Legal
Data Processing Addendum
Last updated: 15 October 2026.
1. Scope and parties
This Data Processing Addendum (“DPA”) is between you, the customer (“you”), and Search Ventures Pty Ltd (ACN 639 906 353) as trustee for the Ahlgren Trust, trading as Finance Calendar API (“we”, “us”). It forms part of the Terms of Service and applies whenever we process Customer Personal Data while providing the Service. It needs no signature. If you need a signed copy for your records, ask through the contact form.
Where this DPA and the Terms of Service differ on the processing of personal data, this DPA applies.
2. Roles
For Customer Personal Data, you are the controller and we are your processor. “Customer Personal Data” means personal data of your staff and contractors that we process to provide the Service to you. For your account and billing relationship with us, we act as an independent controller under our Privacy Policy.
3. Details of the processing
| Subject matter | Providing the Finance Calendar API to you |
| Duration | The term of your subscription, then deletion under section 9 |
| Nature and purpose | Signing in, authenticating API requests, applying plan limits, showing usage, support |
| Types of personal data | Email addresses; IP addresses and times of sign-in requests and API requests; API key labels |
| Data subjects | Your staff and contractors who use the Service, and people whose systems send requests with your keys |
| Special categories | None. The calendar data itself contains no personal data. |
4. Our obligations
We will:
- process Customer Personal Data only on your documented instructions, which are the Terms of Service and your use and configuration of the Service, unless the law requires otherwise, in which case we will tell you first where the law allows
- make sure the people who process it are bound by confidentiality
- protect it with the measures described on our Security page, which we may improve but will not materially weaken
- help you, as far as reasonably possible, to answer requests from data subjects and to meet your obligations on security, breach notification and impact assessments
- tell you without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting Customer Personal Data, with the information you reasonably need to meet your own obligations
5. Subprocessors
You authorise us to use these subprocessors:
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, storage, email delivery, bot protection | Global network, including the United States and Australia |
| Stripe, Inc. and its affiliates | Payments, subscriptions, invoices, billing portal | United States and other countries |
We impose data protection terms on each subprocessor that protect Customer Personal Data to the standard of this DPA, and we remain responsible for their performance. We will give you at least 30 days’ notice by email before adding or replacing a subprocessor. If you object on reasonable data protection grounds and we cannot address the objection, you may cancel your subscription before the change takes effect and we will refund any period paid for but not provided.
6. International transfers
Customer Personal Data may be processed outside the country where it was collected, including in the United States. Where the GDPR or UK GDPR applies to a transfer, it is covered by the Standard Contractual Clauses, or the UK addendum to them, in our subprocessors’ data processing terms, or by another mechanism the law recognises.
7. Australian Privacy Act
Where the Privacy Act 1988 (Cth) applies, we handle Customer Personal Data in line with the Australian Privacy Principles, as described in our Privacy Policy.
8. Audits
On reasonable request, no more than once a year, we will give you the information you reasonably need to confirm we meet this DPA, including our subprocessors’ current security certifications and audit reports where they make them available.
9. Deletion and return
We delete Customer Personal Data within 30 days of a deletion request, or of the account being closed, except billing records the law requires us to keep, which we keep only for that purpose.
10. Contact
Data protection questions and requests: the contact form, choosing “Privacy or data request”, or by post to Search Ventures Pty Ltd, PO Box 255, Bli Bli QLD 4560, Australia.