Customer Policies Pack

1. Purpose and Scope

This Customer Policies Pack sets out key customer-facing policies for Valour Compliance, operated by DRRP Corp Pty Ltd, including cancellation, refunds, and how customer data is stored, retained, and used.

These policies apply to customers located in Australia and to customer data that is stored and processed in Australia in accordance with DRRP Corp Pty Ltd's data residency posture.

2. Definitions

• Account Administrator: an authorised user who can manage subscription, billing, and account settings.
• Billing Period: the period covered by a subscription payment (e.g., monthly or annual).
• Cancellation Effective Date: the date on which cancellation takes effect (typically the end of the current Billing Period).
• Customer / You: the subscribing organisation or the individual account holder (as applicable).
• Content: information you submit to the Service, including information, questionnaire responses, evidence, and generated outputs (gap reports, action plans and related artefacts).
• Outputs: reports, gap analysis results, prioritised action lists and other results generated by the Service.
• Post-Cancellation Retention Window: a 30-day window following the Cancellation Effective Date during which Your Content is retained to enable reactivation.
• Download Window: a 30-day period following the Cancellation Effective Date during which you may download/export Outputs generated prior to cancellation.
• Read-Only Status: account access that permits viewing Content and previously generated Outputs, but does not permit generating new reports/assessments or creating new outputs.
• Subscription Tier Limits: limits that may apply to a plan, including maximum active users and maximum reports/assessments generated per month (or per Billing Period).
• Some tiers may limit assessment cycles and/or export/sharing features for Outputs.

3. Cancellation Policy

3.1 How to Cancel

You can cancel your Valour Compliance subscription via your account settings or by contacting DRRP Corp Pty Ltd support using the channels listed in Valour Compliance. Cancellation requests must be made in writing by an Account Administrator.

3.2 When Cancellation Takes Effect

Unless otherwise required by law, cancellation takes effect on the Cancellation Effective Date, which is typically the end of your current Billing Period. You will retain paid access until then.

3.3 Access After Cancellation (Read-Only)

After the Cancellation Effective Date, you will not be able to access your account or any previously generated Outputs.

3.4 Reactivation

You may reactivate your subscription anytime prior to the Cancellation Effective Date. Reactivation takes effect once payment has been successfully processed.

If you reactivate prior to the Cancellation Effective Date, you will not lose previously generated Outputs or uploaded Content, subject to Subscription Tier Limits and these policies.

3.5 Subscription Tier Limits

Assessment cycles may be limited per time period (e.g., per month or Billing Period), and certain tiers may restrict exporting/sharing functionality.

Subscription tiers may include limits (which may be multi-factored) such as:

• maximum number of active users per account; and/or
• maximum number of reports/assessments that can be generated per month (or per Billing Period); and/or
• maximum number of regulations accessible.

Tier limits are displayed in Valour Compliance and/or on the Pricing page.

3.6 After Cancellation

After Cancellation, DRRP Corp Pty Ltd may disable access and delete or de-identify Content in accordance with the Data Retention Policy, except where retention is required by law or for legitimate security, fraud prevention, or dispute resolution purposes.

4. Refund Policy

4.1 Australian Consumer Law

Nothing in this Refund Policy excludes, restricts, or modifies your rights under the Australian Consumer Law (ACL). Where ACL applies, you may be entitled to remedies (including a refund) in certain circumstances (e.g., a major failure).

4.2 Subscription Fees and Change-of-Mind

Unless required by ACL or otherwise stated in a written agreement, subscription fees are non-refundable for change-of-mind. Cancelling stops renewal and you retain paid access until the Cancellation Effective Date.

4.3 Billing Errors

If you believe you were incorrectly charged, contact DRRP Corp Pty Ltd support within 14 days of the charge with your account identifier and transaction details. If we confirm a billing error, we will issue a refund or credit as appropriate.

4.4 Service Issues

If Valour Compliance is materially unavailable or defective, we will assess remedies in line with ACL and any applicable service commitments. Remedies may include service credits, partial refunds, or full refunds in limited cases, depending on impact and circumstances.

4.5 Tier Limits and Refunds

Hitting a Subscription Tier Limit (e.g., active users or reports generated per month) does not generally entitle you to a refund. The appropriate option is typically to upgrade or wait until the next billing period, unless required by ACL.

5. Data Storage Policy

5.1 Data Residency (Australia Only)

DRRP Corp Pty Ltd's policy is to store and process customer data in Australia only. Valour Compliance is configured to use Australian data centres for hosting and storage. DRRP Corp Pty Ltd does not intentionally store Content offshore and selects vendors/subprocessors accordingly.

5.2 What Data We Store

Depending on your use of Valour Compliance, we may store:

• account details (e.g., name, email, role, organisation);
• Content (uploaded documents, responses, evidence, and generated Outputs);
• usage logs (e.g., audit logs, access logs, support interactions);
• billing details as required for invoicing/receipts (payment processing is typically handled by third‑party payment providers; we do not store full card details where a provider is used).

5.3 Security Controls (High Level)

We use reasonable safeguards appropriate to the sensitivity of Content, such as access controls, encryption in transit (and where applicable at rest), logging and monitoring, and vendor due diligence.

5.4 Subprocessors

Where DRRP Corp Pty Ltd uses third‑party subprocessors (e.g., hosting, support, communications, analytics), DRRP Corp Pty Ltd will take reasonable steps to ensure they are configured to store/process relevant customer data in Australia, consistent with this policy.

6. Data Retention Policy

6.1 Retention Principles

We retain Content only for providing Valour Compliance, maintaining security, complying with legal obligations, resolving disputes, and enforcing agreements.

6.2 Retention While Active

Content is retained while your account remains active.

6.3 Retention After Cancellation

After cancellation takes effect, DRRP Corp Pty Ltd may retain Content for a limited period for operational, security, fraud prevention, dispute resolution, and legal purposes.

No Outputs can be downloaded or exported following the Cancellation Effective Date.

6.4 Deletion and Backups (30 Days)

Following deletion from active systems, copies of Content may persist in backups until backup rotation cycles complete. DRRP Corp Pty Ltd's current backup rotation cycle is up to 30 days.

6.5 Customer Deletion Requests

You may request deletion of your account and Content. If you submit a deletion request during the Post-Cancellation Retention Window, DRRP Corp Pty Ltd will action deletion as soon as reasonably practicable, subject to:

• any legal obligations to retain certain records (e.g., tax records);
• security, fraud prevention, or dispute resolution requirements;
• technical constraints (e.g., backup rotation cycles up to 30 days).

7. Data Usage Policy

7.1 Primary Use

We use Content to provide Valour Compliance, including mapping your inputs to relevant regulatory obligations and generating compliance gap Outputs and prioritised actions.

7.2 Secondary Uses

We may also use data to maintain security, prevent misuse, troubleshoot and support customers, and improve Valour Compliance. Where we use data for improvement and analytics, we aim to do so in aggregated and de‑identified form where appropriate.

7.3 No Sale of Content

DRRP Corp Pty Ltd does not sell Content uploaded to Valour Compliance.

7.4 Legal Disclosures

We may disclose information where required by law, court order, or to enforce rights, protect safety, or investigate fraud.

7.5 Data Location

Customer data submitted to Valour Compliance is intended to be stored and processed in Australia only, consistent with the Data Storage Policy.

8. Contact and Support

For policy questions, cancellations, refunds, or data requests, contact DRRP Corp Pty Ltd via info@valourcompliance.com.au.