer Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256, with customer-managed keys available on supported plans. Encryption keys are managed in dedicated key vaults in Australia and are not exported outside Australia.
- Inference traffic is minimised in content. The Platform sends to AI Subprocessors only the data necessary for the requested inference, with extraneous metadata stripped at the egress boundary.
- Donna maintains tenant isolation and identity-based service-to-service authentication using managed identities. There are no stored shared secrets in production, which materially reduces the risk surface in the event of a request directed to a Subprocessor.
- Plaintext access by Donna personnel to Customer Data requires a documented operational need, multi-factor authentication, just-in-time elevation, and is logged in immutable audit trails reviewed by the security team.
- Subprocessor contracts require contractual transparency reporting in respect of government access, to the extent permitted by the Subprocessor’s home law.
Practical assessment of Australian law
Donna has assessed the laws of Australia, where all Customer Data is processed, against the practical ability of Donna and its Subprocessors to comply with the obligations owed under the EU SCCs, the UK IDTA, the Swiss-adapted EU SCCs and the APP 8 framework. The assessment supports Donna’s view that, taken together with the supplementary measures described in this section 7, the safeguards set out in this Addendum provide a level of protection essentially equivalent to that required by the applicable Data Protection Laws. The assessment is documented in the transfer impact assessment described in section 8.
8.Transfer impact assessments
Donna maintains a written transfer impact assessment (the “TIA”) covering transfers of EU, UK and Swiss Personal Information into Australia under section 5. The TIA addresses:
- the categories of Personal Information transferred and the purpose of the transfer;
- the legal framework of Australia, including any laws that confer rights of access on public authorities, and the scope of any limitations or safeguards;
- the practical experience of Donna and its Subprocessors with government access requests, including the volume, nature and outcome of such requests;
- the supplementary technical, contractual and organisational measures applied by Donna to mitigate any risks identified; and
- the conclusion as to whether, taken together, the safeguards provide a level of protection essentially equivalent to that required by the applicable Data Protection Laws.
Because Donna does not transfer Customer Data outside Australia, the TIA does not cover any onward transfer. If that position ever changed under the process in section 3, the TIA would be updated to cover the new location before the change took effect.
The TIA is reviewed and refreshed at least annually, and on any material change in the law of Australia, in the practical experience of access requests, or in the Subprocessor footprint. A redacted summary of the TIA is available to Customers on request, subject to a confidentiality undertaking, so that the Customer can perform its own assessment of the transfer.
9.Suspension of transfers
Without limiting any right that the Customer or any data subject has under the EU SCCs, the UK IDTA, the Swiss-adapted EU SCCs or any applicable law, the Customer may suspend one or more transfers of Personal Information to Donna or to a Subprocessor in the circumstances contemplated by Clause 14 of the EU SCCs (or the equivalent provision of the UK IDTA), including where the Customer reasonably considers, on the basis of objective evidence, that the transfer has become unlawful in Australia.
Where the Customer suspends a transfer under this section, Donna will cooperate with the Customer to give effect to the suspension, including by:
- disabling the relevant Subprocessor or the relevant regional configuration of the Platform, to the extent operationally feasible;
- assisting the Customer to migrate to an alternative configuration of the Platform that does not require the suspended transfer, where one is reasonably available; and
- returning or deleting the affected Personal Information in accordance with the DPA, where the suspension cannot be cured.
Donna will also notify the Customer if Donna itself becomes unable to comply with its obligations under the EU SCCs, the UK IDTA, the Swiss-adapted EU SCCs or this Addendum, and will work with the Customer in good faith to identify a remediation. Where no remediation is reasonably available, the Customer may terminate the affected portion of the Platform Agreement on the basis set out in the DPA, without penalty.
10.Execution and incorporation
This Addendum is incorporated into the Platform Agreement and is deemed to have been executed by the Customer and by Donna on the Customer’s acceptance of the Platform Agreement (or, if later, on the Customer’s first transfer to Donna of Personal Information within scope of section 5). No additional signature is required for the Addendum, the EU SCCs, the UK IDTA or the Swiss-adapted EU SCCs to take effect.
On request, Donna will execute physical counterparts of the EU SCCs, the UK IDTA or the Swiss-adapted EU SCCs, completed as set out in this Addendum, for the Customer’s record-keeping or for production to a supervisory authority. The Customer may countersign the same counterparts. The execution of physical counterparts does not alter the substantive terms of this Addendum or the underlying transfer instruments.
Where the Customer, or a controller for which the Customer acts as processor, requires a form of execution other than that described in this section, the parties will negotiate in good faith to accommodate that requirement, provided that any divergence from the standard form is documented in a separate written instrument signed by authorised signatories of each party.
11.Defined terms
Capitalised terms used in this Addendum have the meanings given to them in the Platform Agreement, the DPA or the Privacy Policy. The following defined terms are used with particular frequency in this Addendum:
- Customer means the entity that has accepted the Donna Platform Agreement and that is identified as the customer in the corresponding order form.
- Customer Data means the Personal Information and other data uploaded to, generated within, or otherwise made available through the Platform by or on behalf of the Customer, as further defined in the Platform Agreement and the DPA.
- Data Protection Laws means all laws and binding regulations applicable to the processing of Personal Information in the relevant jurisdiction, including the Privacy Act, the GDPR, the UK GDPR, the FADP, the California Consumer Privacy Act and equivalent laws of other US states, and any subordinate instruments made under them.
- EU SCCs means the Standard Contractual Clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time.
- Personal Information means information that is “personal information” under the Privacy Act, “personal data” under the GDPR or the UK GDPR, “personal data” under the FADP, “personal information” under the California Consumer Privacy Act, or any equivalent term under another applicable Data Protection Law, as the context requires.
- Subprocessor means a third party engaged by Donna to process Personal Information in connection with the provision of the Platform, as further described in the DPA and at /legal/subprocessors.
- UK IDTA means the International Data Transfer Agreement issued by the Information Commissioner under section 119A of the Data Protection Act 2018, as amended or replaced from time to time. References in this Addendum to the “UK Addendum” are to the UK Addendum to the EU SCCs issued by the same authority.
Headings in this Addendum are for convenience only and do not affect interpretation. References to a statute, regulation or instrument include any amendment, replacement or consolidation of it from time to time. Where a provision of this Addendum confers a right, power or discretion on Donna, it does so without prejudice to the equivalent rights conferred on Donna by the Platform Agreement, the DPA or applicable law.