Data Processing Addendum

1. Scope and incorporation

This Data Processing Addendum (“Addendum”) forms part of the Terms of Service between Drum Software Inc. (“Drum”) and the Customer, and of any order that refers to those Terms. It applies whenever Drum processes Customer Data on the Customer’s behalf in providing the Services. No separate signature is required. A Customer that needs a countersigned copy for its records can request one from support@getdrum.com.

Capitalised terms not defined in this Addendum have the meaning given in the Terms. If this Addendum conflicts with the Terms on the processing or protection of Customer Data, this Addendum controls to the extent of the conflict.

2. Definitions

• “Applicable Privacy Law” means the privacy and data protection laws that apply to the processing of Customer Data under the Terms, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and the Privacy Act 2020 (NZ), each as amended or replaced.
• “Personal Information” means Customer Data that is personal information or personal data under Applicable Privacy Law.
• “Security Incident” means a confirmed breach of security that leads to the accidental or unlawful unauthorised access to, disclosure of, alteration of, or loss of Customer Data held by Drum or a Subprocessor. It does not include unsuccessful attempts or activities that do not compromise the security of Customer Data, such as blocked network scans, failed sign-in attempts or denial-of-service attempts that do not expose data.
• “Subprocessor” means a third party that Drum engages to process Customer Data on Drum’s behalf. Services that a Customer chooses to connect to Drum, as described in section 9, are not Subprocessors.

3. Roles and instructions

The Customer controls the Customer Data in its account and determines the purposes for which it is collected and used. Drum processes Customer Data on the Customer’s behalf, and only to provide, secure, support and maintain the Services, to follow the Customer’s documented instructions, and to comply with law.

The Terms, this Addendum, the Customer’s configuration of the Services and the Customer’s requests to Drum support are the Customer’s instructions. Drum will tell the Customer if it believes an instruction breaches Applicable Privacy Law, and is not required to follow that instruction.

The Customer is responsible for having the rights, notices and consents it needs under Applicable Privacy Law to provide Customer Data to Drum and to have Drum process it under the Terms.

4. Details of processing

• Subject matter and purpose: providing the Services to the Customer, including project, resourcing, time, cost, proposal, invoicing and reporting features, support, assisted onboarding and imports, and the integrations and AI-assisted features the Customer chooses to use.
• Nature of processing: collection, storage, organisation, retrieval, calculation, display, transmission to recipients the Customer directs, backup and deletion, as needed to provide the Services.
• People whose Personal Information is processed: the Customer’s Users and other personnel, and the Customer’s clients, prospects, suppliers, subcontractors and their contacts.
• Types of Personal Information: names, job titles, business contact details, User account details, roles and permissions, timesheets, leave and availability, cost and charge-out rates, project, budget, invoice and expense records, emails, documents and files the Customer uploads or sends to Drum, proposal responses and signatures, and technical data such as IP addresses, device and browser details and activity logs.
• Sensitive information: the Services are not designed to process sensitive information as defined in Applicable Privacy Law, such as health information. The Customer is responsible for deciding whether to enter such information.
• Frequency and duration: continuous while the Customer uses the Services, and afterwards for the period described in sections 13 and 15.
• Location: as described in section 11 and on the Subprocessors page.

5. Drum access to Customer Data

Onboarding and imports. When the Customer asks Drum to help with onboarding or to import data, Drum personnel access the source data the Customer provides, and the Customer’s account, to review, map, transform, import and reconcile that data and to set up the account. Drum handles that source data as Customer Data, uses it only for the onboarding or import, and keeps it only for as long as it is reasonably needed for that purpose.

Support and setup. Drum personnel may access the Customer’s account and Customer Data when reasonably needed to respond to a support request, to set up or configure the account at the Customer’s request, to maintain or secure the Services, to investigate misuse, or to comply with law. Outside these cases, Drum personnel do not review Customer Data.

Limits and records. Drum limits this access to personnel and contractors who need it for the task, and to the Customer Data the task requires. Each of them is bound by written confidentiality obligations. Where available, Drum’s account-access tools record who accessed the account, the Customer involved and the reason for access.

6. Security

Drum maintains administrative, technical and organisational safeguards designed to protect Customer Data against misuse, interference, loss and unauthorised access, modification or disclosure. These safeguards are summarised on our Data Management and Security page. Drum may change its safeguards over time, but will not reduce the overall level of protection they provide to Customer Data.

7. Customer security responsibilities

Without limiting Drum’s obligations under this Addendum, the Customer is responsible for its use of the Services, including:

• using the security features of the Services appropriately for the risk to its Customer Data, such as User permissions and multi-factor authentication where available;
• keeping its Users’ sign-in credentials and API tokens secure, and removing access promptly when a User no longer needs it;
• securing the systems and devices it uses to access the Services;
• configuring connected services, API clients and webhook destinations appropriately; and
• keeping any exports or independent copies of Customer Data that it needs for its own legal, contractual or business-continuity purposes.

The Customer has reviewed the Services, the safeguards described in section 6 and Drum’s commitments in this Addendum, and is responsible for deciding that they meet its own needs and obligations under Applicable Privacy Law.

8. Security incident notification

Timing. Drum will notify the Customer without undue delay, and in any case no later than 48 hours after Drum confirms a Security Incident that affects the Customer’s Customer Data. This applies to Security Incidents at Drum and at its Subprocessors. For a Security Incident at a Subprocessor, the 48 hours run from when the Subprocessor notifies Drum or Drum otherwise confirms it. If Drum does not have all the information in this section within that time, Drum will still notify the Customer with the information it has, and will provide the rest as it becomes available.

