Effective date: 12 June 2026 · Last updated: 12 June 2026
This Data Processing Addendum ("DPA") forms part of the anzscofinder Terms of Service between Tonalium Pty Ltd ("Tonalium", "we") and the customer ("you"). It applies where you submit personal information to the anzscofinder API platform at platform.anzscofinder.com. It is designed to operate alongside the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Contact: hello@anzscofinder.com.
You determine the purposes for which the personal information in your submissions is handled; you are the controller / APP entity in respect of that information. We process it on your behalf and on your documented instructions as your processor, solely to provide the Service.
"Controller" and "processor" are used as commonly understood; under the Privacy Act 1988 (Cth) each of us is an APP entity, and our respective obligations are as set out in this DPA.
You warrant that you have a lawful basis and any consent required to collect the personal information you submit and to disclose it to us for processing, including consent for the overseas disclosure to OpenAI, L.L.C. in the United States described in clause 5, and that you have given affected individuals any privacy notice required.
We will: (a) process personal information only on your documented instructions and to provide the Service; (b) ensure persons authorised to process it are under confidentiality obligations; (c) implement reasonable technical and organisational security measures (encryption in transit and at rest, access controls, blocked public storage access); (d) assist you, taking into account the nature of processing, to respond to data subject requests and to meet your security, breach notification and (where applicable) assessment obligations; and (e) delete submitted content and derived data within 30 days, and on request delete a specific submission earlier.
You authorise us to engage the sub-processors listed in our Privacy Policy, including Amazon Web Services (storage in Australia), OpenAI, L.L.C. (LLM processing in the United States), Stripe (billing), Vultr (hosting in Australia) and Cloudflare (network). We will impose data-protection obligations on sub-processors substantially similar to those in this DPA and will give notice of new sub-processors. The submitted CV text is processed by OpenAI in the United States; data stored by the Service is held in Australia (Sydney).
We will notify you without undue delay after becoming aware of a data breach affecting your submitted content, and provide information reasonably available to help you meet your obligations under the Notifiable Data Breaches scheme.
We will make available information reasonably necessary to demonstrate compliance with this DPA. On termination, submitted content and derived data are deleted in accordance with our 30-day deletion practice; no separate return is required given that retention window.
This DPA is governed by the laws of Queensland, Australia. If there is any conflict between this DPA and the Terms of Service in relation to processing of personal information, this DPA prevails to the extent of the conflict.
Tonalium Pty Ltd (anzscofinder) — hello@anzscofinder.com