Home Policies

Policies

Terms of Service, Acceptable Usage Policy, Privacy Policy and Service Level Agreement
Onidel
By Onidel
5 articles

Privacy Policy

Data Collected We collect information from you when you register on our site or place an order. During registration or ordering, you may be asked to provide details such as your name, email address, mailing address, phone number, or credit card information. However, you can also browse our site anonymously. We gather anonymous data from all website visitors to monitor traffic and address technical issues. This data includes information such as web requests, responses to those requests, IP addresses, browser types, browser languages, and timestamps of requests. Additionally, we employ various technologies to collect information, which may involve placing cookies on your computer. Cookies are small data files stored on your hard drive or device memory that enable access to specific features of our website. Use of the Data The information we collect from you may be used in the following ways: - Personalising Your Experience: Your information helps us respond more effectively to your individual needs. - Enhancing Our Website: We continually improve our website offerings based on the information and feedback you provide. - Improving Customer Service: Your information allows us to respond more efficiently to your customer service inquiries and support requests. - Processing Transactions: We use your information to process and manage your orders. - Sending Periodic Emails: The email address you provide for order processing will only be used to send information and updates related to your order. *Note: If you wish to unsubscribe from future emails, please contact us at *[email protected] to have your address removed from our system. Be aware that this may also stop you from receiving account notifications, as we handle all account-related correspondence via email. Your information, whether public or private, will not be sold, exchanged, transferred, or shared with any other company without your consent, except for the express purpose of delivering the product or service you have requested. Security We employ various security measures to safeguard your personal information when you place an order or enter, submit, or access your data. We use a secure server, and all sensitive/credit information you provide is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our payment gateway provider's database. This information is only accessible to those with special access rights and who are required to keep it confidential. After a transaction, your private information (such as credit card details, social security numbers, financial information, etc.) will be securely stored to facilitate renewals and future orders. Data deletion You can request the deletion of your information from our systems at any time. To do so, you may submit a request through our client support ticket system or send an email to [email protected]. Sharing of Data We do not sell, trade, or otherwise transfer your personally identifiable information to outside parties, except when necessary to provide the service you've requested. This does not include trusted third parties who assist us in operating our website, conducting our business, or providing services to you, as long as these parties agree to keep your information confidential. We may also disclose your information if we believe it is necessary to comply with the law, enforce our site policies, or protect the rights, property, or safety of ourselves or others. However, non-personally identifiable visitor information may be shared with other parties for marketing, advertising, or other purposes. Chargebacks In the event of a chargeback, we reserve the right to provide our payment processor with information about you to dispute the chargeback. This information may include: - Proof of Service/Product - IP Address & Access Logs - Account Details - Ticket Transcripts - Service Information - Server Credentials Change to the Policy This Privacy Policy may be updated at any time, with changes reflected immediately on this page. It is your responsibility to review the policy regularly and stay informed of any updates. We may send an email notification if significant changes are made.

Last updated on Feb 26, 2026

Service Level Agreement

Overview We guarantee a 99.99% power and network uptime SLA on a monthly basis for all our services across all locations. Please note that we do not provide SLA compensation for the following events: - Scheduled Maintenance: Any planned or scheduled maintenance activities notified in advance. - Customer-initiated actions: Downtime or issues caused by actions taken by the customer, such as configuration changes, software installation, or mismanagement. - Force Majeure Events: Natural disasters, acts of war, terrorism, or any other events outside our reasonable control. - Third-party Service Failures: Downtime or performance issues caused by third-party services or providers outside of our direct control. - DDoS Attacks: Downtime resulting from Distributed Denial of Service (DDoS) attacks or other similar malicious activities. - Violations of Terms of Service: Any incident resulting from a violation of our terms of service or acceptable use policy. - Performance issues: We do not offer SLA coverage for performance issues on customer servers; however, we will investigate if the problem may be due to our configuration. If you believe your server's performance has degraded, please open a ticket for further assistance. SLA Credits Below is the table outlining the credits we will provide: | Uptime / month | Credit | |---|---| | 99.90% to 99.98% | Service extended by 3 days | | 99% - 99.89% | 50% of your monthly service cost (excluding add-ons e.g premium support, managed service cost, etc) | | Lower than 99% | 100% of your monthly service cost (excluding add-ons e.g premium support, managed service cost, etc) | When monetary credit is applicable, the agreed amount will be credited to your Onidel Cloud account. We reserve the right to determine the validity of any SLA compensation request. SLA Credit Requirements Please note that in order to claim the SLA credits, you must meet the following requirements: - Your account has no outstanding payments. - You have not initiated a chargeback. - A ticket must be created within 48 hours of finalising an SLA that fails to meet the guarantee. - Your service complies with our policies and remains active. Maintenance We will perform scheduled maintenance at a time deemed suitable by us. Should it require any service(s) to be offline for more than thirty (30) minutes, we will post details of the scheduled maintenance at least two (2) days prior. These periods are not included in the SLA calculations. Unscheduled maintenance will be performed as required by us, and should any service(s) be offline for greater than thirty (30) minutes, we will post details of the maintenance and any updates until it has been completed. These periods are not included in the SLA calculations.

