Data Processing Addendum

This Data Processing Addendum forms part of the agreement between Hey Sully Pty Ltd (ABN 33 702 380 452) ('we', 'us') and the organisation that uses Sully ('you'): our Terms of Service, or a signed agreement that incorporates it. It applies whenever we process customer personal information to provide the apps.

“Customer personal information” means personal information in your content, and in the details of your workspace members, that we process on your behalf. “Privacy law” means the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and any other data protection law that applies to that processing.

If our documents differ on how customer personal information is handled, they apply in this order: a signed agreement with us, then this addendum, then the Terms of Service, then our Privacy Policy. A data processing agreement you have signed with us replaces this one.

You decide why and how customer personal information is processed, and we process it on your behalf to provide the Services to you. In the language of the GDPR you are the controller and we are your processor, and under United States state privacy laws we are your service provider.

We are separately responsible, as our Privacy Policy describes, for the information we handle for our own purposes: billing, account security, and measurements of how the product is used that do not include your content.

We process customer personal information only to provide, secure and support the Services, and only on your instructions. Your instructions are the Terms of Service, your use of the features and settings in the apps, and any other written instructions you give us that we agree to.

We do not sell customer personal information, and we do not use it to train AI models. If we think an instruction would break privacy law, we will tell you.

• Duration: for as long as your workspace exists, and then until it is deleted as described below.
• Purpose: storing and processing walks, including transcription, visual analysis, summaries and action items, translation and dubbed audio, delivery to services you connect, sharing, chat (answering your questions, including from the files, web pages and places you add to it, and drafting documents), and support.
• People: your staff and other workspace members; people who appear in or can be heard on a walk; and people named in notes, transcripts, summaries, chats or files you attach, such as clients, site contacts and suppliers.
• Information: names, email addresses and roles; video, images and audio, including faces and voices; transcripts and notes; files and web pages added to a chat; location information, including the path of a walk and a place shared in a chat; and everything we produce from them.
• Sensitive information: we do not ask for it. A walk may capture some incidentally, and we handle it like the rest of your content, but please avoid capturing it where you can.

You are responsible for having a lawful basis for the personal information you put into Sully, including telling people on site that you are recording and getting any consent the law requires, as our Terms of Service describe. If a professional standard requires consent before confidential information goes into an AI system, such as the RICS professional standard on the responsible use of artificial intelligence, getting that consent is your responsibility. Please do not put sensitive information into Sully unless the job needs it.

Only staff who need to reach customer personal information to operate or support the Services can do so, and they are bound to keep it confidential. When our staff view your workspace to support you, that view is read-only and recorded against their account.

We protect customer personal information with the measures described on our Security page. We may change those measures as the Services develop, but not in a way that reduces the overall protection they give.

You authorise us to use the providers listed in our Privacy Policy to process customer personal information. We contract with each of them on terms that require them to protect it, and we remain responsible to you for their work.

Before a new provider starts processing customer personal information, we will add it to that list and email the owners of every workspace at least 30 days in advance, unless we must act sooner to keep the Services running securely, in which case we will tell you as soon as we can.

If you object to a new provider on reasonable privacy grounds, tell us within those 30 days. If we cannot resolve the objection, you may stop using the affected part of the Services, and we will refund any fees you have prepaid for the rest of that billing period.

Customer personal information is stored in Australia. Some processing happens overseas, as our Privacy Policy describes: every AI model step, transcription included, runs on Google’s global infrastructure. Before disclosing customer personal information to an overseas provider, we take reasonable steps, including contractual ones, to make sure it handles the information consistently with the Australian Privacy Principles.

If your organisation is subject to the GDPR or the UK GDPR, contact us before you put the personal information of people in the European Union or the United Kingdom into Sully, so we can put the transfer terms those laws require in place.

If someone asks us to access, correct or delete personal information in your content, we will pass the request to you rather than respond ourselves, unless the law requires otherwise. We will help you respond to requests you receive, through the features of the apps or with reasonable help from our team.

If a government agency, regulator or court asks us for customer personal information, we will tell you first where the law allows, disclose only what we are legally required to, and challenge a request we reasonably consider unlawful or too broad.

If we become aware of unauthorised access to, disclosure of, or loss of customer personal information, we will tell you without undue delay, and in any case within 72 hours of becoming aware of it. We will give you the information we have to help you assess it under the Notifiable Data Breaches scheme, take reasonable steps to contain it, and keep you updated.

Where the people affected or the regulator must be notified, we will work with you on the notification.

We will give you the information you reasonably need to show that you are meeting your obligations under privacy law, including answers to a reasonable security questionnaire once a year and reports from independent assessments once we have them, and we will help with any privacy impact assessment that concerns the Services. On request we will also give you written information about how Sully processes content and what each provider may do with it, to support your due diligence.

Audits beyond that, including on-site audits, need a signed agreement with us.

The person who uploaded a walk, or a workspace admin, can delete it in the apps at any time. A lapsed plan never deletes your content on its own.

When a workspace’s owner deletes it in the apps, it is closed to new uploads and questions for 14 days, during which an owner or admin can keep it, and we then delete customer personal information. When you ask us to close your workspace, including when our agreement ends, we will delete customer personal information within 30 days. Both are apart from what the law requires us to keep.

Deleted files and records can remain in our storage recovery window and database backups for up to 14 days until they expire, and this addendum keeps protecting them until then. We email the workspace’s owners and admins when deletion is complete, and will confirm it in writing again if you ask.

Before a workspace is deleted, you can download each walk’s video, and we will help you retrieve the rest of your content if you ask.

This addendum applies for as long as we hold customer personal information, including after our agreement ends.

Liability under this addendum is subject to the limits in the Terms of Service, or in your signed agreement with us.

Questions about this addendum, and requests under it, go to our Privacy Officer at hello@heysully.ai.