LEGAL
The data-protection terms that apply when CleaningCentral processes personal data for a customer workspace.
Effective date: 2 November 2026 · HOSTAL PTY LTD · ABN 58 693 993 501 · contact@cleaningcentral.netThis Data Processing Addendum (“DPA”) forms part of the agreement where CleaningCentral processes personal data in customer content on the Customer’s behalf. The Customer is the controller or business and CleaningCentral is the processor or service provider, except where each party independently determines its own purpose as described in the Privacy Policy.
Subject matter: operating and supporting the subscribed CleaningCentral workspace and authorised connections. Duration: the trial or paid term plus the documented return, deletion and legal-retention period. Nature: collection, storage, organisation, retrieval, transmission, backup, security, support and deletion on documented instructions.
Data subjects may include the Customer’s prospects, clients, staff, contractors, suppliers, authorised users and other people whose information the Customer lawfully places in the service. Data may include contact, property, service, communication, quote, booking, invoice, payment-status, workforce, timesheet, job evidence, consent and technical records. Protected modules may hold additional employment, financial or funded-service information.
CleaningCentral will process customer personal data only on documented instructions in the agreement, product configuration, authorised support request or connected workflow, unless law requires otherwise. We will inform the Customer if an instruction appears to violate applicable data-protection law, unless prohibited. The Customer is responsible for lawful instructions, notices, legal bases, data minimisation and accuracy.
Personnel and contractors with access to customer personal data are bound by confidentiality and receive access only as needed for their duties. CleaningCentral maintains role-based and workspace-scoped access controls appropriate to the service.
CleaningCentral maintains technical and organisational measures appropriate to risk, including access control, supported encryption, credential protection, audit records, secure development and release practices, backups, incident procedures and tenant-isolation checks. The Customer must configure user roles, secure its endpoints and credentials, and use protected fields for sensitive information.
The Customer gives general authorisation for the subprocessors listed in the current Subprocessor Notice. CleaningCentral remains responsible for imposing data-protection obligations appropriate to the services performed. We will provide notice of a material new subprocessor where required and allow a reasonable documented objection based on data-protection grounds. If the parties cannot resolve a valid objection, the affected feature may be disabled or the Customer may terminate the affected service.
CleaningCentral will use a lawful transfer mechanism where GDPR or UK GDPR restricts a transfer. Where applicable and not replaced by another valid mechanism, the 2021 EU Standard Contractual Clauses for controller-to-processor transfers are incorporated, with the Customer as exporter and CleaningCentral as importer, and the UK International Data Transfer Addendum applies to restricted UK transfers. The agreement and this DPA provide the annex information, supplemented by the order and Subprocessor Notice.
For New Zealand disclosures, the parties will apply Privacy Principle 12 safeguards. Australian overseas-disclosure obligations remain applicable where required.
Taking account of the nature of processing, CleaningCentral will provide reasonable assistance for access, correction, deletion, restriction, objection, portability or opt-out requests that concern customer content. If a person contacts us about customer-controlled data, we may refer the request to the Customer. The Customer remains responsible for the response.
CleaningCentral will notify the Customer without undue delay after confirming a personal-data breach affecting customer content and will provide available information reasonably needed for the Customer’s assessment and notification duties. Notification is not an admission of fault. The Customer is responsible for notices arising from its own systems, users or instructions.
CleaningCentral will provide reasonable information needed for the Customer’s data-protection impact assessment or regulator consultation where the request relates to the service and information is not otherwise available. Additional work may be charged at an agreed rate unless required because of CleaningCentral’s breach.
At the end of the service, CleaningCentral will delete or return customer personal data according to the agreement, available export tools and displayed deletion schedule, unless law requires retention. Protected backups are isolated from ordinary use and expire under backup schedules.
CleaningCentral will make available reasonable compliance information and may provide independent reports or questionnaires when available. If that is insufficient, the Customer may request a proportionate audit no more than once annually, or after a material incident, subject to confidentiality, security, non-disruption and reasonable cost arrangements. Audits cannot expose another customer’s information.
Where US state privacy law applies, CleaningCentral will not sell or share customer personal information, retain, use or disclose it outside the business purposes in the agreement, or combine it with unrelated personal information except as legally permitted. CleaningCentral will notify the Customer if it can no longer meet an applicable service-provider obligation and will allow reasonable steps to stop and remediate unauthorised use.