Last updated on Mar 07, 2026

Acceptable Usage Policy

Overview All Onidel cloud servers are governed by our Acceptable Usage Policy, which is designed to ensure the fair and responsible use of shared resources. This policy is in place to maintain optimal performance and reliability for all users. CPU Usages Our virtual server plans feature shared, burst-able vCPU cores that can be utilised by multiple users. This model allows us to provide more vCPU cores per plan, delivering better performance for typical workloads since most applications don't require constant maximum CPU utilisation. Your vCPU allocation is designed for burst capacity while maintaining reasonable average utilisation over time. Full vCPU capacity is available for handling traffic spikes, batch processing, and temporary demanding tasks. When hypervisor nodes experience high CPU utilisation, we investigate virtual machines showing consistent peaks or sustained high CPU usage patterns. Virtual machines exhibiting these characteristics may be subject to temporary scheduling adjustments to ensure fair resource distribution. These adjustments appear as CPU steal within your system metrics - if you notice high CPU steal, it typically indicates active CPU throttling. Cryptocurrency Mining Cryptocurrency mining is strictly prohibited. If we detect crypto miners running on your service, it will be suspended or terminated without prior notice. No refunds will be provided if your cloud server is suspended or restricted due to involvement in a cryptocurrency project. Bandwidth Usages Each cloud server is assigned a monthly bandwidth allowance, which varies based on the package you select. The bandwidth is pooled across all services within your account. If your account exceeds the allocated bandwidth, we reserve the right to take actions such as limiting the network speed, suspending the account until the next allocation period, suspending it until additional bandwidth is purchased at an extra cost, requiring an upgrade to a higher-level package, terminating the account, and/or charging an additional fee for the overages. Please note that unused bandwidth does not roll over to the following month. Services advertised with unlimited bandwidth are subject to a fair usage policy to ensure equitable access and performance for all customers. While we strive to provide generous and flexible bandwidth allowances, the following principles apply: - Fair Access: Usage should remain within reasonable levels typical of standard customer activity. Excessive bandwidth consumption that impacts the service quality of other users is not permitted. - Prohibited Activities: The following activities are strictly prohibited under the fair usage policy: - Continuous high-volume data transfers for purposes such as streaming large-scale multimedia content, hosting excessively trafficked platforms, or data mining. - Activities that result in sustained high levels of bandwidth utilisation, such as large-scale content distribution without prior written approval. - Monitoring and Review: Usage patterns may be monitored to ensure compliance. If a service exceeds typical usage levels, we may: - Contact the user to discuss their usage. - Request adjustments to their usage or recommend alternative plans better suited to their needs. - Temporarily throttle or restrict bandwidth to maintain service quality for other customers. - Exceptions: Users requiring consistently high bandwidth levels for legitimate purposes can reach out to us to explore tailored service options. - Enforcement: Violation of this policy may result in warnings, suspension, or termination of the service I/O Usages We don't impose strict guidelines on I/O usage. Our hypervisors utilise Gen 4 NVMe SSDs in distributed storage systems, making I/O usage generally not an issue. However, we expect you to maintain reasonable usage. We reserve the right to limit your I/O if we determine it is negatively affecting other users. Offensive Content You may not publish or transmit any content through Onidel's network that Onidel reasonably believes: - constitutes child pornography; - constitutes pornography; - is excessively violent, incites or threatens violence, or contains harassing content or hate speech; - is unfair or deceptive under consumer protection laws, including chain letters and pyramid schemes; - is defamatory or invades an individual's privacy; - poses a risk to personal or public safety, compromises national security, or interferes with law enforcement investigations; - improperly discloses trade secrets or other confidential/proprietary information; - is intended to help others circumvent technical copyright protections; - clearly infringes on another person's trademark, patent, or other intellectual property rights; - promotes illegal drugs, violates export control laws, relates to illegal gambling, or involves illegal arms trafficking; - is otherwise illegal or solicits illegal conduct under applicable laws; - is malicious, fraudulent, or could provoke retaliation against Onidel by offended viewers; Onidel does not permit the following types of material: - Proxy services, Warez, Escrow services, High Yield Investment Programs (HYIP), illegal gambling, and lottery sites. - Content "published or transmitted" through Onidel's networks, including web content, emails, bulletin board postings, chat, and any other transmissions relying on Onidel's internet services. Onidel reserves the right to terminate services for any of the above reasons and may, at its sole discretion, determine whether to issue a refund. Public VPNs/Proxies/Exit Relays If the Customer operates a public VPN, proxy service, or exit relay, the Customer is responsible for ensuring that users of such services comply with the Onidel's Terms of Service and Acceptable Use Policy. Any violations originating from or transmitted through such services on the Onidel's network will be treated as violations committed by the Customer and may result in suspension or termination of the service. Changes to the Policy This Acceptable Usage Policy may be updated at any time, with changes reflected immediately on this page. It is your responsibility to review the policy regularly and stay informed of any updates. We may send an email notification if significant changes are made.

