Data Processing Addendum

Effective date: 1 September 2026 Version: 1.3

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Mango Dog Pty Ltd (ACN 628 425 481), an Australian company ("Processor", "Mango Dog"), and the customer that has accepted those Terms ("Controller", "Customer"). It applies whenever, in providing the Mango Receptionist service ("Service"), Mango Dog processes Personal Data on behalf of the Customer in respect of which the Customer is the controller.

This DPA is intended to satisfy:

• Article 28 of the EU General Data Protection Regulation (2016/679) ("EU GDPR") and the UK GDPR;
• the Standard Contractual Clauses approved by the European Commission in Decision 2021/914 ("EU SCCs") for transfers from the EU to third countries;
• the UK International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner ("UK IDTA");
• the cross-border disclosure principles in APP 8 of the Privacy Act 1988 (Cth).

By accepting the Terms of Service the Customer accepts this DPA. Customers who require a counter-signed copy may request one from privacy@mangoreceptionist.com.

1. Definitions

Terms not defined here have the meanings given in the EU GDPR. In particular:

• "Personal Data" means any information relating to an identified or identifiable natural person processed by Mango Dog on behalf of the Customer in connection with the Service.
• "Data Subject" means the natural person to whom Personal Data relates.
• "Processing", "Controller", "Processor", "Sub-processor", "Personal Data Breach", and "Supervisory Authority" each have the meanings given in the EU GDPR.
• "Restricted Transfer" means a transfer of Personal Data from a Data Subject in the EU, the EEA, the UK, or Switzerland to a recipient in a country not the subject of an adequacy decision.
• "Service Terms" means the Terms of Service published at https://mangoreceptionist.com/terms.

2. Roles, subject matter, duration

3. Customer instructions

Mango Dog will process Personal Data only on documented instructions from the Customer, as set out in the Service Terms, the configuration the Customer makes in the client console, the script and Aimee Instructions the Customer provides, and the content the Customer uploads or emails to Aimee.

The Service Terms (including this DPA) are the Customer's complete and final instructions on processing for the duration of the engagement. Additional or alternative instructions must be agreed in writing.

Mango Dog will tell the Customer if an instruction infringes the EU GDPR, the UK GDPR, or another applicable data protection law.

4. Confidentiality of personnel

Mango Dog will ensure that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations.

5. Security measures

Mango Dog will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing, including:

• encryption in transit (TLS 1.2+) and at rest;
• per-tenant isolation of the knowledge base;
• access controls, the principle of least privilege, and multi-factor authentication for administrative access;
• secret management, dependency scanning, and patching;
• network segmentation, logging, and security monitoring;
• provider-managed backup and recovery controls where configured;
• a documented incident response process;
• staff training in privacy and security;
• secure software development practices, including code review and dependency review.

A current summary of security measures is available at https://mangoreceptionist.com/security or on request.

6. Sub-processors

6.1 Authorisation

The Customer authorises Mango Dog to engage sub-processors. The current sub-processor list as at the effective date is:

We publish the authoritative list at https://mangoreceptionist.com/legal/dpa#sub-processors and keep it current.

6.2 Notice of changes

Mango Dog will give the Customer at least 30 days' written notice (including by email to the registered address and a banner in the client console) before adding or replacing a sub-processor.

6.3 Customer objection

If the Customer has a reasonable objection to a new sub-processor on data-protection grounds, the Customer may notify Mango Dog in writing within the 30-day notice window. Mango Dog will work with the Customer to resolve the objection, including (where reasonable) by offering an alternative configuration. If the parties cannot resolve the objection, the Customer may terminate the part of the Service that requires the new sub-processor by written notice within 30 days of the objection, and Mango Dog will refund any pre-paid fees for unused service.

6.4 Sub-processor obligations

Mango Dog will impose on each sub-processor data protection obligations no less protective than those in this DPA, and remains liable to the Customer for the acts and omissions of its sub-processors.

7. Data Subject requests

Mango Dog will, where reasonably possible:

• promptly notify the Customer if it receives a request from a Data Subject to exercise their rights under the GDPR (access, rectification, erasure, restriction, portability, objection, automated decisions);
• not respond to the request directly except on the Customer's instruction or to confirm we are processor for the Customer;
• provide reasonable assistance to enable the Customer to respond.

If a request relates to a Customer's tenant, we route it to that Customer.

