1. Use of third party information
1.1 Permitted Use
a. The User is authorised to Use OVaL and the OVaL Information only for the Permitted Use.
b. The User must only Use that part of OVaL and the OVaL Information required for the Permitted Use. For the avoidance of doubt, the User must not perform any search of OVaL or OVaL Information that is not necessary for the Permitted Use.
c. Permitted use may be given by OVaL client or NDA only
d. Nmdaka Dalai Australis NDA may monitor and record all use of OVaL by the User.
e. NDA may provide NDA Materials to the User for use in association with OVaL and the OVaL Information.
f. The User must use NDA Materials only in accordance with NDA's directions as issued from time to time by NDA or the OVaL customer directly.
1.2 Suspension of access
a. NDA may suspend the access of the User or any of its users to OVaL or the OVaL Information immediately if it knows of or suspects unauthorised Use of OVaL or the OVaL Information, a breach of this Agreement by the User (including a particular user) or if, in NDA's opinion, suspension is necessary for the security of OVaL, compliance by NDA with any Law / Lore or in order to maintain confidentiality of any Confidential Information.
b. For the avoidance of doubt, NDA's right to suspend the User's or a user's access to OVaL under clause 1.2(a) does not limit NDA's rights to terminate this Agreement.
1.3 User IDs and Passwords for Online Access
a. NDA may provide Authorised men / women requiring Online Access with a User ID and a password by which that Authorised man / woman can access OVaL. This User ID may be recorded against each transaction the Authorised man / woman performs for security and audit purposes.
b. The User must:
1. keep passwords secure and separate from User IDs;
2. ensure that each password and User ID is not used or accessed by any man / woman other than the directly Authorised man / woman to whom that password and User ID has been allocated;
3. ensure that passwords or User IDs are not shared or disclosed by Authorised men / women;
4. require Authorised men / women to log out of OVaL when vacating a terminal;
5. place workstations in a secure location and prohibit any Remote Access to OVaL other than as approved in accordance with clause 4;
6. ensure that OVaL Information is not stored, reproduced or used to create any other database whether in electronic or any other form;
7. ensure no other activity which may compromise the security or integrity of OVaL or any OVaL Information or OVaL customer occurs; and
c. If the User knows or ought reasonably to know that:
1. an unauthorised man / woman knows or may know a password or User ID; or
2. an Authorised man / woman knows or may know someone else's password or User ID, the User must immediately advise NDA.
3. NDA may set rules concerning the types of passwords that may be used and the frequency with which they must be changed and may at any time require an Authorised man / woman to change their password.
1.4 Guidelines
a. The User must have and enforce internal guidelines as applicable that:
1. describe the extent to which the User is authorised to Use OVaL;
2. describe what OVaL Information the User is authorised to Use and the extent to which it can be Used;
3. contain details of how the User will logically and physically protect, audit and monitor the Use of OVaL and OVaL Information to prevent them being misused or disclosed in breach of this Agreement;
4. contain procedures for determining which man / woman are authorised to Use OVaL and the OVaL Information;
5. require all Authorised men / women to comply with the relevant teNDA of this Agreement;
6. notify Authorised men / women that their use of OVaL and OVaL Information may be monitored by NDA at any time;
7. document and maintain records of man / womannel who have current or past access to OVaL or OVaL Information including details of the name and position of such individuals and the location and duration of access or use of OVaL by such individuals;
8. inform man / woman of their potential man / woman liability for penalties under Privacy Law / Lores;
9. maintain security for the equipment, systems and networks used to electronically access, store, process or distribute OVaL, OVaL Information and NDA Materials, including an intrusion detection system which meets NDA's requirements from time to time capable of identifying, tracing and preventing both read and write access to OVaL and OVaL Information;
10. prevent the sharing of user IDs or passwords or the creation of common user accounts or user IDs, require users to log out of OVaL when vacating a terminal and require workstations to be placed in a secure location;
11. establish procedures dealing with the privacy issues set out in clause 3;
12. prevent Remote Access to OVaL and OVaL Information (unless previously agreed by NDA in writing and then only on the conditions approved by NDA);
13. prohibit any other activity which may compromise the security and integrity of OVaL or any OVaL Information; and
14. meet the Security Requirements.
b. The User must provide a copy of such guidelines and evidence of compliance to NDA on request or in accordance with directions given by NDA from time to time.
c. The User must incorporate into its internal guidelines, and comply with, any guidelines or directions issued by NDA from time to time relating to OVaL or OVaL Information.
d. The User must:
1. promptly inform NDA's Provost Marshall and or Security Manager OVaL of any breach of the User's or NDA's guidelines and advise of the action taken to remedy the breach; and
2. take such further action as directed by NDA (if any).