Last updated on Mar 15, 2026

Terms of Service

Terms and Conditions These terms and conditions define the rules and regulations for using the Onidel Cloud platform, located at https://onidel.com and https://cloud.onidel.com. Please note that these terms and conditions may be updated at any time. By accessing this website, you acknowledge and accept these terms and conditions. If you do not agree with any part of these terms and conditions, please refrain from using Onidel Cloud. The following terminology applies to these Terms and Conditions, our Privacy Statement, the Disclaimer Notice, and all related agreements: - "Customer" refers to the individual or entity that has ordered services provided by Onidel. - "Customer Service" describes the relationship between Onidel staff and the Customer, aimed at assisting the Customer with any inquiries they may have. - "Service", "Service(s)", or "Services" encompasses any product(s) or service(s) that the Customer has signed up for. This may include, but is not limited to, the provision of server space, internet connectivity for web, email hosting, FTP services, domain name registration, transfer or renewal, SSL, and VPS. These product(s) and service(s) are detailed in the "sign up" and "service provision" emails sent by Onidel following the Customer's service request. Specific details of the Services can be found by logging into Onidel control panel or on our website. - "Onidel", "Onidel Cloud", "Company", or "Business" refers to Onidel Pty Ltd. - "We", "Our", or "Us" refers to Onidel Pty Ltd (ABN 67 662 357 397). - "You" or "Your" refers to the Customer. Onidel Services - Onidel will make every effort to provide service to the Customer as quickly as possible after the Customer completes the necessary sign-up forms and makes payment for the service. If Onidel is unable to deliver the requested service, the Customer will be notified within 5 working days and will receive a full refund for any charges paid for that service. - Onidel will deliver its services to the Customer in a manner Onidel deems appropriate. The Customer Agrees To Pay - The Customer agrees to pay Onidel the fees associated with the services provided. These fees must be paid within 7 days of the invoice being sent. Invoices will be sent electronically via email. - Onidel reserves the right to adjust the amount and structure of the fees. The Customer will receive electronic notice of any fee changes, with a 14-day notice period before the changes take effect. If the Customer does not wish to continue using Onidel's services after the fee adjustment, they must notify us within that 14-day period, and we will disconnect their account. If no response is received, we will assume the Customer accepts the revised fees. - If the Customer fails to pay the fees within the specified timeframe, Onidel reserves the right to charge interest at a rate of 15% per year, accruing daily from the due date until payment is received. Onidel may also impose an administrative charge for late payments. - The Customer acknowledges that they are responsible for all fees incurred by anyone using their account login or password, regardless of whether they authorised the use. We strongly advise taking all necessary precautions to ensure the security of account login and password details. - If the Customer provides a credit card or direct debit authorisation, it will be charged upon renewal unless the Customer instructs otherwise. A 14-day notice period is required if the Customer does not wish to have a payment charged against an existing credit card or direct debit authorisation. Account Credit Account Credit means prepaid monetary value that a user adds to their account using an available and approved payment method. Account Credit represents stored value intended solely for the purchase of services offered through the Onidel platform. Each top-up of Account Credit is valid for a period of 3 years from the date on which the respective credit amount is added to the account. After this period, any unused portion of that specific top-up will automatically expire and be permanently forfeited without compensation. When multiple top-ups are made, expiration is calculated separately for each individual top-up based on its original funding date. Onidel reserves the right to correct errors, reverse improperly granted credits, or deduct credits in cases of fraud, chargebacks, payment disputes, or violation of these Terms. Refund Onidel provides a 7-day money-back guarantee, during which customers may request a full refund. After this period, refunds are not available unless Onidel is unable to provision the requested service. Whenever possible, refunds will be issued using the same payment method as the original transaction. Any applicable transaction fees may be deducted from the refunded amount. For services purchased under a Promotional Plan (plan purchased during limited sale or with a promo code), any eligible refund will be issued as Account Credit. All account recharges (top-ups) are final and non-refundable. Billing - Invoices for Customer's service(s) are typically generated at least one week in advance. If payment is not received, Onidel usually suspend Customer's service(s) after the due date, following repeated email reminders. Customer's service(s) may be terminated after one week, although Onidel may extend this period depending on the specific product. - All services are