A Processor agreement with the boring bits handled

This DPA forms part of the Terms of Service between VoucherGrid Australia Pty Ltd, trading as VoucherGrid, and the merchant. It applies from the merchant account owner's acceptance, before the first processing of merchant customer data, including during a free trial. Acceptance records identify the Terms and DPA versions, accepting person and timestamp. Acknowledgement of the Privacy Policy is separate from optional tracking consent.

At a glance · what this DPA does

§1 · Definitions

Terms used here have the same meanings as in the Terms of Service and applicable data protection law, including the Privacy Act 1988 (Cth) and, where applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”).

§2 · Scope of processing

The merchant determines the purposes of processing its customer data; VoucherGrid processes that data on documented instructions to provide voucher creation, sale, delivery, redemption, reporting, support and retained-record services. Processing lasts for the service and any justified retention described in section 8. The merchant is responsible for the lawfulness of its instructions and information it supplies.

VoucherGrid is responsible under its Privacy Policy for its own subscription billing, business administration and independently determined fraud/security purposes. Staff information can fall into either role depending on use. Where GDPR applies, these are the corresponding controller and processor roles; the initial Australian merchant market does not itself decide whether overseas laws apply.

§3 · Processor obligations

When processing merchant-controlled personal information, VoucherGrid will:

• Process personal data only on the Controller’s documented instructions (being the provision of the service);
• Ensure persons authorised to process personal data are bound by appropriate confidentiality obligations;
• Implement appropriate technical and organisational security measures as described in the Privacy Policy;
• Not engage new sub-processors without prior notice via the Sub-Processor Register;
• Assist the Controller in responding to data subject rights requests (access, erasure, portability) within a reasonable timeframe;
• Notify affected merchants of a personal data breach without undue delay, providing available information first and further updates as facts become available. This is distinct from any controller regulatory notification deadline.

§4 · Sub-processors

The merchant authorises the providers used for the services identified in the Provider register. Conditional integrations are used only when enabled. We assess the applicable agreements, account coverage, processing locations and safeguards for providers we appoint to process merchant-controlled data, require appropriate data-protection obligations and remain responsible for their performance of those obligations to the extent required by applicable law.

We give affected merchants at least 30 days' advance notice of planned additions or replacements, including the provider's role and locations. Merchants may raise reasonable data-protection objections with privacy@vouchergrid.com. We will work to resolve them; an unresolved objection allows exit from the affected service without penalty, a refund of unused prepaid subscription fees for that service and an orderly handover.

§5 · Cross-border transfers

Our service uses overseas providers as described in the register. Locations summarise the service setup and are not exclusive residency guarantees. For disclosures subject to APP 8, we take reasonable steps to ensure the overseas recipient handles personal information consistently with the APPs, unless an applicable exception applies. We consider the provider's protections and applicable contractual terms rather than treating a public privacy link as sufficient by itself.

Where GDPR transfer rules apply, we use a valid transfer mechanism for the actual parties and processing, including appropriate Standard Contractual Clauses and supplementary safeguards where needed. We do not claim that every provider or processing purpose uses the same mechanism. Contact us for information about the safeguards relevant to your service.

§6 · Data subject rights

Merchants handle requests about customer data they control. VoucherGrid provides reasonable assistance through account/export tools and verified requests to privacy@vouchergrid.com. We refer direct customer requests to the relevant merchant where appropriate and do not disclose another person's data without authority. We respond within applicable legal timeframes, considering any lawful retention duties. Australian privacy law does not provide a universal right to erasure.

§7 · Audit rights

We provide information reasonably necessary to demonstrate our compliance with this DPA and allow proportionate audits and inspections where required by applicable law, including GDPR Article 28 where it applies. We agree reasonable scope, timing and confidentiality arrangements and protect other customers' information. We assist with applicable impact assessments and regulator consultations, and tell you if we believe an instruction infringes applicable data-protection law. We do not represent that we hold an independent certification or security audit report.

§8 · Return and deletion

At the end of processing services, you may choose return or deletion of the personal data we process on your behalf. We will follow that instruction and delete existing copies unless applicable law requires their retention, with restricted backup handling as described below. Information we independently control for our own lawful purposes is handled separately under the Privacy Policy; that does not give us a general right to disregard your deletion instructions.

Paid cancellation and handover

Cancelling renewal keeps your paid plan, public store and new sales available until the provider-confirmed end of your paid billing period. You can reactivate before that period ends. The next 30 calendar days provide existing-voucher handover: authorised viewing, redemption, permitted refunds and voids, and existing ledger, report and accounting exports remain available. New sales and issuance stop during handover.

An interim export is prepared when handover begins. At the fixed operational cutoff, operational access and public live-balance access end and a final export is prepared. Cancelling does not cancel valid vouchers or remove your responsibility to honour them outside VoucherGrid.

Retained records and access

Verified owners can use records-only access without resubscribing. Explicitly authorised representatives can use representative records access. Retrieval covers records still retained and permitted for disclosure; it does not reopen the workspace or provide live balances. Exports distinguish the cutoff, snapshot and generation dates, with later retained activity labelled separately.

Private download links are time-limited. Records-only links last up to 15 minutes, subject to the package expiry. Revoking representative access stops new requests and links; an already issued link expires at its original expiry time. Deleted or anonymised information is not reconstructed from earlier archives.

Retention and deletion

Paid cancellation and operational cutoff do not themselves anonymise customer records. We keep personal information only for the purposes for which it is needed, including providing the service, supporting outstanding vouchers, complying with law and handling legitimate disputes. We assess retention by record category and purpose, rather than keeping every customer detail for the same period.

• Financial records: retain the minimum transaction fields and supporting evidence for the applicable statutory period or lawful, documented merchant instruction. Where the seven-year company-record requirement applies, it runs after the covered transactions are completed.
• Profiles, contact details and messages: review whether they remain necessary after service and handover end or when a verified request is received. Delete or de-identify information no longer needed, unless retention is required by law or a justified continuing purpose.
• Security and audit records: keep information needed to investigate incidents and substantiate relevant transactions. Retention depends on the record and purpose; a selected incident does not justify preserving all customer information indefinitely.
• Exports and backups: a download link expiring is not evidence of stored-object deletion. Temporary packages and backup copies follow their separate cleanup and provider recovery processes. Until removal, restrict retained copies to recovery or another justified purpose and reapply completed deletion instructions after restoration.

We can handle these reviews and verified requests manually. A legal or dispute hold records the affected information, reason, responsible person and review date. It does not automatically restart every retention period. Where immediate destruction of a backup is not reasonably possible, we restrict its use and take reasonable steps to remove it through the applicable recovery cycle; we do not promise a single expiry period for all copies.

Keyed hashes and surviving identifiers remain personal information where someone is reasonably identifiable. Removing names alone does not establish de-identification. Merchant downloads and independently controlled provider records require separate handling; we do not promise erasure of copies outside our control.

Trial expiry is separate

If a trial ends without payment details, the existing seven-day read-only grace period applies. Choose a paid plan to restore full access. This is different from paid-cancellation handover; failed payment and immediate account deletion are also separate processes.

§9 · Governing law

This DPA is governed by the laws of Victoria, Australia. Where GDPR applies, the competent supervisory authority is the relevant EU member state authority for the Controller’s establishment.