Data Processing Addendum

This Data Processing Addendum describes how Philomathia handles Customer Data when an organisation uses Philomathia products, pilots, hosted services, support workflows, or related professional services.

It is intended to sit with the Master Services Agreement, order form, pilot plan, Child and Participant Data Schedule, Privacy Policy, and any signed customer agreement. A signed agreement controls where it expressly conflicts with this addendum.

For customer deployments, Customer is responsible for deciding what data is submitted, who may access it, and the lawful basis, notices, consents, or approvals that allow the data to be processed. Philomathia processes Customer Data only to provide, secure, support, maintain, and improve the services, comply with law, and follow documented customer instructions in the applicable agreement.

Where Australian privacy law applies, the parties intend to operate consistently with the Australian Privacy Principles. Where another privacy framework applies, the customer agreement should identify the additional requirements before data is submitted.

Permitted processing includes hosting, storage, authentication, service delivery, learner and supporter workflows, AI-assisted feedback, diagnostics, support, security monitoring, billing, customer success, audit logs, backups, de-identification, and aggregated service improvement.

• Philomathia will not sell Customer Data.
• Philomathia will not use Customer Data for third-party advertising.
• Philomathia will not use identifiable child or participant data for model training, fine-tuning, public demos, or unrelated research unless the customer agreement and required consent expressly allow it.

Customer Data may include sensitive information, health-adjacent support context, disability-related context, school context, NDIS context, behavioural observations, learning records, reflections, and information about children or participants. Customers must not submit this data unless they have authority to do so and the submission is reasonably necessary for the agreed service.

For individuals under 15, and especially children under 13, Customer must obtain parent or guardian consent, or confirm that an authorised school, support provider, guardian, or other legally responsible organisation has authority to provide the data. Additional requirements are set out in the Child and Participant Data Schedule.

Philomathia may use subprocessors to provide hosting, database, forms, authentication, analytics, communications, payment, support, security, embedded media, and AI infrastructure. Current public-site subprocessors and data locations are listed on the Subprocessors page.

Philomathia will use reasonable vendor review and contractual controls for subprocessors that process Customer Data. If a customer requires advance notice, objection rights, or a fixed subprocessor list, those terms should be included in the applicable customer agreement or order process.

Customer Data may be processed in Australia, the United States, and other countries where Philomathia or its subprocessors operate infrastructure or support services. Philomathia will use reasonable contractual, technical, and organisational safeguards for overseas processing.

Where APP 8 or another cross-border disclosure rule applies, Philomathia will take reasonable steps designed to ensure overseas recipients handle personal information consistently with the required privacy protections.

Philomathia will use technical and organisational measures designed to protect Customer Data against unauthorised access, disclosure, loss, misuse, and alteration. These may include encryption in transit, access controls, least-privilege permissions, environment separation, logging, backups, vendor review, and administrative access limits.

Customer remains responsible for its own user permissions, administrator choices, endpoint security, internal sharing, exported files, and instructions given to Philomathia.

Philomathia will investigate suspected unauthorised access, disclosure, loss, or misuse of Customer Data. If an incident is likely to be an eligible data breach or otherwise requires notice, Philomathia will notify affected customers without unreasonable delay and provide available information needed for assessment, remediation, and legally required notices.

Customers must promptly notify Philomathia of suspected account compromise, mistaken disclosure, unauthorised administrator access, or other customer-side incidents involving the services.

Philomathia will provide reasonable assistance for access, correction, deletion, export, objection, restriction, consent withdrawal, and complaint requests relating to Customer Data, subject to product capabilities, legal limits, identity verification, and the customer agreement.

Where an organisation provides access to the service, some requests may need to be handled through that organisation because it controls the deployment, user relationships, and legal authority for the data.

After termination or expiry, Philomathia will provide reasonable assistance for return, export, or deletion of available Customer Data on request, subject to product capabilities, legal limits, backup retention, security obligations, dispute preservation, and unpaid fees.

Backup copies and logs may persist for a limited period under standard retention processes before deletion or overwriting.

Before live deployments involving child or participant data, Philomathia should maintain a data inventory and retention table, subprocessor register, breach response runbook, access and deletion workflow, lightweight privacy impact assessment, and vendor review checklist for AI providers, authentication, analytics, hosting, communications, and storage providers.

These operational artifacts are internal controls and may be shared with customers under appropriate confidentiality terms where procurement or risk review requires them.

Questions about this Data Processing Addendum, customer data protection, security review, or subprocessor terms can be sent to [email protected].

This addendum should be reviewed by legal counsel before Philomathia represents that any particular deployment is fully compliant.