Data Processing Agreement
Effective: 23 September 2026
1. Parties, scope and priority
This DPA is between Southern Vector Limited (willdo, we) and the business customer accepting willdo's Terms of Service (Customer, you). It applies automatically when we process personal information on your behalf through the Service. It does not require a separate signature unless the parties agree otherwise.
Customer Personal Information means personal information supplied, retrieved or generated through the Service that we process on your behalf, including relevant copies in outputs, indexes, logs, backups and support records. Applicable Privacy Law means the New Zealand Privacy Act 2020 and other privacy law binding on the relevant party and processing. The processing schedule below forms part of this DPA.
This DPA prevails over conflicting standard Terms for that processing. The Terms' liability provisions also apply to this DPA. Nothing limits individuals' statutory rights, regulator powers or obligations that cannot lawfully be contracted out of.
2. Roles and instructions
You determine the lawful business purposes and instructions. To the extent we process solely on your behalf, we act as your service provider or agent for the purposes of section 11 of the Privacy Act 2020. Where you act for another organisation, you must have its authority to appoint us and give instructions. Labels do not override the parties' actual legal responsibilities.
Your instructions consist of this agreement and your authorised users' work requests, configurations, connections, sharing choices, approval settings and deletion instructions. They include necessary hosting, model inference, operational AI, relevant diagnostics and support described in the Service and Privacy Policy. They do not authorise us to bypass a saved Blocked action or required human-only approval.
We will process Customer Personal Information only on those instructions, to provide and secure the Service, or as required by law. We will tell you if an instruction appears to violate Applicable Privacy Law and may suspend affected processing while it is resolved. We do not undertake to validate the legality of every instruction. Where law requires different processing, we will notify you before it occurs unless prohibited.
For information we process for our own account administration, billing, lawful marketing or other independent purposes, the Privacy Policy applies. We will not reclassify customer work as our own information simply to avoid this DPA, use it for content-based advertising, sell it, or train or fine-tune models on it.
3. Customer responsibilities
You are responsible for a lawful purpose and authority to collect, use and disclose the information; necessary notices and permissions; the accuracy and relevance of inputs; and lawful instructions, including any automated decision or overseas connection. You must provide only information reasonably needed and comply with the Terms' sensitive-data restrictions.
You manage your users, provider accounts, granted permissions and business retention needs. You must provide a contact for privacy and security cooperation. We remain responsible for our own duties and cannot transfer those duties merely by describing you as responsible for customer data.
4. Confidentiality and security
We will ensure that people authorised to process Customer Personal Information are subject to appropriate confidentiality obligations and access is limited to a legitimate operational need. Approved AI-assisted support and investigation must be within the disclosed supplier arrangements and relevant purposes.
We will maintain reasonable technical and organisational measures appropriate to the nature of the information and risks, including access controls and credential protection, logical separation of customer workspaces, management of privileged access, appropriate transmission safeguards, vulnerability handling, operational monitoring, backup management and deletion procedures. We will maintain a process for investigating privacy and security incidents. These are contractual standards, not a claim of an independent certification or a guarantee that every failure can be prevented.
We may improve or replace measures without materially reducing the overall protection of Customer Personal Information. You remain responsible for security of your devices and customer-appointed services. You can request information reasonably needed to assess our measures.
5. Suppliers and customer-appointed services
You give general authorisation for us to appoint subprocessors identified as processing customer work in the Service Providers, Recipients and Subprocessors list. Before giving them access, we will carry out appropriate checks and impose written obligations providing protection materially consistent with this DPA, including confidentiality, security, permitted purposes, incident cooperation and appropriate deletion or return.
We remain responsible for the performance of our appointed subprocessors' data-processing obligations as if they were ours, subject to the Terms' lawful limitations of liability. For willdo-appointed AI suppliers receiving customer content, the arrangements must be consistent with our no-training commitment. A business-product label by itself does not establish compliance.