set to auto-renew by default. Onidel will first attempt to use the Customer's account credit to process the renewal on the renewal date. Account credit will only be applied if it is sufficient to cover the full payment. If account credit cannot be used, any saved payment methods will be charged instead. If no payment is successful within 24 hours after the renewal date, the Customer will be responsible for making a manual payment to keep the service(s) active. - If the product page indicates that Customer's service is in a "Suspended" state, there is a high likelihood that Customer's data is still intact. However, if Customer's service(s) is marked as "Terminated" or disappeared, Customer's data and service(s) are likely no longer available. - It is Customer's responsibility to cancel the service(s) through the control panel before the service due date. Failure to do so may result in the payment method on file being charged or the invoice not being properly canceled. Network Restrictions We do not guarantee that any IP address provided with the Service will function with, or be accepted by, third-party services, platforms, or networks that impose access restrictions, filtering, blocking, geolocation limitations, reputation-based controls, or other technical or policy-based limitations. Such restrictions are outside the control of Onidel. Additionally, Onidel does not guarantee that the Services will be reachable or fully functional from networks that implement significant censorship, filtering, firewalling, or other access controls imposed by governments, internet service providers, or organizational network administrators. Connectivity limitations originating from the Customer's local network environment or jurisdiction are not the responsibility of the Service Provider. The Customer is responsible for verifying that our Services can be accessed and used within the network environments in which they intend to operate. Inability to access or use Onidel Services due to network restrictions, censorship, filtering, or other limitations imposed by third parties or the Customer's network environment do not constitute a service defect and are not a valid reason for a refund. Content of Information The Customer agrees to use the Onidel services and products in accordance with the Acceptable Usage Policy and to comply with all reasonable directions and instructions provided by Onidel regarding service use. The Customer also agrees to abide by all relevant laws in their state or territory related to internet use. Onidel respects the Customer's privacy and does not generally monitor or control the content accessed or provided via the Onidel services. However, if Onidel becomes aware of a breach of the Acceptable Usage Policy, it reserves the right to take immediate action, including: - Removing any web pages provided by or to the Customer without notice. - Terminating or suspending the provision of Onidel services to the Customer. - Providing a copy of the infringing material to any legally empowered authority. The Customer acknowledges that Onidel may access the Customer's data, and while Onidel typically respects privacy, in certain cases - such as resource allocation or system checks - Onidel may examine data content. The Customer agrees that in these cases, Onidel will not be held liable for any alleged breach of confidentiality or privacy. Acceptable Usage These Terms and Conditions include and incorporate the Onidel AUP available HERE. Multiple Accounts Multiple accounts are permitted, provided they are not used for the following purposes: - Reusing a one-per-account promotion code - Engaging in fraudulent activities - Evading account closure or bans If you are found to be in violation of this policy, we reserve the right to close any duplicate accounts without issuing a refund. Additionally, the information on all your accounts must be consistent (e.g., full name, address, phone number). If inconsistencies are found, we will contact you to request that the information be updated. IP Change You may request to change the IP address associated with your service. There is a one time $3 USD fee associated with it. Service Transfers A $10 USD transfer fee applies if you wish to move your service to another client account. This fee covers the administrative work involved in the transfer process. Any other methods of service or account ownership transfers are strictly prohibited and will result in immediate termination without refunds of existing services. We require Customer to notify us via Ticket in advance before any ownership of account or service takes place. Location Transfers Transfer of services between different Onidel locations is generally not supported. However, the service may be refunded as account credits if the Customer opened a support ticket shortly after the service was created. Then the Customer may decide to repurchase the service in a different location. Sending Emails By default, we block port 25 and disable email sending across our infrastructure. Customer may request for their port to be unblocked after opening a Ticket and explaining the intended purpose. Once the port is unblocked on the VM, the Customer is entirely responsible for ensuring no spam emails are being sent from Onidel's network and they must adhere to all relevant policies of this Terms of Service document. If we determine you are intentionally sending spam, we reserve the right