Data Processing Schedule

This Schedule forms part of the ListingMate Subscription Agreement. It sets out how ListingMate handles Personal Information on the Customer's behalf. Terms defined in the Subscription Agreement have the same meaning here.

1. Roles

1.1 The Customer decides why and how Personal Information about its clients, staff and other individuals is collected. ListingMate handles that Personal Information only to provide the Services, as a service provider to the Customer.

1.2 ListingMate also collects some Personal Information for its own purposes, such as account, billing and support contact details. That information is handled under the ListingMate Privacy Policy, not this Schedule.

2. Customer obligations

2.1 The Customer is responsible for:

1. having a lawful basis to collect the Personal Information it puts into the Platform or makes available through Connected Accounts;
2. giving individuals any collection notices required under Australian Privacy Principle 5, including that their information may be handled by service providers such as ListingMate; and
3. getting any consents it needs, including consent from people who appear in photos or video used in listing marketing.

2.2 Unless the parties agree otherwise in writing, the Customer must not put the following into the Platform: sensitive information (as defined in the Privacy Act 1988 (Cth), such as health information); government identifiers such as driver licence, passport or tax file numbers; credit card or bank account details; or passwords for other services, except through an authorised connection the Platform provides.

2.3 The Customer is responsible for securing its own logins, devices and systems used to access the Platform, and for keeping its own copies of any content it needs to retain.

2.4 The Customer has reviewed the security measures in Annex C and considers them appropriate for the Personal Information it will put into the Platform.

3. ListingMate obligations

3.1 Use. ListingMate will collect, use, store and disclose the Personal Information only to provide, secure and support the Services, as the Customer instructs through its use of the Platform or in writing, or as the law requires. Instructions that fall outside the Services, or that need extra work, must be agreed in writing. If ListingMate reasonably believes an instruction breaches privacy law, it will tell the Customer.

3.2 Privacy Principles. Whether or not ListingMate is itself covered by the Privacy Act 1988 (Cth), it agrees to handle the Personal Information in a way that is consistent with the Australian Privacy Principles as they would apply to the Customer.

3.3 Security. ListingMate will take reasonable steps to protect the Personal Information from misuse, interference, loss, and unauthorised access, change or disclosure. These steps include the measures in Annex C. ListingMate may update those measures over time, as long as the overall level of protection does not go down.

3.4 Personnel. ListingMate will make sure anyone who can access the Personal Information is bound by confidentiality duties and can access only what they need for their role.

3.5 No sale or AI training. ListingMate will not sell the Personal Information or use it for its own direct marketing. It will not use the Personal Information to train, fine-tune or improve any AI model, whether its own or a third party's, unless that is needed to provide the Services as the Customer has asked, or the Customer agrees in writing. ListingMate will require its service providers, including AI model providers, not to use the Personal Information to train their own models.

3.6 Assistance. ListingMate will give the Customer reasonable help to respond to requests from individuals to access or correct their Personal Information, and to complaints. If ListingMate receives such a request directly, it will pass it to the Customer within 5 Business Days and will not respond itself unless the Customer asks it to. If a request needs significant work beyond the normal Services, ListingMate may charge a reasonable fee, agreed with the Customer before the work starts.

3.7 Automated decisions. If any feature of the Platform makes, or substantially helps make, decisions that could significantly affect an individual's rights or interests, ListingMate will tell the Customer, explain in general terms how it works (without revealing trade secrets), and help the Customer meet its disclosure duties under Australian Privacy Principle 1. ListingMate does not expect the current Platform to do this.

4. Service providers (sub-processors)

4.1 The Customer agrees that ListingMate may use the service providers listed in Annex B to help provide the Services. ListingMate may also publish the current list on its website.

4.2 ListingMate will have a written agreement with each service provider that requires it to protect the Personal Information to a standard no lower than this Schedule. ListingMate remains responsible for its service providers.

4.3 ListingMate will give at least 30 days' notice before adding or replacing a service provider that handles Personal Information. The Customer may object on reasonable privacy grounds within 15 days after the notice, and the parties will then try in good faith to find a solution. If they cannot agree within a reasonable time, the Customer may end the Subscription Agreement by notice without an early termination fee, paying only Fees owing up to the end date.

