This Data Processing Agreement ("DPA") supplements the Master Subscription Agreement ("MSA") between Ilixir Technologies Pty Ltd (ABN 11 680 039 392), trading as Duely ("Duely" or "Data Processor"), and the Reporting Entity / Subscriber ("Firm" or "Data Controller"). It sets out the standards and obligations for processing personal and sensitive data handled by the Duely platform. It forms part of the MSA. Clauses 2 and 2A of the MSA prevail over this DPA; subject to that, where the documents conflict in relation to the processing of personal data, this DPA prevails (MSA clause 8.6). A new Firm is bound by this version when it accepts the MSA. For a Firm that accepted an earlier version, any change in this version that is adverse to the Firm takes effect 30 days after Duely emails the Firm's administrator about it; all other changes take effect on publication.

This agreement aligns with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Arrangements for Firms serving EU-connected clients can be discussed on request.

1. Roles and Responsibilities

Data Controller: the Firm determines the purposes and parameters for processing its clients' personal data.
Data Processor: Duely processes the data according to the documented instructions of the Firm, as provided through the platform's workflows and configuration.

1A. Scope and Duration of Processing

Categories of Data Subjects

Employees and personnel of the Firm (Subscriber account holders and users).
Clients and customers of the Firm whose data is processed for AML/CTF compliance purposes.
Beneficial owners, controllers, and associated parties of the Firm's clients.

Types of Personal Data Processed

Contact information (names, email addresses, phone numbers, residential addresses).
Identity documents (government-issued IDs, passport details, driver's licence information).
Biometric data (a live image, liveness and face-match data, processed by the identity verification provider outside Australia, in the European Union, with transfers outside the European Economic Area, including to the United States, under standard contractual clauses. The provider holds the verification session, including the face template it creates for the face match, for about one month after the check and then deletes it, except the pseudonymised data described under "Flow-Down of Obligations" in section 4). Duely retains the live image as part of the verification record and destroys it within 7 days of capture, or straight away where a staff member records an identity attestation during a remote evidence review, except that a copy included in a reliance pack the Firm releases to another firm is kept with that pack as part of the Firm's records, for the life of the subscription and the deletion periods below; the face-match and liveness verdicts, the provider reference and a hash of the destroyed image are kept. Where the Firm has turned on the inclusion of identity images in released reliance packs and the live image has not yet been destroyed, a copy of it is included in the reliance pack the Firm releases to another reporting entity relying on the Firm's customer due diligence, and the pack is stored with the customer's documents.
Government related identifiers (document numbers on identity documents), used only to verify identity for the Firm's AML/CTF obligations.
Financial and business information (ABN/ACN, company structures, beneficial ownership details).
Screening data: the name and, for individuals, the date of birth, gender and any declared citizenship of the person being screened, and the results (PEP status, sanctions matches, criminal watchlist matches, adverse media findings).
Risk assessment data (risk ratings, enhanced due diligence records).
Documents a Firm uploads for AI-assisted document reading, where the Firm has turned AI-assisted document reading on, and the questions and records involved in a Dee conversation, unless the Firm has turned Dee off (section 6).
Audit trail data (user actions, timestamps, matter lifecycle events).

Duration of Processing

Processing commences on the Firm's activation of a Duely subscription and continues for the duration of the subscription. When the subscription ends, the Firm keeps read-only access to view and download its records, as specified in clause 6 of the MSA, and the data is deleted or de-identified after at least 30 days' notice, as set out in section 6A, except the records Duely keeps for its own legal obligations listed there.

1B. Processor Obligations

Lawful Instructions

Duely processes personal data only on documented instructions from the Firm. If Duely considers that an instruction from the Firm infringes applicable privacy legislation, Duely will promptly inform the Firm before carrying out the instruction, unless prohibited by law from doing so.

Duely's own obligations under the Privacy Act and under its agreements with government and third-party verification services apply regardless of the Firm's instructions; for example, Duely will not disclose the underlying result of a government verification check on a Firm's instruction. Duely is itself bound by the Australian Privacy Principles for the personal information it holds.

The Firm's documented instructions include the uses permitted by clause 3 of the MSA. Apart from processing on the Firm's instructions, Duely uses personal data only to secure, support and maintain the platform, to comply with law and with its agreements with verification providers and government agencies, and, after de-identifying and aggregating it so that it no longer identifies the Firm or any individual, to operate, analyse and improve its services.

Legal Demands

If Duely receives a subpoena, warrant, court order or statutory notice for the Firm's data, Duely may tell the Firm and give it a copy of the demand where the law permits, as set out in the Law Enforcement and Regulatory Request Policy.

