2

Opens in a new tab

Data Processing Addendum

Last updated: 29 January 2026

This Data Processing Addendum (DPA) applies automatically to all Customers who access or use the Services.
It forms part of, and is incorporated into, the Customer Agreement available at link.

Definitions

  • Customer means the entity or individual that creates an account and uses the Services.
  • Personal Information has the meaning given in the Privacy Act 1988 (Cth).
  • Privacy Laws means the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
  • Services means our software-as-a-service chatbot platform, including the Chatbot, related software, user interfaces, onboarding materials, documentation, and standard support services, as made available by us from time to time.
  • Sub-processor means a third party engaged by us to process Personal Information in connection with the Services.
  • We, us means Ravzify Pty Ltd ACN 691 339 652
  1. Roles & Scope of Processing

2.1 Roles

  • The Customer determines what Personal Information is collected and submitted through the chatbot.
  • We process Personal Information on behalf of the Customer for the purpose of providing the Services.

2.2 Purpose Limitation

We will only process Personal Information to:

  • operate, maintain and support the Services;
  • comply with the Customer Agreement; and
  • comply with applicable laws.

Customer Instructions

Use of the Services constitutes the Customer’s instructions to process Personal Information in accordance with:

  • this DPA; and
  • the functionality and configuration of the Services.

Security Measures

We will implement reasonable technical and organisational measures to protect Personal Information against:

  • misuse, interference or loss; and
  • unauthorised access, modification or disclosure.

Security measures may include access controls, secure hosting, and encryption where appropriate. 

Schedule 1 to this DPA provides a list of our security measures.

Sub-processors

The Customer authorises us to engage Sub-processors as reasonably required to provide the Services (including cloud hosting and AI service providers). Some of the Sub-processors are described in Schedule 2. 

Data Breach Notification

If we become aware of a suspected or actual unauthorised access, disclosure or loss of Personal Information that may require notification under Privacy Laws, we will:

  • notify the Customer as soon as reasonably practicable; and
  • provide reasonable assistance to support compliance with legal obligations.

Assistance & Cooperation

We will provide reasonable assistance to the Customer in responding to:

  • privacy complaints or enquiries; and
  • regulatory requests,

to the extent the matter relates to Personal Information processed through the Services.

Data Retention & Deletion

We will retain Personal Information only for as long as reasonably necessary to provide the Services, unless retention is required by law.

Upon termination or account closure, Personal Information will be deleted or de-identified within a reasonable period.

Cross-Border Processing

Personal Information may be processed or stored outside Australia where Sub-processors are located.
We will take reasonable steps to ensure cross-border disclosures comply with Privacy Laws.

Liability

This DPA does not expand or limit either party’s liability beyond what is set out in the Customer Agreement.

Governing Law

This DPA is governed by the laws specified in the Customer Agreement.  

Schedule 1 infrastructure and security protocols

To ensure a secure environment for our users, RAVZify employs the following infrastructure and security protocols:

  • Secure Hosting: Our platform is hosted on DigitalOcean, a provider recognized for its advanced infrastructure and stringent security protocols.
  • Two-Factor Authentication (2FA): We enforce the use of 2FA for account logins to add an extra layer of protection against unauthorized access.
  • Cloudflare Protection: We leverage Cloudflare to safeguard the platform against DDoS attacks and to ensure all data transmission remains secure.
  • 256-Bit Encryption: All data stored within our database is secured with 256-bit encryption.
  • GDPR Compliance: We manage conversation data in full compliance with GDPR, reflecting our commitment to user rights and data privacy.
  • Secure API Connections: When interacting with AI services, specific query data is passed to OpenAI via secure API connections to maintain high-level security during transmission.

We may update or modify the technical and organisational measures described in Schedule 1 from time to time, provided that such updates do not materially reduce the overall level of security.

Schedule 2 Sub-processors

This Schedule is provided for transparency purposes only and does not constitute a representation or warranty as to the internal practices of any third-party provider. This is a non-exhaustive list of Sub-processors engaged in connection with the Services.

Open AI. 

The Services utilise application programming interfaces (APIs) provided by OpenAI to enable chatbot functionality. OpenAI acts as a Sub-processor where it processes Personal Information in connection with the Services.

According to OpenAI’s publicly available documentation applicable to its API services as at 3 February 2026, OpenAI does not use API inputs or outputs submitted through the Services to train or improve its models and retains such data only for a limited period for abuse monitoring, service provision and legal compliance purposes, unless required to retain it by law.

OpenAI’s data handling practices are governed by its own terms and policies, which may be updated from time to time.