to charge a $25 USD fee for IP cleaning. Abuse If we receive an abuse complaint regarding your service, you are required to respond within 24 hours. Failure to do so may result in your service being suspended, and if unaddressed for 7 days, it may be terminated. In cases of repeated abuse or intentional acts that could harm our infrastructure, we may take immediate action. For instances of email spamming or other malicious activities, we may impose a fee, such as a $25 USD IP cleaning fee, to cover the administrative work required to remove your IP address from spam databases. Engaging in any illegal activity, or any activity that could negatively impact our infrastructure or damage the reputation of our services and IP ranges, is strictly prohibited. Prohibited activities include, but are not limited to: - Unauthorized Port Scanning, Brute Forcing or Vulnerability Scanning - Malware Distribution or Control Servers - DDoS or DoS Attacks - Phishing Attacks - IP Spoofing - Sending Email Spam - Distributing Copyrighted Content - Distributing or Using Pirated Software - Hosting any content deemed "offensive" in our Acceptable Use Policy - Hosting Public VPNs, Proxies or Exit Relays - unless Onidel's AUP is enforced onto end users Our fair use conditions for resources within our services are detailed in the Acceptable Use Policy. We adhere to the laws of Australia and the laws applicable in the country where your server is located. For example, if your server is based in Singapore, you must comply with both Singapore and Australia laws. It is your responsibility to ensure that all activities on your services are fully legal. Copyrighted content is strictly prohibited on our services. We will take action if we receive repeated copyright complaints, and we do not ignore DMCA requests, which are typically treated as copyright infringement notifications. Disclaimer Onidel will strive to provide the best possible service to the Customer. However, periodic maintenance of the Onidel services is necessary, and during these times, service may be temporarily unavailable. Onidel will make every effort to minimise downtime and, whenever possible, schedule maintenance at times that are least likely to inconvenience the Customer. Given these factors, Onidel cannot guarantee or warrant the availability of its services at all times, nor can it guarantee performance features or compatibility with any cooperating email networks or connected internet services. If Onidel suspects that the Customer is in breach of these Terms and Conditions, it reserves the right to access the Customer's data to investigate the potential breach. Indemnity The Customer indemnifies and holds Onidel harmless against any damages arising from claims brought by the Customer or any other person against Onidel due to the Customer's use of Onidel services, the Customer's negligence, or the Customer's breach of this agreement. Except as otherwise provided by legislation, the Customer acknowledges that Onidel is not liable for any loss or damage the Customer may suffer as a result of using Onidel services or from Onidel's inability to provide those services. Specifically, Onidel accepts no liability for any loss of business, personal inconvenience, or any other damages arising from or alleged to have arisen from the loss or non-provision of services to the Customer or any third party. We expressly exclude any implied warranties from this agreement. If legislation requires us to provide a warranty for our services, the Customer agrees that our liability for any breach of such warranty is limited to: - Resupplying the Onidel service, or - Covering the cost of having the Onidel service resupplied. Protection of Data and the Need for Backing Up Onidel advises that while we will make every effort to preserve the integrity of your data, we are NOT liable for any loss or damage to your data. We strongly recommend that you create and maintain independent backup copies of all data stored or accessed through the Onidel services. Our Right of Termination Onidel reserves the right to immediately terminate this agreement without prior notice to the Customer if: - It is discovered that the Customer has breached this agreement. - The Customer becomes bankrupt, enters liquidation, or has a receiver appointed over their assets. - Any account payable by the Customer remains unpaid for more than seven (7) days. - Any other reasonable cause, as determined at Onidel's sole discretion. In addition to our right to terminate, we may suspend the Customer’s account without notice if it becomes overdue. Should we choose to reconnect the account - which we are not obligated to do - the Customer will be required to pay the applicable reconnection fee. Privacy These Terms and Conditions include and incorporate the Onidel privacy policy available HERE. Complaints If you have a complaint or issue with our service, we encourage you to contact us. We will acknowledge your message within 3 working days of receipt and will make every reasonable effort to respond to your concerns within 7 working days. Our goal is to resolve your complaint as quickly as possible. If you are not satisfied with our proposed resolution, please let us know. We are open to further discussion and can advise you on third-party resolution options that may be available to you, depending on the situation. You can reach out to us via support ticket or via [email protected].

