Confidentiality Deed

CONFIDENTIALITY DEED


PARTIES: This deed is made by ARTHUR REED PHOTOS PTY. LTD.

OF 148 - 154 MARSHALLTOWN ROAD GROVEDALE 3216

('Photographer') in favour of the person acting as Principal of

this School ('School')


RECITALS: The Principal has authorised the Photographer to take photographs
of Students who attend the School ('Students').


1. INTERPRETATION

The following words have these meanings in this deed unless the contrary intention
appears.

Approved Person means an employee or sub-contractor of the Photographer
who needs access to Confidential Information and Photographs for Approved
Purposes.

Approved Purposes means the production of photographs of the Students for
any purposes authorised by the Principal.

Confidential Information means Information which is or has been -
(a) disclosed by or on behalf of the Principal or the School to the
Photographer, whether orally, electronically, in writing or otherwise; or
(b) otherwise obtained by the Photographer from the Principal or the School,

and includes information pertaining to any aspect of the School known to the
Photographer but does not include any such Information which the Photographer
can establish is in the public domain, otherwise than through a disclosure in
breach of this deed by the Photographer or an Approved Person or any person to
whom the Photographer has disclosed Confidential Information.

Confidential Information and Photographs means the Confidential Information
and the Photographs or any part of them.

Parents means the parents including any other legal guardian of a Student.

Photographs means photographs of any of the Students or any photograph in
which a student appears including without limitation any negatives, reproductions,
frames, mounts, captions or other accessories or aspects of a photograph.



2. CONFIDENTIALITY

General obligation of confidence

2.1 The Photographer acknowledges that the Confidential Information and
Photographs are valuable to the Principal and undertakes to -

(a) keep the Confidential Information and Photographs confidential and
secret; and

(b) take all steps and do all things that are reasonably necessary or prudent
or desirable to protect and preserve the confidential nature and secrecy
of the Confidential Information and Photographs.

Disclosure to Parents

2.2 A Photographer may disclose -

(a) Confidential Information and Photographs pertaining to a Student to the
Parents of that Student, and

(b) a Photograph in which more than one Student appears, to the Parents of
any of those Students.

Particular obligations

2.3 The Photographer -

(a) may only use or reproduce Confidential Information and Photographs for
Approved Purposes;

(b) must not disclose or permit disclosure of Confidential Information and
Photographs to any person except as permitted by this deed;

(c) must take all reasonable steps to -

(i) ensure that the only persons to whom Confidential Information and
Photographs are disclosed are Approved Persons or Parents;

(ii) ensure that Approved Persons (whether or not still employed or
engaged in that capacity) do not do or omit to do anything which, if done or
omitted to be done by the Photographer, would be a breach of the Photographer’s
obligations under this deed; and

(iii) enforce the confidentiality obligations of the Photographer
imposed or required to be imposed by this deed;

(d) must not permit persons, except where authorised under this deed, to
have access to the Confidential Information and Photographs, and must
not, without the prior written consent of the Principal, provide any
Confidential Information or Photographs to any person not authorised
under this deed;


(e) must co-operate with the Principal in any action which the Principal may
take to protect the confidentiality of the Confidential Information and
Photographs; and

(f) must not use any of the Confidential Information and Photographs in a
manner which may prejudice the Principal or the School in any way.

Disclosures required by law

2.4 A Photographer may disclose Confidential Information and Photographs -

(a) to the extent required by law including court order or by a lawful
requirement or any government or governmental body, authority or agency
having authority over the Photographer; or

(b) if required in connection with legal proceedings;

but in each case, subject to the Photographer giving the Principal sufficient
notice of any proposed disclosure to enable the Principal or any other person
to seek a protective order or other remedy to prevent the disclosure.

Survival of obligations of confidentiality

2.5 The obligations of confidentiality imposed by this deed survive the termination of
this deed and the completion of the Approved Purposes.


3. RETURN OF CONFIDENTIAL INFORMATION AND PHOTOGRAPHS

Withdrawal

3.1 If the Photographer has completed, or determines that it does not wish to
proceed further with the carrying out of, the Approved Purposes, it will promptly
advise the Principal of that fact.

Delivery

3.2 If the Photographer -

(a) determines that it does not wish to proceed further with the carrying out of
the Approved Purposes; or

(b) sells its business used for the photographic services,

the Photographer shall deliver to the Principal (or, with the Principal’s prior consent, destroy or erase)
all the Confidential Information and Photographs ithe possession, power or control of
the Photographer or an Approved Person.

No Release

3.3 Return, destruction or erasure of the Confidential Information and Photographs
under clause 3.2 does not release the Photographer from its obligations under
this deed.

4. INDEMNITY AND MANDATORY DISCLOSURE

Mandatory Disclosure

The Photographer must -

(a) notify the Principal immediately if it becomes aware of a suspected or actual
breach of this deed by any Approved Person;

(b) discuss with the Principal in good faith what action it should take, including
diligently prosecuting at the Photographer’s cost, any breach or threatened
breach of such confidentiality obligations by an Approved Person to whom the
Photographer has disclosed Confidential Information and Photographs; and

(c) take all reasonable steps, at its own expense, required to prevent or stop the
suspected or actual breach by any Approved Person.


