IDCARE Terms and Conditions of Trade - Australia V1.3

Background

• The Customer wishes to obtain the Services of IDCARE on the terms set out in this Agreement.
• IDCARE agrees to provide the Services on the terms set out in this Agreement.

Operative Clauses

1. Definitions and Interpretation

1.1 Definitions

In this Agreement: 

‍Agreement means this Agreement (including any Schedules) in writing between IDCARE and the Customer for the provision ofthe Services.

‍Business Day means any day except a Saturday or a Sunday or other public holiday in Queensland.

Confidential Information means any information relating to either party, that has been disclosed in any form to the other party or otherwise learned or acquired by the receiving party under or in connection with this Agreement, which is identified by disclosing party as being confidential, or which due to the circumstances of disclosure the receiving party knows or ought to know is confidential, whether disclosed visually, orally or in writing, but excluding information that:

• was or becomes generally available to the public, other than as a result of a breach of an obligation of confidentiality owed to disclosing party;
• IDCARE agrees to provide the Services on the terms set out in this Agreement.
• was in the receiving party’s possession, without an obligation of confidentiality, prior to receipt from disclosing party; or
• is independently developed by the receiving party. 

‍Customer means the entity executing this agreement.
‍
‍Fee means the agreed fee for the Services as set out in the ratified IDCARE Services proposal.

Force Majeure Event means an event which:

• is outside of the reasonable control of the party claiming that the event has occurred;
• the adverse effects of that event could not have been prevented or mitigated against by that party by reasonable diligence or reasonable precautionary measures; and
• includes natural disasters, health pandemics, acts of terrorism, riots, civil disturbances, industrial disputes and strikes (other than strikes involving that party, its agents, employees or contractors).

‍IDCARE means Identity Care Australia & New Zealand Limited (ABN 84 164 038966), My Data Care Pty Ltd (ABN 35 643 544 950) and IDCARE Limited (NZBN9429041070109), the Supplier, and any of the charity's wholly-owned entities.
‍
‍Incident means a data breach arising from unauthorised access to information owned by the Customer and the Customer has engaged IDCARE to provide services in relation to the Incident.

‍Personal Information has the same meaning as in the Privacy Act.
‍
‍Privacy Act refers to the Privacy Act 1988 (Cth), including any amendments or replacements thereof.

‍Modern Slavery has the same meaning given to it in the Modern Slavery Act 2018 (Cth) and other similar activities prohibited under any other applicable law.
‍
‍Services means the Services specified in the First Schedule (if there is one) or as otherwise agreed to in writing between the parties.

1.2 Interpretation

In this Agreement: 

• headings are inserted for ease of reference only and will not form part of nor be used in the interpretation of this Agreement;
• words importing the singular will include the plural and vice versa, words importing a gender will include the other gender;
• reference to a person will be construed as a reference to an individual, firm, body corporate or other entity (whether incorporated or not), or, where a position is nominated, the individual occupying that position;
• where any inconsistency exists between this Agreement and the Proposal, the provisions of this Agreement will take precedence;
• reference to legislation includes any amendment to it, any legislation substituted for it, and any subordinate legislation made under it;
• reference to a party includes that party’s personal representatives, successors and permitted assigns;
• a provision must be read down to the extent necessary to be valid. If it cannot be read down to that extent, it must be severed;
• if a thing is to be done on a day which is not a Business Day, it must be done on the Business Day after that day;
• a reference to “including” should be read as “including, without limitation”;
• another grammatical form of a defined expression has a corresponding meaning;
• an expression defined in the Corporations Act 2001 (Cth) has the meaning given by the Corporations Act;
• a reference to dollars or $ is to Australian currency;
• no rule of construction applies to the disadvantage of a party because that party put forward this Agreement or any portion of it; and
• where this Agreement refers to the “satisfaction”, “consent”, “approval”, or similar indication of assent or consent on the part of any party in relation to a particular matter, in the absence of an express qualification that the party in question act “reasonably” or “in good faith” or in a particular manner such party may withhold the same for any reason in its absolute discretion.

