Terms and Conditions
Effective 31 August 2026
Previous version: Terms and Conditions — valid from 01/01/2018 to 08/30/2026
1. Definitions
These Conditions apply to all contracts for the supply of Goods and/or Services by Secure Internet Storage Solutions Pty Ltd (ACN: 118 851 700) trading as Secure ISS (the "Supplier") to the Client, to the exclusion of all other terms and conditions. Any terms contained in, attached to, or referred to in a Client's purchase order, request for tender, or other documentation have no effect unless expressly accepted in writing by an authorised representative of the Supplier, and the Supplier's performance of any Services does not constitute acceptance of those terms.
Where the Supplier and the Client have entered into a written agreement signed by both parties (a "Client Agreement"), the terms of that Client Agreement prevail over these Conditions to the extent of any inconsistency. To the extent a Client Agreement does not deal with a matter addressed in these Conditions, these Conditions continue to apply.
1.1 “Additional Services” shall mean any goods or services provided by the Supplier which fall outside the scope of works described in the Quotation.
1.2 “Client” shall mean the entity named on any form provided by the Supplier to the Client who buys or agrees to buy Goods and/or Services.
1.3 “Contract” means each contract formed between the Supplier and the Client which incorporates the terms of this document.
1.4 “CPI” means the Consumer Price Index published from time to time by the Australian Bureau of Statistics.
1.5 “Default Event” means an event of default under clause 11 of these Terms and Conditions.
1.6 “Deliverables” shall mean all Deliverables, Goods, Services and/or Works undertaken by the Supplier (including, but not limited to any advice or recommendations given regarding the Deliverables) and are as described on any Invoice, Quotation, Fees Schedule or any other forms provided by the Supplier to the Client.
1.7 “Disbursement” means any amount paid or debt incurred by the Supplier on behalf of the Client during the provision of the Goods and/or the Services under the Contract.
1.8 “Fees Schedule” shall mean the schedule of fees agreed between the Supplier and the Client and specified in or calculated by reference in respect to any Quotation, Estimate, or any other forms provided by the Supplier to the Client.
1.9 “Fixed Term Contract” is for a defined period and has a set starting date and a set ending date.
1.10 “Goods” shall mean all goods, including Deliverables (including but not limited to any advice or recommendations given regarding the Goods), specified in the Quotation to be provided by the Supplier to the Client pursuant to a Contract.
1.11 “GST” shall mean goods and services tax payable under the Goods and Services Tax Act 1999.
1.12 “Intellectual Property” means, in respect of any person, all intellectual property and industrial property rights and interests (including common law rights and interests) owned or held by that person, or lawfully used by that person.
1.13 “Invoice” means any tax invoice from the Supplier to the Client claiming an amount for payment for Goods, Services or Deliverables provided under a Contract between those parties.
1.14 “Parties” to the contract means the Client and the Supplier.
1.15 “Price” shall mean the cost of the Goods, Works and/or Deliverables as determined by the Supplier and any other amounts owing to the Supplier by the Client.
1.16 “Quotation” shall mean any quotation provided by the Supplier to the Client which describes goods or services to be provided by the Supplier and specifies a price for those good or services.
1.17 “Services” means all services described in the Quotation to be provided by the Supplier to the Client in accordance with the Contract.
1.18 “Supplier” shall mean Secure ISS, and/or any related companies of the Supplier, and/or agents, employees, successors or assignees thereof.
1.19 “Terms and Conditions” means this document and the terms contained herein.
1.20 “Variations” means any amendment of or change to the Contract agreed by the Client and Supplier.
1.21 "APPs" means the Australian Privacy Principles set out in Schedule 1 to the Privacy Act.
1.22 "Client Data" means all data and information (in any form) that is provided by or on behalf of the Client to the Supplier, or that is accessed, collected, generated, stored or processed by the Supplier in the course of providing the Goods and/or Services, including any Personal Information contained in it, but excluding the Supplier's Intellectual Property.
1.23 "Eligible Data Breach" has the meaning given in Part IIIC of the Privacy Act.
1.24 "NDB Scheme" means the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.
1.25 "Personal Information" has the meaning given in the Privacy Act.
1.26 "Privacy Act" means the Privacy Act 1988 (Cth).
1.27 "Security Incident" means any actual, suspected or threatened unauthorised access to, or unauthorised disclosure, loss, alteration or destruction of, Client Data.
1.28 "Service Records" means the logs, log files, alerts, tickets, case and incident artefacts, and operational reports that are generated or compiled by the Supplier in the course of providing the Services in respect of the Client, in each case to the extent retained by the Supplier. Service Records form part of Client Data.
