These Subscription Terms apply to every order form for the iShapps service (an **Order Form**) agreed between {{provider.name}} (ABN {{provider.abn}}), trading as iShapps (the **Provider**), and its customer (the **Customer**). The Order Form and these Terms, including Schedules 1 to 3, together form the agreement between them.

If the documents conflict, they apply in this order: the Order Form, then the Schedules, then these Subscription Terms.

## 1. Definitions

- **Add-on** means an optional service listed in Schedule 1 or the Order Form that is charged in addition to the Subscription Fees, including SMS notifications and services supplied through a Third-Party Provider.
- **Billable User** has the meaning given in Schedule 1.
- **Billing Month** means a calendar month, determined in Australian Western Standard Time.
- **Customer Data** means all data, documents and information that the Customer or its Users enter into or upload to the Service, including personal and health information about Workers, Participants and other individuals.
- **Order Form** means an order for the Service that names the Customer, its Plan and the commercial terms, whether signed on paper or accepted electronically in the Service by an authorised person for the Customer. The Customer can see each Order Form it has accepted in the Service.
- **Organisation** means a client organisation or facility group of the Customer that is set up in the Service to receive Shifts.
- **Participant** means a person receiving care or support from the Customer whose details are entered into the Service.
- **Plan** means the subscription package named in the Order Form.
- **Service** means the iShapps workforce management platform, including the web application, the mobile application, and related documentation, as updated from time to time.
- **Shift** means a period of work created in the Service and assigned to a Worker.
- **Sub-admin** means a User the Customer authorises to administer its account, other than the Super-admin.
- **Super-admin** means the single primary administrator account created for the Customer when its account is set up.
- **Third-Party Provider** means a supplier of a service that integrates with or is delivered through the Service but is not operated by the Provider.
- **User** means any individual given access to the Service under the Customer's account, including the Super-admin, Sub-admins, Workers, and Organisation or facility users.
- **Worker** means a care worker or other health care professional engaged by the Customer and given a Worker account in the Service.

Headings are for convenience only. "Including" means including without limitation. A reference to legislation includes any amendment or replacement of it.

## 2. The Service

1. The Provider grants the Customer a non-exclusive, non-transferable right for its Users to access and use the Service during the term, for the Customer's internal business purposes, within the limits of its Plan.
2. The Provider may improve, update or change the Service. It will not make a change that materially reduces the core functionality of the Customer's Plan during the current term without the Customer's agreement.
3. The Customer may not exceed its Plan's Organisation limit. The Service prevents new Organisations from being created once the limit is reached; to go beyond it, the Customer must move to a higher Plan. Billable Users above the Plan's maximum are charged as set out in Schedule 1.
4. On moving to a lower Plan, the Customer must first archive Organisations to bring its account within the lower Plan's limits. Archiving does not delete Customer Data.

## 3. Fees and billing

1. The Customer must pay the Subscription Fees and Add-on charges set out in the Order Form and Schedule 1.
2. Fees are calculated per Billing Month and invoiced monthly in arrears. Each invoice will list the Billable Users counted for that Billing Month and the Add-on usage charged. The Customer can see its charges so far for the current Billing Month in the Service at any time.
3. All fees are in Australian dollars and exclude GST. GST is added to each invoice where it applies.
4. Invoices are payable within the period stated in the Order Form. If an amount remains unpaid 14 days after its due date, the Provider may give written notice and, if it is still unpaid 14 days after that notice, suspend the Service under clause 14 until it is paid.
5. The Provider may change its fees by giving at least 60 days' written notice. A change takes effect from the start of the next renewal term. If the Customer does not accept the change, it may end the agreement by giving notice before the change takes effect, without penalty.
6. If the Customer disputes an invoice in good faith, it must tell the Provider in writing within 14 days of receiving it and pay the undisputed part. The parties will work to resolve the dispute promptly using the billing report for that Billing Month.