2. Provision of Services

2.1 IDCARE will provide the Services to the Customer in accordance with this Agreement. 

2.2 IDCARE will not vary the Services provided without the written consent of the Customer. 

2.3 IDCARE acknowledges and agrees that:

• it is entitled to and has full right, capacity, power and authority to enter into and perform its obligations under this Agreement;
• it will act professionally and in a good workmanlike manner at all times in the provision of the Services, exercising professional skill, care and diligence, including by ensuring that the Services are reasonably fit for purpose ;
• it nor any of its directors, subcontractors, agents or employees will disclose to any other party other than the Customer’s point of contact any information about this Agreement or any information (particularly confidential or sensitive information) obtained when performing the Services (unless such disclosure is approved in writing by the Customer or required by law); and
• by entering into and complying with any of its obligations under this Agreement, IDCARE is not and will not be in breach of any agreement or undertaking with any other person (whether written or otherwise) or any law.

2.4 IDCARE will operate and maintain for the duration for which the Services are performed information and data security policies, standards and procedures (“Security Practices”) based on, and consistent with, best industry practice.

3. Fees and expenses

3.1 IDCARE will provide the Services in consideration for the payment by the Customer of the Fee detailed in this executed Agreement. Any payments so provided for in this Agreement are exclusive of GST (unless otherwise stated).

3.2 The Fee:

• The fixed fee component must be paid in full by the Customer within twenty-eight (28) days that the Customer receives a correctly rendered invoice from IDCARE.
• Variable costs shall be paid on presentation of a rendered Tax Invoice, billed monthly based on retrospective usage of the relevant services.
• In the event of a dispute, any items not disputed must still be paid.

3.3 Annual Price Reviews:

• Both parties acknowledge that market conditions and other relevant factors may affect the pricing of the goods/services provided under this agreement.
• Therefore, the pricing of the goods/services shall be subject to an annual review by both parties, commencing on the anniversary date of this agreement.
• The purpose of the annual price review is to ensure that the pricing remains fair and reasonable, considering prevailing market conditions, changes in costs, and other relevant factors.
• Upon completion of the annual price review, IDCARE may propose adjustments to the pricing. Such proposals shall be communicated in writing to the other party.
• The parties shall engage in good faith negotiations to agree upon any proposed adjustments to the pricing. If an agreement is reached, the revised pricing shall be documented in writing.
• If the parties are unable to reach an agreement within 30 calendar days from the initiation of the price review, the current pricing shall continue in effect unless this agreement is terminated by either party, and the price review process shall be repeated on the subsequent anniversary date.
• This clause does not apply where IDCARE is providing Incident Management services only.

4. Conflict of interest

4.1 IDCARE acknowledges and agrees that to the best of its knowledge, information and belief, at the date of executing of this Agreement, no conflict of interest exists or is likely to arise in the provision of the Services pursuant to this Agreement.

4.2 IDCARE will take all necessary steps to ensure that its employees, agents and sub-contractors do not engage in any activity or obtain any interest, which is in conflict with the provision of the Services to the Customer pursuant to this Agreement.

4.3 If during this Agreement, a conflict of interest or a risk of conflict of interest arises (without limitation, because of work undertaken for any person other than the Customer) IDCARE will notify the Customer immediately in writing of that conflict of interest or risk.
‍
4.4 The Customer may manage the conflict of interest as it reasonably considers appropriate provided it takes actions in compliance with relevant policies of the Customer. Management of a conflicts of interest issue by the Customer may include termination of this Agreement by the Customer without liability to IDCARE.

5. Term of Agreement

5.1 This Agreement will commence from the date hereof and continue in force for one (1) year or the earlier termination of this Agreement. Notwithstanding the foregoing, the terms of this Agreement will continue to apply to any Services until IDCARE has fulfilled its performance of such Services, or for Services expressed to be performed in perpetuity.
‍
5.2 The Customer may terminate for convenience by providing thirty days written notice of termination.

6. Termination for default

6.1 If either party:

• fails to observe or perform any of its obligations pursuant to this Agreement;
• assigns this Agreement or any of its benefits or purports to assign, subcontract or otherwise divest itself of any of its obligations under this Agreement without the other party's written consent;
• enters into any arrangement or proceedings for the purpose of insolvency administration or is placed under official management;
• abandons or refuses to proceed with the provision of the Services; or
• is involved in or creates a conflict of interest under this Agreement,

the other party will notify the defaulting party in writing specifying the reason for the default and requiring the defaulting party, where possible, to remedy the failure or to show cause within thirty (30) days from the giving of such notice why the Agreement should not be terminated.

6.2 If the defaulting party fails to remedy the failure or to show cause within thirty (30) days to the satisfaction of the other party acting reasonably, the other party may without prejudice to any other rights, terminate this Agreement by notice.

