Our data sovereignty and privacy guide

This guide distinguishes published service statements from the General Terms and Conditions v3.6. Confirm the terms incorporated into your own Service Agreement, including any later version or agreed variation.

Key facts

Our data sovereignty and residency statement

Our published residency statement describes the following position. Confirm its application to each service and any overseas processing or access before relying on an Australian-only commitment:

we ensure that customer data is stored and processed within Australian-based data centres, providing strong data residency guarantees aligned to Australian regulatory expectations. Customer data remains subject to Australian legal jurisdiction, with governance controls implemented to minimise exposure to foreign access. Administrative access is strictly controlled through role-based permissions, multi-factor authentication, and comprehensive audit logging. Cross-border data transfers do not occur by default and are only enabled where contractually agreed, supported by encryption, contractual safeguards, and vendor risk assessments. Our approach aligns with the Australian Privacy Act, ISO 27001, and industry regulatory requirements, enabling customers to meet their compliance obligations while maintaining control and transparency over their data.

Three limits of the statement should be understood. It names no data centre operator, city or facility. It does not distinguish between emPOWER services (cloud, DRaaS, co-location, voice, unified communications, mobile), which may run on different infrastructure. And it describes foreign access as minimised, not eliminated, and does not address support or administrative access performed from outside Australia, which is relevant because we describe follow-the-sun support from teams in the United States and United Kingdom.

Service-specific residency statements exist for some services. The emPOWER Backup for Microsoft Entra ID identity data is "stored securely within Australia" on our private cloud, and the SaaS Backup page carries the same position. Where a workload is placed is a design decision recorded in the Service Order.

The contractual position on overseas transfer (clause 18.3)

Clause 18.3 of the General Terms and Conditions v3.6 begins with a general prohibition: neither party may transfer or disclose Personal Information to a recipient outside Australia or the country of first collection (the Relevant Countries), or let anyone outside those countries access it, without the other party's prior written consent. It then continues, verbatim, "except that Customer gives blueAPACHE consent to transfer Customer's Personal Information to":

• the US;
• any EU Member State;
• the UK;
• any country where we or our contractors are currently providing the Services from;
• any other country set out in our privacy policy,

"where it is necessary or convenient to do so for blueAPACHE to meet its obligations to provide the Services under the Service Agreement."

Reconciling the two positions: the residency statement's "only enabled where contractually agreed" is consistent with clause 18.3 only if the standing consent in the general terms counts as the contractual agreement. A buyer who needs an Australian-only commitment for all Customer Data, or a per-transfer approval right, should write it onto the Service Order, which prevails over the general terms.

Privacy obligations (clause 18)

Each party must comply with the Privacy Act 1988 (Cth) "as though it were bound by the Privacy Act", and with the other party's written privacy policies and reasonable directions. Personal Information may be collected, used and disclosed only for performing the agreement and its administration (invoicing, contract management, risk management, insurance, renewals, support), disclosed only to personnel on a need-to-know basis, as required by law, or with consent, and any recipient must handle it consistently with the agreement.

The customer gives two warranties in clause 18.6: that it has obtained express informed consent from each individual whose Personal Information we will receive, covering use as contemplated by the agreement and our privacy policy "including a transfer overseas to the countries stated in the privacy policy"; and that it "will not provide blueAPACHE with, nor request that blueAPACHE processes any, personal data that is subject to the General Data Protection Regulation (EU) 2016/679". Determine whether EU GDPR or UK data-protection law applies to the actual processing; a person's citizenship alone does not establish that scope. Resolve the clause 18.6 warranty and any necessary contractual arrangements before supplying data subject to EU GDPR.

Eligible data breach notification (clause 18.4)

Where an eligible data breach (as defined in the Privacy Act) involves Personal Information provided by the other party, the party that suffered the breach must notify the other "immediately, and in any event within 24 hours of the discovery", supplying all information required for an OAIC or individual notification; cooperate with any investigation or audit including access to locations, personnel, processes and systems; and not disclose the breach to any third party, "including the Information Commissioner", without the non-breaching party's prior written approval, unless the non-breaching party fails to make a legally required notification and the breaching party is required by law to make it. The contractual clock runs from discovery of the eligible data breach, and the duty is mutual within that stated scope. Contractual coordination does not remove statutory reporting duties or permit a missed legal deadline. Confirm the reporting responsibilities and the narrow contractual disclosure exception alongside applicable law.

Information security (clause 17) and the ISMS

Clause 17 gives the contractual security duties: reasonable steps against unauthorised access to Customer Records or Customer Data, practices to protect Customer Records against loss, corruption and deletion, the security features in the relevant Schedule, provision of Customer Records within 10 Business Days of request, no use of Customer Data for marketing or profiling, and no encumbrances. These sit alongside, and are distinct from, the ISO/IEC 27001:2022 certificate 202507-118, which certifies our management system rather than creating customer rights. See ISO 27001 certification.