## 4. Customer responsibilities

1. **Compliance stays with the Customer.** The Service is a tool to help the Customer manage its workforce. The Customer remains solely responsible for its own legal and regulatory obligations, including worker screening and credential checks, the aged care and NDIS rules that apply to it, workplace health and safety, award and pay obligations, and the care it delivers.
2. **Document checks support, and do not replace, the Customer's judgement.** Certification tracking, expiry reminders and automatic status changes in the Service depend on the information entered into it. They do not verify that a document is genuine or that a Worker is suitable for a Shift. The Customer must review and approve documents itself.
3. The Customer is responsible for the accuracy and lawfulness of Customer Data, and for having all consents and notices needed for the Provider to process it under this agreement.
4. The Customer is responsible for its Users. It must make sure they keep their login details secure, use the Service in line with this agreement, and that access is removed promptly when a User leaves.
5. The Customer must tell the Provider promptly if it becomes aware of any unauthorised access to its account.

## 5. Acceptable use

The Customer must not, and must make sure its Users do not:

- use the Service for anything unlawful, harmful or fraudulent;
- upload malicious code or material that infringes another person's rights;
- try to gain unauthorised access to the Service or another customer's data, or test its security without the Provider's written permission;
- copy, reverse engineer, resell or provide the Service to anyone else, except as this agreement allows;
- use the Service in a way that places an unreasonable load on it, including use well beyond the email and storage allowances of its Plan; or
- share one User's login between several people.

## 6. Customer Data and privacy

1. The Customer owns its Customer Data. The Customer grants the Provider a licence to host, process and use Customer Data only to provide, support, secure and improve the Service, and as required by law.
2. The Provider may use aggregated data that does not identify the Customer or any individual to operate and improve the Service.
3. Each party must comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles as they apply to it. Customer Data may include health information, which is sensitive information under that Act.
4. The Provider processes Customer Data in line with Schedule 2, including its list of subprocessors.

## 7. Security and data breaches

1. The Provider will maintain reasonable technical and organisational security measures to protect Customer Data, as described in Schedule 2.
2. If the Provider becomes aware of unauthorised access to, disclosure of, or loss of Customer Data, it will notify the Customer without undue delay and in any event within 72 hours. It will give the Customer the information it reasonably needs to assess the incident, and cooperate with the Customer's response.
3. Each party will cooperate so that any assessment and notification required under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 can be completed on time. Unless the parties agree otherwise, the Customer is responsible for notifying affected individuals and the Office of the Australian Information Commissioner about breaches involving its Customer Data.

## 8. Data on termination

1. For 30 days after this agreement ends, the Customer may export its Customer Data using the Service's export features, or ask the Provider to provide an export in a standard format.
2. After that period the Provider will delete Customer Data from the Service within a further 60 days, and from backups as they expire in the normal 7-day backup cycle, unless the law requires it to keep the data longer.

## 9. Intellectual property

1. The Provider and its licensors own all intellectual property in the Service. Nothing in this agreement transfers it to the Customer.
2. If the Customer gives suggestions or feedback about the Service, the Provider may use them freely, without obligation to the Customer.

## 10. Confidentiality

1. Each party must keep the other's confidential information confidential and use it only for the purposes of this agreement. Customer Data is the Customer's confidential information. Non-public details of the Service and its pricing are the Provider's.
2. This does not apply to information that is public through no fault of the recipient, that the recipient already had or develops independently, or that must be disclosed by law, in which case the recipient will give notice where it lawfully can.

## 11. Warranties

1. Each party warrants that it has authority to enter into this agreement.
2. The Provider warrants that it will provide the Service with due care and skill, and substantially in line with its documentation.
3. Except as stated in this agreement, the Service is provided without other warranties. The Provider does not warrant that the Service will be uninterrupted or error-free.
4. Nothing in this agreement excludes, restricts or modifies any right or remedy under the Australian Consumer Law that cannot lawfully be excluded. Where the Provider's liability for failing to comply with a consumer guarantee can lawfully be limited, it is limited to supplying the services again or paying the cost of having them supplied again.

## 12. Liability

1. Neither party is liable to the other for any loss of profit, revenue or opportunity, or any indirect or consequential loss, however caused.
2. Each party's total liability under or in connection with this agreement in any 12-month period is limited to the fees paid and payable by the Customer under this agreement in the 12 months before the event giving rise to the claim.
3. For a breach of clause 6 or clause 7 (data and security), the cap in clause 12.2 is increased to two times that amount.
4. The caps in this clause do not apply to the Customer's obligation to pay fees, to a party's fraud or wilful misconduct, or to liability that cannot be limited by law.
5. Each party's liability is reduced to the extent the other party, or its personnel or Users, contributed to the loss.

