Skip to content
coverbound
Free trial

Data Processing Agreement

Last updated 13 October 2026

1. About this agreement

This Data Processing Agreement ('DPA') forms part of the Terms of Service between Coverbound ('we' or 'us') and the firm that uses Coverbound ('you'). Coverbound is a trading name of Risk Monitor Pty Ltd (ACN 158 218 994). It applies whenever we process personal information on your behalf, and you accept it when you accept the Terms of Service.

It is written to meet Article 28 of the UK General Data Protection Regulation ('UK GDPR') and to support your obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles ('APPs'). 'Personal information' includes 'personal data' under the UK GDPR. Other terms, such as 'controller', 'processor' and 'personal data breach', have the meaning given in the UK GDPR.

2. Roles

For personal information in your data (as defined in the Terms of Service), you are the controller and we are your processor. In Australia, you are the APP entity that holds the information and we are your service provider. Annex 1 describes the processing.

This DPA doesn't cover personal information we handle for our own purposes, such as your users' account and billing details. Our Privacy Policy covers that, and for it we are a controller.

3. Your instructions

We process personal information only on your documented instructions. The Terms of Service, this DPA and the way you configure and use Coverbound are your complete instructions. We may process it otherwise only where the law requires, and if so we'll tell you first unless the law prohibits that.

We'll tell you promptly if we believe an instruction breaks the UK GDPR, the Privacy Act or other data protection law.

You are responsible for the lawfulness of your instructions and for having a lawful basis, and giving any notices, for the personal information you put into Coverbound. That includes recording meetings and sharing special category information such as health information.

4. Our staff

Only staff and contractors who need access to provide Coverbound may access personal information, and all of them are bound by a duty of confidentiality.

5. Security

We maintain the technical and organisational measures in Annex 2, which are designed to meet Article 32 of the UK GDPR and APP 11. We may update them, provided the overall level of protection doesn't fall.

6. Sub-processors

You give us general authorisation to use the sub-processors on our sub-processor list. We'll give you at least 30 days' notice by email before adding or replacing a sub-processor. If you have reasonable data protection grounds to object, tell us within that period. We'll work with you in good faith to resolve the objection, and if we can't, you may end the affected service and get a pro-rata refund of prepaid fees.

Each sub-processor is bound by a written contract with data protection obligations at least as protective as this DPA. We remain liable to you for our sub-processors' performance of those obligations.

7. Helping you

  • Requests from individuals: if an individual asks us to access, correct, delete or otherwise act on their information, we'll pass the request to you and won't respond ourselves unless you ask us to. Coverbound lets you find, correct and delete most information yourself, and we'll give you reasonable help with the rest.
  • Security, assessments and regulators: we'll give you reasonable help with your obligations on security, data protection impact assessments and prior consultation with a regulator, taking into account the nature of the processing and the information available to us.

8. Data breaches

If we become aware of a personal data breach affecting your data, we'll notify you without undue delay and in any case within 72 hours. We'll tell you what we know about what happened, the information and people likely to be affected, the likely consequences and what we are doing about it, and we'll keep you updated as we learn more.

We'll help you assess whether the breach is an eligible data breach under the Notifiable Data Breaches scheme, or must be reported under the UK GDPR, within the time those laws allow. As the controller, you decide whether and how to notify the OAIC, the ICO and affected individuals, and we won't notify them about your data without your agreement unless the law requires us to.

9. International transfers

Your data is stored in the United States. Our AI provider may process it in other countries where Google operates. Our staff in Australia may access it to provide support and run Coverbound. The locations of each sub-processor are on our sub-processor list.

Australia: where we disclose personal information outside Australia, we take reasonable steps to make sure each recipient handles it consistently with the APPs, as APP 8 requires, including through our contracts with sub-processors.

United Kingdom: the UK has not made adequacy regulations for Australia. Where your use of Coverbound involves a restricted transfer of personal data from the UK, the International Data Transfer Agreement issued by the ICO under section 119A of the Data Protection Act 2018 is incorporated into this DPA, with you as exporter and us as importer, and with its tables completed using the details in this DPA and Annex 1. We rely on adequacy regulations, the UK Extension to the EU-US Data Privacy Framework or the ICO's transfer mechanisms for our sub-processors' onward transfers. We'll share our transfer risk assessment on request.

10. Deletion and return

When the Terms of Service end, you can ask us to return your data in a common format or to delete it. We'll do either within 30 days of your written request. Information in backups is deleted as the backups expire in their normal cycle, and is protected under this DPA until then. We may keep information only where the law requires, and will protect it while we do.

11. Audits and information

We'll give you the information reasonably needed to show that we comply with this DPA, including answers to reasonable security questionnaires. If that isn't enough, or a regulator requires it, you or an independent auditor bound by confidentiality may audit our compliance once a year, on at least 30 days' notice, during business hours and in a way that limits disruption and protects other customers' data. Each party bears its own costs.

12. Liability and order of precedence

The limits on liability in the Terms of Service apply to this DPA. If this DPA conflicts with the Terms of Service about personal information, this DPA wins. If the International Data Transfer Agreement applies and conflicts with either, it wins.

Annex 1: Details of the processing

  • Subject matter and duration: providing Coverbound under the Terms of Service, for their duration and until deletion under section 10.
  • Nature and purpose: hosting, storing, reading, extracting, transcribing, analysing and drafting from your data, sending and receiving email and messages for you, running client-facing questionnaires, portal, e-signing and claim reporting, and backing up and securing it, all to provide Coverbound to you.
  • Individuals: your clients and prospects and their owners, directors, staff and contacts, people named in policies, claims, documents and emails, meeting participants, insurers' and other third parties' staff, and your own users.
  • Types of personal information: names and contact details, job titles, business details, insurance, policy and claims history, financial information about businesses, signatures, the content of documents, emails, messages and meeting recordings or transcripts, and technical data such as hashed IP addresses.
  • Special category and sensitive information: your data may include health information, criminal records and other sensitive information where you need it to arrange insurance or handle claims. You decide whether to include it.

Annex 2: Security measures

  • Encryption of data in transit using TLS, and encryption of stored data at rest by our cloud provider.
  • Each firm's data separated at the database level using row-level security.
  • Access to production systems limited to staff who need it, with credentials held in a managed secrets store.
  • Uploaded files scanned for malware before they are processed.
  • IP addresses of people using client-facing links stored only as hashes.
  • Time-limited links for client access and for downloads, and one-time codes for client portal sign-in.
  • Regular database backups and the ability to restore them.
  • Logging and monitoring of our systems, and a process for responding to security incidents.
  • AI providers contracted not to train their models on your data.