5. MISCELLANEOUS

No merger

5.1 The warranties, undertakings and obligations in this deed do not merge on
completion of the Approved Purposes.

Governing Law

5.2 This deed and the transactions contemplated by this deed are governed by
the law in force in the State of Victoria.

---

THE COMMON SEAL of ARTHUR REED PHOTOS PTY. LTD.
A.C.N. 006 302 110 was affixed on January 1st, 2019





In accordance with its articles of
association in the presence of:

---

Data protection

GDPR – General Data Protection Regulation
 
Introduction

GDPR – General Data Protection regulations which came into force on 25 May 2018 in the EU and applies to all businesses doing business in or with a person in the EU. 

Although the GDPR is not required in Australia, we have taken precautions as per the requirements of the intended law into account while creating of our web service, and have adopted the GDPR requirements as our interim best practice.


Our software partner Netlife AS (org nr.983 501 605) are to be considered as a processor and are responsible for processing personal data on behalf of Arthur Reed Photos as a controller. Development of the platform is always be based on the ‘data protection by design and by default” principle. The controller determines the purposes and means of processing personal data.
 
The GDPR includes the following rights for individuals and you will find information on how the software platform is compliant with these rights below:   

• the right to be informed;  
• the right of access;  
• the right to rectification;  
• the right to erasure;  
• the right to restrict processing;  
• the right to data portability;  
• the right to object; 
• and the right not to be subject to automated decision-making including profiling:

The right to be informed
 
Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the GDPR.
 
In our privacy policy we inform about the purposes for processing personal data, the retention periods for that personal data, and who it will be shared with. 

Our privacy policy is always visual in the webshop both as short link in the footer and also as a popp-up together with the coockie warning.
 


The right of access
 
Individuals have the right to access their personal data and supplementary information.
The right of access allows individuals to be aware of and verify the lawfulness of the processing.
 
In the users "my account" section in the webshop, the user can easilly downloade a .zip file containing a full copy of all data we hold on them.
 

 
The right to rectification 
 
Under Article 16 of the GDPR individuals have the right to have inaccurate personal data rectified. An individual may also be able to have incomplete personal data completed
 
The user can at any time get access to - and edit their info in the “my account” section. 



The right to erasure/be forgotten
 
Under Article 17 of the GDPR individuals have the right to have personal data erased. This is also known as the ‘right to be forgotten’. 
 
The user will at any time get access to the “delete me” feature in the “my account” section in the webshop. If they press this button, their user account will be “frozen” and inactivated. If they regret, they can reactivate their account within 30 days. After 30 days the user account and all data stored on their account will be erased. 



The right to restrict processing  
 
Article 18 of the GDPR gives individuals the right to restrict the processing of their personal data in certain circumstances. This means that an individual can limit the way that an organization uses their data. This is an alternative to requesting the erasure of their data.
 
In the users “my account” they can select to stop all reminder on both desktop and mobile.



The right to data portability  
 
The right to data portability gives individuals the right to receive personal data they have provided to a controller in a structured, commonly used and machine-readable format. It also gives them the right to request that a controller transmits this data directly to another controller.
 
The content in the .zip file downloaded with data stored can be sent to the third party. But since we have the copyright to the pictures, we are not committed to transfer these to a new controller.



The right to object 
 
Individuals have the right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling); direct marketing (including profiling); andprocessing for purposes of scientific/historical research and statistics. 

The user need to activly opt-in to receive communication related to pure marketing of services when they create an account. In the users “my account” they can select to stop all reminder and preventing us from contact them with sales related communication. Communciation related to gallery access, including reminders is not considered as marketing.


 
Cookie warning
 
We will display a warning in the webpage footer regarding the use of cookies, where the user needs to accept before continuing to register an account. Users can at any time read more about how the cookies are used on a dedicated system webpage with a direct link in the webshop footer. 

Server security

Information regarding server security provided by our software partner Netlife AS (org. nr 983 501 605).

To get a fully controlled and monitored environment, and to provide the uptime and the reliability necessary for the service, Netlife have built their own dedicated server rack, where all data is stored. They do not use cloud based storage based on third party suppliers like Amazon.

 
"Netlife store all data in a server center which is located in a massive u-boat bunker. This bunker is also used by other national and international telcos and also the national archive. Access to the bunker is secured with 24-hour manned security, biometric access & intruder alarms. We have electronic access control systems with per-rack resolution and camera monitoring. The servers are also protected with automatic non-destructive fire suppression. The data center has currently a Tier 2-3 certification.
 
A highly over-dimensioned power supply with high-quality redundant UPS systems and diesel generators, will together protect against any data crash due to loss of power. 
 
As an additional protective layer against data loss and disasters, Netlife store an additional copy of all data in a different safe location."