1.29 "Retention Period" means, in respect of Service Records, the period specified as such in the Quotation or Fees Schedule or, if no period is specified, 3 months on a rolling basis during the term of the Contract.
1.30 "Rules of Engagement" means the document agreed between the parties during onboarding (as updated by agreement from time to time) that records the response actions the Client authorises the Supplier to take, including the categories of action, the systems or network segments in scope, any constraints or exclusions, approval workflows for actions outside the authorised set, and the Client's nominated contacts for incident response.
2. Interpretation
2.1 If any provision of this Contract shall be invalid or unenforceable the validity, existence, legality and enforceability of the remaining provisions shall not be affected, prejudiced, or impaired.
2.2 This Contract shall be subject to the laws and statutes of Queensland and subject to the jurisdiction of the court geographically closest to the physical address of the Supplier.
2.3 The Supplier may sub-contract any part of this Contract. No sub-contractor has any authority to agree to any variation of this Contract on behalf of the Supplier.
2.4 The Supplier’s failure or delay in exercising or enforcing any right it has under this Contract shall not operate as a waiver of the Supplier’s rights to exercise or enforce such rights or any other rights in the future.
2.5 Any waiver of these Terms and Conditions by the Supplier must be made in writing.
2.6 The Client may not assign all or any of the Client’s rights or obligations under this Contract without the written permission of the Supplier.
2.7 The Supplier shall not be bound by any error or omission made by the Supplier on any invoice, quotation, estimate, or any other document issued by the Supplier.
2.8 The Client shall notify the Supplier of any intention to cease trading and/or of any change in the Clients name and/or contact details by giving at least seven (7) days’ notice in writing prior to any such events taking effect.
2.9 In these Conditions, unless expressly stated otherwise:
a. a reference to legislation is a reference to legislation of the Commonwealth of Australia or of an Australian State or Territory;
b. a reference to legislation or to a provision of legislation includes any amendment, re-enactment or replacement of it, and any regulation, code or other instrument made under it; and
c. a reference to legislation of another jurisdiction (including New Zealand) applies only where expressly identified, including in the New Zealand Addendum.
3.1 The Supplier may offer to enter into a Contract on the Terms and Conditions contained herein with a Client for the work described therein by:
(i) providing the Client with an engagement letter;
(ii) providing the Client with a quotation; or
(iii) providing the Client with any other documentation containing a description of work to be performed by the Supplier and a price for performing the same.
3.2 Where a Quotation is given for the Price then:
(i) where Goods, Works and/or Deliverables are required in addition to the quotation then the Client agrees to pay the additional Price of such Goods, Works and Deliverables; and
(ii) the Supplier reserves the right to amend the quotation in the event of circumstances beyond the Supplier’s control.
3.3 Any offer made by the Supplier to the Client shall be deemed to expire 20 business days from provision of the same, unless otherwise agreed between the parties.
4. Acceptance
4.1 The Client may accept an offer made by the Supplier to enter into a Contract by:
(i) Providing instructions, written or verbal, to the Supplier for the supply of Goods, Works and/or Deliverables;
(ii) Making payment of any amount requested by the Supplier in the offer;
(ii) Making payment of any amount requested by the Supplier in the offer;
(iii) Accepting Goods, Works and/or Deliverables supplied by the Supplier; or
(iv) Accepting the offer in writing.
4.3 The Client acknowledges that no employees, contractors, agents and/or representatives of the Supplier are authorised to make any representations, statements, conditions and/or agreements without the prior written consent of a Director of the Supplier. The Client expressly agrees that the Supplier will not be bound by any such unauthorised statements.
5. Variation
5.1 The Parties agree that the Supplier may, at its discretion, elect to vary the Terms and Conditions from time to time.
5.2 Any variation of the Supplier’s Terms and Conditions shall not affect the terms of any Contract on foot at the time of such variation unless expressly agreed between the Parties. For the avoidance of doubt, the terms and conditions that apply to any Contract shall be the Terms and Conditions as then incorporated into the Contract at the time of formation, unless otherwise agreed by the Parties.
(i) Providing instructions, written or verbal, to the Supplier for the supply of Goods, Works and/or Deliverables;
(ii) Making payment of any amount requested by the Supplier in the offer;
(iii) Accepting Goods, Works and/or Deliverables supplied by the Supplier; or
(iv) Accepting the offer in writing.
