Last updated: 29 September 2026
This Data Processing Addendum forms part of the Crittiks Terms of Service between Crittiks Group Pty Ltd (ABN 55 654 097 784) (“Processor”) and the customer entering into a Crittiks subscription (“Controller”), and applies to Crittiks’ processing of personal data on the Controller’s behalf and instructions, including personal data subject to the GDPR and UK GDPR.
1. Subject matter and duration
Crittiks processes personal data submitted by the Controller into the Crittiks platform (“Customer Data”) for the duration of the Controller’s subscription, and for the export/deletion periods described in the Terms of Service and Privacy Policy.
2. Nature and purpose of processing
Crittiks processes Customer Data to provide the Crittiks platform as instructed by the Controller — including hosting, storage, display, backup, and the specific features the Controller activates (CRM, e-signature, project management, invoicing, communications, and AI-assisted features).
3. Categories of data subjects and personal data
Data subjects may include the Controller’s employees, contacts, clients, and other individuals whose personal data the Controller stores in Crittiks. Categories of personal data may include names, contact details, communications content, financial and billing details, and electronic signature audit data, as described in the Privacy Policy.
4. Processor obligations
Crittiks will: - process Customer Data only on the Controller’s documented instructions, including as set out in the Terms of Service; - ensure personnel authorised to process Customer Data are subject to confidentiality obligations; - implement the technical and organisational security measures described in the Crittiks Security Policy; - assist the Controller, where reasonably possible, in responding to data subject rights requests and in meeting its own GDPR/UK GDPR obligations, including data protection impact assessments where relevant; - notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Data; - make available information reasonably necessary to demonstrate compliance with this Addendum, and allow for audits, subject to reasonable notice and confidentiality; - delete or return Customer Data at the end of the subscription, as described in the Terms of Service, except where retention is required by law.
5. Sub-processing
The Controller authorises Crittiks to engage the sub-processors listed in the Crittiks Sub-processors document to process Customer Data. Crittiks will impose data protection terms on sub-processors no less protective than this Addendum, and will notify the Controller at least 14 days before adding a new sub-processor that will process personal data, giving the Controller the opportunity to object.
6. International transfers
Where Customer Data originating in the EU or UK is transferred to a sub-processor or Crittiks infrastructure located outside the EU/UK (including India, Singapore, the United States, and Japan, as listed in the Sub-processors document), the transfer is made under the European Commission’s Standard Contractual Clauses (Module 2: Controller to Processor) or, for UK transfers, the UK International Data Transfer Addendum to those Clauses, incorporated by reference into this Addendum. [ASH/LAWYER: the actual SCC/IDTA module text must be attached as an exhibit to this Addendum, and executed with each relevant sub-processor, for this clause to reflect a completed legal mechanism rather than a stated intention.]
7. Assistance with data subject requests
Where Crittiks receives a request directly from a data subject relating to Customer Data, Crittiks will, where possible, redirect the individual to the Controller and provide reasonable assistance to help the Controller respond.
8. Liability
Liability under this Addendum is subject to the limitations set out in Section 13 of the Crittiks Terms of Service.
9. Term
This Addendum takes effect on the date the Controller’s Crittiks subscription commences and remains in effect for as long as Crittiks processes Customer Data on the Controller’s behalf.
To execute this DPA for your workspace, contact support@crittiks.com with your workspace name and business details, so the SCC/IDTA annex relevant to your data flows can be attached and countersigned.
Contact: support@crittiks.com