Data Processing Agreement (DPA) — Template

1. Parties and roles

This Data Processing Agreement (“DPA”) is between the customer of Drawn (“Customer”, the data controller) and Drawn Mind Solutions Pty Ltd (“Drawn”, the data processor). It supplements the Terms of Service between the parties and takes effect when Customer first uses Drawn or when a signed copy is exchanged, whichever is earlier.

Where Drawn’s processing falls inside the Customer’s own privacy notice and lawful basis, the parties agree the GDPR-equivalent Art. 28 roles apply: Customer is controller, Drawn is processor.

2. Subject matter, duration, nature, purpose

• Subject matter: Drawn’s provision of the Drawn platform as described in the Terms of Service.
• Duration: from acceptance of the Terms until the Customer’s subscription is terminated and the post-termination data return window (Terms §7) expires.
• Nature of processing: collection, structured storage, AI inference (via sub-processor Anthropic), de-identification, aggregation (opt-in), deletion.
• Purpose: delivery of the Drawn service to the Customer, as described in the Privacy Policy §6 (primary purpose) and §13 (sub-processors).

3. Categories of personal data and data subjects

Categories of personal data: contact details (name, business email, phone), call audio + transcripts, AI-generated summaries + sentiment classifications, structured business facts, behavioural signals, connector-sampled rows (when Customer connects an upstream system), HMAC-hashed caller phone numbers.

Categories of data subjects:Customer’s authorised users, Customer’s callers, Customer’s end-customers/patients/clients (where their data is captured via voice agent or connected system).

Special categories (sensitive information): Drawn does not solicit sensitive information. Incidental capture (e.g. a caller describing health symptoms) is handled with the same controls; Customer warrants it has lawful basis under APP 3.3 / GDPR Art. 9 for the source disclosure.

4. Controller obligations (Customer)

• Customer is responsible for the lawfulness of collection from data subjects, including obtaining all consents required by Australian law (recording disclosures under Part 7.4 of the Telecommunications (Interception and Access) Act 1979 (Cth) and applicable State surveillance-devices Acts).
• Customer’s own privacy notice must name Drawn and Anthropic as recipients of personal information before activating any connector or upstream-source integration (APP 3.6 / GDPR Art. 14).
• Customer’s instructions to Drawn must be lawful and documented (the Terms + Privacy Policy + a signed copy of this DPA serve as the documented instructions).
• Customer is the first point of contact for data-subject requests; Drawn assists per Section 8 below.

5. Processor obligations (Drawn)

Drawn will:

• Process personal data only on Customer’s documented instructions (as in Section 4) and as required by Australian law.
• Ensure that persons authorised to process personal data are under appropriate confidentiality obligations (Terms §13).
• Implement appropriate technical and organisational security measures (Section 7 below).
• Engage sub-processors only on terms that bind them to obligations no less protective than this DPA (Section 6).
• Assist Customer with responding to data-subject requests, supervisory authority enquiries, and Notifiable Data Breach assessments (Sections 8-9).
• On termination, return or delete personal data as set out in Terms §7.
• Make available all information necessary to demonstrate compliance with this DPA and allow for audits (Section 10).

6. Sub-processors

Drawn engages the sub-processors listed at /legal/sub-processors. Customer authorises that engagement on signing this DPA.

Drawn will give Customer at least 30 days’ written notice before adding a new sub-processor that processes Customer Data. If Customer reasonably objects on data-protection grounds within that notice period, Customer may terminate the subscription before the change takes effect and receive a pro-rata refund of pre-paid fees.

Drawn imposes contractual obligations on its sub-processors no less protective than those in this DPA and remains accountable to Customer for sub-processor performance.