6.3 Where IDCARE is providing Incident Management services, it reserves the right to terminate this Agreement if:

• Proposed notifications to impacted persons have not first been reviewed by IDCARE, or they have been insufficient in their detail in providing impacted persons with an understanding of what is likely to have been exposed, what happened, when the exposure first occurred, what measures have been taken to mitigate risks of serious harm, the police report number or Report Cyber number, and/or the representation of IDCARE and its services available to impacted persons is inaccurate, inconsistent or misleading;
• The Customer does not provide sufficient notice to IDCARE about the notification schedule to impacted persons by providing at least two business days’ notice of any notifications, the size of the notified person or entity cohort, and a copy of the draft notifications (absent of personal information, such as a template);
• The Customer references IDCARE, such as written, verbal, website links,or use of IDCARE logo, in a notification communication or publicly, such as via media releases, website content, or notification to the regulator, without first obtaining consent from IDCARE;
• The Customer is relying on IDCARE to be the sole or main contact point for impacted persons, rather than as an escalatory service as outlined in this Agreement or the Customer has not sufficiently channelled impacted persons through agreed escalation pathways or there has been a repeated referrals of ineligible individual(s) through agreed referral channels;
• The management of the event and proposed communications are likely to contribute to further the risk of serious harm experienced by impacted persons;
• The management of the Incident and proposed communications are inconsistent with IDCARE’s preliminary views of the likely assessment of serious harm to impacted persons based on the available information about the Incident provided to IDCARE by the customer or a third party they have engaged to respond to the Incident on their behalf;
• The management of the Incident and proposed communications are not timely and/or have not been managed in a way that recognises the need to mitigate the serious risk of harm to impacted persons in a timely way.

6.4 Termination under Clause 6.3 shall result in the withdrawal of IDCARE services as at the termination date made in writing to the Customer. IDCARE shall issue in writing a notice to terminate the Agreement at the specified date and invite the Customer to provide a written response to the notice in seeking to address or remedy the reasons outlined in the notice. If the Customer fails to remedy the failure or to show cause within fifteen (15) days to the satisfaction of IDCARE acting reasonably, IDCARE may without prejudice to any other rights, terminate this Agreement by notice.

6.5 On receipt of any such response to the notice to terminate under Clause 6.3, it is IDCARE’s sole discretion (acting reasonably) to determine whether the reasons are sufficient, and if not, to issue an invoice only for the work performed under the First Schedule to the termination date. There shall be no further conditions or requirements on either party from the date of termination as it relates to this agreement.

7. Consequences of termination

7.1 On termination of Agreement, the parties are released from their respective obligations to continue to perform this Agreement, provided that such termination does not affect:

• any accrued rights and liabilities of either party, including, where appropriate, the rights arising in respect of the breach giving rise to the right to terminate; or
• any provisions of this Agreement that are expressed to, or by their nature, survive termination or expiry of this Agreement.

7.2 If the Customer terminates the Agreement in accordance with clause 6.2, IDCARE must refund the Customer for any Fees paid in respect of Services that are yet to be performed within 28 days of termination of this Agreement. This excludes all establishment fees as specified in this executed Agreement.

7.3 On expiry or termination of this Agreement, both parties agree that within 14 days from the date of expiry or termination IDCARE will return (or at the Customer’s option, destroy and certify the destruction of) any of the Customer’s property (including any confidential or sensitive information provided by the Customer to IDCARE or otherwise obtained by IDCARE during the course of providing the Services) in its possession or control.

8. Delay

8.1 A party to this Agreement will not be entitled to exercise its rights and remedies upon the default of the other party (whether at common law or under this Agreement) if that default is caused by a Force Majeure Event.

8.2 A party prevented from performing any of its obligations under this Agreement by a Force Majeure Event must:

• continue to perform all other unaffected obligations in accordance with this document;
• use its best endeavours to continue to perform the affected obligations, whether by way of a work around or other methods;
• use its best endeavours to overcome the effects of the Force Majeure Event as soon as possible; and
• notify the other party as soon as it is no longer affected by the Force Majeure Event.

9. Indemnities

9.1 Each party shall indemnify the other party and its officers, directors, employees, principals and agents, against any and all loss, liability, damages, and expenses (including legal fees on a full indemnity basis) suffered or incurred by either of them to the extent such loss, liability, damage or expense is suffered or incurred, as a result of any of the following:

• any fraudulent, negligent or wilful act or omission by such party;
• any claim that the provision or receipt of the Services, infringes the rights (including intellectual property rights) of any person; and
• any breach by such party of any applicable laws.

