DATA PROCESSING AGREEMENT

This page summarises the Data Processing Agreement ("DPA") between Planfocus Consulting Pty Ltd (the "Processor") and the customer entity (the "Controller" or "Licensee") that engages AdviceStudio.ai. The DPA forms part of the Master Services Agreement (MSA) between the parties and applies whenever the Processor processes Personal Information on behalf of the Controller.

To sign the executable form of this agreement (PDF), contact privacy@advicestudio.ai.

1. Subject matter and duration

The Processor processes Personal Information on behalf of the Controller in connection with the Controller's use of the AdviceStudio.ai service. This DPA continues for the term of the MSA. Sections that by nature survive — security, breach notification, data return — continue after termination.

2. Nature and purpose of processing

Purpose — to enable the Controller's Authorised Users (financial advisers acting under the Controller's licensee) to create, edit, store, and export financial advice presentations for their clients.

Nature — collection, storage, transformation (LLM generation and adviser editing), output (PDF download, on-screen presentation), and deletion of the data described below.

Categories of data subjects

• Authorised Users (advisers) — the Controller's staff.
• Clients of Authorised Users — the natural persons receiving financial advice via the generated presentation.

Categories of Personal Information processed

• Adviser — name, business email, phone, IP address, hashed password, audit metadata.
• Client — identification information contained in the source document the adviser uploads (name, date of birth, account numbers, financial details). Held only as needed to render the presentation.

3. Processor obligations

The Processor will process Personal Information only on documented instructions from the Controller (the use of the service is itself a documented instruction), and in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth) and any other applicable data-protection law.

The Processor will not sell or share Personal Information for purposes other than providing the service. The Processor imposes confidentiality obligations on its personnel with access to Personal Information.

4. Security

The Processor implements and maintains the technical and organisational measures described in the AdviceStudio.ai Security Posture document (a current copy is provided to the Controller on request) and in its SOC 2 System Description. At minimum, those measures include:

• TLS 1.2+ encryption in transit on every endpoint.
• Encryption at rest of the production database and all backups.
• Bcrypt password storage; multi-factor authentication (optional default-on) on all Authorised User accounts.
• Strict logical access controls; access only to those with a documented need.
• PII redaction before any large-language-model call.
• An immutable audit log of material adviser actions.
• Quarterly access reviews; annual restore drill; annual policy review.
• A documented Incident Response Policy aligned with the Notifiable Data Breaches scheme.

The Processor may update its security measures over time, provided the level of protection does not materially decrease.

5. Sub-processors

The Controller authorises the Processor to engage sub-processors to perform the services. The current list of sub-processors is published at /legal/sub-processors.

The Processor will:

• Maintain the published list current.
• Notify the Controller of any new sub-processor at least 30 days before processing begins — publication on the public list constitutes notice.
• Impose data-protection obligations on every sub-processor no less protective than those in this DPA.
• Remain liable to the Controller for the acts and omissions of its sub-processors.

The Controller may object to a new sub-processor on reasonable security or compliance grounds within 30 days of notification. The parties will work in good faith to address the objection; if no resolution is possible, the Controller may terminate the affected services with pro-rata refund of prepaid fees.

6. Data subject rights

The Processor provides the Controller and Authorised Users with self-service mechanisms to support data subject rights:

• Access — Authorised Users can download a JSON copy of their profile data via the in-app export endpoint. For broader exports, contact privacy@advicestudio.ai.
• Correction — Authorised Users update their own profile via the in-app account settings page.
• Erasure — Authorised Users can self-delete via the in-app account settings page; the row is sentinel-erased after a 30-day grace window. Immediate erasure is available via Controller admin support.

If the Processor receives a request directly from a data subject, it will (unless legally required to respond) refer the request to the Controller.

7. Notifiable data breaches

The Processor will notify the Controller of an actual or suspected eligible data breach (per the NDB scheme) without undue delay, and in any case within 72 hours of becoming aware.

The notice will include a description of the breach; the categories and approximate number of affected data subjects and records; the likely consequences; and the measures taken or proposed to address the breach. The parties will cooperate in good faith to assess whether the breach is "likely to result in serious harm" under the NDB scheme.

8. International transfers

The Processor stores all Personal Information in Australia (ap-southeast-2). Limited categories of data are transferred to sub-processors outside Australia:

• Redacted adviser-supplied content to Anthropic (US) for LLM inference. Client PII is redacted before transfer.
• Adviser email and subscription metadata to Stripe (US) for payment processing.
• Adviser email and message bodies via Amazon SES (AU-region send, may transit US infrastructure).

Transfers occur under the sub-processor's SOC 2 / ISO 27001 attestations and their DPA commitments. Where required, the Processor will execute Standard Contractual Clauses or equivalent.

9. Return and deletion

On termination of the MSA, the Controller may request export of all Personal Information processed for the Controller, in a portable format, within 30 days. The Controller may also request deletion of all Personal Information processed for the Controller within 30 days, with written confirmation of deletion.

Some Personal Information may be retained beyond the 30-day window where required for legal compliance (e.g. ATO record-keeping for billing rows, 7 years), resolution of a pending claim, or audit log integrity.

10. Audit

The Controller may, at its own cost and at reasonable intervals (no more than annually), audit the Processor's compliance with this DPA. Audits are satisfied by the Processor providing the Controller with a current SOC 2 Type 2 report (under NDA), the Security Posture document, and a response to any reasonable security questionnaire. On-site audit is available at the Controller's cost where the above evidence is insufficient and is requested for cause.

11. General

This DPA is governed by the law of Victoria, Australia. It does not increase the Processor's liability beyond the cap set in the MSA except where the law prohibits such limitation. No variation of this DPA is effective unless in writing and signed by both parties (or, in the case of changes to the sub-processor list, made by publication as set out in §5).

12. Contact

For questions or to sign the executable form of this DPA, contact privacy@advicestudio.ai.

© 2026 Planfocus Consulting Pty Ltd. All rights reserved.

AdviceStudio.ai is a platform operated by Planfocus Consulting Pty Ltd | www.advicestudio.ai