Data Processing Agreement

Effective Date: 2026-08-12 Parties: PawPalPro Pty Ltd (Processor) and the PawPalPro subscriber (Controller) This DPA supplements the PawPalPro Privacy Policy and Terms of Service. 1. Processor Obligations PawPalPro agrees to: - Process personal information only to provide the PawPalPro service - Implement appropriate security measures (encryption, RLS, access controls) - Not disclose personal information except to permitted service providers - Assist with data subject access requests within 30 days - Notify Controllers within 24 hours of any actual or suspected data breach - Permanently delete all Controller data immediately upon account deletion by the Controller 2. Controller Obligations The Operator agrees to: - Obtain appropriate consent from pet owners before entering their information - Inform pet owners that their information will be stored in an Australian-hosted cloud service - Revoke owner portal access when the pet owner relationship ends 3. Sub-processors PawPalPro uses: Supabase (database, storage, authentication and transactional email) and Stripe (payments). Hosting/infrastructure is provided by Vercel. Each has its own privacy policy. This list is kept up to date as PawPalPro's infrastructure changes — do not assume providers not listed here are in use. 4. Data Breach Response In the event of a breach, PawPalPro will notify Controllers within 24 hours via email. The Controller is responsible for notifying affected pet owners if required by the Notifiable Data Breaches scheme (s26WA of the Privacy Act 1988). 5. Governing Law This DPA is governed by Queensland, Australia law and the Privacy Act 1988 (Cth). Contact: PawPalPro Pty Ltd | admin@pawpalpro.com.au | https://pawpalpro.com.au This DPA template should be reviewed by a qualified Australian legal practitioner before commercial launch.