8. Personal Data Breach

Mango Dog will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA. The notification will contain (as far as we then know):

• the nature of the breach, including categories and approximate number of Data Subjects and records concerned;
• likely consequences;
• measures taken or proposed to address the breach and mitigate its effects;
• a contact point.

Mango Dog will cooperate with the Customer in any required notification to a Supervisory Authority or Data Subjects.

9. Audits

Mango Dog will make available to the Customer all information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, on the following terms:

• on at least 30 days' written notice;
• not more than once per 12-month period (except for audits required by a Supervisory Authority or following a confirmed Personal Data Breach);
• subject to confidentiality and to a scope that is proportionate to the risk;
• carried out by the Customer or a qualified independent auditor agreed in writing, at the Customer's cost (except where the audit identifies a material breach by Mango Dog, in which case Mango Dog will bear reasonable costs);
• without unreasonable disruption to the Service or other Customers.

Mango Dog may satisfy audit requests by providing recent third-party audit reports (e.g. SOC 2, ISO 27001) when available.

10. Return or deletion of Personal Data

On expiry or termination of the Service Terms, Mango Dog will, at the Customer's choice:

• return all Personal Data to the Customer in a structured, commonly used, machine-readable format; or
• delete all Personal Data and copies, except where retention is required by law.

The default behaviour, if the Customer does not give a choice within 30 days of termination, is deletion in accordance with the retention schedule in our Privacy Policy.

11. International transfers — EU and UK

11.1 EU SCCs

The EU SCCs (Decision 2021/914) are incorporated into this DPA by reference for any Restricted Transfer from the EU/EEA to a country not the subject of an adequacy decision. The following modules apply:

• Module Two (controller to processor) where the Customer is a controller in the EEA transferring Personal Data to Mango Dog as a processor.
• Module Three (processor to processor) where the Customer is itself a processor and Mango Dog acts as a sub-processor.

Where the EU SCCs apply:

• the data exporter is the Customer;
• the data importer is Mango Dog;
• the optional docking clause in Clause 7 applies;
• in Clause 9, option 2 (general written authorisation) applies, with the time period in §6.2 above;
• in Clause 11, the optional language is not elected;
• in Clause 17, the governing law is the law of Ireland;
• in Clause 18, the courts of Ireland have jurisdiction;
• the description of the transfer (Annex I.B), the competent supervisory authority (Annex I.C), the technical and organisational measures (Annex II), and the list of sub-processors (Annex III) are completed by reference to this DPA and the Privacy Policy.

11.2 UK IDTA

For Restricted Transfers from the UK, the UK International Data Transfer Addendum to the EU SCCs (version A1.0) is incorporated into this DPA by reference, with the parties, transfer details, and technical/organisational measures completed by reference to this DPA.

11.3 Swiss transfers

For transfers subject to Swiss data protection law, references in the EU SCCs to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

11.4 Supplementary measures

The parties acknowledge the Court of Justice of the EU decision in Schrems II. Mango Dog has implemented supplementary technical and organisational measures including encryption in transit and at rest, access controls, audit logging, and challenge of government access requests where lawful. A description is available on request.

12. Liability

Each party's liability under this DPA is subject to the liability provisions in the Service Terms. Nothing in this DPA limits or affects a Data Subject's rights under the EU GDPR or the UK GDPR.

13. Order of precedence

If there is a conflict between this DPA and the Service Terms, this DPA prevails on data-protection matters. If there is a conflict between this DPA and the EU SCCs or UK IDTA, those clauses prevail to the extent of the conflict.

14. Changes

We may amend this DPA from time to time. Material changes will be notified at least 30 days before they take effect. Continued use of the Service after the effective date of an amendment constitutes acceptance.

15. EU/EEA and UK service availability

Mango Dog is established in Australia. Before Mango Dog offers a Service configuration to a Customer established in the EU/EEA or UK where Article 27 GDPR or UK GDPR requires a representative, Mango Dog will appoint the required representative and publish its name and contact details in the applicable privacy notice. Until then, Mango Dog does not make that configuration available for that Customer's production use. This does not prevent a Customer from independently obtaining legal advice about whether the DPA, SCCs, UK Addendum, or another transfer mechanism is appropriate for its circumstances.

16. Contact

Mango Dog Pty Ltd
ACN 628 425 481
Australia
Privacy: privacy@mangoreceptionist.com
Legal: legal@mangoreceptionist.com