## 13. Indemnity

1. The Provider will defend the Customer against any claim that the Service infringes a third party's Australian intellectual property rights, and pay the amounts finally awarded, provided the Customer notifies it promptly and lets it control the defence.
2. The Customer will indemnify the Provider against third-party claims arising from Customer Data, or from the Customer's breach of clause 4 or clause 5.

## 14. Suspension

1. The Provider may suspend access to the Service, in whole or in part, if fees remain unpaid as set out in clause 3.4, or if suspension is reasonably needed to prevent a serious security risk or unlawful use.
2. The Provider will give notice before suspending where it reasonably can, will limit the suspension to what is needed, and will restore access promptly once the cause is resolved. Customer Data is not deleted during a suspension.

## 15. Term and termination

1. This agreement starts on the Start Date and continues for the Initial Term, then renews as stated in the Order Form.
2. Either party may end this agreement by written notice if the other party materially breaches it and does not remedy the breach within 30 days of being notified, or becomes insolvent.
3. When this agreement ends, the Customer's access ends, the Customer must pay all fees due up to the end date, and clause 8 applies to Customer Data. Clauses that by their nature continue (including 6, 8, 9, 10, 12 and 13) survive.

## 16. Changes to these terms

1. The Provider may update these Subscription Terms by giving the Customer at least 30 days' written notice. A change that does not disadvantage the Customer, or that is required by law, may take effect sooner.
2. If a change materially disadvantages the Customer, the Customer may end this agreement by giving notice before the change takes effect, and will receive a refund of any fees paid in advance for the period after termination. Otherwise the change applies from its stated date.

## 17. General

1. **Notices** must be in writing and sent by email to the contacts in the Order Form, or another address a party nominates.
2. **Subcontracting:** the Provider may use subcontractors and subprocessors to provide the Service and remains responsible for them.
3. **Assignment:** neither party may assign this agreement without the other's consent, which must not be unreasonably withheld, except that either party may assign it to a buyer of all or most of its business on notice.
4. **Force majeure:** neither party is liable for delay or failure caused by events beyond its reasonable control, other than an obligation to pay money.
5. **Disputes:** the parties will first try to resolve any dispute through good-faith discussions between senior representatives for 30 days before starting proceedings, except for urgent relief.
6. **Governing law:** this agreement is governed by the laws of Western Australia. The parties submit to the non-exclusive jurisdiction of its courts.
7. **Entire agreement:** the Order Form, these Subscription Terms and the Schedules are the entire agreement between the parties on their subject matter. If any provision is invalid, it is severed and the rest continues.

## Schedule 1 — Fees, Billable Users and Add-ons

The Customer pays each Billing Month for the greater of its Billable Users and its Plan's minimum, plus any Add-ons used. Plan prices are those in the Customer's Order Form.

### S1.1 Plans

{{plans.table}}

Each Plan also includes the email, file-storage and feature allowances published for it at the Start Date.

### S1.2 Billable Users

1. A Billable User for a Billing Month is each of the following, counted once:
   - each Sub-admin whose account is active in the Service, counted at the end of the Billing Month; and
   - each Worker who started at least one Shift whose scheduled start time falls within the Billing Month. A Shift counts once it has been started in the Service, by the Worker or by the Customer for them, even if it is later cancelled or not approved.
2. The following are not Billable Users: the Super-admin; Organisation and facility users; iShapps support accounts; and Workers who did not start a Shift in the Billing Month, whatever their account status (for example Onboarding, Ready to approve, Active, On hold, Deactivated or Archived).
3. The Customer's Billable Users and charges so far for the current Billing Month are shown in the Service. The final count for a Billing Month is made after it ends. A Shift that starts in one Billing Month and finishes in the next is counted in the month of its scheduled start.
4. If the Customer's Billable Users exceed its Plan's maximum in a Billing Month, the Provider will charge the excess at the Plan's fee for that month and may require the Customer to move to a higher Plan from the next Billing Month.

### S1.3 Organisations

The Customer may have up to its Plan's Organisation limit of non-archived Organisations at any time. The Service does not allow more to be created; creating more requires a higher Plan.

