SCHEDULE J: DATA PROCESSING
This Schedule forms part of the Master Client Terms. Words defined in clause 1 of the Master Client Terms have the same meaning here.
When this Schedule applies. This Schedule applies whenever we process personal information for you, on either Service Line, whether or not your Service Agreement identifies it (Master Preamble). That includes your customers' information held in Systems we operate, session and call recordings, call review material, employee information, New-Hire records and reporting data (together, your personal information). No selection in a Service Agreement switches it off while that processing happens.
Our standard. We handle your personal information to the standard of the Australian Privacy Principles.
1. WHO IS RESPONSIBLE FOR WHAT
1.1 Between us, you decide what personal information is collected and why, and we handle it on your behalf:
(a) you decide what is collected, from whom, why, and what happens to it; and
(b) we act on your instructions, and only to deliver the services in your Service Agreement.
1.2 Where the Privacy Act 1988 (Cth) applies to you, you remain accountable under the Australian Privacy Principles for your personal information, including notice under APP 5, use and disclosure under APPs 6 and 7, and any eligible data breach. Each of us complies with the privacy obligations that apply to it. This Schedule allocates responsibility between us and does not remove a statutory obligation from either of us.
1.3 Information we collect about you and your people in our own right is governed by our Privacy Policy at rev-raise.com/privacy, not by this Schedule.
1.4 Where your customers are in a jurisdiction with its own privacy regime, such as the EU, the UK or New Zealand, tell us before we start. This Schedule is written to Australian law and does not by itself meet those regimes. We will agree any additional terms you need.
2. WHAT WE DO WITH YOUR PERSONAL INFORMATION
2.1 We will:
(a) process it only to deliver the services in your Service Agreement, and on your documented instructions;
(b) keep it separate from other clients' data;
(c) restrict access to people who need it for their role;
(d) require everyone with access to be bound by confidentiality that continues after their engagement ends;
(e) tell you promptly if we think an instruction from you would breach the Privacy Act; and
(f) help you meet your own obligations under clause 6.
2.2 We will not:
(a) use it for our own purposes;
(b) market to your customers;
(c) sell, rent or share it, except with the service providers in clause 4 to deliver the services;
(d) combine it with another client's data;
(e) use it to build a product; or
(f) keep it after your Engagement ends beyond the periods in clause 8.
2.3 Model training. Our commitments on model training, and on service providers that do not offer an adequate setting, are in clause 11.3 of the Master Client Terms.
3. WHAT YOU ARE RESPONSIBLE FOR
3.1 You warrant that:
(a) you collected your personal information lawfully;
(b) you gave the notices required under APP 5, including that information may be handled by service providers, which may include Rev-Raise and providers overseas, and the countries in which they are likely to be located, where practicable;
(c) you hold the consents required for how it will be used, including for marketing under the Spam Act 2003 (Cth);
(d) your use of it for direct marketing, and your disclosure of it to us to operate your Systems, is permitted under APPs 6 and 7;
(e) your instructions to us comply with the Privacy Act; and
(f) every list you provide meets clause 10.3(d) and (e) of the Master Client Terms.
3.2 Sensitive information. Do not put sensitive information, as defined in section 6 of the Privacy Act, such as health or biometric information, into Systems we operate without telling us first and agreeing the additional controls in writing. If you operate a clinic or any health service, raise this before onboarding.
3.3 Your customers' requests. You are the first point of contact for your customers. If one asks us for access, correction or deletion, we refer them to you and tell you on the same Business Day.
4. SERVICE PROVIDERS
4.1 We use third-party service providers to deliver the services. The categories are listed in our Privacy Policy.
4.2 A current list of named providers, and the countries in which each processes data, is available on request, and we provide it within 10 Business Days of your request.
4.3 We give you 30 days notice before adding a new provider, or a new category of provider, that will process your customers' personal information. If you object on reasonable grounds, we work with you on an alternative. If there is none, you may end the affected services on 30 days Notice, with no early-release amount or notice-period fee (Master clause 5.8).
4.4 We take reasonable steps, including reviewing a provider's terms before we use it, to ensure each provider protects your personal information with reasonable security and uses it only as its terms permit. What we do and do not promise about a provider's own use of data is in clause 11.3 of the Master Client Terms.
5. WHERE THE DATA IS
5.1 Some providers process data outside Australia, including in the United States. Our Privacy Policy names the categories and countries.
5.2 Before your personal information is disclosed overseas, we take reasonable steps, including contractual commitments where available, to ensure the recipient handles it consistently with the Australian Privacy Principles, to the standard of APP 8.
