Data processing agreement.

For a person who buys a reading, Hermes Horizon Pty Ltd is the data controller. We decide what is collected and why, and the privacy policy is the notice that goes with that role.

Where a business uses Starwell on behalf of its own customers, we act as a processor for that data and a data processing agreement is the right instrument. That is what this page offers.

Write to support@starwell-hh.com with "DPA" in the subject line and tell us who the agreement is between. We send our standard terms within five business days. There is no fee and you do not need to be a large customer to ask.

If you have your own paper, send it. We will read it and tell you plainly what we can and cannot sign rather than ignoring it.

The subject matter and duration of the processing, the kinds of personal data and the categories of person involved, and the instructions we act on. Our duty of confidentiality, the security measures we apply, and the conditions on engaging another processor.

Our help with your obligations: responding to a person exercising their rights, notifying a breach, and completing a data protection impact assessment. What happens to the data when the agreement ends, and your right to audit or to receive the information needed to demonstrate compliance.

We are an Australian company and most of our providers are in the United States, so personal data leaves the EEA and the United Kingdom. Those transfers are made under the European Commission standard contractual clauses, with the United Kingdom international data transfer addendum where the UK GDPR applies, and the Swiss addendum for Switzerland.

The full list of providers, what each one receives and where it sits, is published in section 04 of our privacy policy rather than held back for people who ask.

Data is encrypted in transit and at rest by our hosting and database providers. Access to production data is limited to the people who need it, sign-in is by emailed code so there is no password of yours for us to lose, and we rate-limit requests to slow down abuse.

If a breach affects data we process for you, we tell you without undue delay and give you what you need for your own notification duty. We will not wait for certainty about the scope before telling you it happened.

support@starwell-hh.com reaches the person who handles this. We have not appointed a data protection officer, because our processing does not meet the threshold in Article 37 that requires one, and we have not appointed an Article 27 representative in the Union. If either becomes required we will name them here.

Post reaches us at Hermes Horizon Pty Ltd, Suite 329/98-100 Elizabeth Street, Melbourne VIC 3000, Australia.