Access and Correction Requests

If an individual asks Duely for access to, or correction of, personal information Duely holds for the Firm (APP 12 and APP 13), Duely will tell the Firm within five (5) business days and help it respond, including through the Platform's functions for viewing and correcting records. Duely will respond to the individual itself where the Privacy Act requires it to.

Personnel Confidentiality

Duely ensures that all personnel authorised to process personal data on behalf of the Firm are bound by appropriate confidentiality obligations, whether by contract or by statutory duty. Access to Firm data is granted on a need-to-know basis and subject to internal access controls.

2. Technical and Organisational Measures

Duely implements technical and organisational measures appropriate to the risks associated with the processing of AML/CTF data, including:

Encryption: data is encrypted at rest, and TLS 1.2 or higher is used for data in transit, with TLS 1.3 preferred.
Access Controls: Role-Based Access Control (RBAC) segregated by tenant / Firm. Access by Duely personnel to Firm matter data is limited to authorised personnel who need it to operate, secure or support the platform, or where the law, a court order, or an audit by a verification provider or government agency under Duely's agreement with it requires it.
Audit Trails: append-only event streams that record actions within matters.

3. Data Localisation

Application hosting and the primary storage of matter, document, and evidence data are located in Australia (Sydney). Certain specialist processing is performed outside Australia by the sub-processors listed in section 4: identity document verification and biometric liveness / face-match in the European Union, with transfers outside the European Economic Area, including to the United States, under standard contractual clauses; sanctions, PEP, criminal watchlist and adverse-media screening in Switzerland and the European Union; AI-assisted document reading (only for a Firm that has turned it on) and Dee (when Duely makes it available, for every Firm unless a Firm administrator turns it off) in the United States and any other country where the AI provider runs its models; platform email in the United States; error monitoring in Germany, with sub-processors in the United States and other countries; address lookup (where switched on) and web fonts in the United States and other countries; and subscription billing in the United States and other countries. Each provider holds the data only for the period stated in section 4, except the pseudonymised data described under "Flow-Down of Obligations" in section 4; the resulting verification record, screening result and extracted data are stored in Australia, and the live image Duely holds within the verification record is destroyed within 7 days of capture, or straight away on a staff identity attestation during a remote evidence review, except that a copy included in a reliance pack the Firm releases to another firm is kept with that pack as part of the Firm's records, for the life of the subscription and the deletion periods in section 6A. The steps Duely takes for these overseas disclosures under APP 8 are set out in section 4.3 of the Privacy Policy.

4. Sub-Processors

Duely uses sub-processors to deliver core platform functionality. The sub-processor list is maintained as a living document within this DPA. For each provider that receives personal data, the table states what is sent, where it is processed, how long the provider holds it, how quickly it must notify Duely of a breach, and the document that binds it.