APRA regulated customers (clause 10)

Where the customer is an APRA regulated entity and the Services are a material business activity under Prudential Standard CPS 231, the customer warrants it has complied with APRA's requirements in choosing and appointing blueAPACHE and will meet its ongoing review, monitoring, renewal, change management, risk management, resourcing and governance obligations. It must notify us if APRA varies CPS 231 or adds a standard, and we may charge for the resulting changes. On an APRA Request, we will promptly notify the customer, comply within APRA's statutory authority, and not disclose or advertise an APRA audit except as required to coordinate with other APRA-regulated institutions that are also service customers.

Where the customer falls within clause 10 and requires a business continuity plan under clause 15, clause 10.4 requires that plan, at minimum, to describe activities to minimise interruption, how it integrates with the customer's plan, trigger events, roles and responsibilities, disaster procedures to protect Customer Data and restore Services, the communication plan, restoration timeframes, our alternative site if applicable, the testing process and the review process. It must be reviewed and updated when the customer notifies us of an update to its own plan, and tested jointly every 6 months or when reasonably requested, with results supplied within 7 days of the end of the test. The customer may also require a joint technical review covering performance, capacity, security, availability and recoverability, risk assessment, change management, the RACI, incident management including root cause, continuity and backup arrangements, and documentation. Clauses 10.5 and 10.7 allocate the costs of the clause 10.4 BCP work and clause 10.6 review respectively to the customer, at the specified Time and Materials Rates or our then-current rates, as Professional Services. The terms reference CPS 231; APRA has since consolidated its outsourcing requirements under CPS 230, and the terms place the notification duty on the customer.

Related

• ISO 27001 certification
• Terms and conditions guide
• Support and service levels
• Privacy Policy
• Service Agreement
• Financial Services industry
• Government and Public Sector industry
• Healthcare and Aged Care industry
• Private and Public SaaS Backup

Do you keep customer data in Australia?

Our published residency statement describes Australian storage and processing, and the Entra ID and SaaS Backup pages specifically describe Australian storage. Confirm the particular service, facilities, backups, support access and third-party processing in your agreement. Clause 18.3's overseas-transfer consent means the general statement alone is not an Australian-only commitment for every workload.

Then what does clause 18.3 allow?

It records a standing customer consent for us to transfer Personal Information to the US, any EU Member State, the UK, any country where we or our contractors provide the Services from, and any country in our privacy policy, where necessary or convenient to provide the Services. It restricts Personal Information only, not all Customer Data.

How do I get a binding Australian-only commitment?

Write it onto the Service Order, which prevails over the General Terms and Conditions. Specify whether it covers all Customer Data or Personal Information only, whether support access from overseas is permitted, and whether subcontractor changes require notice.

Can I use blueAPACHE for EU or UK personal data?

The customer warrants under clause 18.6 that it will not provide, or ask us to process, personal data subject to the GDPR. Assess which law applies to the actual processing; EU GDPR and UK data-protection law are distinct, and citizenship alone does not determine applicability. Resolve the warranty and any required arrangements before supplying EU-GDPR-regulated data.

What must happen after a data breach?

For an eligible data breach involving Personal Information provided by the other party, clause 18.4 requires immediate notice to that party and in any event within 24 hours of discovery of the eligible breach, with information required for OAIC and/or affected-individual notification. It also requires cooperation. Third-party disclosure requires prior written approval unless the non-breaching party fails to make a legally required notification and the breaching party is itself required by law to notify. Statutory reporting duties and deadlines still apply.

Who is responsible for individuals' consent?

The customer. Clause 18.6 requires the customer to warrant that it has obtained express informed consent from each individual for our use of their Personal Information as contemplated by the agreement and our privacy policy, including overseas transfer.

What is your liability for a privacy breach?

Breach of clause 18 is capped at $1 million per event or series of connected events and $2 million in the aggregate for all claims under the Service Agreement, subject to applicable rights that cannot lawfully be excluded. A breach of clause 18 not remedied within 20 Business Days of written notice is a contractual termination trigger.

Does the ISO/IEC 27001 certificate cover data residency?

No. The certificate covers our information security management system for our emPOWER infrastructure and managed services at Melbourne, Sydney and Brisbane. Residency is a separate operational statement and contractual matter.

What extra applies if we are APRA regulated?

Where clause 10 applies, it addresses customer warranties and APRA Requests. If the customer requires a BCP under clause 15, clause 10.4 specifies ten minimum elements, joint testing every six months or when reasonably requested, and results within 7 days of the test's end. Clause 10.6 provides a technical-review right with disclosure limits. Clauses 10.5 and 10.7 address costs for the BCP work and review; confirm the applicable agreement and current regulatory requirements.

What do the terms say about subcontractors?

Clause 27.4 permits subcontracting without the customer's prior written consent and keeps us responsible for subcontractors as for our own employees. It does not establish a blanket waiver of notification duties elsewhere in the agreement or law. Because clause 18.3 addresses countries from which contractors provide Services, confirm any subcontractor disclosure, approval and change-notification requirements in your Service Order.