Data processing agreement

This agreement applies automatically whenever you use Behavr to process personal data that is subject to the GDPR, the UK GDPR, or the Australian Privacy Act. It forms part of our Terms of service. You do not need to sign it.

If your organisation requires a signed copy or a different form, contact hello@behavr.ai.

1. Who is who

You are the controller. You decide what research material to upload, what to test, and why.

We are the processor. Behavr (ABN 69 736 572 825), a registered business name in Sydney, Australia, processes that material on your instructions and for no other purpose.

Account data is different. Information about you as our customer, your name, email, billing details and usage, is data we control, not process for you. Our Privacy policy covers it and this agreement does not.

2. What we process, and why

3. Our obligations

We will: process personal data only on your documented instructions, which include your use of the Service and any settings you choose (uploading material is an instruction to process it); tell you if we believe an instruction breaches data protection law, and may pause that processing until it is resolved; ensure anyone who can access the data is bound by confidentiality; keep the security measures described in section 5; help you respond to data subject requests, as set out in section 6; tell you about personal data breaches without undue delay, and in any case within 48 hours of becoming aware; delete or return the data when you ask or when this agreement ends, as set out in section 7; and give you the information you reasonably need to demonstrate compliance, and allow audits as set out in section 8.

We will not sell the data, use it for our own purposes, or use it to train AI models.

4. Your obligations

You will: have a lawful basis for the material you upload and for us to process it; give data subjects any notice or information they are entitled to, because we have no relationship with them and cannot do this for you; not upload special category data (racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation), criminal offence data, government identifiers, payment card numbers, or data about children; remove or mask direct identifiers where you reasonably can, since Behavr does not need names or contact details to build a persona; and give instructions that comply with data protection law.

If you upload material in breach of this section, we may remove it, and you are responsible for the consequences.

5. Security

We maintain measures appropriate to the risk, including: encryption in transit (TLS) and at rest; access controls, with access limited to what is needed to run and support the Service; logical separation between customer workspaces; authentication handled by a specialist provider, so we never see or store passwords; payment card details handled entirely by our payments provider, never reaching our systems; backups, and a documented process for restoring them; and logging of access to production systems.

We review these measures periodically and may change them, provided security is not reduced.

6. Data subject requests

If a data subject contacts us directly about material you uploaded, we will not respond to the substance. We will tell them to contact you, and tell you within 5 business days.

You can access, export, correct and delete uploaded material yourself in the application. Where you cannot, we will help you respond to a request within a reasonable time, at no charge for reasonable volumes.

7. Deletion and return

You can delete uploaded material, personas, sessions and reports at any time in the application. Deletion is immediate in the application and removed from backups within 30 days.

When your account closes, we delete your uploaded material, personas, sessions and chats immediately, except where we must keep something to comply with law. Screenshots and recordings are deleted within 30 days, and backups within 30 days. Billing records are kept for 7 years as Australian tax law requires; they do not contain uploaded research.

Export anything you want to keep before closing your account.

8. Audits

We will give you the information you reasonably need to verify our compliance with this agreement, including our security documentation and current subprocessor list.

If that is not enough, you may audit us, or appoint an independent auditor, on 30 days’ notice, no more than once a year unless a regulator requires otherwise or we have had a breach affecting your data. Audits must be during business hours, must not disrupt the Service, and are at your cost.

9. Subprocessors

You give general authorisation for us to engage subprocessors. Our current list is the provider table in our Privacy policy.

We will give at least 30 days’ notice before adding or replacing a subprocessor that processes uploaded material. If you reasonably object on data protection grounds, tell us within those 30 days and we will try to resolve it. If we cannot, you may terminate and receive a pro-rata refund of any prepaid unused period.

Each subprocessor is bound by written terms no less protective than these, and we remain responsible for their performance.

10. International transfers

We are in Australia. Our subprocessors operate in the United States, and some of them in other locations worldwide. Australia does not have an EU adequacy decision.

Where personal data is transferred out of the EEA, the Standard Contractual Clauses adopted by the European Commission on 4 June 2021 apply and are incorporated into this agreement, with Module Two (controller to processor). Where personal data is transferred out of the UK, the UK International Data Transfer Addendum applies.

For those clauses: you are the data exporter, we are the data importer; the docking clause applies; Clause 9 Option 2, general written authorisation, with 30 days’ notice as set out in section 9; Clause 11, the optional independent dispute resolution body does not apply; Clause 17, governed by the law of Ireland; Clause 18, disputes to the courts of Ireland; Annexes I, II and III are populated by sections 1, 2, 5 and 9 of this agreement and the subprocessor list.

11. Liability

The liability limits in our Terms of service apply to this agreement. Nothing in this section limits either party’s liability to a data subject under Article 82 of the GDPR, or any liability that cannot be limited by law.

12. Term and general

This agreement starts when you first use the Service and ends when your account closes and the deletion in section 7 is complete.

If this agreement conflicts with our Terms of service on the processing of personal data, this agreement wins. Otherwise the Terms of service apply.

We may update this agreement to reflect changes in law or in how the Service works. For material changes we will give at least 30 days’ notice.

Questions: hello@behavr.ai