Civica Education Suite (CES) - Sub‑processors (Australia)

Use of third‑party sub‑processors

Civica Pty Limited engages selected third-party service providers (“Sub‑processors”) to support the delivery, operation and improvement of the Civica Education Suite (CES) and associated cloud-based services in Australia.

These Sub‑processors may process Personal Data on behalf of Civica solely for the purpose of providing contracted services and in accordance with Civica’s documented instructions. All processing is undertaken in line with Civica’s contractual obligations, security requirements, and applicable data protection laws.

For the purposes of this page, terms such as Personal Data, Customer Personal Data, Sub‑processor, Cloud Services, and End User Personal Data have the meanings set out in Civica’s Data Processing Addendum and applicable customer agreements.

Oversight, compliance and data protection

Civica maintains a robust governance framework for the selection and ongoing management of Sub‑processors, including:

• Due diligence assessment of security, privacy, and compliance practices

• Contractual obligations requiring Sub‑processors to implement appropriate technical and organisational safeguards

• Ongoing monitoring and review of Sub‑processor performance and compliance Risk assessments for cross-border data transfer.

Where Personal Data is transferred outside Australia, Civica undertakes appropriate safeguards and transfer risk assessments in accordance with applicable privacy legislation.

Scope and duration of processing

The Sub‑processors listed below support CES by providing services such as:

• Cloud hosting and infrastructure

• Identity and access management

• Communications and messaging services

• Network delivery and performance optimisation.

Sub‑processors process only the Personal Data necessary to perform their specific services. This may include:

• User identifiers (e.g. name, email address, username)

• Contact details

• System usage data (e.g. log data, IP addresses, device information)

• Communications data (e.g. messages, notifications).

Personal Data is retained only for as long as necessary to provide the relevant services and in accordance with contractual and legal requirements.

List of Sub-processors (CES-Australia)

Additional Sub-processors (DESA deployments only)

Change notifications

Civica may update this list from time to time to reflect changes to Sub‑processors used in the delivery of CES services.

Customers may subscribe to receive notifications when Civica adds, or changes Sub‑processors used in the delivery of its services.