Data processing agreement
Roles
Your firm decides why and how personal information in its files is handled. We handle that information only to carry out your instructions, and for no other purpose.
Where the work happens
Our team works inside your own systems, such as your practice management software and Microsoft 365, through secure remote access you control. We do not keep copies of client files on our own systems unless you agree in writing for a specific task.
Overseas access
Our delivery team is located in India. Before any overseas access, we agree in writing to handle personal information consistently with the Australian Privacy Principles, so your firm can meet its obligations under APP 8 when disclosing information overseas.
People
- Each team member signs an individual confidentiality deed naming your firm.
- Access is limited to the people assigned to your matters, and removed when they move off them.
- The team is trained on confidentiality, privilege and privacy before working on client files.
Security
- Named user accounts with multi-factor authentication where your systems support it.
- Company-managed devices with encrypted storage and up-to-date security software.
- No personal email, personal cloud storage or removable media for client information.
Data breaches
If we become aware of a suspected data breach involving your information, we notify you without undue delay and in any case within 72 hours, and help you assess it under the Notifiable Data Breaches scheme.
Other providers
We use only standard business providers, such as email and hosting, to run our own business. We do not pass client-file information to any other party without your written consent.
Audit and information
On request we give you the information you reasonably need to check that we comply, including our list of team members with access to your matters.
When the arrangement ends
We stop accessing your systems, return anything you ask for and delete any copies we hold, and confirm this in writing.
Request a copy
Email hello@luxeconsulting.com.au for the full agreement to review before you engage us.