5.3 Under section 16C of the Privacy Act, an entity that discloses personal information overseas can be accountable for the recipient's acts. We give you what you need to assess your own position, and we tell you before moving your personal information to a new country.
6. HELPING YOU MEET YOUR OBLIGATIONS
6.1 At no charge, we provide:
| You need | We provide | Within |
|---|---|---|
| An extract of one person's information, for an APP 12 access request | The extract | 10 Business Days |
| Correction or deletion of a record | The change, made | 5 Business Days |
| The named provider list | The list | 10 Business Days |
| Information for a privacy impact assessment | What we hold about our processing | 15 Business Days |
| Information to assess a suspected breach | Everything we know | Without delay |
| A description of automated decisions (clause 10) | The statement | 10 Business Days |
7. SECURITY AND INCIDENTS
7.1 We take reasonable steps to protect your personal information from misuse, interference, loss and unauthorised access, modification or disclosure, to the standard of APP 11, including multi-factor authentication on accounts that access it.
7.2 Incidents. Clause 11.7 of the Master Client Terms applies to any data incident affecting your personal information, not only unauthorised access or disclosure. It also covers loss, alteration, corruption, ransomware, and unavailability that results from a security event or lasts more than 24 hours. We notify you without undue delay, and in any case within 72 hours of becoming aware.
7.3 Our notice includes what we know about what happened, what information was involved, what we have done, and what we recommend.
7.4 Each of us complies with any obligation under Part IIIC of the Privacy Act that applies to it. Where an incident may be an eligible data breach affecting your customers, we agree with you which of us will carry out the assessment and any notification, as section 26WJ permits. Where the law permits and it will not delay a required notification, we coordinate with you before either of us notifies the OAIC or affected individuals.
7.5 We cooperate fully with your assessment and any remediation.
8. RETURN AND DELETION
8.1 Systems data. When Systems end, your data is exported and deleted under the off-boarding provisions that apply (Master clause 11.3(h)): Schedule B clause 12 where Schedule B applies, and otherwise Schedule A clause 16 or your Service Agreement. In each case we keep your data for 90 days after your access ends and then delete it, unless you ask us to delete it sooner or to hold it longer. The retention, holding-fee, backup and third-party platform provisions of that clause apply, and this Schedule does not displace them.
8.2 Recordings. A customer recording is deleted within 90 days after the coaching or review for which it was provided (Schedule C clause 7.6 and Schedule H clause 8.5), unless you ask in writing for longer. A session recording is kept only for the uses each person consented to in their Attendee Recording Consent, and is deleted when those uses end or, if no longer period was consented to, 24 months after the session, whichever is earlier. You may ask us in writing to delete it sooner.
8.3 Employee information, New-Hire records and reporting data. When the service that uses them ends, we give you a copy on request within 30 days, and delete them 90 days after the service ends, unless you ask us to delete them sooner. Training, assessment and accreditation records we hold in our own right, including the register of accredited Facilitators, are held under our Privacy Policy.
8.4 Copies we must keep by law. Where a law requires us to keep a record, we keep only that record, only for the period the law requires, and only for that purpose.
8.5 Backups. Personal information may remain in backups after deletion from live systems. Backups are not used for any purpose other than disaster recovery, and the information is deleted when those backups are overwritten.
8.6 We confirm deletion in writing on request.
9. AUDIT
9.1 On reasonable written notice, once in any 12-month period, you may ask us to demonstrate compliance with this Schedule. We respond with written information about our controls, our service providers and our practices.
9.2 We do not offer on-site audits or access to our systems, because they hold other clients' data. Where you reasonably need more than clause 9.1 provides, we discuss it in good faith.
10. AUTOMATED DECISIONS
10.1 Clause 11.5 of the Master Client Terms governs automated decisions made or supported by Systems we build or operate. We do not currently deploy a System that makes a decision significantly affecting an individual without your approval under clause 10 of the Master Client Terms.
10.2 On request, we provide an automated decision statement for your account, listing the kinds of personal information used and the kinds of decisions made or supported, so that you can meet your own transparency obligations, including under APP 1.7 to 1.9 from 10 December 2026.
11. PRECEDENCE
11.1 This Schedule is the Schedule specific to the handling of personal information for the purposes of the priority rule in the Master Client Terms.
11.2 A data processing agreement signed as a Variation or as part of your Service Agreement wins over this Schedule.
© 2026 Rev-Raise Group Pty Ltd trading as Rev-Raise (ABN 45 691 400 594). All rights reserved. THE DELIBERATE SALE™ and REV-RAISE™ are trade marks used by Rev-Raise under an exclusive licence.