Roles and scope
You are the controller of the personal data in your website content, the data about visitors to your website that SiteBeacon handles for you, and the data from the Google resources you connect. We are your processor for that data. We are an independent controller of the details of your panel users, our security and usage records, and our billing records, as the SiteBeacon privacy notice explains.
The subject matter is providing SiteBeacon and Umbrella Connect. The duration is the term of your service plus the retention and deletion periods below. The types of data and people are those described in the SiteBeacon privacy notice and the Umbrella Connect privacy notice.
Our instructions from you
We will process the personal data only on your documented instructions, which are these terms, your agreement with us and your use of the service. We will tell you if we think an instruction breaks the law. We will not process the data for our own purposes, except for the controller activities named above. We will never sell it.
Confidentiality
We make sure the people who can access the personal data are bound by confidentiality and have access only where their role needs it.
Security
We take appropriate technical and organisational measures to protect the personal data. These include:
- access to staff consoles through single sign-on with multi-factor authentication
- encrypted connections and encrypted storage of the Google refresh tokens
- separation of each client's data from every other client's data
- activity records for actions taken in the panel
- hashing of panel passwords
We review these measures from time to time.
Sub-processors
You give us general authorisation to use the sub-processors listed on our sub-processors page. We choose them carefully, share with each only the data it needs for its role, and stay responsible for their performance. We will give you at least 30 days notice before we add or replace a sub-processor, by updating that page and emailing everyone who has subscribed to changes (the page explains how to subscribe). If you object on reasonable data protection grounds within that time, we will work with you to find a solution, and if we cannot, you may end the affected service.
Helping you with requests from people
We will give you reasonable help to respond to requests from people to access, correct, delete, restrict, port or object to the handling of their personal data. If a person contacts us directly about data we process for you, we will pass the request on to you and not respond ourselves, unless the law requires us to.
Data breaches
We will tell you without undue delay after we become aware of a personal data breach affecting your data. We will give you the information we have to help you meet your own obligations, including under the Notifiable Data Breaches scheme and, where it applies, the GDPR. We will take reasonable steps to contain and fix the breach.
Deletion and return
When your service ends, you can ask for an export of your data. We keep your data for 30 days after we remove you from SiteBeacon, then purge it. Google data is deleted within 30 days of the connection ending. After that we delete the personal data we process for you, unless the law requires us to keep it. Some data held by our providers, such as backups and aggregate counts, expires on its own schedule.
Audit
We will give you the information reasonably needed to show we meet this DPA. If that is not enough, you may audit us once a year, or after a data breach, on reasonable notice, during business hours, at your cost, and subject to confidentiality and to protecting other clients' data. An independent auditor you appoint may do it, as long as they accept those conditions.
International transfers
Australia and APP 8. Our providers process data outside Australia, as the sub-processors page shows. Before we disclose personal information to an overseas provider, we take reasonable steps in the circumstances to make sure it handles the information in a way that is consistent with the Australian Privacy Principles, as APP 8 requires.
UK and EU. If the UK or EU GDPR applies to the processing and personal data is transferred to Australia or another country without an adequacy decision, the parties will use an appropriate transfer mechanism, such as the EU Standard Contractual Clauses or the UK International Data Transfer Agreement or Addendum. We will sign the relevant clauses on request. We do not state here that Umbrella has a representative in the UK or EU.
Records
We keep a record of the processing we do for you and will make it available to a supervisory authority if the law requires.
Liability and governing law
Each party's liability under this DPA is subject to the limits in the terms it forms part of. This DPA is governed by the laws of Western Australia, except where the GDPR requires otherwise.
What changed
- Version 1.0, 31 October 2026: first published.
Contact us
- Business: Umbrella Technologies Pty Ltd (ABN 15 701 061 243)
- Location: Osborne Park, Perth WA 6017 (by appointment)
- Privacy email: privacy@umbrellatech.com.au
- Support email: support@umbrellatech.com.au
- Phone: 1800 262 262