1. Parties, scope and precedence
This Data Processing Agreement (DPA) is between ARVICA AI HOLDINGS PTY LTD (ABN 30 702 257 761), trading as Arvica Cloud (Arvica), and the customer identified in the applicable agreement or order (Customer). It forms part of the Arvica Cloud Terms of Service or the Master Services Agreement between the parties (the Agreement) and applies where Arvica processes personal information or personal data on behalf of Customer in providing the services (Customer Personal Data). If this DPA conflicts with the Agreement on a data protection matter, this DPA prevails.
2. Roles and instructions
Customer is the controller (or equivalent) of Customer Personal Data and is responsible for its lawful collection, notices, consents and retention. Arvica acts as processor (or service provider or data intermediary, as applicable) and processes Customer Personal Data only to provide, secure and support the services, in accordance with the Agreement and Customer's documented lawful instructions. Arvica will inform Customer if, in its opinion, an instruction infringes applicable data protection law. Arvica will not sell Customer Personal Data or use it to train AI models.
3. Personnel
Arvica ensures that persons authorised to process Customer Personal Data are bound by appropriate confidentiality obligations, are given access only where needed and that administrative access is logged.
4. Security measures
Arvica implements the technical and organisational measures described in Annex B, appropriate to the nature of the processing and the risk. Arvica may update these measures provided the overall level of security is not reduced.
5. Subprocessors
Customer authorises Arvica to engage the subprocessors described in Annex C. Arvica will impose data protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for their performance. Arvica will give Customer at least thirty (30) days' notice of any new or replacement subprocessor, except where urgently required for security or legal reasons. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected services without early termination charges. Any change to a hosting, backup or remote-support country agreed in an order requires Customer's prior written consent.
6. Security incidents
Arvica will notify Customer without undue delay after becoming aware of a security incident affecting Customer Personal Data; any specific notification deadline is as required by applicable data protection law or as stated in a signed agreement between the parties. The notice will describe the incident and the measures taken, and will be supplemented as further information becomes available. Arvica will reasonably cooperate with Customer in containment, investigation and any notification Customer is required to make to regulators or individuals, including under the Notifiable Data Breaches scheme.
7. Assistance and audits
Taking into account the nature of the processing, Arvica will reasonably assist Customer to respond to requests from individuals to exercise their rights, and with security assessments and regulatory enquiries. Arvica may charge reasonable fees for assistance beyond its standard support. On request, and subject to confidentiality, Arvica will provide available independent assurance reports or security summaries for its services and relevant subprocessors. On-site audits of data centre facilities are subject to the policies of the relevant facility operator.
8. International transfers
Customer Personal Data is processed in the hosting regions selected by Customer or specified in the order, and may be accessed for support from the countries listed in Annex C. Where the transfer of Customer Personal Data requires additional safeguards under the EU or UK GDPR or other applicable law, the parties will execute the applicable standard contractual clauses or other approved transfer mechanism, which will form part of this DPA.
9. Return and deletion
On expiry or termination of the services, Customer must retrieve any Customer Personal Data it requires before the end of the service or within any export period stated in its order. Arvica will then delete Customer Personal Data from the affected services in accordance with its standard deletion procedures, subject to retention required by law, and will confirm deletion in writing on request.
10. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where applicable law does not permit such limitation.
Annex A — Details of processing
Subject matter and duration: provision of GPU compute infrastructure, technical support and account administration for the term of the Agreement and any agreed export period.
Nature and purpose: hosting, storage, transmission, computation, support access and deletion, to the extent necessary to provide the services.
Categories of data subjects: as determined by Customer, which may include Customer's employees, contractors, end users and customers.
Types of personal data: as determined by Customer through its use of the services. Customer must not process sensitive or regulated data unless agreed in its order.
Contacts: Arvica: support@arvica.ai. Customer: as specified in the Agreement or order.
Annex B — Technical and organisational measures
Access control: role-based access and least-privilege principles; multi-factor authentication on the infrastructure management accounts Arvica uses to administer its hosting, database, code and deployment providers; privileged actions in the Arvica Portal and Admin console are recorded in an audit log, and any additional authentication controls for those consoles are as stated in your order or signed agreement.
Encryption: encryption in transit using TLS for management interfaces and APIs; encryption at rest where supported by the underlying infrastructure or ordered by Customer.
Isolation: single-tenant allocation of dedicated and bare-metal resources; logical separation of on-demand workloads.
Operations: vulnerability and patch management for Arvica-managed systems, monitoring, incident response procedures and secure media sanitisation on decommissioning.
Backups: application and data backups are Customer's responsibility unless backup services are expressly ordered.
Data centres: physical security, access control and environmental controls provided by professionally operated data centre facilities.
Annex C — Subprocessors and locations
Arvica uses the following categories of subprocessors: data centre and GPU infrastructure providers in the hosting region selected by Customer; cloud hosting, email and customer support tools (United States); and payment processing (Australia and the United States). Remote support may be provided from Australia. A current list of subprocessors, including entity names and locations, is available on request from support@arvica.ai.
Execution
Where this DPA is not incorporated by acceptance of the Terms of Service or a signed order, the parties may sign it below.
For ARVICA AI HOLDINGS PTY LTD: Signature ______________________ Name / title ______________________ Date ____________
For Customer: Legal name ______________________ Signature ______________________ Name / title ______________________ Date ____________