Legal

Data Processing Agreement

This Data Processing Agreement ("DPA") is a standard template. To execute a signed DPA with Anchor & Co Limited, contact privacy@anchorand.co. Once executed, it forms part of the agreement between your organisation and Anchor & Co for use of the AnchorOS platform.

This Data Processing Agreement is entered into between the organisation accessing or using the AnchorOS platform ("Controller") and Anchor & Co Limited, trading as AnchorOS ("Processor", "Anchor & Co"), and forms part of the Terms of Use and any other agreement between the parties relating to the AnchorOS platform ("Principal Agreement").

This DPA sets out the terms on which the Processor processes personal information on behalf of the Controller in connection with the AnchorOS platform, consistent with the New Zealand Privacy Act 2020 and applicable Information Privacy Principles.

1. Definitions

In this DPA:

Controller means the organisation that determines the purposes and means of processing personal information within its AnchorOS tenant.
Processor means Anchor & Co Limited, which processes personal information on behalf of the Controller.
Personal information has the meaning given in the Privacy Act 2020: information about an identifiable individual.
Processing means any operation performed on personal information, including collection, storage, use, disclosure, or deletion.
Sub-processor means any third party engaged by the Processor to process personal information on its behalf in connection with the platform.
Security incident means any confirmed or reasonably suspected unauthorised access to, loss, or disclosure of personal information.
Privacy Act means the New Zealand Privacy Act 2020.

2. Scope and subject matter

2.1 Nature and purpose of processing

The Processor processes personal information on behalf of the Controller for the purpose of providing and operating the AnchorOS platform, including:

Authenticating and managing user accounts
Storing and retrieving governance, programme, RAID, and decision data entered by the Controller and its users
Generating reports, exports, and dashboards from Controller data
Providing AI-assisted features where enabled by the Controller
Maintaining an immutable audit trail of all data mutations
Delivering transactional notifications and support communications

2.2 Categories of personal information

The categories of personal information processed under this DPA include:

Name, job title, and work email address of organisation users
Organisational role and access permissions
Authentication credentials (stored in hashed form)
Names and contact details of individuals associated with governance records, decisions, programmes, risks, and activities
Usage activity and audit logs
Any other personal information submitted by the Controller or its users within their AnchorOS tenant

2.3 Duration

The Processor processes personal information for the duration of the Principal Agreement, and thereafter in accordance with section 9 of this DPA (Data Return and Deletion).

3. Controller obligations

The Controller agrees to:

Comply with the Privacy Act 2020 and applicable privacy laws in respect of the personal information it submits to the platform
Ensure that any personal information submitted to the platform has been collected lawfully and that individuals have been given appropriate notice
Ensure that users are provided with information about how their personal information is processed, including by making the AnchorOS Privacy Policy available to them
Configure access permissions appropriately and review them regularly
Not instruct the Processor to process personal information in a way that would breach the Privacy Act 2020 or any other applicable law

4. Processor obligations

4.1 Processing on instructions

The Processor processes personal information only on the documented instructions of the Controller, as set out in this DPA and the Principal Agreement, except where required by law. If the Processor is required by law to process personal information in a way not covered by the Controller's instructions, the Processor will notify the Controller before doing so unless prohibited by law from doing so.

4.2 Confidentiality

The Processor ensures that persons authorised to process personal information are subject to a duty of confidentiality. Access to Controller data is restricted to personnel who need it to perform their role. The Processor does not disclose Controller data to any person except as permitted under this DPA or required by law.

4.3 Security measures

The Processor implements and maintains appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, or disclosure. These measures include, at a minimum:

Encrypted data transmission (TLS 1.2 or higher)
Encrypted storage at rest (AES-256)
One-way cryptographic hashing of passwords
Zero-trust, multi-tenant architecture with row-level security enforced at the database layer
Server-side role-based access controls and per-user, per-module permission overrides
Session token rotation on every request
Immutable, field-level audit trail of every data mutation
Rate limiting and server-side file upload validation
Regular security review

Full details of the security architecture are set out in the AnchorOS Technical and Security Summary, available on request from privacy@anchorand.co.

4.4 Sub-processors

The Controller authorises the Processor to engage the sub-processors listed in the AnchorOS Privacy Policy. The Processor requires sub-processors to comply with equivalent data protection obligations as set out in this DPA. The Processor remains responsible for the acts and omissions of sub-processors to the same extent as if it were performing the processing directly.

