Data Processing Terms
The terms on which we process personal data on behalf of a client, and the obligations we accept when we do.
1. The Parties And When These Terms Apply
These terms are entered into between the client, which is the controller, and Khufu Management Pty Ltd, trading as BlackSnow Intelligence, which is the processor. They apply whenever we process personal data on behalf of a client, and they form part of the engagement agreement between us.
Where we act on our own account rather than for a client, we are the controller and our Privacy Notice applies instead of these terms. Running the BSI Calculator against an organisation is our own processing, not a client's, and these terms do not cover it.
- Processor: Khufu Management Pty Ltd, ABN 98 676 753 683, ACN 676 753 683
- Registered office: 38 Miles Platting Rd, Eight Mile Plains, QLD 4113
- Contact for data protection matters: ror@blacksnowintel.com
The governing law of these terms is the law of Queensland, unless the engagement agreement states otherwise.
2. Subject Matter, Nature And Purpose Of The Processing
We process personal data on behalf of a client for the purpose of delivering the assessment, research or advisory service described in the engagement agreement, and for no other purpose.
| Term | What It Is In Our Engagements |
|---|---|
| Subject matter | The assessment, research or advisory service described in the engagement agreement |
| Duration | The term of the engagement, and the wind-down period in section 11 |
| Nature and purpose of the processing | Reading, analysing, recording and reporting on documents and records the client supplies or directs us to |
| Categories of personal data | Business contact details, job titles, authorship and approval records, and any personal data contained in documents the client supplies |
| Categories of data subject | The client's staff, officers, suppliers and, where the client supplies them, its own customers |
| Special categories | None. We instruct clients not to supply special category data, and we do not solicit it |
3. Our Instructions
We process personal data on behalf of the client only on the client's documented instructions, which are the engagement agreement, these terms, and any later written instruction the client gives.
Where a law we are subject to requires us to process personal data beyond those instructions, we will tell the client before we do, unless that law forbids us from telling them. We will tell the client immediately if we consider an instruction infringes data protection law, and we may pause the affected processing while that is resolved.
4. Confidentiality
Every person we authorise to process personal data under these terms is bound by a written duty of confidentiality that survives the end of their engagement with us. We limit authorisation to the people who need it to deliver the service.
5. Security
We apply appropriate technical and organisational measures to protect personal data. Personal data is encrypted in transit and encrypted at rest. Access is role-based and granted on the principle of least privilege and on a need-to-know basis, and access controls are reviewed when a role changes.
We apply a data classification to client material and hold it for no longer than the engagement requires. Where analysis can be carried out on aggregated data or on anonymised records, we work from those rather than from identifiable ones.
Our full control set is described in our Security Overview.
6. Sub-Processors
The client gives general authorisation for us to engage the sub-processors named on our Sub-Processors page. That page is the complete list, and a party absent from it does not process client personal data.
We give 30 days notice before a new sub-processor begins processing personal data, by publishing the change on that page and writing to every client under contract. A client may object to the appointment during that period, in writing, on reasonable grounds relating to data protection, and where an objection cannot be resolved the client may terminate the affected service without penalty.
We impose on every sub-processor, by written contract, the same data protection obligations these terms impose on us, and we remain liable to the client for the performance of each one.
7. International Transfers
Where personal data leaves the European Economic Area, the European Commission's Standard Contractual Clauses apply between the parties and are incorporated into these terms. Where personal data leaves the United Kingdom, the International Data Transfer Addendum to those clauses applies on the same basis.
We do not rely on the Data Privacy Framework and we do not rely on Binding Corporate Rules. We complete a transfer impact assessment before a new transfer begins and record its outcome, and we make that record available to the client on request.
Client records are stored in Ireland. Our systems run in the Dublin region and our database runs in the Ireland region.
8. Artificial Intelligence And Model Providers
We do not send client confidential material or client personal data to a model provider without the client's written instruction. Where a client instructs us to, the providers are the two named in our AI Policy and no others.
We do not use customer data to train models, and our accounts with those providers are configured so that our inputs are excluded from model training. Prompts and model inputs are retained by the provider for a limited period for abuse monitoring and are then deleted.
9. Assistance To The Controller
We assist the client, by appropriate technical and organisational measures and taking account of the nature of the processing, to respond to a request from a data subject exercising a right of access, correction, erasure, restriction, objection or portability.
Where a data subject contacts us directly about client data, we do not answer on the client's behalf. We forward the request to the client without undue delay and tell the data subject we have done so.
We also assist the client with data protection impact assessments, with prior consultation of a supervisory authority, and with the security and breach obligations in Articles 32 to 36 of the GDPR.
10. Personal Data Breach
We will notify the client of a personal data breach affecting client personal data without undue delay and in any event within 24 hours of becoming aware of it. The notification will describe what happened, the categories and approximate number of records affected, the likely consequences and the measures taken.
We do not notify a supervisory authority or a data subject on the client's behalf unless the client instructs us to in writing. Data breach notification to a regulator is the controller's decision to make.
11. Deletion And Return
At the end of the engagement we delete or return client personal data at the client's choice, and delete existing copies, unless a law we are subject to requires us to keep it. The client tells us which within 30 days of the end of the engagement; where the client does not, we delete.
Our retention period for client material runs from the date a record was last used. Deletion reaches backups, caches and archives on their own cycles, which complete within a further 90 days, and no copy is retained in a model.
12. Audit
We make available to the client the information necessary to demonstrate compliance with these terms, and we allow for and contribute to an audit conducted by the client or an auditor the client mandates, on 30 days written notice and no more than once a year unless a breach or a regulator requires otherwise.
13. Data Protection Officer
We have not appointed a Data Protection Officer and we are not required to appoint one. Data protection matters are handled by the founder, who is accountable for these terms, at ror@blacksnowintel.com. Our representatives in the European Union and the United Kingdom are named in our Privacy Notice.
14. Complaints And Escalation
A client dissatisfied with how we have handled personal data may write to ror@blacksnowintel.com, and has a right to appeal a decision we make on that complaint to the founder, who will answer in writing. A client or a data subject may also lodge a complaint with a supervisory authority at any time.
15. Changes To These Terms
This is version 1.0, published on 17 August 2026. We will not change these terms to the detriment of a client during an engagement without the client's written agreement. Changes are published at this address with a new version number and date.
16. How To Reach Us
Write to ror@blacksnowintel.com, or to Khufu Management Pty Ltd, 38 Miles Platting Rd, Eight Mile Plains, QLD 4113. Our other published documents are indexed on the Legal page.