Sender and recipients. Notices are sent by Drum from support@getdrum.com to the account owner and to any security contact the Customer has nominated. A Customer can nominate or change its security contact by emailing support@getdrum.com. The Customer is responsible for keeping these contacts current.

Content. To the extent known at the time, the notice will describe:

• the nature of the Security Incident, when it occurred and when Drum confirmed it;
• the categories and approximate volume of Customer Data and Users affected or likely to be affected;
• whether a Subprocessor was involved and, if so, which one;
• the likely consequences of the Security Incident;
• the steps Drum has taken or proposes to take to contain it and reduce its effects;
• any steps the Customer should take, such as resetting credentials or revoking API keys; and
• a contact at Drum for further information.

Updates and cooperation. Drum will keep the Customer informed as its investigation progresses, and will provide a written summary of the cause and the corrective actions taken once the investigation is complete. Drum will take reasonable steps to contain the Security Incident, preserve relevant evidence and prevent it from happening again.

Customer’s notifications. Drum will provide the information and assistance the Customer reasonably needs to assess whether a Security Incident is an eligible data breach or otherwise notifiable under Applicable Privacy Law, and to prepare any notification to the Office of the Australian Information Commissioner, the New Zealand Privacy Commissioner, other regulators or affected individuals. This includes relevant records such as event times and account access logs, to the extent they exist and can be shared without compromising the security of other customers. The Customer decides whether and how to notify regulators and individuals about its Customer Data. Drum will not notify them on the Customer’s behalf unless the Customer agrees or the law requires Drum to do so.

A notice under this section is not an admission of fault or liability by Drum.

9. Subprocessors

The Customer authorises Drum to engage the Subprocessors listed on our Subprocessors page. Drum will engage each Subprocessor under a written agreement that requires it to protect Customer Data to a standard no less protective than this Addendum requires for the services it provides, and to notify Drum of security incidents that affect Customer Data. Drum remains responsible for the performance of its Subprocessors under this Addendum.

Drum will give the Customer at least 30 days’ notice before a new Subprocessor begins processing Customer Data, by updating the Subprocessors page and emailing the account owner. If the Customer has a reasonable objection related to data protection, it may tell Drum within that period. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected Services by written notice and receive a refund of prepaid fees for the unused period.

A Customer or User may choose to connect Drum to services such as Google, Microsoft, Xero, MYOB or QuickBooks, or configure an API client or webhook destination. Data sent to those services at the Customer’s direction is governed by the Customer’s own arrangements with them.

10. Artificial intelligence

Drum will not use Customer Data to train, fine-tune, develop or improve any artificial intelligence or machine learning model, whether Drum’s own or a third party’s, unless the Customer agrees in writing.

Drum uses AI providers only for the AI-assisted features a User chooses to invoke, and only on terms under which the provider does not use the submitted content or the results to train or improve its models. Drum will not engage an AI provider as a Subprocessor on any other terms without the Customer’s written agreement.

The Services do not use AI to make decisions about individuals that have legal or similarly significant effects. AI-generated results are suggestions for a User to review before relying on them.

11. Data location and international processing

Drum’s core production application, databases, caches and file storage are hosted in Sydney, Australia. Some Subprocessors process selected Customer Data outside Australia, as listed on the Subprocessors page. Where Drum discloses Personal Information outside Australia or New Zealand, Drum will take reasonable steps, including through its agreements with Subprocessors, to ensure the recipient protects it in a way that is substantially similar to Applicable Privacy Law.

12. Assistance with requests

The Services allow the Customer to access, correct, export and delete most Customer Data itself. Where the Customer cannot do so, Drum will provide reasonable assistance so the Customer can respond to requests from individuals to access or correct their Personal Information, and to enquiries or complaints from regulators about Customer Data.

If Drum receives such a request or enquiry directly, it will refer the person to the Customer, unless the law requires Drum to respond. Drum will tell the Customer about the request where the law permits.

13. Return and deletion

The Customer may export its Customer Data using the Services before its account is deleted. When an account is deleted, Drum deletes the active Customer Data as described in section 13 of the Terms. Limited copies may remain in backup or disaster-recovery systems until they are overwritten or expire in their normal cycle. Drum will continue to protect those copies under this Addendum until they are deleted.

14. Information and reviews

Drum will provide the information the Customer reasonably needs to show its own compliance with Applicable Privacy Law in relation to the Services. This includes responding to a reasonable security or privacy questionnaire once a year, or more often after a Security Incident or where a regulator requires it. Drum may decline to share information that would compromise the security of the Services or the confidentiality of other customers or Subprocessors. Information Drum provides under this section is Drum’s Confidential Information.

15. Duration, liability and changes

This Addendum applies for as long as Drum processes Customer Data, including after the Terms end, until that Customer Data is deleted as described in section 13.

Each party’s liability under this Addendum is subject to the limitations and exclusions in the Terms.

Drum may update this Addendum as the Services or the law change. We will publish the revised Addendum and update the date above. A change that materially reduces the protection of Customer Data will be made only with the notice required for material changes under section 19 of the Terms, unless the law requires it sooner.

16. Contact

Questions about this Addendum, and reports of suspected security issues, can be sent to support@getdrum.com. Please do not include passwords, API tokens or other secrets in email.