Data Processing Agreement (DPA)
This Data Processing Agreement (“DPA”) is entered into by and between:
(1) You the client, a legal entity subscribing to and using the SAVA P platform and
(2) SAVA P Pty Ltd (“Processor” or “SAVA P”), a technology service provider incorporated in Australia.
1. Subject Matter and Scope
This DPA governs the Processing of Personal Data on behalf of the Client in connection with the use of SAVA P’s whitelabel platform, which includes data room services, email communications, and branded content ecosystems.
2. Definitions
- Personal Data means any information relating to an identified or identifiable natural person.
- Processing means any operation performed on Personal Data, including storage, use, transmission, and deletion.
- Controller means the entity determining the purposes and means of Processing Personal Data.
- Processor means the entity Processing Personal Data on behalf of the Controller.
- Data Subject means an individual whose Personal Data is being processed.
3. Roles and Responsibilities
- The Client acts as the Data Controller.
- SAVA P acts solely as a Data Processor.
The Client warrants that it has all necessary rights and legal bases to process and share Personal Data using the Platform.
The Client is solely responsible for:
- Obtaining valid consent or establishing a legal basis for email communications;
- Managing data subject rights requests (access, erasure, rectification);
- Complying with all applicable privacy, data protection, and financial promotion laws.
4. Instructions
SAVA P shall only process Personal Data:
- As necessary to provide the Platform and related support services;
- In accordance with the Client’s documented lawful instructions;
- As required by law (in which case, SAVA P will notify the Client unless prohibited).
5. Confidentiality and Access Controls
- All SAVA P personnel with access to Personal Data are bound by confidentiality obligations.
- Access is restricted based on least-privilege principles and monitored for anomalies.
6. Security Measures
SAVA P implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- TLS encryption for data in transit;
- Access logging and audit trails;
- Role-based access control;
- Regular vulnerability testing and updates;
- Isolated data environments for each client.
7. Subprocessors
SAVA P may engage third-party subprocessors to provide elements of the Platform. A current list will be made available upon request.
SAVA P will:
- Ensure subprocessors are bound by data protection obligations equivalent to this DPA;
- Remain fully liable for subprocessors.
8. International Data Transfers
SAVA P may transfer Personal Data outside the country of origin, subject to appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) where applicable;
- Data transfer agreements for onward transfers;
- Hosting data in privacy-compliant jurisdictions.
9. Assistance with Data Subject Rights
SAVA P will:
- Promptly forward any request from a Data Subject to the Client;
- Assist the Client in fulfilling data subject requests, as feasible and at Client’s cost if excessive.
10. Data Breach Notification
SAVA P will notify the Client without undue delay upon becoming aware of a Personal Data Breach. The notification will include:
- A description of the breach;
- The likely consequences;
- Measures taken or proposed to address the breach.
11. Data Retention and Deletion
- Retention During Subscription: SAVA P will retain Client Data on the Platform for the duration of the Client’s active subscription.
- Termination and Export: Upon termination of the Agreement or closure of the Client’s account, SAVA P will:
- Provide the Client with a defined export window (no less than 30 days) to retrieve all Client Data using export tools provided by the Platform.
- Notify the Client that it is solely responsible for exporting and retaining any records required by applicable law (for example, 7 years for investment-related communications in Australia).
- After the export window has lapsed, SAVA P may delete Client Data from active systems.
- Backups and System Logs: Residual copies of Client Data (such as system logs, cached data, and backups) will be securely deleted within 90 days of termination, unless retention is required by law, regulation, or ongoing dispute resolution.
- Client Responsibility for Recordkeeping: Clients acknowledge that they, not SAVA P, are responsible for ensuring compliance with any statutory or regulatory record-keeping obligations in their jurisdiction. Clients must ensure that they export or otherwise retain such records prior to account closure.
- Legal and Dispute Retention: Notwithstanding the above, SAVA P may retain minimal Personal Data where necessary:
- To comply with applicable legal obligations;
- To resolve disputes or enforce agreements; or
- To preserve evidence relevant to regulatory or legal proceedings.
12. Liability and Indemnity
The Client agrees to indemnify, defend, and hold harmless SAVA P against any claims, fines, damages, or investigations arising from:
- The Client’s failure to comply with applicable data protection laws;
- The Client’s misuse of the Platform;
- Any inaccurate or unlawful instructions given by the Client.
13. Audit & Compliance
SAVA P shall:
- Provide Documentation: Within 30 days of a written request, deliver documentation necessary to demonstrate compliance with this DPA.
- Allow Audits: Clients may conduct physical or remote audits no more than once per year, provided:
- At least 30 days written notice is given;
- Audits occur during normal business hours;
- They do not unreasonably disrupt operations;
- They are limited in duration to one business day, extendable once for cause;
- The Client bears all audit-related costs.
- Regulator-Mandated Audits: If law or a competent supervisory authority requires it, additional audits or inspections are permitted.
14. Governing Law
This DPA shall be governed by:
- Australian law if the Client is based in Australia;
- English law if based in the UK or EU;
- Delaware law if based in the USA or elsewhere.
Addendum A – European Union (GDPR)
- SAVA P complies with the General Data Protection Regulation (EU) 2016/679.
- Standard Contractual Clauses (SCCs) are incorporated by reference.
- Clients must identify their EU representative if applicable.
Addendum B – United Kingdom (UK GDPR)
- SAVA P complies with UK GDPR and the Data Protection Act 2018.
- Transfers to or from the UK are subject to UK IDTA or SCCs as appropriate.
Addendum C – Australia (Privacy Act 1988)
- The Client must ensure that any personal information collected, stored, or disclosed complies with the Australian Privacy Principles.
- Data must not be kept longer than reasonably necessary. For financial services, investment-related communications (excluding invoices), this is generally 7 years.
Addendum D – United States (CCPA & CAN-SPAM)
- SAVA P is a “service provider” under the California Consumer Privacy Act (CCPA).
Clients must:
- Disclose data collection practices in their own privacy notices;
- Honour opt-out and do-not-sell requests;
- Comply with CAN-SPAM for email marketing (include unsubscribe links, accurate sender details).
15. Contact
Questions related to this DPA should be directed to:
info@sava-p.com
Legal & Compliance Team, SAVA P Pty Ltd, c/o Acclime, Level 16/101 Miller St, Sydney
16. Acceptance and Execution
By clicking “I accept,” creating an account, or continuing to use the Platform, the Client acknowledges and agrees that:
- This DPA is legally binding on the Client;
- The Client acts as the Data Controller and SAVA P acts as the Data Processor;
The Client accepts and assumes responsibility for compliance with all applicable data protection, privacy, and financial promotion laws in connection with its use of the Platform.