Current Sub-Processors

Provider	Service and data sent	Location	Retention at provider	Breach notice to Duely
Identity verification provider	Identity document verification, biometric liveness and face-match. The identity document images, the live image and the person's details.	In the European Union, with transfers outside the European Economic Area, including to the United States, under standard contractual clauses	About one month after the check, then deleted with the session, including the face template. Duely has opted out of the provider using its verification data to improve its models. The provider may also keep pseudonymised data derived from a verification for its own purposes, as described under "Flow-Down of Obligations" below.	Within 48 hours of confirming the breach.
Screening provider	Sanctions, politically exposed person, criminal watchlist and adverse-media screening: one-off checks and, where Duely has turned it on, ongoing monitoring. The name and, for individuals, the date of birth, gender and any declared citizenship of the person being screened.	Switzerland and the European Union	One-off screening: for the duration of the request only. The provider states that it keeps technical data about the request but no record of the personal data. Ongoing monitoring: the name, date of birth and gender are kept while the person is monitored, which is while they are part of an active engagement. When Duely removes the person from monitoring, the provider deletes them and keeps only the timestamp, IP address and request type for billing. When the agreement ends, the provider deletes all of Duely's data except billing and legal records.	Not set in the provider's published terms.
AI provider	AI-assisted document reading, used only for a Firm that has turned it on, and Dee, which, when Duely makes it available, is on for every Firm unless a Firm administrator turns it off. The document being read, or the records needed to answer the user's question. Nothing is sent for a feature that is off.	The United States, and any other country where the provider runs its models. Duely does not set an inference region. Safety review, support and incident response may take place where the provider or its affiliates operate	Inputs and outputs deleted within 30 days of receipt or generation, unless the provider must keep them longer to enforce its usage policy or to comply with the law. Documents are sent with each request, not stored with the provider as files. Not used to train the provider's models.	Within 48 hours of becoming aware.
Payment provider	Subscription payments and billing. The Firm's billing contact and payment details. The provider also acts as an independent controller for payment data.	United States and other countries	Under the provider's terms; Duely does not store card numbers.	Under the provider's data processing terms.
Hosting provider	Cloud infrastructure: application hosting, including the authentication service.	Australia (Sydney)	For the life of the subscription and the deletion periods in section 6A.	Under the provider's terms.
Cloud storage provider	Cloud infrastructure and storage: databases, documents and evidence.	Australia (Sydney)	For the life of the subscription and the deletion periods in section 6A.	Under the provider's data protection terms.
DVS gateway	Gateway to the Australian Government Document Verification Service (DVS), used only where a Firm requests a DVS check. The document details and the person's name and date of birth, passed to the DVS for a match or no-match result.	Australia	Destroyed once its purpose is fulfilled, as the DVS Participation Agreement requires of Duely's Information Match Agent.	Under its terms and the DVS Participation Agreement.
Email provider	Transactional email from the platform, such as invitations, verification links and notifications. The recipient's name and email address and the content of the email.	United States	Under the provider's terms.	Under the provider's data processing terms.
Error monitoring provider	Error monitoring for the platform. Technical details of an error, which can include a user identifier and request details; the platform removes personal data from error reports before they are sent where it can.	Germany (storage), with sub-processors in the United States and other countries	Under the provider's terms.	Under the provider's data processing terms.
Address lookup provider	Address lookup when a user enters an address in the platform. The address text the user types, sent by the user's browser directly to the provider, with the browser's IP address and details. Only where the platform's address lookup is switched on.	United States and other countries	Under the provider's terms.	Under the provider's data processing terms.
Web fonts provider	Font files the platform's pages load. The user's IP address and browser details, sent by the browser when a page loads. No Firm records are sent.	United States and other countries	Under the provider's terms.	Under the provider's terms.

The Australian Business Register (ABN and business-name lookups) and the Australian Government Document Verification Service (DVS) are government services, not sub-processors. Only the ABN or name being looked up, or the document details, name and date of birth being matched, are sent, and both are processed in Australia. DVS checks go through the DVS gateway listed above.

Flow-Down of Obligations

Four specialist processing providers receive personal data of the Firm's clients: the identity verification provider, the screening provider, the AI provider (for AI-assisted document reading where the Firm has turned it on, and for Dee unless the Firm has turned it off) and, for DVS checks, the DVS gateway. Hosting and storage providers hold the platform records as described above. When acting as a processor on Duely's behalf, the identity verification provider and the AI provider are each bound by written terms under which it may process the data only on Duely's instructions and only to perform the service Duely requests. Each of them must keep the data secure, notify Duely of a data breach within the period stated above, give Duely notice and a right to object before appointing a sub-processor of its own, and delete the data when the processing ends, except as described in the next paragraph. The screening provider handles screening requests under its published privacy policy and terms, which say requests to its paid screening service are not stored in its databases or logs. The DVS gateway is bound instead by its Identity Service Provider user terms and, as Duely's Information Match Agent, by the DVS Participation Agreement and Access Policy, which require it to keep the data secure, use it only for the DVS check and destroy it once its purpose is fulfilled.

The identity verification provider may also keep pseudonymised data derived from a verification, without a fixed deletion date, for its own security, fraud and abuse prevention (including across its other customers), service testing and quality assurance, legal compliance and legal claims. It does so as an independent controller under its own terms and privacy policy, not on Duely's instructions. Duely has opted out of the provider using verification data to improve its models.

The other providers in the table process data under their standard data processing terms. Duely remains accountable for each sub-processor's handling of the data as section 16C of the Privacy Act requires.

Changes to Sub-Processors (Right to Object)

Duely will notify Firms at least thirty (30) days before appointing any new sub-processor that handles personal data, or before Duely changes the country in which an existing sub-processor processes it. Where a sub-processor changes its processing location, its own terms or the purposes for which it uses the data on its own initiative, or on shorter notice than Duely can give, Duely will tell Firms as soon as practicable after Duely learns of it. Within this notification period, the Firm has a right to object to the change on reasonable data protection grounds. If Duely cannot address the Firm's concerns, the Firm may terminate the affected Subscription without penalty, and Duely will refund any prepaid Fees pro-rata for the unused remainder of the then-current term.