Last updated on Mar 29, 2026

Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of and is incorporated into the Onidel Cloud Terms of Service (“Agreement”) between: Onidel Pty Ltd (ABN 67 662 357 397), an Australian proprietary company (“Onidel” or “Data Processor”); and The Customer identified in the applicable Onidel Cloud account (“Customer” or “Data Controller”). Together referred to as the “Parties” and each a “Party.” 1. Purpose and Scope This DPA sets out the obligations of Onidel when processing personal information or other data on behalf of the Customer in connection with the provision of cloud infrastructure services, including virtual private servers, block storage, object storage, and related services (the “Services”). This DPA is intended to ensure compliance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles and the Notifiable Data Breaches (“NDB”) scheme under Part IIIC of the Privacy Act, as well as any other applicable Australian data protection laws and regulations. For the purposes of this DPA: • “Customer Data” means all data, including personal information as defined in the Privacy Act 1988 (Cth), that the Customer stores, transmits, or processes using the Services. • “Data Breach” means any unauthorised access to, disclosure of, or loss of Customer Data, or any event that is, or is likely to be, an “eligible data breach” within the meaning of Part IIIC of the Privacy Act 1988 (Cth). • “Sub-processor” means any third party engaged by Onidel that has access to or processes Customer Data in connection with the delivery of the Services. 2. Data Handling Obligations 2.1 Processing Instructions Onidel shall process Customer Data only in accordance with the Customer’s documented instructions and solely for the purpose of providing the Services. Onidel will not process Customer Data for any independent purpose, including marketing, analytics, profiling, or any purpose unrelated to the delivery of the Services. 2.2 Prohibition on Unauthorised Access Onidel shall not access, use, copy, modify, or disclose Customer Data except as: (a) Strictly necessary to deliver, maintain, or support the Services; (b) Required by applicable Australian law or a valid order of an Australian court or regulatory authority; or (c) Expressly authorised in writing by the Customer. Where Onidel is compelled by law to access or disclose Customer Data, Onidel will, to the extent permitted by law, promptly notify the Customer of such requirement before making the disclosure. 2.3 Infrastructure-Only Access The Customer acknowledges that Onidel provides infrastructure-as-a-service. Onidel’s personnel may access the underlying hypervisor, storage, and network infrastructure for operational purposes (such as hardware maintenance, security patching, and incident response), but will not access the contents of Customer Data except as set out in clause 2.2. 2.4 Account Data Onidel collects and stores Customer account information (such as name, email address, billing details, and contact information) for the purpose of administering the Services. Customer account passwords are stored using industry-standard one-way cryptographic hashing and are not stored in plain text. Sensitive information shared by the Customer via support tickets (such as credentials, access keys, or similar material) is automatically purged from the ticketing system after 7 days. 3. Security — Shared Responsibility Model Onidel operates an infrastructure-as-a-service platform. Security is a shared responsibility between Onidel and the Customer. Onidel is responsible for securing the physical infrastructure, hypervisor, storage hardware, and network infrastructure. The Customer is responsible for securing the guest operating system, applications, and data within their provisioned instances. 3.1 Shared Responsibility Summary The following table summarises the division of security responsibilities: 3.2 Onidel’s Security Obligations Onidel implements and maintains the following security measures for the infrastructure under its control: - Encryption in transit: All management, API, and control-plane communications are encrypted using TLS 1.2 or higher. - Access controls: Role-based access limited to personnel whose roles require infrastructure access for the delivery of the Services, with multi-factor authentication for administrative access to production systems. - Monitoring and logging: Logging and monitoring of administrative access to infrastructure components, with regular review of access privileges to ensure compliance with the principle of least privilege. - Physical security: All data centre facilities provide enterprise-grade physical security including biometric or multi-factor access controls, 24/7 monitoring, CCTV surveillance, and environmental protections. Details of each facility are set out in Schedule 1. 