6. Subscription Agreements
6.1 Where the quotation describes the type of the Contract as a “Subscription Agreement” (as opposed to being a “service agreement”), the additional terms of this clause 6 will apply.
6.2 The Supplier may, at its own discretion, elect to review the scope of the Services and the Price as set out in the Quotation, with that right arising on the day that is 3 months after the commencement date and expiring on the day that is 4 months after the commencement day.
6.3 If the Supplier elects to exercise its right to review, it may amend such terms of the Quotation as it deems commercially reasonable in the circumstances, including but not limited to any changes in the Client’s or the Supplier’s circumstances since the Quotation was issued, to create a new Quotation (“New Quotation”) and must provide a copy of the New Quotation to the Client within five (5) working days of exercising its right to review.
6.4 Within ten business days of receiving the New Quotation, the Client must either accept or reject the New Quotation by notice to the Supplier. For the avoidance of doubt, it will be deemed to be a rejection of the New Quotation if the Client fails to provide notice of their decision to the Supplier within the specified timeframe and that notice will be deemed to have been received on the eleventh day after the day the Client received the New Quotation.
6.5 The parties expressly agree that where the Supplier issues a New Quotation and the Client rejects the quotation, the Supplier may terminate this agreement by written notice to Client at any time within 30 days of receipt of the notice of rejection and such termination shall be on the following terms:
(i) The Contract will terminate 30 days after date of the notice;
(ii) The Parties expressly agree that the Supplier’s election to terminate under this clause shall not be construed as a breach or a repudiation of the Contract and shall not give rise to any claim for damages in relation to that termination, except to the extent that either party has failed to comply with the terms of this clause 6.
7. Suppliers Obligations
7.1 The Supplier agrees to provide the Goods and/or Services in exchange for the Client agreeing to pay the Price.
7.2 The Supplier warrants:
(i) it has the right to grant the licenses in respect of the Deliverables under this agreement to the Client without violating any rights of any third party;
(ii) any Services provided under this agreement shall be performed in line with industry best practice(s).
8. Clients Obligations
8.1 The Client agreeing to pay the Price in exchange for the Supplier agreeing to provide the Goods and/or Services.
8.2 The Client acknowledges that:
(i) the Supplier is in the business of Cyber Security, Cloud and Technical Operations and the Supplier shall have the right to provide services to third parties which are the same or similar to the Services;
(ii) it is responsible for any faults, which occur, in the Client’s computer or communication equipment; or do not meet any minimum specifications;
(iii) incorrect delivery addresses may incur an additional freight fee. It is the Customer’s responsibility to advise any changes to current address or contacts and ensure a person is ready to receive the delivery at the location;
(iv) there must be a person ready to receive any delivery at the location. Once delivered and signed the risk passes to the Customer at the location. If there is no one there to accept a delivery an additional fee may be charged.
9. Additional Services
9.1 Any request for Additional Services from the Client to the Supplier shall constitute a request to vary the Terms of the Contract to vary the scope of work to include those Additional Services in accordance with this clause.
9.2 Any fee for additional services shall be calculated based on the amount of time required for the Supplier to perform the work comprising the Additional Services at the rate specified in the Fee Schedule for that type of work.
10. Payment
10.1 All Fees payable under this agreement for Goods and/or Services shall be payable in advance, unless otherwise agreed between the parties or where the fees relate to Additional Services. For the avoidance of doubt:
(i) the Supplier’s obligations under these Terms and Conditions, including but not limited to their obligations to provide Goods and/or Services, are conditional upon the Client making payment in advance; and
(ii) Where the Supplier has specified a timeframe for doing any action or task, that timeframe is conditional upon payment being received when due, and the Parties agree that where the specified timeframe shall be extended by the amount of time that the payment was due but not made.
10.2 Unless the Supplier otherwise agrees in writing, payment of any Invoice shall be due seven (7) days after an Invoice is issued for the Price.
10.3 Unless the Parties agree otherwise, payment must be made by way of irreversible bank transfer.
10.4 The Supplier may submit a detailed payment claim at intervals of not less than one (1) month for work performed up to the end of each month. The value of Goods, Works and/or Deliverables may include the value of authorised variations.
10.5 All payments by the Client must be made in full.
10.6 Should the Client dispute any invoice of the Supplier’s, the Client shall remain liable for payment to the Supplier, of any outstanding invoices not subject to any dispute raised by the Client. Payment for any invoice not related to a dispute, shall remain due, on the date noted on the Supplier’s invoices. Nothing in this clause shall be construed as waiving, suspending or otherwise modifying the Client’s obligation to pay a validly issued invoice.