9.2 A party’s liability to indemnify the other party pursuant to this clause 9 shall be reduced to the extent that the other party caused or contributed to the relevant loss, liability, damage or expenses. The parties agree that they will have a duty to mitigate their loss before relying on the indemnity provided under this clause 9.

10. Limitation of Liability

10.1 In no event will either party be liable for any consequential, incidental, indirect, special or punitive damage, loss or expenses or business interruption, lost business, lost profits or lost savings based on, resulting from, arising out of, or otherwise related to this Agreement.

11. Insurance

11.1 IDCARE will, at its own expense, obtain and maintain the following Insurance Policies with a reputable insurer:

• Public liability insurance with a minimum cover of $20,000,000 per claim.
• Insurance against any liability which may arise under law, including relevant workers or accident compensation legislation.
• Professional indemnity insurance with a minimum cover of $20,000,000.

11.2 IDCARE must maintain these Insurance Policies for the Term of this Agreement and for a period of seven years after the expiry or termination of this Agreement. IDCARE will provide the Customer with current evidence of the insurance policy upon request.

12. Dispute Resolution

12.1 If a dispute arises between the Customer and IDCARE in connection with this Agreement or the provision of the Services, either party will give a written notice of dispute to the other, which notice will identify and provide full details of the dispute, within seven (7) days of the dispute arising.

12.2 Notwithstanding the notification of a dispute, the parties will continue to perform their obligations pursuant to this Agreement.

12.3 Within fourteen (14) days of the written notice of dispute, the parties will confer at least once to resolve the dispute or to agree on methods of resolving the dispute.

12.4 If the dispute is not resolved within fourteen (14) days of the written notice of dispute, the dispute may be referred to mediation by either party or be the subject of litigation.

13. Confidential Information

13.1 Each party will (and, if applicable, will procure that their Related Companies will):

• use all reasonable safeguards to keep the other party’s Confidential Information confidential and secure; and
• not use the other party’s Confidential Information except to the extent required to perform its obligations or exercise its rights in accordance with this Agreement.

13.2 Clause 13.1 will not apply to the extent the disclosure is:

• required to be disclosed by law or the rules of any stock exchange on which a party or any Related Company of that party is listed, in which case that party will:
  (i) as soon as reasonably practicable, unless prevented from doing so by any applicable law, notify the other party of the requirement, the Confidential Information that the party will disclose, and the date the party will disclose that Confidential Information;
  (ii) use any available discretion or exception not to disclose the other party’s Confidential Information; and
  (iii) use all reasonable endeavours to ensure that the recipient of the other party’s Confidential Information keeps the Confidential Information confidential.
• agreed by the other party before the disclosure is made;
• publicly available (or becomes publicly available) through no fault of the party making the disclosure;
• independently acquired or developed by the party making the disclosure without breaching any of its obligations under this Agreement or at law;
• lawfully required in accordance with the Tax Administration Act 1994 (for New Zealand), or the Tax Administration Act 1953 (Australia), or similar legislation from time to time; or
• lawfully acquired from a third party by the party making the disclosure, so long as that information is not obtained by that third party’s breach of its confidentiality obligations.

14. Compliance

14.1 IDCARE must, in carrying out its obligations under this Agreement, comply with all relevant statutes, regulations, by laws and requirements of any Commonwealth, State, Territory or Local Authority.

14.2 IDCARE and any person who performs or provides goods or services under this Agreement will comply with the requirements (including registration or licensing) of any relevant profession or industry.

15. Privacy

15.1 In providing the Services, IDCARE must comply, and ensure that its officers, employees, agents and subcontractors comply with the Privacy Act and not do anything that would breach an Australian Privacy Principle contained within the Privacy Act.

15.2 IDCARE shall only collect, use, and disclose Personal Information for purposes directly related to the performance of this Agreement, and only to the extent necessary to fulfill those purposes.

15.3 IDCARE shall take reasonable precautions to protect the security of Personal Information against unauthorised access, loss, misuse, or alteration. IDCARE shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption, access controls, and regular security assessments.

15.4 IDCARE will notify the Customer as soon as reasonably practicable if it becomes aware of a breach or possible breach of the obligations contained in this clause.