3.3 Customer’s Security Obligations The Customer is solely responsible for: - Implementing encryption of data at rest within provisioned instances where required by applicable law or the Customer’s regulatory obligations (for example, using full-disk encryption such as LUKS/dm-crypt or application-level encryption); - Securing and patching the guest operating system and all software installed within provisioned instances; - Managing user access, authentication, and authorisation within provisioned instances; - Implementing application-level firewalls, intrusion detection, and security monitoring; - Maintaining backups of Customer Data in accordance with the Customer’s own business continuity and disaster recovery requirements; and - Classifying data and ensuring the Services selected are appropriate for the sensitivity and regulatory requirements of the Customer’s data. 3.4 Confidentiality All Onidel employees and contractors with access to infrastructure on which Customer Data may reside are bound by written confidentiality obligations. These obligations survive the termination of their employment or engagement. 4. Sub-processors 4.1 Current Sub-processors Onidel engages the following sub-processors in connection with the delivery of the Services. Only sub-processors relevant to the Customer’s selected data centre location(s) apply to the Customer’s deployment. An up-to-date list of Onidel data centre locations and facilities is maintained at: https://kb.onidel.com/hc/kb/articles/1756088660-datacenters 4.2 Sub-processor Obligations Onidel ensures that each sub-processor is bound by data protection obligations no less protective than those set out in this DPA, including confidentiality, security, and restrictions on data use. 4.3 Notification of New Sub-processors Onidel will provide the Customer with at least 30 days’ prior written notice before engaging any new sub-processor that would have access to Customer Data. The notice will include the identity of the sub-processor, the nature of the processing, and the location of processing. 4.4 Right to Object The Customer may object to the engagement of a new sub-processor by providing written notice to Onidel within 14 days of receiving notification. Onidel will work in good faith with the Customer to address the objection, which may include providing an alternative sub-processor. If the Parties are unable to resolve the objection within a reasonable period, the Customer may terminate the affected Services without penalty on 30 days’ written notice. 5. Data Breach Notification 5.1 Notification Timeframe In the event Onidel becomes aware of a suspected or confirmed Data Breach affecting Customer Data, Onidel will notify the Customer without undue delay and in any event within 72 hours of becoming aware of the breach. Notification will be made via the Customer’s registered email address and, where applicable, through the Onidel control panel. 5.2 Content of Notification The breach notification will include, to the extent known at the time: - A description of the nature of the breach, including the categories and approximate volume of data affected; - The likely consequences of the breach; - The measures taken or proposed to be taken by Onidel to address the breach and mitigate its effects; and - A contact point at Onidel for further information. 5.3 Cooperation with NDB Obligations Onidel will provide reasonable assistance to the Customer in meeting the Customer’s own obligations under the NDB scheme, including providing information and cooperation necessary for the Customer to assess whether an eligible data breach has occurred and to prepare any notification to the Office of the Australian Information Commissioner (“OAIC”) or affected individuals. 