7. Security measures

Drawn implements the following technical and organisational measures (verifiable on request):

• Encryption in transit: TLS 1.2+ on every endpoint.
• Encryption at rest: AES-256-GCM on connector credentials and other secrets; Supabase platform encryption on customer data tables.
• Access control: Row-level security (RLS) on every customer-data table — enforced at the database layer, not at the application layer.
• Identity: Service-role keys held server-side only; no direct browser access to admin credentials.
• Network: CSP, HSTS, X-Frame-Options DENY, Permissions-Policy headers on every response.
• Pseudonymisation: Caller phone numbers stored as HMAC-SHA-256 hashes by default.
• Monitoring: Audit logs on every connector + admin action; rate limits on export, delete, and connector endpoints.
• Backups: Encrypted, time-bounded; included in the 90-day post-termination deletion window (Terms §7).
• Personnel: Background-checked engineers under written confidentiality obligations; least-privilege production access.

8. Data subject rights handling

Drawn provides self-serve mechanisms for the most common rights requests:

• Access: Settings → Security → Export My Data (JSON, generated on demand).
• Correction: “What Drawn Knows” page edit/delete; supersede with audit trail.
• Deletion: Settings → Security → Delete Account (30-day soft-delete + cancellation window).
• Object/restrict: Settings → Security → Aggregation opt-out (default OFF).

Where a Customer’s data subject directs a request to Drawn instead of Customer, Drawn will: (a) acknowledge receipt within 5 business days; (b) forward the request to Customer; (c) assist Customer to respond within the timeframe required by law (typically 30 days under APP 12.4 / one month under GDPR Art. 12.3). Drawn does not respond directly to a third-party data subject without Customer authorisation, except where required by law.

9. Personal-data breach notification

If Drawn becomes aware of a personal-data breach (within the meaning of Part IIIC of the Privacy Act 1988 (Cth) / GDPR Art. 33), Drawn will:

• Notify Customer without undue delay and in any event within 72 hours of becoming aware.
• Include in the notification: nature of the breach, categories and approximate number of data subjects affected, likely consequences, measures taken or proposed to address it, and a single point of contact at Drawn.
• Assist Customer in meeting Customer’s own notification obligations to the OAIC and to affected data subjects under Part IIIC (NDB scheme) or applicable foreign law (GDPR Art. 34).
• Maintain a written incident-response runbook (available on request to active customers).

10. Audit rights

Customer may, on 30 days’ written notice and no more than once per 12 months (or more frequently following a personal-data breach), request:

• a current copy of Drawn’s security documentation (SOC 2 attestation when available, sub-processor list, incident-response runbook);
• responses to a reasonable written questionnaire about Drawn’s processing;
• where required by Customer’s regulator (e.g. AHPRA, APRA), a virtual audit walkthrough of Drawn’s controls, scoped to avoid disclosing information about other customers.

On-site audits are not contemplated by this DPA. If Customer’s regulator requires an on-site audit, the parties will negotiate scope and cost in good faith.

11. Cross-border data transfers

Drawn discloses personal data to Anthropic PBC (United States) for AI inference. Drawn remains accountable for Anthropic’s acts and practices under APP 8.1, supported by Anthropic’s Commercial Terms and the no-training-on-API-inputs default. Full disclosure in Privacy Policy §8.

Where Customer is subject to GDPR or equivalent foreign data-protection law, the parties will execute the Standard Contractual Clauses (SCCs) Module 3 (processor-to-processor) on request, with Drawn as “Module 3 data importer” in respect of Anthropic.

12. Liability

Drawn’s liability under this DPA is governed by the limitation of liability and indemnities clauses in the Terms of Service (§§9-10), subject to the Australian Consumer Law carve-outs in Terms §12.

13. Term and termination — data return

This DPA continues for the duration of Customer’s subscription to Drawn. On termination, Drawn will return or delete Customer Data per Terms §7.

14. Governing law

This DPA is governed by the laws of Queensland, Australia. Dispute resolution follows Terms §14.

15. How to execute

To execute a binding signed copy of this DPA on your business’s letterhead, email privacy@drawn.com.au with your business name, ABN, signatory name + role. We will send a PDF for signature within 2 business days.

In the absence of a signed copy, this version of the DPA applies by reference once Customer accepts the Terms of Service.