We will notify your account contact at least 14 days before a new or replacement subprocessor begins materially relevant processing. You may object during that period on reasonable, specific data-protection grounds. We will discuss an alternative or other reasonable solution. If none is available, either party may end the affected Service without penalty, with a proportionate refund of any unused prepaid fees for it. We will not introduce the disputed processing for you before the objection is resolved or affected use ends. An urgent replacement needed to protect security or continuity may be made sooner with comparable safeguards and notice as soon as practicable; you retain the objection and exit rights.
A model provider, app, database or other service chosen and contracted directly by you is a customer-appointed service, not automatically our subprocessor. You instruct the corresponding transmissions and manage that service's terms and safeguards. This distinction does not excuse our own security or transmission failures, or turn a supplier we actually appoint into your supplier.
6. Processing locations
You authorise the locations disclosed for our appointed providers and the lawful destinations you instruct through your connections. Our primary AWS-hosted infrastructure is currently in the United States. We will meet applicable requirements for overseas processing and disclosure, including comparable safeguards where required by information privacy principle 12. Your agreement to this DPA is not a substitute for a required transfer safeguard or an individual's required authorisation.
If a proposed use requires additional mandatory transfer documentation or a sector-specific agreement not included here, the parties must put it in place before that use. This DPA does not claim that every worldwide deployment is already covered by every foreign regime.
7. Privacy incidents
We will notify your designated contact without undue delay and as soon as practicable after becoming aware of a breach affecting Customer Personal Information, including unauthorised access or disclosure, loss, alteration, destruction or loss of availability. This contractual notification does not depend on first establishing that the breach reaches a statutory reporting threshold.
We will provide available information about its nature, affected information and people, likely consequences, mitigation and contact person, with updates as facts become known. We will take reasonable containment and remediation steps and cooperate with your response. Notification is not an admission of liability.
Each party remains responsible for notifications it must make to regulators or affected people. We will consult you where practicable before notifying people about your records, unless a legal duty or urgency requires otherwise. Neither party may delay a required notification while waiting for the other's approval.
8. Rights, assistance and assurance
We will promptly pass on requests relating to information we hold on your behalf, unless prohibited, and provide reasonable assistance with access, correction, deletion, complaints, risk assessments and legally required inquiries, taking account of the nature of the processing and information available to us. We may respond directly where legally required. Your approval is not required to exercise an individual's non-excludable rights.
We will provide relevant compliance and security information on reasonable request. Ordinarily, assurance starts with written information or available independent reports. If reasonably insufficient, an appropriately qualified, independent auditor bound by confidentiality may conduct a proportionate audit on reasonable notice, normally once in 12 months. Additional access may be required by law, a regulator or a material incident. Audits must protect other customers, privileged information and security, and avoid unreasonable disruption. No penetration testing is permitted without written agreement.
You bear reasonable, agreed costs of exceptional assistance or audits, except to the extent needed because of our breach or where charging is not lawful. We will not use charges or the ordinary audit frequency to obstruct mandatory rights or regulatory access.
9. Return, retention and deletion
We retain and delete Customer Personal Information in accordance with your lawful instructions and the Privacy Policy's retention schedule. Active work is distinct from routine 30-day operational logs. Customer-controlled settings apply only to the records and functions they actually cover.
On account closure or termination, you may request return in available formats within 30 days. We will give reasonable assistance with retained information; we do not promise a bespoke migration, a complete audit export or recovery of records already properly deleted. A return request made in time pauses deletion of the identified retained material only as long as reasonably necessary to complete return, unless law requires otherwise.
Absent a return request requiring temporary retention, we will delete Customer Personal Information from active systems within 30 days after termination or a valid deletion instruction. Backup copies may remain for up to 30 additional days after live deletion, inaccessible for ordinary use and used only for recovery or legal needs. If restored, the deletion instruction will be reapplied. We will require our appointed subprocessors to follow appropriate corresponding deletion requirements.
Where law requires retention, we will retain only the necessary information for the required period, restrict its use, and explain the exception where lawful. On request, we will confirm completion or describe remaining categories and the applicable expiry. Customer-appointed services and recipients control their own copies; we will reasonably assist with information needed for your requests to them.