Data Processing Addendum
Last updated: October 25, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Calendar Force Pty Ltd (ABN 58 695 616 794) ("Calendar Force", "we") and the business that holds a Calendar Force account (the "Customer", "you"). It applies whenever we process personal data on your behalf in providing the service, and it takes effect automatically — there is nothing to sign. If you need a countersigned copy for your own records, email admin@calendarforce.com.
It is written to meet the requirements placed on a “service provider” or “processor” by the California Consumer Privacy Act and the other comprehensive United States state privacy laws, and on a recipient of personal information under the Australian Privacy Principles. Where a law gives you a right this DPA does not mention, that right is unaffected.
1. Definitions
- Customer Data means all data you, your staff or your connected agents put into the service, or that the service reads from your Google account on your instructions, including personal data about your clients, appointment attendees, staff and contacts.
- Account Data means data about you as our customer — your login, billing, settings and support history. We are the controller of Account Data and it is governed by our Privacy Policy, not this DPA.
- Personal data, personal information, controller, business, processor, service provider, sell and share have the meanings given by the privacy law that applies to the data in question.
- Subprocessor means a third party we engage to process Customer Data on our behalf.
- Data Protection Law means every law that applies to the processing of personal data under this DPA, including the Privacy Act 1988 (Cth) and the United States state privacy laws.
2. Roles
In relation to Customer Data, you are the controller or business and we are your processor or service provider. You decide what Customer Data is collected, from whom and for what purpose; you are responsible for having a lawful basis for it, for any notice or consent the people it concerns are owed, and for the accuracy of the instructions you give us. We process it only as this DPA and your instructions allow.
Where you connect your own AI assistant to the service, that assistant's vendor processes what you say to it under its own terms and is not our subprocessor. Where you send an invoice by email or a reminder by SMS, the recipient's email provider or mobile carrier receives it on your behalf as part of the delivery you asked for.
3. Details of Processing
- Subject matter and duration: the provision of the Calendar Force service to you for as long as you hold an account, plus the deletion periods in our Data Retention Policy.
- Nature and purpose: storing a working copy of the calendars you connect; scheduling and sending SMS reminders; generating invoices, credit notes and related documents in your Google Drive; for United States Customers who ask for it, calculating the sales tax shown on an invoice and preparing filing reports; matching photographs and remittances to jobs; operating the staff portal; logging and, where you ask, undoing the actions of agents you connect.
- Categories of data subjects: your clients and their representatives; people invited to your appointments; your staff and contractors; your suppliers and payers; you and the people who use your account.
- Categories of personal data: names; phone numbers and email addresses; appointment titles, times, locations and notes; service and job records; invoice, payment and credit-note data; job addresses and the tax jurisdictions they resolve to; exemption certificates recorded against a client, including the client's name and certificate number; photographs uploaded to your Drive and the references we hold to them; staff names, emails and the calendar events assigned to them.
- Sensitive data: the service is not designed for health, financial-account or government-identifier data about your clients. If your line of work puts such data into appointment notes or service records — as it may for care providers — you are responsible for the additional obligations that attach to it, and this DPA applies to it as to any other Customer Data.
4. Our Obligations
We will:
- Process Customer Data only on your documented instructions, which are the Terms of Service, this DPA, your settings in the service and the actions you and your authorised users take in it — and otherwise only where the law requires, in which case we will tell you first unless the law forbids it.
- Not sell or share Customer Data, not retain, use or disclose it for any purpose other than the business purpose of providing the service to you, not use it outside the direct business relationship between us, and not combine it with personal data we receive from any other source, except as Data Protection Law expressly permits a service provider to do.
- Not use Customer Data to train or improve any machine-learning or artificial-intelligence model.
- Keep it confidential. Access to Customer Data is limited to the people who need it to run the service, who are bound by confidentiality obligations. Human access to Google user data in particular is limited as set out in our Privacy Policy.
- Secure it with the measures in Annex 2, which we may update provided the overall level of protection does not fall.
- Help you respond to requests from people whose data we hold for you — to access, correct, delete or port it — using the export, edit and delete functions of the service, or by acting on your written instruction within 10 business days where a function does not exist. If such a request reaches us directly we will tell you within 5 business days and will not respond on our own account except to acknowledge it and point the person to you.
- Help you meet your own obligations under Data Protection Law, taking into account what we know and what the service does — including, where you reasonably ask, the information needed for a data protection or risk assessment.
- Tell you if we believe an instruction breaks the law, and tell you promptly if we determine we can no longer meet our obligations under this DPA, in which case you may direct us to stop and remedy any unauthorised use.
- Allow you to verify our compliance as set out in section 7.
5. Subprocessors
You authorise us to use the subprocessors listed in Annex 3. We impose on each of them, by contract, data protection obligations no less protective than this DPA, and we remain responsible to you for their performance.
We will publish any change to Annex 3 on this page and will give you at least 30 days' notice before a new subprocessor begins processing Customer Data, by email or through the service. If you object on reasonable data-protection grounds and we cannot resolve the objection, you may close your account before the change takes effect and we will refund your unused credit and token balance.
