Data Processing Annex
1. Roles
This Annex applies where your SkuBase data contains personal information about individuals. For that personal information, you (the merchant) are the responsible party / controller and Coalition Software Pty Ltd is the operator / processor. We process it only to provide the Service under the Terms.
2. Instructions and compliance
- We process personal information only on your documented instructions (configuration, API calls and support requests through the Service), unless legally required otherwise — in which case we will tell you before processing unless prohibited.
- You are responsible for having a lawful basis for the personal information you upload and for informing the individuals concerned where required.
- Personnel authorised to process personal information are bound by confidentiality obligations.
3. Security
We maintain the technical and organisational measures described in our Privacy Policy: encryption in transit and at rest, access controls, scoped and revocable API keys, and backup and logging practices appropriate to the risk.
4. Sub-processors
The providers listed in Section 5 of the Privacy Policy (Supabase, Fly.io, Cloudflare, Paddle, Google Analytics) act as sub-processors for the personal information we host. We will notify you of any new sub-processor before it processes your data, and you may object on reasonable grounds.
5. Assistance and breach notification
- We will assist you in responding to requests from data subjects and regulators where you cannot reasonably fulfil them yourself.
- If we become aware of a security breach affecting your personal information, we notify you without undue delay and in any event within 72 hours, with enough detail for you to meet your own notification obligations.
6. Transfers, return and deletion
- Personal information is hosted in the locations listed in the Privacy Policy, under the transfer safeguards described there.
- On termination of your account, we delete your tenant data, including any personal information, after the 30-day grace period described in the Privacy Policy, or return it at your request before that period ends.