1.1 This Data Processing Addendum (“DPA”) is between VenueScan Pty Ltd ABN 34 686 356 329 (“VenueScan”, “we”, “us” or “our”) and the customer named in the Service Agreement (the “Customer”). It sets out how we handle Patron Data on the Customer's behalf.
1.2 This DPA forms part of the Service Agreement. If this DPA and the Service Agreement conflict on how Patron Data is handled, this DPA applies.
1.3 This DPA applies automatically to every Customer. It does not need to be separately signed.
1.4 Last updated 1 December 2026.
Terms defined in the Service Agreement have the same meaning here. In addition:
3.1 The Customer owns and controls Patron Data. We hold and process Patron Data only on the Customer's behalf.
3.2 The Customer is responsible for deciding what Patron Data to collect, having a lawful basis to collect it, telling patrons about the collection, and choosing retention periods that meet the laws that apply to its venue.
3.3 Each party will comply with Privacy Law in connection with Patron Data.
4.1 We process Patron Data only on the Customer's documented instructions. These are the Service Agreement, this DPA, the settings the Customer chooses in the Service, and written requests from the Customer's account administrators.
4.2 If we believe an instruction breaks Privacy Law, we will tell the Customer and do not have to follow that instruction.
5.1 We use a Customer's Patron Data only to provide the Service to that Customer.
5.2 We never sell Patron Data, use it for marketing or profiling, or use it to train machine learning or AI models.
5.3 We may count how the Service is used, such as the total number of sign-ins across all venues, and publish those totals. Published totals never identify a patron or Customer.
6.1 We never collect or store raw images of IDs. IDs are read on the terminal, and only the fields the Customer has chosen to collect are kept.
6.2 We do not store driver licence numbers or card numbers.
6.3 Any feature that uses biometric information, such as matching a selfie to the portrait on an ID, is off by default and only runs if the Customer turns it on. Biometric information is used only to provide that feature to that Customer.
6.4 Biometric information is sensitive information under Privacy Law. Before turning on a biometric feature, the Customer is responsible for obtaining any consent Privacy Law requires. On request, we will give the Customer the information it reasonably needs to assess the feature, such as for a privacy impact assessment.
7.1 Personnel do not access Patron Data. Our systems are designed and restricted so that Personnel can access Metadata only.
7.2 We provide support using Metadata. Where a support request involves Patron Data, the Customer's authorised users view or change it themselves through the Service.
7.3 Automated systems process Patron Data to run the Service, for example to sync, back up and delete it. Personnel do not view Patron Data while doing so.
7.4 Personnel may approve an export the Customer has requested. The export is generated by our systems and sent to the Customer's admin email address, and Personnel do not view its contents.
7.5 The only other exception is where the law requires us to disclose Patron Data, which is handled under clause 12.
7.6 All Personnel are bound by written confidentiality obligations that continue after they leave VenueScan.
7.7 Any other access to Patron Data by Personnel is a Security Incident and will be handled under clause 11.
8.1 We will protect Patron Data using technical and organisational measures appropriate to its sensitivity, including encrypting it at rest and in transit. Our current measures are described on our Security page.
8.2 We may update these measures over time, but we will never reduce the overall level of protection they provide.
9.1 Patron Data is stored in Sydney, Australia, on Amazon Web Services. We will never store Patron Data outside Australia.
9.2 The only time Patron Data is sent outside Australia is for address suggestions during QR code sign-in. As a patron types their address, the text they type is sent to Google in the United States, which returns matching addresses. The address the patron chooses is stored only in Australia.
9.3 We will not send Patron Data outside Australia for any other purpose except through the process in clause 10.
10.1 Our current Sub-processors are listed on our sub-processors list. The Customer authorises us to use them.
10.2 Each Sub-processor is bound by written terms that protect Patron Data at least as well as this DPA, and processes only the Patron Data it needs to provide its service to us. We remain responsible for our Sub-processors.
10.3 We will email the Customer's admin email address at least 30 days before adding or replacing a Sub-processor.
10.4 The Customer may object to a new Sub-processor on reasonable privacy or security grounds by writing to us within that 30 days. We will work with the Customer in good faith to address the objection. If we can't, the Customer may terminate the Service Agreement under clause 10.1 of the Service Agreement before the change takes effect.
11.1 We will notify the Customer without undue delay, and within 48 hours, of becoming aware of a Security Incident.
11.2 Our notice will include what we know at the time: what happened, the Patron Data and number of patrons affected, the likely consequences, and what we are doing about it. We will send updates as we learn more.
11.3 We will help the Customer assess whether the incident is an eligible data breach under the Notifiable Data Breaches scheme, and with any notifications to patrons or the Office of the Australian Information Commissioner.
11.4 We will not notify patrons or regulators about a Security Incident affecting the Customer's Patron Data without the Customer's agreement, unless the law requires us to.
11.5 Where a Security Incident is caused by our breach of this DPA, we will cover the reasonable costs of investigating it, notifying affected patrons and any regulator, and fixing the cause.
12.1 If police, a government agency or a regulator asks us for Patron Data, we will direct them to the Customer.
12.2 We will notify the Customer of the request promptly, unless the law prohibits us from doing so.
12.3 If the law requires us to disclose Patron Data, we will disclose only the minimum required, and we will challenge requests we reasonably believe are unlawful or too broad.
12.4 We will never disclose Patron Data voluntarily.
13.1 If a patron asks us to access, correct or delete their Patron Data, we will pass the request to the Customer within 2 Business Days and tell the patron we have done so. We will not respond to the request ourselves.
13.2 The Service lets the Customer's authorised users find, export, correct and delete an individual patron's records, so the Customer can respond to these requests itself.
14.1 The Customer sets retention periods in the Service. Patron Data is deleted automatically at the end of its retention period. Default periods are listed in our data collection reference.
14.2 Deleted Patron Data is removed from our backups within 7 days.
14.3 When the Service Agreement ends, the Customer can export its Patron Data as set out in clause 8.5 of the Service Agreement. We will then delete all Patron Data, including from backups, and email the Customer a written confirmation of deletion without needing to be asked.
15.1 The Customer's audit logs record changes across its venue, and are kept for 1 year.
15.2 Once every 12 months, or after a Security Incident, we will answer the Customer's reasonable security and privacy questionnaire within 20 Business Days.
15.3 On request, we will give the Customer any other information it reasonably needs to show that Patron Data is handled in line with this DPA and Privacy Law.
16.1 The exclusions for loss of data and regulatory fines or penalties in clause 12.2 of the Service Agreement do not apply to loss caused by our breach of this DPA.
16.2 Our total liability for breaches of this DPA is limited to the greater of $250,000 and 3 times the Fees paid by the Customer in the 12 months before the event giving rise to the claim. This limit is separate from, and in addition to, the limit in clause 12.1 of the Service Agreement.
17.1 We may update this DPA at any time to increase the protection it gives Patron Data.
17.2 Any other change needs the Customer's written agreement.
This DPA applies for as long as we hold any of the Customer's Patron Data, including after the Service Agreement ends.
Questions about this DPA can be sent to privacy@venuescan.com.au.