Grace← Home

Data Processing Addendum — Grace

  • Provider: Michael Egan (ABN 37 317 577 102), trading as Strategic Worlds — referred to in this DPA as "Strategic Worlds", "we" or "us"
  • Service: Grace, the ISO 9001 / ISO 27001 compliance platform at grace.strategicworlds.com.au
  • Effective date: 6 October 2026
  • Contact: contact@strategicworlds.com.au

This Data Processing Addendum (the "DPA") forms part of the Terms of Service between Strategic Worlds and the customer ("Customer", "you") for the Grace Service, and applies from the effective date of your Order. It governs our handling of personal information contained in Customer Data that we process on your behalf and on your instructions to provide the Service.

No separate signature is needed for this DPA to apply — it takes effect with your Order, so your data is covered from the first day of the subscription rather than from whenever paperwork is returned. Where your own auditor requires a signed counterpart, we will execute one on request at contact@strategicworlds.com.au.

Australian privacy law does not use the EU "controller / processor" split, but this DPA adopts a similar structure: you determine what personal information goes into your workspace and why; we handle it only to run the Service for you.

1. Scope and roles

  • Subject matter: our processing of personal information within Customer Data to provide the Service.
  • Duration: the term of the Terms of Service, plus the post-termination retention window in section 2.7.
  • Nature and purpose: hosting, storage, computation, transmission, access control, backup, security and support — solely to provide, secure and support the Service.
  • Types of personal information: as determined by you; typically the identity and contact details of your staff, contractors and business contacts, and whatever you record in your compliance registers.
  • Categories of individuals: your Users, personnel, contractors, and the contacts you include.

2. Our obligations

We will:

  1. Process on instructions. Process personal information in Customer Data only to provide the Service and in accordance with your documented instructions (the Terms of Service and your use of the Service), except where law requires otherwise — in which case we will tell you, unless we are prohibited from doing so.
  2. No independent use. Not use Customer Data for our own purposes, not sell it, and not use it for advertising or to train machine-learning models.
  3. Confidentiality. Ensure that any personnel authorised to process Customer Data are bound by confidentiality obligations.
  4. Security. Implement and maintain reasonable technical and organisational security measures appropriate to the risk, consistent with Australian Privacy Principle 11. These include isolation of each workspace's data enforced at the database by row-level security, encryption of traffic in transit over HTTPS/TLS, encryption at rest by our infrastructure providers, and role-based access control within the Service. The current measures are described at grace.strategicworlds.com.au/security.
  5. Assist you. Provide reasonable assistance for you to meet your own obligations, including responding to individuals' access and correction requests and to data-breach and regulatory obligations, taking into account the nature of the processing and the information available to us.
  6. Data breaches. Notify you without undue delay and in any event within 72 hours of becoming aware of a data breach affecting your Customer Data, with the information reasonably available to us at that time, and cooperate with your response and with your obligations under the Notifiable Data Breaches scheme. Where full information is not available within 72 hours, we will provide it in stages as it becomes available rather than delay the first notification.
  7. Retention and deletion. On termination, we will retain Customer Data for 90 days so that you can export it, after which it will be permanently deleted, unless retention is required by law. This matches the Terms of Service; if the two ever differ, section 6 of this DPA decides.
  8. Records and verification. Make available the information reasonably necessary to demonstrate compliance with this DPA. In practice that means our published security statement and sub-processor list, and a response to one reasonable written security questionnaire in any twelve-month period. An on-site or third-party audit is not included, except where a regulator with authority over you requires one, or following a data breach affecting your Customer Data — in either case on reasonable written notice, during business hours, subject to confidentiality, and at your cost.

3. Sub-processors

You authorise us to engage sub-processors to help provide the Service. The current sub-processors — what each one does, the data it sees and where it processes that data — are published at grace.strategicworlds.com.au/sub-processors and kept current. We remain responsible for their performance of the obligations in this DPA, and impose data-protection terms on them consistent with it.

We will give you at least 30 days' written notice before a change of sub-processor that materially changes where Customer Data is held — meaning a change that would cause Customer Data to be processed in a country where we do not already process it, or that would move a category of Customer Data to a different country from the one named in the published list. Changes that do not move Customer Data between countries are reflected in the published list rather than separately notified.

4. Overseas processing (APP 8)

Some processing happens outside Australia. As at the effective date:

  • The application database and file storage, which hold Customer Data, are in Australia (Sydney).
  • Authentication is processed in the United States.
  • Email, used only for features a workspace switches on, is sent either by a United States provider sending from Japan, or by an Australian provider, depending on how your workspace is configured. A workspace may require Australian processing, in which case nothing is sent through an offshore provider. Email is cross-border at delivery in any case, because the recipient's own mailbox may be hosted anywhere.
  • The optional AI assistant, only where a workspace enables it, sends prompts and the records asked about to a provider in the United States.

Where personal information in Customer Data is processed overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles. You are responsible for determining that such cross-border processing is permitted for your own use case, and for making any disclosures required to the individuals concerned. The published sub-processor list is the current record of who processes what, and where.

5. Your obligations

You warrant that: you have the right to provide the Customer Data to us for processing under this DPA; you have made any notifications and obtained any consents required from the individuals concerned; your instructions comply with applicable law; and your use of the Service will not cause us to breach applicable privacy law.

6. Precedence and changes in applicable law

If there is a conflict between this DPA and the Terms of Service about the handling of personal information in Customer Data, this DPA prevails to the extent of the conflict.

This DPA is written to Australian privacy law. If the General Data Protection Regulation or a comparable overseas regime becomes applicable to your use of the Service, the parties will put the necessary additional terms — including standard contractual clauses where required — in place before that processing begins.