6. Security Incidents
If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Data, we will notify you without undue delay, and in any case within 72 hours of becoming aware of it, by email to the address on your account. The notice will describe what happened, the data and people likely affected, what we have done and recommend, and a point of contact, and we will update it as we learn more. We will cooperate with you in meeting your own notification obligations and will not name you in any notice to a regulator or the public without your consent unless the law requires it. Our own obligations under the Australian Notifiable Data Breaches scheme and United States state breach laws are described in our Privacy Policy.
7. Verification and Audit
On written request, no more than once a year unless a regulator requires it or an incident has occurred, we will answer a reasonable security questionnaire and provide the documentation we hold about our security measures and those of our subprocessors, including their third-party audit reports where they publish them. Where that is not enough to show compliance, you or an independent auditor bound by confidentiality may audit our processing of Customer Data on at least 30 days' notice, during business hours, in a way that does not disrupt the service or expose other customers' data, at your cost.
8. International Transfers
Customer Data is stored in the United States and accessed from Australia, and our subprocessors operate in the locations in Annex 3. For Australian Customers this is a disclosure of personal information to overseas recipients under Australian Privacy Principle 8, and we take the reasonable steps that principle requires — contractual commitments and the security measures in Annex 2 — to ensure the recipients handle it consistently with the Australian Privacy Principles. For United States Customers, the only transfer out of the United States is our own access from Australia, which is subject to this DPA.
9. Return and Deletion
Throughout the term you can export your data from the service, and the authoritative copies of your invoices, sheets and photographs live in your own Google account. On closure of your account we delete the Customer Data we hold within the periods in our Data Retention Policy — operational data within 90 days, Google tokens within 30 days, backups overwritten within a further 30 days — except for records we must keep by law, which stay subject to this DPA until they are deleted. If you want a final export, ask before you close the account.
10. Liability and Precedence
Each party's liability under this DPA is subject to the exclusions and limits in sections 15 to 18 of the Terms of Service, treated as a single aggregate cap. If this DPA conflicts with the Terms of Service on a data-protection matter, this DPA prevails. If a Data Protection Law requires a term this DPA does not contain, that term is taken to be included to the extent the law requires it. This DPA is governed by the law that governs the Terms of Service.
Annex 1 — Processing Summary
| Controller / business | The Customer |
|---|---|
| Processor / service provider | Calendar Force Pty Ltd, ABN 58 695 616 794, New South Wales, Australia |
| Purpose | Providing the Calendar Force service as described in section 3 |
| Duration | The life of the account plus the deletion periods in the Data Retention Policy |
| Frequency | Continuous while the account is active |
| Storage location | United States; accessed from Australia |
Annex 2 — Security Measures
- Encryption in transit (TLS) for every connection to the service and between the service and its subprocessors, with HSTS and modern security headers on both hosts.
- Encryption at rest for the database and backups; field-level AES-256-GCM encryption for banking details and Google access tokens, with the key held only in server configuration.
- Tenant isolation enforced in the database by row-level security on every table, so each account can reach only its own rows; verified by an automated two-tenant isolation test.
- Least-privilege Google access: only the Google permissions needed for the features you use, narrowed in September 2026; Drive access limited to files the service creates or you pick.
- Access control: Google sign-in only for customers (no passwords to leak); staff portal access scoped to the staff member's own calendar; agent tokens confined to the agent interface and refused everywhere else; administrative access limited to Calendar Force personnel with a need.
- Consent and suppression controls: SMS sends refused in code where required consent is not recorded; carrier opt-outs honoured across all accounts and not reversible by a customer.
- Audit logging of security-relevant and billing events, retained for investigation.
- Secure development: changes tested on an isolated development environment with synthetic data before release; dependency monitoring; periodic application security scanning and independent review.
- Backups taken by the database provider and overwritten on a 30-day cycle; restoration procedures documented.
- Incident response process with the notification commitments in section 6.
Annex 3 — Subprocessors
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage and scheduled jobs | All Customer Data held by the Service | United States (AWS us-west-2, Oregon) |
| Vercel Inc. | Application hosting, server-side functions and cookieless aggregate analytics | All Customer Data in transit through the application; aggregate page statistics | United States, with global edge delivery |
| Google LLC | Calendar, Drive, Sheets, Docs and Gmail APIs acting on the Customer's own Google account; Calendar Force's administrative mailbox for service email | Calendar events, documents and email the Customer directs the Service to read, create or send | Global, including the United States |
| Telnyx LLC | SMS delivery | Recipient phone number, message text, delivery status | United States, with regional carrier routing |
| Stripe, Inc. | Payment processing for the Customer's purchases from Calendar Force (Stripe acts as an independent controller for payment data) | Customer's name, email, billing address and payment instrument | United States, Australia and Ireland |
| United States Census Bureau | Public geocoding service used to match a job address to a sales tax jurisdiction (United States Customers with sales tax calculation switched on) | Street address of a job only; no name, phone number or appointment detail | United States |
Removed: OpenAI (optional plain-language reminder parsing) — the feature was withdrawn in September 2026 and no Customer Data has been sent to OpenAI since.
Contact
Questions about this DPA, subprocessor notices, data subject requests and security incidents all go to:
Calendar Force Pty Ltd — ABN 58 695 616 794