10.7 All contracts are subject to an Annual Price Review. The Price (exclusive of GST) will be increased on each anniversary of the term of the agreement to an amount calculated by multiplication of the then current Price by a fraction, the denominator of which is the CPI current one year previously and the numerator of which is the then current CPI.
11. Default
11.1 A Default Event occurs if:
(i) any amounts are unpaid after they fall due;
(ii) the Client is unable to pay its debts as they fall due;
(iii) the Client ceases or suspends conduct of its business, or threatens to;
(iv) The Client’s financial circumstances change in a way which, in the reasonable opinion of the Supplier, will affect the Client’s ability to comply with its obligations under this Contract;
(v) an administrator, liquidator, provisional liquidator, receiver and/or manager or any other form of insolvency administrator or controller is appointed to the Applicant or over all or part of the Applicant's assets;
(vi) the Client goes into bankruptcy, dies, or commits any act of bankruptcy or, if the Client is a partnership, the partnership is dissolved;
(vii) execution is levied on any of the Client's assets.
11.3 In the event the Client’s payment to the Supplier is dishonoured for any reason, the Client shall be liable for any dishonour fees incurred by the Supplier.
12. Breach and Termination
12.1 Either party may terminate any Contract on 90 days’ prior written notice to the other party at any time subject to the remainder of this clause.
12.2 If a Default Event occurs:
(i) The Supplier may, at its sole discretion, suspend performance of its obligations under the Contract until such time as the Default Event is rectified or terminate the supply of Goods and/or Services;
(ii) all unpaid amounts become immediately due and payable; and
(iii) the Supplier may immediately terminate the Contract at any given time before the Default Event is rectified by written notice to the Client.
12.3 Prepaid fees are non-refundable except where required by law or where the Supplier fails to provide the relevant Goods or Services.
12.4 Where the Client has entered into a fixed term agreement with the Supplier for Goods and/or Services and cancels the Contract, the Client must pay the fees that would have been payable for the remainder of the fixed term, less any costs avoided by the Supplier as a direct result of the early termination.
12.5 The Parties acknowledge that the Supplier’s rights under this clause may be subject to restrictions pursuant to clause 415D of the Corporations Act 2001 (Cth).
13. Effect of Termination
13.1 If any Contract is terminated by the Client or the Supplier under clause 12, that Contract will terminate and the following will apply:
(i) any license granted under or pursuant to that Contract or these terms and conditions will end, and the Client will not be authorised to use the Goods and/or Deliverables after expiry or termination of that Contract;
(ii) the Client shall be liable to pay the Supplier for full costs of the Works, Goods and/or Deliverables provided by the Supplier, including any Goods, Works and/or Deliverables ordered and/or purchased, up to the date of termination;
(iii) the Client will agree to pay the Supplier for any unpaid fees arising from the Client’s use of the Deliverables up to the date of termination;
(iv) the Client will agree to return to the Supplier, on the Supplier’s demand, any information to which this clause relates to the business of the Supplier or the services or products provided under these terms and conditions and/or any Contract;
(v) termination of any Contract shall be without prejudice to the rights of any party which have accrued prior to, or which arise in connection with, such termination; and
(vi) the provisions of these terms or any Contract intended to apply after termination shall continue to apply.
14. Intellectual Property Rights
14.1 All materials provided by the Supplier to the Client, including but not limited to:
(i) any computer software (in object code and source code form), script, programming code, data or information;
(ii) any trade secrets, know-how, methodologies and processes related to the Supplier’s Goods, Works and/or Deliverables shall remain the Supplier’s sole and exclusive property.
14.2 The Supplier will have no liability to the Client for any claim of infringement based on or related to and relating to the Deliverables, and that the Client has no rights in and/or relating to the Deliverables, other than are expressly provided for in this Contract. This clause shall survive the expiry or termination of the Contract.
14.3 Nothing in this Agreement transfers ownership of the Supplier's pre-existing Intellectual Property.
14.4 The Client retains ownership of all Intellectual Property Rights in Client Data and materials supplied by the Client.
15. Software Licenses
15.1 The Client acknowledges that any license granted by the Supplier under this clause is granted subject to consent from any third party licensors (if any).
16. Disclaimer and Limitation of Liability
16.1 The Supplier disclaims all warranties and conditions, whether express, implied or statutory, other than those identified expressly in this agreement, including but not limited to warranties of title, non-infringement, merchantability, and fitness for a particular purpose, to the extent that it is able to do so at law.