Where a sub-processor becomes unavailable, or must be replaced urgently to protect security, keep the service running or comply with the law, Duely may appoint a replacement on shorter notice than thirty (30) days. Duely will tell Firms as soon as practicable, and the Firm has the same right to object and to terminate the affected Subscription without penalty and with the same refund.

Where an existing sub-processor notifies Duely that it intends to appoint a sub-processor of its own that will handle the Firm's personal data, Duely will pass that notice to Firms within three (3) business days of receiving it, with the provider's objection period and the date by which the Firm must object, which will be at least two business days before the provider's period ends. A Firm that objects by that date may ask Duely to raise the objection with the provider, and if the provider does not resolve it the Firm may terminate the affected Subscription without penalty and with the same refund.

Duely reviews these terms regularly and whenever a provider notifies a change.

5. Security Breach Notification

Duely operates in accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988, and assesses every suspected breach against that scheme's test (whether the breach is likely to result in serious harm to any individual), not only against the GDPR or other overseas law.

If Duely becomes aware of an actual or reasonably suspected personal data breach affecting the Firm's data, Duely will notify the Firm's administrator, its AML/CTF Compliance Officer and any additional contact the Firm nominates in writing without undue delay, and no later than 72 hours after becoming aware of it. Duely becomes aware once it has reasonable grounds to suspect a breach, which may be before its investigation is complete.
Duely will assess the breach and take all reasonable steps to complete that assessment within 30 days (section 26WH), and will keep the Firm informed of its progress and findings.
The notice will describe the breach, the types of information involved, the steps Duely has taken and recommends, and a contact for coordination, and Duely will provide the further information the Firm needs to fulfil its own notification obligations to the OAIC and affected data subjects.
Each sub-processor whose terms state a breach notice period must notify Duely within that period, as shown in section 4. Duely's 72 hours runs from when Duely becomes aware, including when a sub-processor notifies it.
Where the information is held jointly by Duely and the Firm, section 26WM of the Privacy Act provides that compliance by one entity is compliance by both. Duely and the Firm will agree which of them notifies the OAIC and the affected individuals; in the absence of agreement the Firm, as the entity with the direct relationship with the individuals, will notify, with Duely's assistance. If the Firm has not notified within five (5) business days after both have concluded that the breach is an eligible data breach, or sooner where delay would increase the risk of serious harm to the affected individuals, Duely may notify the OAIC and the affected individuals itself after consulting the Firm's AML/CTF Compliance Officer, because section 26WL of the Privacy Act leaves each entity in breach if none notifies. Duely will not include in any notice information whose disclosure would or could contravene section 123 of the AML/CTF Act.
Where a breach involves information obtained through a government verification service, Duely will notify the affected individuals as its agreement with the agency administering that service requires, after consulting the Firm's AML/CTF Compliance Officer.

6. AI Processing

Duely does not use protected customer data, identity documents, screening results, or matter metadata provided by the Firm to train its own AI models, and its AI provider's terms do not permit it to use them to train its models. Duely has opted out of its identity verification provider using verification data to improve its models.

Duely provides two AI features through the AI provider listed in section 4:

AI-assisted document reading, which reads a document the Firm uploads and drafts identity or entity details for the Firm to check; and
Dee, an in-app assistant that answers a user's questions from the Firm's own records and Duely's help guides.

When Duely makes Dee available, it is on for every Firm unless a Firm administrator turns it off. AI-assisted document reading is off until a Firm administrator turns it on. A Firm administrator may turn either feature on or off at any time under Settings > Consent and privacy > Your firm. The change applies from the next request, and nothing is sent to the AI provider for a feature that is off. When a feature is on, the document being read, or the records needed to answer the question, are sent to the AI provider solely to return a result; the provider does not use them to train its models and deletes them within 30 days, unless it must keep them longer to enforce its usage policy or to comply with the law. Duely keeps the details a document reading produced with the customer record they belong to, and deletes Dee conversations after 90 days.

Duely will give Firms at least 30 days' notice under section 4 before using a new AI provider or using personal data for a new AI purpose, and will pass on a change in where the AI provider processes data as set out in section 4.