15.5 The obligations and rights set forth in this clause shall survive the termination or expiration of the Agreement.

16. Governing law

16.1 This Agreement will be governed by and construed in accordance with, the laws of Queensland. The parties hereby submit themselves to the jurisdiction of the Courts of Queensland.

17. GST

17.1 Where GST is imposed on a taxable supply for the purposes of the GST law, a party must pay GST on a taxable supply made to it under this Agreement, in addition to any consideration (excluding GST) that is payable for that taxable supply.

17.2 A party making a taxable supply to another party under this Agreement must issue a tax invoice to the other party, setting out the amount of the GST payable by that other party.

17.3 If a party is required under this Agreement to indemnify another party or to make a reimbursement or contribution to another party, and that other party can obtain an input tax credit on an acquisition associated with that indemnity, reimbursement or contribution, the amount the party is required to pay is:

• reduced by the amount of that input tax credit; but
• increased by any GST payable by that other party in respect of the indemnity, reimbursement or contribution.

However, the amount of an indemnity, reimbursement or contribution is not reduced by the amount of an input tax credit if that credit has already been taken into account in calculating the amount of the indemnity, reimbursement or contribution.

17.4 The supplier of a taxable supply warrants that it is registered or will be registered for Australian Business Number and GST purposes, at each time a taxable supply is made. A party must continually indemnify the other party for any loss and damage it suffers as a result of a party not being registered for Australian Business Number and GST purposes. On request by the other party, a party must produce evidence that it is registered.

17.5 If an adjustment event results in the GST on a taxable supply being different from the GST recovered by a party, a party:

• must refund to the other party any excess; and
• may recover from the other party any shortfall.

The recovery of any money from the other party is conditional on an adjustment note being given first.

17.6 Each party must do everything reasonable to assist each other party to comply with its GST obligations in relation to this Agreement.

17.7 For the purposes of this Clause, GST and GST law shall have the following meanings assigned to them:

• GST means a tax, levy, duty, charge and/or deduction or impost, together with any related additional tax, interest, penalty, fine or other charge calculated by reference to the value of anything supplied under this Agreement; and
• GST law means any law imposing a GST include the A New Tax System (Goods & Services Tax) Act 1999 (Cth) or, if that act does not exist for any reason, any act imposing or relating to a GST and any regulation made pursuant to any such act.

18. Notices

18.1 Notices under this Agreement will be in writing and may be delivered by prepaid postage, by hand or by e-mail to each of the parties at the address specified in this Agreement or such other address as either party may specify by notice in writing to the other.

18.2 Notices will be deemed to be given:

• Ten (10) days after deposit in the mail with postage prepaid;
• immediately upon delivery by hand;
• immediately via electronic message with confirmation of delivery;

provided that delivery of any notice pursuant to Clause 17.2(b) after 5.00 pm will be deemed delivery on the following Business Day.

19. Entire agreement

19.1 This Agreement constitutes the entire agreement between the parties in relation to its subject matter and supersedes any and all prior discussions or previous agreements between the parties in relation to its subject matter.

19.2 No modification intended to be an amendment to this Agreement will have any effect unless made in writing and signed by an authorised officer of the Customer and by IDCARE. For the avoidance of doubt this shall include any standard terms and conditions of IDCARE which have no effect unless otherwise expressly agreed in writing by the parties and signed by an authorised officer of the Customer and by IDCARE. 

20. Assignment

Neither this Agreement nor any of the benefits or obligations may be assigned, subcontracted or otherwise divested by IDCARE without the Customer's prior written consent.

21. Counterparts

This Agreement may be executed in any number of counterparts. Together all counterparts make up one instrument.

22. Severability

If any provision of this Agreement is declared by any judicial or other competent authority to be void, voidable, illegal, or otherwise enforceable, then shall be severed from this Agreement. In all other respects the terms and conditions of this Agreement shall remain in full force and effect.

23. Relationship of the parties

This Agreement is not intended to create a relationship of employment, trust, partnership, joint venture or agency between the parties. No party to this Agreement is empowered to incur any obligation or make any representation on behalf of the other party without the express consent of that other party.

24. Publicity

No party to this Agreement will disclose, distribute or otherwise communicate any media release, promotional material or publicity in connection with this Agreement, its relationship with the other party or otherwise refer to the other party or any service mark or trademark of the other party without the prior written approval of the relevant party. Each party may grant or withhold such approval in its sole discretion.