5.4 Scope of Breach Notification For the avoidance of doubt, Onidel’s breach notification obligations under this clause 5 apply only to breaches of the infrastructure, systems, or networks under Onidel’s control. Security incidents originating within the Customer’s provisioned instances (such as application vulnerabilities or compromised credentials) are the Customer’s responsibility to detect, assess, and report. 6. Data Location 6.1 Data Residency Customer Data is stored and processed in the data centre location(s) selected by the Customer at the time of provisioning. Onidel will not replicate, transfer, or store Customer Data to any location other than the Customer’s selected data centre location(s) without the Customer’s prior written consent. 6.2 Australian Data Residency Where the Customer has provisioned Services exclusively in Onidel’s Sydney data centre (Equinix SY3, Alexandria, NSW), Customer Data will remain within Australia. This may assist the Customer in meeting obligations under the Privacy Act regarding cross-border disclosure of personal information. 6.3 Multi-Region Deployments If the Customer elects to provision Services in data centres located outside Australia, the Customer acknowledges that Customer Data will be stored in the selected jurisdiction(s). In such cases, the Customer is solely responsible for ensuring compliance with the Privacy Act and any other applicable requirements regarding cross-border disclosure of personal information. 7. Customer Rights 7.1 Evidence of Compliance Upon the Customer’s written request (no more than once per 12-month period unless a Data Breach has occurred), Onidel will provide the Customer with a summary of its security measures, compliance status, and any relevant audit reports or certifications held by Onidel or its data centre providers. Onidel may satisfy this obligation by providing third-party audit reports, SOC reports from its data centre providers, or an attestation signed by an authorised officer. 7.2 Right to Object to Sub-processors The Customer’s right to object to sub-processors is set out in clause 4.4 above. 7.3 Data Portability and Access During the term of the Agreement, the Customer retains full access to Customer Data through the Services and may export or retrieve Customer Data at any time using the tools and interfaces provided by Onidel. 8. Data Deletion and Return on Termination Upon termination or expiry of the Agreement, or upon the Customer’s written request: (d) Onidel will continue to make Customer Data available for retrieval for a period of 14 days following termination (“Retrieval Period”); (e) Following the expiry of the Retrieval Period, Onidel will delete all Customer Data from its systems within 30 days of the termination date, including any copies, backups, or replicas, except to the extent that retention is required by applicable Australian law; and (f) Upon the Customer’s request, Onidel will provide written confirmation that deletion has been completed. The Customer acknowledges that once Customer Data has been deleted, it cannot be recovered. 9. Governing Law and Jurisdiction This DPA is governed by and construed in accordance with the laws of the State of New South Wales and the Commonwealth of Australia, including the Privacy Act 1988 (Cth). The Parties submit to the non-exclusive jurisdiction of the courts of New South Wales. 9.1 Cooperation with Regulatory Authorities Onidel will cooperate with any inquiry, investigation, or determination by the OAIC or any other Australian regulatory authority in connection with the processing of Customer Data under this DPA, to the extent such cooperation is required by law or reasonably requested by the Customer. 10. Term and Amendment This DPA commences on the Effective Date and remains in force for the duration of the Agreement. It will automatically terminate upon termination or expiry of the Agreement, subject to any surviving obligations (including data deletion under clause 8 and confidentiality under clause 3.4). This DPA may only be amended by written agreement signed by both Parties. 11. Conflict In the event of any conflict between this DPA and the Agreement (including the Onidel Terms of Service and Privacy Policy), the terms of this DPA will prevail to the extent of the inconsistency with respect to matters relating to data processing and data protection. 12. Contact For any queries relating to this DPA, the Customer may contact Onidel at: - Email: [email protected] - Support portal: https://cloud.onidel.com (Support Tickets)

Last updated on Mar 31, 2026