Data Processing Addendum

This Data Processing Addendum ("DPA") supplements and forms part of the Terms of Service, or any other agreement that refers to this DPA, (the "Agreement") between Zuno Group Pty Ltd ("Zuno", "we", "us") and the Customer ("you"). It applies where and to the extent that we handle personal information that you provide to us when you use the Zuno platform (the "Platform").

References to "we" include our Affiliates, including Zuno Enterprises Pty Ltd (ACN 692 113 321), to the extent they handle Customer Personal Information.

If there is a conflict between this DPA and the Agreement on a privacy or data handling matter, this DPA prevails. If you have signed a separate enterprise or white-label agreement with us that contains data handling terms, those terms prevail over this DPA to the extent of any inconsistency.

Terms defined in the Terms of Service have the same meaning here.

• Customer Personal Information means personal information contained in Customer Data that is provided to us by you or on your behalf in connection with the Platform, including information about your staff.
• Privacy Act means the Privacy Act 1988 (Cth), including the Australian Privacy Principles ("APPs").
• Privacy Laws means the Privacy Act and any other Australian law that applies to a party's handling of personal information.
• Subcontractor means a third party we engage that handles Customer Personal Information.

3.1 Providing the Platform to you

You decide what Customer Personal Information is loaded into the Platform and how the Platform is used in your business. We handle Customer Personal Information to provide, secure and support the Platform for you, including generating forecasts, recommended rosters and labour guidance, and training and calibrating the forecasting models for your venues.

3.2 Our own purposes

We also handle Customer Personal Information for the following purposes of our own, and we are responsible for our own compliance with Privacy Laws when we do so:

• developing, training, testing and improving our models, algorithms, products and services. We de-identify Customer Personal Information before we use it for these purposes across our customer base;
• creating De-identified Data and other Zuno Data, measuring performance and producing benchmarks;
• communicating with Authorised Users about the Platform, their accounts and support;
• protecting the safety and security of the Platform; and
• complying with our legal obligations and establishing, exercising or defending legal claims.

3.3 Our commitments

We will:

• comply with the Privacy Laws that apply to us in handling Customer Personal Information;
• not sell Customer Personal Information; and
• not publish or disclose Customer Personal Information in a form that identifies you, your venues or any individual, except: to our Affiliates and Subcontractors; to our professional advisers and insurers; to a prospective purchaser or investor in connection with a business transfer, under obligations of confidentiality; as you direct; or as required or authorised by law.

3.4 Your obligations

You will:

• comply with Privacy Laws and workplace laws in your handling of Customer Personal Information, including when you provide it to us;
• give your staff the notices, and obtain the consents and rights, necessary for you to provide Customer Personal Information to us and for us to handle it as described in this DPA and our Privacy Policy;
• provide only the Customer Personal Information that is needed to use the Platform, and take reasonable steps to keep it accurate and up to date;
• not load Excluded Data (as defined in the Terms of Service) into the Platform, including in free-text fields, and not permit your Authorised Users to do so; and
• remain responsible for responding to requests and complaints from your staff.

We will take such steps as are reasonable in the circumstances to protect Customer Personal Information from misuse, interference and loss, and from unauthorised access, modification or disclosure. We may change our security measures from time to time.

• You agree that we may engage Subcontractors, including hosting and other technology providers, to handle Customer Personal Information. We remain responsible to you for our Subcontractors' handling of it.
• As at the date of this DPA, Customer Personal Information in the Platform is hosted in Australia. A limited number of our authorised support personnel located in Vietnam may access it, under supervision and confidentiality obligations, to maintain and support the Platform.
• We may change our Subcontractors and where Customer Personal Information is handled. If we disclose Customer Personal Information to a recipient outside Australia, we will comply with APP 8 and reflect the change in our Privacy Policy.

If we receive a request or complaint from an individual about Customer Personal Information that we hold because we provide the Platform to you, we may refer the individual to you. We will give you reasonable assistance to respond, and may charge our reasonable costs for assistance beyond routine support.

• If we become aware of unauthorised access to, unauthorised disclosure of, or loss of Customer Personal Information that is likely to result in serious harm to an individual, we will notify you without undue delay.
• The parties will cooperate so that the requirements of the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act are met and, where both parties hold the information, so that a single notification is made. Unless we agree otherwise, you will notify your staff, because you hold the direct relationship with them.
• Nothing in this clause prevents us from notifying individuals or the Office of the Australian Information Commissioner where we consider that the law requires us to.
• Our notification of, or response to, an incident is not an acknowledgement of fault or liability.

• For 30 days after termination we will make Customer Data available for export on request, as set out in the Terms of Service.
• Within 12 months after that export period we will destroy or de-identify Customer Personal Information, other than copies in backups, which are overwritten in the ordinary course, and records we are required by law to keep.
• De-identified Data and other Zuno Data are not subject to this clause.

The liability of each party and its Affiliates under this DPA is subject to the exclusions and limitations of liability in the Agreement.

This DPA is governed by the laws of New South Wales, Australia. Each party submits to the non-exclusive jurisdiction of the courts of New South Wales.

Privacy Officer, Zuno Group Pty Ltd

Email: hello@zuno.au

• Individuals: your Authorised Users and your venue staff, including employees and contractors.
• Kinds of personal information: names, contact details and login details of Authorised Users; names, dates of birth, home addresses (where you record them), roles, employment type, classifications and pay rates, availability, roster and shift information of venue staff, and any other staff information you load; usage and device data.
• Sensitive information: not sought. Excluded Data must not be loaded into the Platform, including in free-text fields. If we become aware that Excluded Data has been loaded, we may delete or de-identify it.
• Purposes: as set out in clause 3.
• Duration: for the duration of the Agreement and then as set out in clause 8.
• Location: hosted in Australia, with access by authorised support personnel in Vietnam, as at the date of this DPA.