16.2 The Supplier will not be liable for any loss or damage suffered by the Client as a result of any failure or defect in any services or products provided by third party vendors, developers or consultants referred to the Client by the Supplier unless such third party products or services are provided under written agreement between the Client and the Supplier and then only to the extent expressly provided in those agreements.
16.3 Under no circumstances (including, but not limited to negligence), shall the Supplier, or any of the Supplier’s related companies, officers, employees, partners, agents or suppliers, be liable to the Client for:
(i) the Client’s reliance on the Deliverables; and
(ii) any direct, incidental, special, consequential, indirect or punitive damages (including loss of use, loss of data, loss of profits, loss of anticipated savings, or loss of goodwill) that result from the use of, or the inability to use, and/or relating to the Deliverables.
16.4 Subject to clauses 16.5 and 16.6, and to the maximum extent permitted by law, the aggregate liability of the Supplier and its Personnel to the Client for all claims, damages, losses and causes of action arising under or in connection with a Contract, whether in contract, tort (including negligence), under statute or otherwise, will not exceed two (2) times the total fees paid or payable by the Client to the Supplier under the Contract in the twelve (12) months immediately preceding the event giving rise to the claim (or, where the Contract has been in effect for less than twelve [12] months at that time, two [2) times those fees annualised). ]
a. In this clause 16, "Personnel" means the Supplier's related bodies corporate, officers, employees, agents, contractors and suppliers. The Supplier holds the benefit of this clause 16 on trust for, and may enforce it on behalf of, its Personnel.
b. The Client must ensure that any third party it permits to access or use the Goods or Deliverables is bound by limitations of liability no less protective of the Supplier than this clause 16, and the Client indemnifies the Supplier against any claim by such a third party to the extent it exceeds the limits in this clause.
16.5 Nothing in these Terms and Conditions excludes, restricts or modifies, or has the effect of excluding, restricting or modifying, any guarantee, right, condition, warranty or remedy conferred on the Client by the Competition and Consumer Act 2010 (Cth) (including the Australian Consumer Law) or any other law, where to do so would contravene that law or render any part of these Terms and Conditions void (Non-excludable Rights). All other terms of this clause 16 apply subject to the Non-excludable Rights.
16.6 To the extent the Supplier is able to limit its liability for a failure to comply with a guarantee under the Australian Consumer Law (other than a guarantee under sections 51 to 53 of the Australian Consumer Law), the Supplier's liability for such failure is limited, at the Supplier's option, to:
a. in the case of goods: the replacement or repair of the goods, the supply of equivalent goods, or the payment of the cost of doing so; and
b. in the case of services: the supplying of the services again, or the payment of the cost of having the services supplied again.
17. Disputes Resolution
17.1 If a dispute arises between the parties in connection with a Contract, a party may give the other written notice of the dispute, and the parties' senior representatives will meet and attempt in good faith to resolve it within 15 business days of that notice.
17.2 If the dispute is not resolved under clause 17.1, the parties will refer it to mediation administered by the Resolution Institute in accordance with its mediation rules before commencing arbitration.
17.3 If the dispute is not resolved by mediation within a further 20 business days, either party may refer the dispute to arbitration before a single arbitrator agreed by the parties or, failing agreement, appointed by the Australian Centre for International Commercial Arbitration (ACICA). The seat of arbitration is Brisbane, Queensland, the language is English, and the arbitration will be conducted under the ACICA Arbitration Rules. The arbitrator's determination is final and binding on the parties to the maximum extent permitted by law.
17.4 Nothing in this clause prevents a party from:
a. seeking urgent injunctive or interlocutory relief from a court;
b. commencing court proceedings to recover an undisputed debt; or
c. exercising any right or remedy that cannot lawfully be made subject to arbitration, including under the Australian Consumer Law.
18. Credit Reporting
18.1 This clause 18 applies only where the Client is an individual, sole trader, or a person who provides a personal guarantee in connection with the Contract.
18.2 The Client agrees that the Supplier may obtain from a credit reporting body (CRB) a credit report containing credit information about the Client for the purpose of assessing an application for commercial credit, in accordance with Part IIIA of the Privacy Act and the registered CR Code.
18.3 The Client agrees that the Supplier may exchange credit information about the Client with credit providers named as trade referees, and with other credit providers, for the purposes of: (a) assessing the Client's creditworthiness; (b) notifying other credit providers of a default by the Client; and (c) collecting overdue payments.
