Airgentic Data Processing Addendum

Last updated: 27 September 2026

This Data Processing Addendum ("Addendum") is between Airgentic Pty Ltd (ABN 62 675 788 897) ("Airgentic") and the customer that accepts the Terms of Service ("Customer"). It applies to Customer Data, as defined in the Terms. It is the same addendum for every customer. A signed order or a signed data-processing agreement prevails over this page if they conflict.

1 Roles

When Airgentic handles chat, search, transcripts, and other content the Customer has asked Airgentic to host or index, Airgentic does so for the Customer. The Customer decides the purposes of that processing. Airgentic does not use that content for its own purposes.

Airgentic is responsible for its own records: the marketing website, sales enquiries, staff records, and Airgentic's own administrator accounts. Those records are described in the Privacy Policy. They are not Customer Data.

2 Instructions

Airgentic handles Customer Data to provide, secure, and support the Service, and as the Customer configures it. The Customer's settings for retention, deletion, and access are instructions for this Addendum.

The Customer is responsible for having a lawful basis to collect Personal Information that it, or its end users, submit to the Service, and for any collection notice those people require.

3 No training

Airgentic does not use Customer Data, queries, or transcripts to train or fine-tune Airgentic or Microsoft foundation models.

Airgentic may use statistics that do not identify the Customer, an end user, or any person, for the operation of the Service.

4 Location and sub-processors

Customer content on the platform is hosted in Microsoft Azure, Australia East (Sydney), unless the Customer has accepted another region. A region outside Australia East is recorded for that Customer.

Transfers of Customer Data. The tool depends on where the Customer is and where that Customer's service is hosted. Australia East is the only region offered today. A region that is not listed here will be added to this section before a Customer is offered it.

  • A Customer in the European Economic Area, with the service hosted in Australia East, is covered by the European Commission's standard contractual clauses for a controller-to-processor transfer. Those clauses are incorporated into this Addendum. Sections 4, 5, and 6 of this Addendum, and the platform sub-processors named in the Privacy Policy, are the description of the transfer.
  • A Customer in the United Kingdom, with the service hosted in Australia East, is covered by those clauses together with the United Kingdom International Data Transfer Addendum to them.
  • A Customer in the European Economic Area, with the service hosted in the United Kingdom, is covered by the European Commission's adequacy decision for the United Kingdom, while that decision remains in force.
  • A Customer in the United Kingdom, with the service hosted in the United Kingdom, keeps that hosting in the United Kingdom.

The platform sub-processors, and that default location, are named in the Privacy Policy under "Platform sub-processors". Airgentic will update that section before it adds a platform sub-processor, and will give the Customer notice of the change. The Customer may object to a new platform sub-processor by ending the subscription before the change takes effect.

5 Security

Airgentic maintains technical and organisational measures appropriate to the Service, including:

  • Access to Airgentic administration is through Microsoft Entra ID, with multi-factor authentication.
  • Connections to the Service use TLS. TLS 1.2 is the minimum. Application Gateway also offers TLS 1.3. TLS 1.0 and TLS 1.1 are disabled.
  • Azure file shares and Azure Key Vault are encrypted with AES-256.
  • Airgentic logs administrative access and security-relevant events, and keeps an incident-response process.

The Customer may ask Airgentic for a current description of these measures.

6 Retention and deletion

During the subscription, conversation content is kept for the period the Customer configures. Where the Customer asks Airgentic in writing to delete Customer Data, Airgentic will delete it from production systems within a reasonable time, except where Airgentic must keep it to comply with law.

After the subscription ends, Airgentic will make Customer Data available for download for 30 days, and will then delete it from production systems. Copies in backups are overwritten as those backups expire.

7 Incidents

If Airgentic becomes aware that Customer Data may have been exposed to an unauthorised person, it will tell the Customer promptly. The parties may agree a different notice period in a signed order.

Where the Notifiable Data Breaches scheme applies to Airgentic, Airgentic will also meet that scheme. Where the GDPR requires Airgentic to notify a regulator about its own records, Airgentic will do so within the time that law requires.

8 Contact

Airgentic Pty Ltd

Email: contact@airgentic.com

© 2026 Airgentic Pty Ltd. All rights reserved.