### S1.4 Add-ons

| Add-on | Price (A$, ex GST) | Applies |
| --- | --- | --- |
| SMS notifications | {{sms.price}} per SMS message part sent | Only on Plans that include SMS, when SMS is switched on for the Customer |
| Third-party services (for example integrations, telephony or identity checks) | As stated in the Order Form or the Provider's written quote | Only when the Customer opts in |

1. Add-ons are billed monthly in arrears on actual usage.
2. An SMS message is sent in parts: one part holds up to 160 standard characters, and a longer message is split into parts of up to 153 characters each. A message containing emoji or other special characters holds up to 70 characters, or 67 per part when split. Each part is charged. Verification codes sent by the Service are not charged.
3. The Provider will notify the Customer at least 30 days before changing an Add-on price. The Customer may ask for an Add-on to be switched off at any time.
4. Where an Add-on is supplied by a Third-Party Provider, its availability depends on that provider, and the Customer may need to accept that provider's terms.

## Schedule 2 — Data processing and subprocessors

The Provider processes Customer Data only to provide the Service, on the Customer's instructions as set out in this agreement.

### S2.1 Data processed

- **Individuals:** the Customer's Sub-admins, Workers, job applicants, Organisation and facility contacts, and Participants.
- **Data:** contact and identity details; employment and compliance documents (such as police checks, identification and professional registrations); job applications and CVs; bank account and superannuation details for pay; Shift, attendance and timesheet records, including location at clock-in and during Shifts; electronic signatures on contracts and policies and their signing records (time, IP address and device); Participant details and progress notes (which may include health information); messages sent through the Service; and billing records.

### S2.2 Security measures

- Each customer's data is held in its own separate database on a shared database server, and its files under a separate storage location.
- Data is encrypted in transit using TLS, and encrypted at rest in the database and in file storage.
- Access to the Service is controlled by role-based permissions. Provider staff access Customer Data only when needed to provide support or operate the Service.
- Databases are backed up daily, and each backup is kept for 7 days.
- Security updates are applied to the platform and its infrastructure in a timely way.

### S2.3 Subprocessors

The Provider uses the subprocessors below. It will give the Customer at least 30 days' notice before adding or replacing one. If the Customer reasonably objects on data-protection grounds, the parties will discuss it in good faith, and the Customer may end the agreement if they cannot resolve the objection.

| Subprocessor | Purpose |
| --- | --- |
| DigitalOcean | Application and database hosting |
| Amazon Web Services (S3) | Document and file storage, and database backups |
| Cloudflare | Web application delivery, DNS and bot protection |
| SMTP2Go | Transactional email delivery |
| OneSignal | Mobile push notifications |
| Google (Maps Platform) | Address lookup and location services |
| Mobile Message | SMS notifications, if enabled |
| JustCall | Click-to-call from the admin panel, if enabled |
| Microsoft (Teams / Power Automate) | Shift notifications to the Customer's Teams, if enabled |

The Service's hosting, files and backups are in Australia. Some subprocessors may process limited Customer Data, such as names, contact details and notification content, outside Australia, including in the United States. The Provider takes reasonable steps, in line with Australian Privacy Principle 8, to make sure overseas recipients handle it consistently with the Australian Privacy Principles.

### S2.4 Assistance

The Provider will give reasonable help with the Customer's privacy obligations, including access and correction requests from individuals and data-breach assessments.

## Schedule 3 — Support and service levels

The Provider aims to keep the Service available 99.5% of each month, excluding scheduled maintenance and events outside its reasonable control.

### S3.1 Support

- **Channels:** email to {{support.email}} and phone on {{support.phone}}.
- **Hours:** 8:30am–5:00pm AWST, Monday to Friday, excluding Western Australian public holidays. P1 — Critical issues can be reported by phone at any time.

### S3.2 Response targets

| Priority | Example | Target first response |
| --- | --- | --- |
| P1 — Critical | Service unavailable, or Shifts cannot be created or worked | 2 hours, at any time |
| P2 — High | A core feature is not working and there is no workaround | 2 business hours |
| P3 — Normal | A minor fault, or a feature works with a workaround | 2 business hours |
| P4 — Request | A question, how-to or feature request | 1 business day |

### S3.3 Maintenance

Scheduled maintenance will be carried out where practical between 10:00pm and 6:00am AWST. The Provider will give at least 48 hours' notice of maintenance expected to interrupt the Service.

These are targets, not guarantees.