18.4 Credit information obtained under this clause will be used and retained by the Supplier only for purposes permitted under Part IIIA of the Privacy Act and the CR Code, including assessing creditworthiness, processing payments, and managing the Client's account.
18.5 The Supplier will handle credit information in accordance with its Privacy Policy and credit-reporting policy.
19. Force Majeure
19.1 No Party hereto will be liable nor deemed to be liable to the other Party for failure or delay in meeting any obligation hereunder due to strikes and/or lockouts (whether of their own employees or those of others and whether or not the Party against whom such action is taken could have avoided the same by acceding to the demands of the employees responsible for such action) Acts of God, war, fire, flood, embargo, litigation, acts of government or any agency instrumentality or any political subdivision thereof or any other cause beyond the control of the Party which had the duty to perform. In any such event, the time for performance of the obligations under this Contract will be extended by the same period or periods (as the case may be) for which performance is delayed. The Party so affected will use its best endeavours to avoid or remove such causes of non performance and will continue performance hereunder as soon as such causes are removed provided that nothing in this clause will be construed as requiring the affected Party to settle any industrial dispute.
20. Privacy and Personal Information
20.1 Each party will comply with the Privacy Act and the APPs, to the extent applicable to that party, in respect of any Personal Information it handles in connection with a Contract.
20.2 The Supplier will only collect, use and disclose Personal Information contained in Client Data for the purpose of providing the Goods and/or Services, performing its obligations under the Contract, or as otherwise required or authorised by law.
20.3 The Client warrants that it has made all notifications and obtained all consents necessary under the Privacy Act for the Supplier to handle Personal Information contained in Client Data as contemplated by the Contract.
20.4 The Client acknowledges and agrees that, in providing the Goods and/or Services, the Supplier may disclose Personal Information to recipients located outside Australia, including service providers in the United States and such other jurisdictions as notified in the Supplier's Privacy Policy. The Supplier will, in accordance with APP 8, take such steps as are reasonable in the circumstances to ensure that those overseas recipients do not breach the APPs in relation to that Personal Information, except where an exception in APP 8.2 applies.
20.5 The Supplier's handling of Personal Information is further described in its Privacy Policy, available at https://www.secure-iss.com/privacy-policy, as updated from time to time.
21. Client Data, Security and Sub-contracting
21.1 As between the parties, the Client retains all right, title and interest in Client Data. Nothing in the Contract transfers ownership of Client Data to the Supplier. The Client grants the Supplier a non-exclusive licence to access, use, store and process Client Data to the extent necessary to provide the Goods and/or Services and perform its obligations under the Contract.
21.2 The Supplier will implement and maintain reasonable technical and organisational security measures designed to protect Client Data against a Security Incident, consistent with its obligations under APP 11 and with the requirements of its ISO/IEC 27001 certification. The Client acknowledges that no security measures can guarantee absolute security.
21.3 Where the Supplier sub-contracts any part of the Services under clause 2.3 and that sub-contractor will handle Client Data, the Supplier will ensure the sub-contractor is bound by confidentiality and data-protection obligations no less protective than those in this clause 21. The Supplier remains responsible for the acts and omissions of its sub-contractors in relation to Client Data.
21.4 Within 30 days after expiry or termination of a Contract, the Supplier will, at the Client's written election, return or securely destroy Client Data in its possession or control, except to the extent the Supplier is required to retain it by law or for the purpose of resolving any dispute, and except for routine back-ups that are overwritten in the ordinary course. The obligation to keep Client Data secure continues for as long as the Supplier holds it.
22. Data Breach Notification and Cooperation
22.1 If the Supplier becomes aware of a Security Incident affecting Client Data, the Supplier will notify the Client without undue delay, and where practicable within 24 hours of becoming so aware, and will provide the Client with the information then known about the Security Incident.
22.2 The parties will cooperate in good faith to assess whether the Security Incident is, or is likely to be, an Eligible Data Breach, to contain it, and to mitigate any resulting harm. The Supplier will take all reasonable steps to assist the Client in complying with the Client's obligations under the NDB Scheme.
22.3 Where a Security Incident constitutes an Eligible Data Breach, the party that holds the relevant Personal Information for the purposes of the Privacy Act is responsible for making any notification required under the NDB Scheme to the Office of the Australian Information Commissioner and to affected individuals. The parties will consult on the content and timing of any such notification before it is made, to the extent practicable and lawful.
22.4 The Supplier will keep a record of Security Incidents affecting Client Data and the actions taken in response, and will make that record available to the Client on reasonable request.