5. Overseas disclosure

5.1 Some service providers store or process data outside Australia. The countries are listed in Annex B.

5.2 Before any Personal Information is disclosed overseas, ListingMate will take reasonable steps to make sure the recipient handles it in a way consistent with the Australian Privacy Principles, as required by Australian Privacy Principle 8.

5.3 ListingMate will tell the Customer if the list of countries changes, under the notice process in clause 4.3.

6. Data breaches

6.1 If ListingMate becomes aware of unauthorised access to, unauthorised disclosure of, or loss of Personal Information it holds for the Customer, it will:

1. notify the Customer without undue delay, and in any case within 72 hours, describing what is known about the breach, the steps taken to contain it, and any steps the Customer should take;
2. take reasonable steps to contain the breach and reduce the risk of harm;
3. give the Customer the information it reasonably needs to assess whether the breach is an eligible data breach under Part IIIC of the Privacy Act 1988 (Cth), within the 30-day assessment period that law allows; and
4. help the Customer prepare any statement to the Office of the Australian Information Commissioner and any notice to affected individuals.

6.2 Unless the law requires otherwise, the Customer decides whether to notify the Commissioner and individuals. ListingMate will not notify them about the Customer's data without first consulting the Customer, unless the law requires it. If a notice by the Customer will name or identify ListingMate, the Customer will, where lawful, show ListingMate a draft first and consider any corrections it reasonably suggests.

6.3 Notifying a breach is not an admission of fault or liability.

6.4 This clause does not apply to unsuccessful attempts that do not compromise Personal Information, such as failed log-in attempts, pings, port scans or blocked network attacks.

7. Records and review

7.1 On request, and no more than once a year (or after a data breach), ListingMate will answer the Customer's reasonable written questions about how it complies with this Schedule and provide any relevant security summaries or certifications it holds.

7.2 Any on-site or system audit must be agreed in advance, with a written plan given at least 2 weeks before. It is at the Customer's cost, must be carried out during business hours, and must not expose other customers' data or weaken security. A third-party auditor must not be a competitor of ListingMate and must sign a confidentiality agreement. If a recent independent security report or certification covers the same controls, the Customer will accept it instead.

8. End of the Agreement

8.1 When the Subscription Agreement ends, ListingMate will deal with the Personal Information as set out in clause 6.6 of the Subscription Agreement.

8.2 This Schedule keeps applying for as long as ListingMate holds Personal Information for the Customer, even after the Subscription Agreement ends.

8.3 Any Personal Information ListingMate must keep by law stays protected under this Schedule, is used only for the purpose the law requires, and is deleted once it no longer needs to be kept.

9. General

9.1 Each party's liability under this Schedule is subject to clause 9 of the Subscription Agreement.

9.2 ListingMate may update this Schedule by notice only to keep up with changes in privacy law, as long as the change does not materially reduce the protection of Personal Information or materially add to the Customer's obligations.

9.3 Notices under this Schedule may be sent to the privacy contacts in Annex A.

Annex A: Details of the data handled

Annex B: Service providers

Social media platforms such as Meta are Connected Accounts the Customer chooses to use. They are not ListingMate's service providers, and content published to them is governed by the Customer's agreement with that platform.

Annex C: Security measures

• Data encrypted in transit (TLS), and at rest by our hosting and database providers.
• Each customer's data separated with row-level access controls in the database.
• Connected-account credentials encrypted (AES-256-GCM) before they are stored.
• Access to production systems limited to ListingMate personnel who need it.
• Multi-factor authentication on ListingMate's accounts with its hosting, database, code and payment providers.
• Secrets and API keys kept in the hosting provider's protected settings, never in source code.
• Code changes tested before they are released.
• Regular backups by our database provider.
• Software dependencies kept up to date and security advisories reviewed regularly.
• Physical and network security of data centres provided by the hosting providers in Annex B.
• Personal information deleted securely when it is no longer needed.