Data Processing Agreement (DPA)

1. Parties and Scope

The Processor is Tokuqiquxusholdings Pty Ltd, directed by Callum Anderson, located at 412 Collins Street, Melbourne VIC 3000. The Controller is the legal entity or individual engaging the Processor's services. This agreement governs the processing of personal data provided by the Controller for the purpose of executing laser engraving, cutting, and design projects.

2. Categories of Data

The Processor handles the following categories of data:

• Contact Information: Names, email addresses, and phone numbers of the Controller's representatives.
• Project Data: Vector files, logos, and text to be engraved or cut, which may contain personal names or identifiers of the Controller's end-customers.
• Billing Data: Company names and addresses for GST invoicing.

All processing is performed in accordance with our Privacy Policy.

3. Processor Obligations

Tokuqiquxusholdings Pty Ltd agrees to:

• Process data only on documented instructions from the Controller.
• Ensure that personnel authorised to process personal data have committed themselves to confidentiality.
• Assist the Controller in meeting their obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
• Notify the Controller of any breach of these terms without undue delay.

4. Sub-processors

The Processor engages the following sub-processors to ensure service delivery:

• Micron 21 Pty Ltd: Hosting provider located at Unit 2, 7 Eastspur Court, Kilsyth South VIC 3137.
• FormSubmit: Service provider for processing enquiry forms (data may be transferred to the USA in accordance with APP 8).

The Processor ensures that these sub-processors provide sufficient guarantees to implement appropriate technical and organisational measures.

5. Security and Incidents

We implement technical measures including encrypted communication (SSL/TLS) and restricted access to project files. In the event of a data breach, the Processor will notify the Controller and, if required, the Office of the Australian Information Commissioner (OAIC) at GPO Box 5288, Sydney NSW 2001.

6. Data Return and Deletion

Upon termination of the service or completion of the project, the Processor shall delete or return all personal data to the Controller, unless retention is required by Australian law. In line with our Terms and Conditions, vector layouts created by the Processor are provided only after full payment.

7. Audit and Jurisdiction

The Controller has the right to request information to verify compliance with this DPA. Any disputes arising from this agreement shall be subject to the exclusive jurisdiction of the courts in Melbourne. This agreement is governed by the laws of Victoria and the Commonwealth of Australia, including the Australian Consumer Law.