23. Security Services: Acknowledgements and Responsibilities
23.1 The Client acknowledges and agrees that cyber security threats evolve continuously and that cyber security risk can be reduced but cannot be eliminated. Subject to clauses 16.5 and 16.6, the Supplier does not warrant or guarantee that the Goods or Services will detect or prevent all threats, or that any environment, system or data will be free from vulnerabilities, malware, unauthorised access, data breaches or other Security Incidents. Nothing in this clause limits the Supplier's obligation to provide the Services with due care and skill and to industry best practice.
23.2
a. If a Security Incident occurs or is reasonably suspected, the Client must cooperate with the Supplier in good faith, including by providing timely access to relevant systems, personnel, information and approvals reasonably required to investigate, contain and remediate the Security Incident.
b. Where the Client has authorised response actions in the Rules of Engagement, the Supplier may take those actions without further approval where the Supplier reasonably considers them necessary to contain or remediate a Security Incident. Subject to clauses 16.5 and 16.6, the Supplier is not liable for any interruption to, or loss arising in connection with, the Client's systems or operations to the extent it arises from authorised response actions taken in good faith and with reasonable care in accordance with the Rules of Engagement.
c. For actions not authorised under the Rules of Engagement, the Supplier will seek the Client's approval through the contacts and escalation paths recorded in the Rules of Engagement. Subject to clauses 16.5 and 16.6, the Supplier is not liable for any loss or damage to the extent it arises from the Client's delay or failure to provide approvals, or to act on the Supplier's reasonable containment or remediation recommendations.
d. The Client must keep the information recorded in the Rules of Engagement, including its nominated contacts and approval workflows, accurate and current.
23.3
a. The Client acknowledges that the Services depend on third-party platforms, networks and services, including platforms licensed or controlled by the Client (such as its cloud tenancies, software-as-a-service subscriptions, telecommunications carriers and internet service providers) and platforms used by the Supplier to deliver the Services.
b. The Supplier is not responsible for the acts, omissions, availability, performance, or changes to the functionality or terms, of any platform licensed or controlled by the Client, and the Client is responsible for its compliance with the terms applicable to those platforms.
c. Subject to clauses 16.5 and 16.6, the Supplier is not liable for any unavailability, degradation or change of a third-party platform used by the Supplier to deliver the Services to the extent it is beyond the Supplier's reasonable control, and the Supplier is relieved from any affected service levels to the extent of, and for the duration of, any such event. Nothing in this clause 23.4 limits clause 21.3.
d. Where the Goods or Services include or depend on third-party software or services licensed to the Client, the Client must comply with the applicable third-party licence terms notified to the Client.
PART B — NEW ZEALAND ADDENDUM
1.1 This New Zealand Addendum (Addendum) applies where the Client is located in New Zealand, or where the Supplier handles the Personal Information of individuals in New Zealand in connection with a Contract.
1.2 This Addendum forms part of, and is to be read together with, the Terms and Conditions. To the extent of any inconsistency between this Addendum and the Terms and Conditions in respect of a matter governed by New Zealand law, this Addendum prevails.
B2. Definitions (New Zealand)
2.1 "IPPs" means the information privacy principles set out in the NZ Privacy Act, including IPP 3A.
2.2 "NZ Personal Information" means personal information (as defined in the NZ Privacy Act) handled in connection with a Contract.
2.3 "NZ Privacy Act" means the Privacy Act 2020 (NZ).
2.4 "Notifiable Privacy Breach" has the meaning given in the NZ Privacy Act.
2.5 "OPC" means the New Zealand Office of the Privacy Commissioner.
B3. Compliance with the NZ Privacy Act
3.1 Each party will comply with the NZ Privacy Act and the IPPs, to the extent applicable to that party, in respect of any NZ Personal Information it handles in connection with a Contract.
3.2 The Supplier has appointed a privacy officer in accordance with section 201 of the NZ Privacy Act, who may be contacted at privacy@secure-iss.com.
3.3. This clause 3 applies in addition to, and not in substitution for, clause 20 of the Terms and Conditions. Where both Australian and New Zealand privacy law apply to the handling of particular Personal Information, each party must comply with both, and any inconsistency in respect of a matter governed by New Zealand law is resolved in favour of this Addendum in accordance with Addendum clause 1.2.
B4. Data breach notification (New Zealand)
4.1 If the Supplier becomes aware of a Security Incident affecting NZ Personal Information, the Supplier will notify the Client as soon as practicable, and in any event within 48 hours of becoming so aware.
