Patona Digital Pty Ltd (ABN 92 654 805 437) trading as teamified ("teamified", "we", "us", "our")
Last updated: 20 October 2026
Version 1.0
1. Information Security Management System.
teamified maintains an information security management system (ISMS) aligned to ISO/IEC 27001, covering the people, processes and technology used to deliver the Services, the scope of which covers the locations from which teamified delivers the Services. teamified will achieve and thereafter maintain certification of its ISMS to ISO/IEC 27001 (or a successor standard or equivalent independent assurance) and will maintain that certification throughout the term.
2. AI Management System.
teamified is implementing an AI management system aligned to ISO/IEC 42001 governing the development and operation of its AI functionality, including risk assessment, human oversight, data governance for model development, and post-deployment monitoring. On achieving certification, teamified will maintain it (or equivalent independent assurance) throughout the term. AI-specific obligations are set out in Schedule 6.
3. Technical and organisational measures.
teamified will maintain measures consistent with its ISO/IEC 27001 controls, including at minimum:
(a) Access control - role-based access on least-privilege principles; unique credentials; multi-factor authentication for administrative and remote access; access reviewed at least quarterly and revoked promptly on role change or exit; Where offered, teamified supports single sign-on, OAuth 2.0 with Proof Key for Code Exchange for authorised applications, role-based access with granular permissions, and API keys that the CLIENT can scope and revoke.
(b) Encryption. teamified will:
(i) encrypt Client Data in transit using TLS 1.2 or higher;
(ii) encrypt Client Data at rest using AES-256 or an equivalent standard; and
(iii) restrict decryption of Client Data to the systems and personnel required to deliver the Services, including the AI processing described in Schedule 6, and maintain access controls over encryption keys.
(c) Logging and monitoring - security event logging on production systems processing Client Data, retained for at least twelve (12) months, with monitoring for anomalous activity;
(d) Vulnerability management - regular vulnerability scanning; penetration testing of the Self-Serve Platform at least annually by a qualified independent tester; remediation of critical vulnerabilities on prioritised timeframes;
(e) Personnel security - background screening of Personnel where legally permissible; confidentiality undertakings; security awareness training on induction and at least annually;
(f) Physical security - controls at delivery premises per clause 4.8 of the Agreement, including CCTV and biometric access;
(g) High availability and Disaster Recovery - teamified maintains high-availability architecture for the Self-Serve Platform and maintains disaster recovery procedures, which it tests at least annually.
(h) Business continuity - backup of Client Data with periodic restoration testing; power and internet redundancy at delivery premises;
(i) Secure development - change management, environment segregation and security review in the development lifecycle.
The measures above are stated at the level of policy commitment. teamified may update specific technologies and configurations provided the overall level of protection is not materially reduced.
4. Subcontractors and sub-processors.
teamified will not engage a subcontractor or sub-processor with access to Client Data without ensuring it is bound by obligations materially no less protective than this Schedule. teamified will maintain a current list of sub-processors, provide it on request, and give the CLIENT prior notice of new sub-processors with a reasonable opportunity to object on legitimate grounds. teamified remains fully responsible for its subcontractors and sub-processors per clause 2.4.
5. Certification evidence.
teamified will provide, annually on request, certification evidence (including, once achieved, its ISO/IEC 27001 and ISO/IEC 42001 certificates) and, on request, a summary of its latest penetration test.
6. Incident and Data Breach notification.
teamified will notify the CLIENT without undue delay, and in any event within forty-eight (48) hours, after confirming a Data Breach affecting Client Data. Notification will include, to the extent known: the nature of the breach, categories and approximate volume of data affected, likely consequences, and measures taken or proposed. teamified will take immediate steps to contain, investigate, mitigate and remediate, keep the CLIENT reasonably informed, and provide reasonable assistance to enable the CLIENT to meet its own notification obligations (including under the Notifiable Data Breaches scheme). For suspected or attempted incidents that are not confirmed, teamified will investigate promptly and notify the CLIENT if the incident is confirmed as a Data Breach.
7. Assistance, audit and evidence.
teamified will assist the CLIENT to respond to requests under Australian Privacy Principles 12 and 13 and to inquiries from the Office of the Australian Information Commissioner, within a time that allows the CLIENT to meet its own deadlines, at no additional charge for a reasonable level of assistance. Following a Data Breach, a regulator demand, or evidence of a material unremedied failure to comply with this Schedule, the CLIENT may audit teamified's compliance with this Schedule on ten (10) Business Days' notice, at the CLIENT's cost unless the audit confirms a material breach, in which case teamified bears the reasonable cost. Any audit is: limited to compliance with this Schedule; one audit per triggering event and no more than one audit in any twelve (12) month period except following a notifiable Data Breach or where required by a regulator; conducted during business hours without unreasonable disruption; subject to teamified's security and confidentiality requirements; excluding penetration testing of live systems, other clients' data and teamified's commercially sensitive information; and any third-party auditor must not be a competitor of teamified and must first sign a confidentiality undertaking.
8. Retention.
Client Data is retained for the Term and deleted in accordance with clause 5.7, subject to law-mandated retention and legal holds.
9. Data return and deletion.
On termination or expiry of the relevant Service, teamified will return or make available Client Data per clause 5.7, then delete Client Data from its systems (including backups on their normal expiry cycle) and, on request, certify deletion in writing, subject to retention required by law.
10. Precedence.
If there is any inconsistency between this Schedule and any other document forming the Agreement in relation to security matters, this Schedule prevails to the extent of the inconsistency, subject to clause 12(p).