The Processor will notify the Controller of any intended addition or replacement of a sub-processor. If the Controller has reasonable grounds to object to the change, it may raise those grounds with the Processor in writing within 14 days of notification. The parties will seek in good faith to resolve the objection.

4.5 Data subject rights

The Processor provides reasonable assistance to the Controller to fulfil requests from individuals exercising their rights under the Privacy Act 2020, including requests for access, correction, and complaint. Where a data subject contacts the Processor directly, the Processor will direct the request to the Controller.

4.6 Security incident notification

If the Processor becomes aware of a security incident affecting Controller data, it will:

Notify the Controller without undue delay and in accordance with the response commitments in the AnchorOS Technical and Security Summary (within 24 hours of confirmation for a P1 critical incident, within 48 hours for a P2 high incident affecting data)
Provide sufficient information for the Controller to assess the incident and meet its obligations under the Privacy Act 2020, including whether to notify the Office of the Privacy Commissioner
Take reasonable steps to contain the incident and prevent further harm

4.7 Assistance with privacy impact assessments

The Processor provides such reasonable assistance to the Controller as the Controller may reasonably request in connection with any privacy impact assessment the Controller is required or chooses to carry out in connection with its use of the platform.

4.8 AI features

Where the Controller has enabled AI features, the Processor processes operational context (user prompts and excerpts from records the user is authorised to view) via its AI provider, Anthropic. Processing by Anthropic is governed by a Data Processing Agreement between the Processor and Anthropic. Anthropic does not use this data to train AI models. AI feature data is subject to the retention limits in the AnchorOS Privacy Policy. The Controller may disable AI features at any time.

5. International data transfers

Core organisational data is stored and processed on AWS infrastructure in Sydney, Australia (ap-southeast-2). Limited categories of operational data are processed by sub-processors in the United States, as described in the AnchorOS Privacy Policy. Each such sub-processor has executed a Data Processing Agreement with the Processor and holds industry-standard security certifications.

All cross-border disclosures are made in compliance with Information Privacy Principle 12 of the Privacy Act 2020, which permits disclosure to overseas recipients where equivalent protections are in place.

6. Audit and inspection

The Processor makes available to the Controller all information reasonably necessary to demonstrate compliance with this DPA. On reasonable written request (and no more than once per 12-month period unless there has been a confirmed security incident), the Processor will permit the Controller or its nominated auditor to conduct an audit of the Processor's data processing practices, subject to reasonable prior notice, confidentiality obligations, and agreement on scope and cost.

7. Liability

Each party is liable to the other for loss arising from its failure to comply with its obligations under this DPA, subject to the liability limits in the Principal Agreement and, where applicable, the Terms of Use.

The Processor is not liable for processing carried out in accordance with the Controller's instructions where those instructions are the cause of the loss or damage.

8. Term and termination

This DPA remains in force for the duration of the Principal Agreement. It terminates automatically when the Principal Agreement ends. On termination of the Principal Agreement, section 9 of this DPA (Data Return and Deletion) continues to apply.

9. Data return and deletion

On termination of the Principal Agreement, or on the Controller's written request at any time:

The Processor makes available a full export of the Controller's tenant data in a structured, machine-readable format (JSON or CSV)
On the Controller's instruction, the Processor deletes all Controller personal information from the platform
Where neither export nor deletion is requested, the Processor retains the data for the default audit retention period (7 years) and then deletes it

The Processor confirms deletion in writing on request. Some categories of data may be retained beyond the deletion window where required by New Zealand law or regulation, in which case the Processor notifies the Controller of the categories and duration of retention.

10. General

10.1 Governing law

This DPA is governed by the laws of New Zealand. Any dispute arising under this DPA is subject to the non-exclusive jurisdiction of the New Zealand courts.

10.2 Order of precedence

In the event of a conflict between this DPA and the Principal Agreement on a matter of data protection or personal information handling, this DPA prevails.

10.3 Entire agreement on data processing

This DPA, together with the AnchorOS Privacy Policy, constitutes the complete agreement between the parties on the processing of personal information in connection with the AnchorOS platform.

10.4 Contact

Privacy enquiries and requests to execute a signed DPA: privacy@anchorand.co

Security incidents: security@anchorand.co