Customer Data Addendum

Last updated: [date of publication]

This addendum forms part of the Terms of Service between you ("Operator") and Dwayne Charrington trading as Rangefront Labs (ABN [ABN]) ("Rangefront"). It applies to personal information in Customer Data that Rangefront handles for you.

Roles

You decide why and how the personal information of your customers is collected and used. Rangefront handles it for you as a service provider. For account and billing information about your own users, Rangefront acts for itself, as explained in the Privacy Policy. Each party must comply with the Privacy Act 1988 (Cth) as it applies to it.

Your instructions

Rangefront will handle Customer Data only:

• to provide, secure and support the Service;
• as you instruct through your use of the Service and its settings, including features you turn on, integrations you connect and AI features you use; and
• as the law requires, and then we will tell you first if the law allows.

The Terms, this addendum and your configuration of the Service are your instructions. If we think an instruction would breach privacy law, we will tell you.

You are responsible for the lawfulness of the instructions, for notifying your customers (APP 5), and for having any consent you need, including for recording and transcribing calls and for tracking technician location.

Details of handling

• Who: your customers, contacts, staff and technicians.
• What: names, addresses, phone numbers, email addresses, property and wastewater system details, site photos, job records, inspection results, compliance reports, quotes, invoices, messages, call transcripts, and technician location events.
• How long: while your account is active, and then as set out in the Terms and Trial Agreement.

Personnel

Only Rangefront personnel who need access to provide and support the Service can access Customer Data. They are bound by confidentiality. At the date of this addendum, Rangefront's personnel is the owner [and any contractors, who sign confidentiality terms].

Security

Rangefront uses the following measures. They reflect how the Service is built and run today. We do not claim certifications we do not hold.

• Tenant isolation. Every operational record carries your organisation's identifier. Every request must name the organisation and the user must be an active member. Permissions are checked on each action, not only at sign-in. A record that belongs to another organisation is treated as not found. Public links use random tokens, not record numbers.
• Encryption in transit. Access to the Service is over HTTPS.
• Credentials. User passwords are stored hashed. Sign-in uses expiring tokens. Credentials you give the Service for payments, email, SMS and integrations are encrypted at rest in the application and are not returned by the API or written to the audit log.
• Devices. Field devices are enrolled and can be revoked in the console. A revoked device cannot sync. The field app keeps its token and PIN hash in the device's secure store and can require biometric unlock.
• Uploads. Files are stored in a private bucket in locations scoped to your organisation, accessed by short-lived signed links, hashed, and scanned. Files fail closed if the scanner is unavailable.
• Audit log. Creates, updates, deletes and workflow actions are recorded with who and when, and are visible to your administrators. Deleted records are soft-deleted and can be restored.
• Records integrity. Issued compliance reports and sent invoices cannot be edited through the normal API. PDFs are stored with hashes.
• Webhooks and public pages. Incoming webhooks are verified by signature or secret. Public endpoints are rate limited.
• AI. Requests send only what the feature needs, for one organisation at a time. Text entered by users is marked as data for the AI to read, not instructions. We do not keep the text of requests in usage logs.
• Backups. [Backup frequency and retention to be confirmed.]

We review the code for security problems and run automated tests on tenant isolation, but we have not had an independent penetration test [update if this changes]. We will improve these measures over time and will not reduce them in a way that materially weakens protection.

Subprocessors

You authorise Rangefront to use the subprocessors on the Subprocessors page. Rangefront will:

• have a written agreement with each that gives similar protection for Customer Data;
• remain responsible for their handling of Customer Data; and
• give you at least 30 days' notice of a new subprocessor or a change of region, by email or in the Service.

You may object on reasonable grounds within that period. If we cannot resolve it, you may end the affected part of the Service and receive a refund of prepaid fees for the unused period.

Services you connect yourself (for example Xero, a calendar, your own SMS or email provider) are your providers. We send data to them on your instruction.

Overseas disclosure

Some subprocessors handle Customer Data outside Australia, as listed. Rangefront will take reasonable steps to make sure they handle it consistently with the Australian Privacy Principles. You are responsible for any notice you owe your customers about overseas disclosure.

Data breaches

If Rangefront becomes aware of unauthorised access to, disclosure of, or loss of Customer Data that is likely to be an eligible data breach, we will:

• tell you without undue delay, and aim to do so within 72 hours of becoming aware;
• give you what we know: what happened, the data affected, the likely harm, and what we have done;
• help you assess whether the breach is eligible to be notified under Part IIIC of the Privacy Act, and help with notifying the OAIC and affected people; and
• take reasonable steps to contain it and to prevent it recurring.

You decide whether and how to notify your customers and the OAIC, unless the law requires us to notify directly.

Requests from individuals

If someone asks us for access to, correction of or deletion of their information held for you, we will refer them to you unless the law requires us to respond. We will give you reasonable help to respond. The Service already lets you find, change and export customer records.

Return and deletion

On request, or after your account ends, we will give you an export of Customer Data in CSV, with file attachments. After the export period in the Terms (or, for trials, the retention period in the Trial Agreement), we delete Customer Data from live systems and from backups within the backup cycle, unless the law requires us to keep it. We will confirm deletion on request.

Audits

On reasonable written notice, and no more than once a year (unless there has been a breach), we will give you information needed to show we are following this addendum. This may be written answers or relevant documents. If that is not enough, we will agree a scope, timing and confidentiality terms for an audit at your cost, which must not harm other customers or breach their confidentiality.

Order of priority

If this addendum conflicts with the Terms on handling personal information, this addendum prevails.