Data Processing Terms

1. Roles and scope

These Data Processing Terms apply when Doorwise processes personal information in Customer Data for a customer organisation. The customer determines why and how that information is used for its prospecting and agency activities and acts as the organisation responsible for that handling. Doorwise processes it as a service provider on the customer’s documented instructions, except where Doorwise must process information for its own account administration, security, billing or legal obligations as described in the Privacy Policy.

Customer Data may include property contacts, addresses, phone numbers, email addresses, notes, activities, appointments, marketing permissions, contact outcomes, team assignments and imported records. Data subjects may include property owners, prospects, customers, agency personnel and other contacts. Processing continues for the subscription term and applicable retention or recovery periods.

2. Customer instructions and responsibilities

The customer instructs Doorwise to collect, host, organise, match, retrieve, transmit, export, delete and otherwise process Customer Data as needed to provide and secure the service and as users direct through its features.

The customer must:

• have a lawful basis and provide any required notices for Customer Data;
• ensure instructions comply with privacy, Spam Act, Do Not Call Register and other applicable laws;
• configure user access, retention and contact-permission records appropriately;
• provide collection notices addressing agency purposes, Doorwise hosting and relevant integration/overseas disclosures, and avoid unnecessary sensitive information, identity documents and credentials in notes or seller-motivation answers; and
• respond to individuals and regulators where the customer is responsible for the relevant processing.

3. Doorwise obligations

Doorwise will:

• process Customer Data only to provide, secure and support the service, follow documented customer instructions, or comply with law;
• ensure people authorised to process Customer Data are subject to confidentiality obligations;
• use reasonable technical and organisational safeguards appropriate to the risk;
• notify the customer if an instruction appears to breach applicable privacy law, where reasonably able to determine this;
• provide reasonable assistance with access, correction, deletion, complaints, impact assessments and regulator enquiries, taking account of the nature of the processing; and
• maintain records reasonably necessary to demonstrate compliance with these terms.

4. Security measures

Doorwise’s application measures include tenant-level access controls, encryption in transit, protected credentials, restricted privileged access, audit and security records, rate limiting and service health checks. Authenticator-based multi-factor sign-in is currently unavailable for customer and application-admin accounts. Read-only support sessions are time-limited and logged, and may be used for support, security investigations and legal obligations. Measures may evolve as technology and risk change, provided overall protection is not materially reduced. No specific recovery time, backup interval or availability guarantee applies unless separately agreed in writing.

5. Subprocessors

The customer authorises Doorwise to use subprocessors necessary to operate the service, including:

• Supabase for database and authentication services;
• Stripe for checkout, subscription and billing services;
• Cloudflare for network security and abuse prevention;
• Google when a user connects Calendar, including the property address and recorded contact name, mobile and email in synchronised events;
• Discord where enabled for limited operational notifications, including account email and agency name for signups/trials;
• infrastructure, backup and email delivery providers; and
• mapping and property-data providers when a requested feature requires them.

Doorwise will require appropriate provider protections and remains responsible for its own obligations. For a material new subprocessor handling workspace personal information, we will give advance notice where practicable and consider reasonable data-protection objections. If an objection cannot reasonably be resolved, the customer may end affected services with a proportionate refund for the unused prepaid period. Urgent security or legal changes may require prompt notice afterwards.

6. Overseas processing

Our Supabase database project is in Seoul, South Korea. Processing may also occur in Australia, the United States and the locations described in the Privacy Policy and relevant provider disclosures. Integration instructions authorise the described transfers but do not waive Doorwise’s applicable privacy obligations. We will take reasonable steps to require suitable privacy and security protections for overseas processing where Australian privacy law applies.

7. Security incidents

Doorwise will promptly investigate suspected unauthorised access, disclosure, loss or material interference with Customer Data. We will notify the affected customer without undue delay when there are reasonable grounds to suspect an incident requiring their assessment or action, without waiting for every detail to be confirmed. We will provide available information, progressive updates, reasonable containment and assistance with legally required notifications. Each party remains responsible for its legal obligations and the parties will coordinate to avoid inconsistent notifications. Notification is not an admission of fault.

8. Access, export, return and deletion

The workspace owner can export agency data; authorised administrators can run retention cleanup, which is manual rather than automatically scheduled by the retention setting. During the subscription, the customer may use these controls or request reasonable assistance. For 30 days after termination, the verified owner may request a secure copy without renewing, including where ordinary access is unavailable.

Cancellation does not itself delete records. On a verified deletion instruction we aim to delete or de-identify eligible active-system records within 30 days and explain any legal hold, exception or revised completion date. Backups expire under the relevant provider cycle; cycle information is available on request, and deletion instructions must be reapplied on restoration. We may retain minimal legal, security, tax and suppression records where reasonably required. These procedures do not permit a departing user to transfer agency records without authority.

9. Reviews and information

On reasonable written request, Doorwise will provide information reasonably necessary to demonstrate compliance with these terms. If that information is insufficient and the customer has a substantiated compliance concern, the parties will agree on a proportionate independent review that protects other customers, security and confidential information. The customer bears review costs unless a material breach by Doorwise is found.

10. Priority, liability and contact

If these Data Processing Terms conflict with the Terms and Conditions about processing Customer Data, these Data Processing Terms prevail for that issue. The liability provisions in the Terms and Conditions apply. Data-protection requests may be sent to support@doorwise.com.au.

For existing customers, contractual amendments follow the notice and acceptance rules in the Terms and Conditions; publishing this version does not retrospectively replace the agreed processing terms. The previous processing terms remain available. Our Privacy Policy describes current information-handling practices.