6A. Data Return and Deletion on Termination

On termination or expiry of the MSA:

Read-only access: After the subscription ends, the Firm keeps read-only access to its records, and its users can sign in to view and download the records the platform offers for download (such as evidence packs, reports, AML/CTF program versions, documents and training records). The Firm may resume its subscription and get full access back, with all its data; while the subscription is ended nothing new can be done in the platform. Duely does not prepare exports or supply copies of records on request; the Firm downloads what it needs while it has access.
The Firm's own records: The Firm's obligations to keep records under Part 10 of the AML/CTF Act (including sections 107, 111 and 116, which generally require records to be kept for 7 years) are its own. Duely does not keep records for the Firm, so the Firm must download the records it needs before its data is deleted.
Deletion: Duely will give the Firm's administrator at least thirty (30) days' notice by email before the personal data processed on behalf of the Firm is deleted or de-identified. When that happens, Duely deletes or de-identifies it in its primary systems: files are deleted and personal information is removed from records. Duely keeps the data after the subscription ends only so that the Firm can view, download and resume.
Backup purge: Personal data residing in encrypted backups will be overwritten through the normal backup rotation cycle; backups are kept only so that the platform can be recovered after a failure.
What Duely keeps: Duely keeps, for its own legal obligations: its billing and financial records about the Firm, for 7 years (section 286 of the Corporations Act 2001 (Cth)); records of the Firm's acceptance of the MSA (the version, the date, and the accepting user's name and email address), for 7 years; its records of Document Verification Service consents and checks, which do not hold the individual's name, date of birth or address, for 7 years, as its agreement with the agency administering that service requires; records of any data breach involving the Firm's data, for 7 years; and a record of the removal of the Firm's data, for 7 years. It may also keep anonymised, aggregated data that cannot be used to identify any individual, and anything a court order requires. These records are Duely's own and are not disclosed to the Firm.

7. Audits and Compliance

(a) On reasonable prior written notice, and no more than once in any twelve (12) month period, Duely will make available to the Firm (or an independent auditor engaged by the Firm and bound by confidentiality terms acceptable to Duely) the security documentation Duely makes available to its customers, such as a summary of its security controls and any independent reports it holds, for the limited purpose of verifying Duely's compliance with this DPA.

(b) An on-site audit is available only where a law or a regulator requires the Firm to carry one out. Any on-site audit is at the Firm's cost, must be conducted during business hours, must not unreasonably interrupt Duely's operations, and is subject to Duely's security and confidentiality requirements.

(c) Where Duely's standard reports reasonably address the Firm's audit query, the Firm will accept those reports in lieu of a separate audit.

(d) The Firm acknowledges that Duely's use of government and third-party verification services is itself subject to audit by the agencies and providers administering them, and will cooperate with any such audit, including by giving them prompt access to its records of identity checks requested through the platform, to relevant systems and, where an agency requires it, to premises, as clause 2A.7 of the MSA provides.

(e) Duely's agreements with its sub-processors are confidential. On request, Duely will confirm in writing the terms summarised in section 4 for a given provider, and will provide the provider's published terms, security documents and certifications, but may not provide a copy of a signed agreement where the provider's confidentiality terms prevent it.

7A. Liability

Duely's liability to the Firm for a breach of this DPA, including a data breach or a failure of Duely's own consent or notice obligations, is governed by clause 2.1 (Cap on Liability) of the MSA. The Firm's indemnity in clause 2.2(e) of the MSA covers the consents and notifications the Firm must itself obtain and give under the Privacy Act for the personal information it submits, and is reduced to the extent the loss was caused by Duely's negligence, wilful misconduct, breach of the MSA, breach of law or breach of its agreements with verification providers, as clause 2.2 provides. Where Duely's breach of this DPA causes a personal information breach, clause 2.1(d) of the MSA applies to the costs of notification. Duely's agreements with its sub-processors are separate from the Firm's contract. The Firm's rights and obligations, including liability limits, indemnities and the protections for government agencies and verification providers in clauses 2.2(g) and 2A.8 of the MSA, are governed by the MSA and this DPA, subject to applicable law.

8. Governing Law

This Data Processing Agreement is governed by the laws of Queensland, Australia, and the parties submit to the non-exclusive jurisdiction of the courts of Queensland.

9. Version History

2.3 (19 October 2026; for a Firm that accepted an earlier version, changes adverse to it take effect 30 days after Duely emails its administrator, and other changes on publication): sections 2, 3, 4, 5, 6, 6A, 7, 7A and 8 updated; providers added.
2.2 (14 and 15 October 2026): sections 4, 5 and 7 updated; sub-processor table added; AI provider and ongoing monitoring added.
Changes between 2.1 and 2.2: 23 September 2026, sections 2 and 3 updated.
2.1 (19 August 2026): named the operating entity; separated the identity verification provider from the screening provider; listed the AI model providers; added Duely's own obligations to verification services.
Change between 2.0 and 2.1: 6 July 2026, identity verification provider changed.
2.0 (19 May 2026): revised agreement.
1.0 (12 March 2026): first published version.

Data Processing Agreement (DPA)