4.2 The parties will cooperate to assess whether the incident is a Notifiable Privacy Breach (that is, a privacy breach that it is reasonable to believe has caused, or is likely to cause, serious harm) and, if so, to ensure that the OPC and affected individuals are notified as soon as practicable as required by the NZ Privacy Act, using the OPC's NotifyUs process.
B5. Cross-border disclosure (IPP 12) and onward transfer (Part 8)
5.1 Where the Supplier holds or processes NZ Personal Information solely for safe custody or processing on behalf of the Client, and not for the Supplier's own purposes, the parties acknowledge that IPP 12 does not apply to the transfer of that information to the Supplier.
5.2 Where the Supplier discloses NZ Personal Information to a recipient outside New Zealand other than as described in clause 5.1, the Supplier will ensure that at least one basis under IPP 12 is satisfied, including by ensuring (by contract or otherwise) that the recipient is required to protect the information with safeguards comparable to those in the NZ Privacy Act.
5.3 The Supplier may transfer NZ Personal Information to, and process it in, Australia, and may disclose it to service providers in [the United States and such other jurisdictions as notified in the Supplier's Privacy Policy], for the purpose of providing the Goods and/or Services.
5.4 The parties acknowledge that Part 8 of the NZ Privacy Act may restrict the onward transfer out of New Zealand of personal information received in New Zealand from overseas, and the Supplier will comply with any transfer prohibition notice issued under that Part.
B6. Indirect collection (IPP 3A)
6.1 The parties acknowledge that from 1 May 2026, IPP 3A requires that, where Personal Information is collected from a source other than the individual concerned, reasonable steps are taken to make that individual aware of the matters specified in the NZ Privacy Act.
6.2 Where the Supplier collects NZ Personal Information indirectly in the course of providing the Services (including from the Client's systems, logs, identity providers or third-party sources), the Client is responsible for ensuring that the individuals concerned are made aware of the matters required by IPP 3A, including through the Client's own privacy statements, except to the extent a statutory exception applies.
B7. New Zealand consumer law
7.1 Where the Supplier supplies, and the Client acquires, Goods and/or Services under a Contract in trade:
a. the parties agree that the Consumer Guarantees Act 1993 (NZ) (CGA) does not apply to that supply, and that they are contracting out of the CGA in accordance with section 43(2) of the CGA;
b. the parties agree that sections 9, 12A and 13 of the Fair Trading Act 1986 (NZ) (FTA) do not apply to dealings between them in connection with the Contract, and that they are contracting out of those provisions in accordance with section 5D of the FTA; and
c. each party acknowledges and agrees that:
(i) it is in trade and is acquiring or supplying the Goods and/or Services in trade; (ii) this agreement is in writing;
(ii) this agreement is in writing;
(iii) it has had a reasonable opportunity to obtain legal advice and to negotiate the terms of the Contract; and
(iv) having regard to the subject matter and value of the Contract and the parties' respective bargaining positions, it is fair and reasonable that the parties are bound by this clause 7.1.
7.2 Clause 7.1 does not apply, and nothing in the Terms and Conditions or this Addendum excludes, restricts or modifies any guarantee, right or remedy of the Client under the CGA or the FTA, where and to the extent that the Client acquires the Goods or Services as a consumer for the purposes of the CGA, the conditions in section 43(2) of the CGA or section 5D of the FTA are not satisfied, or any such exclusion, restriction or modification would otherwise be unlawful.
7.3 For a Client located in New Zealand, clause 16 of the Terms and Conditions applies subject to this clause 7, and any liability of the Supplier under a guarantee, right or remedy preserved by clause 7.2 is limited only to the maximum extent permitted by law.
B8. Governing law and jurisdiction (New Zealand)
8.1 Notwithstanding clause 2.2 of the Terms and Conditions, nothing in the Terms and Conditions or this Addendum operates to exclude, restrict or modify the application of any provision of the NZ Privacy Act, the Consumer Guarantees Act 1993 (NZ) or the Fair Trading Act 1986 (NZ) where to do so would be unlawful in respect of a Client or individual in New Zealand.
8.2 Clause 17 of the Terms and Conditions applies to a dispute involving a Client located in New Zealand, except that for such a dispute: (a) the appointing body for any arbitration under clause 17.3 is the Arbitrators' and Mediators' Institute of New Zealand (AMINZ); and (b) the seat of arbitration is Auckland, New Zealand.
8.3 In respect of any matter falling within clause 17.4 and involving a Client located in New Zealand, the parties submit to the non-exclusive jurisdiction of the courts of New Zealand.