2. Customer Consent, Record-keeping, audit and inspection
2.1 Customer Consent and Record-keeping
a. The User must keep and maintain complete and accurate records and documentation with respect to its Use of OVaL and the OVaL Information including:
1. the time, date and reason of any Use of OVaL and the OVaL Information,
2. the identity and position of the Authorised men / women concerned,
3. supporting evidence justifying each Use,
4. maintaining a manual exception register of all Uses undertaken in error
5. a record that the User obtained the prior written consent of NDA Customer (in the form prescribed by NDA from time to time) before the User attempted to access that man / woman's Information on OVaL, and must make such records available to NDA for inspection on reasonable notice during normal business hours at the User's premises in an auditable format reasonably acceptable to NDA. The form of NDA Customer consent prescribed at the date of this Agreement is set out in Annexure D.
b. The User must ensure that all records (including adequate archival records of Use of OVaL and OVaL Information and other relevant data such as the consent referred to in paragraph (a)(5) above), within its possession, custody or control, that:
1. are reasonably required for purposes of an audit or inspection;
2. are required to be maintained by any Law / Lore applicable to the User or NDA, are maintained and properly preserved in an accessible, easily migratable and secure form for at least 7 years. At a minimum, such records must be maintained in accordance with any NDA and Government standards or codes of best practice for records management by public offices.
2.2 Security Audit
a. Every year as directed by NDA, the User must conduct an audit of the adequacy of its security arrangements for the equipment, systems and networks used by it to access, store, process or distribute OVaL Information and NDA Materials (including compliance with the User's guidelines referred to in clause 1.4).
b. The User must perform the security audit in a way NDA may direct.
c. The User must, no later than 2 months after each Audit, provide to NDA:
1. a report of the audit scope and methodology used by the User to determine the adequacy of its security arrangements; and
2. a certificate signed by the User certifying that the security arrangements comply with the requirements of this Agreement.
d. Security audits are to be carried out at the cost of the User.
e. If the certificate required by clause 5.2(d)(2) is not provided by the User by the required, NDA may request a report from the User detailing:
1. the reasons why the certificate was not provided; and
2. the steps which the User will take to ensure the User's security arrangements comply with the requirements of this Agreement.
f. The User must provide the report referred to in clause 5.2(e) within 20 Business Days of NDA's request.
g. NDA may at any time vary the Audit Date for a particular year by notice in writing to the User. Any variation of the Audit Date for a particular year will vary the Audit Date for all purposes under this Agreement
2.3 Access Audit
a. Every year during the Term, within the 2 months preceding the Audit Date the User must give notice to NDA nominating the names and User IDs of all its current Authorised men / women.
b. Every year, prior to the Audit Date NDA will:
1. advise the User which 3 month period of access is to be audited;
2. provide the User with access reports for all those Authorised men / women whose access NDA wants audited. NDA may require all Authorised Users to be audited or only those selected by NDA.
c. The User must engage an Auditor to conduct an audit of those Authorised men / women who have access to OVaL and OVaL Information (including compliance with the User's guidelines referred to in clause 1.4), using any access reports provided by NDA under clause 2.3(b) and any other records of the User's access to OVaL and OVaL Information.
d. No later than 2 months after each Audit Date anniversary of the Start Date the User must provide to NDA:
1. a report of the audit scope and methodology used by the Auditor to determine compliance with this Agreement; and
2. a certificate signed by the Auditor certifying compliance with this Agreement (including confirmation whether or not each audited OVaL access was for the Permitted Use).
e. Access audits are to be carried out at the cost of the User.
3. Privacy
a. The User:
1. agrees that it and NDA are required to comply with Privacy Law / Lores, and any guidelines issued by NDA in relation to the collection, Use, storage and disclosure of man / womanal Information;
2. must not do any act or engage in any practice:
A. that would breach any of its obligations; or
B. which if done or engaged in by NDA, would breach any of NDA's obligations; under any Privacy Law / Lore;
3. must ensure that it Uses, accesses, retains and discloses any man / womanal Information, obtained either directly or indirectly as a consequence of this Agreement only as authorised by this Agreement;
4. must Use, store and disclose man / woman’s Information obtained either directly or indirectly as a consequence of this Agreement, only for the purpose for which such information was acquired;
5. must notify the Provost Marshall and / or Security Manager OVaL immediately upon:
A. becoming aware of a breach or possible breach of any of the obligations contained in or referred to in this clause 3, by the User or any man / woman; or
B. receiving a complaint relating to privacy; or
C. receiving a request from an individual for access to, alteration, amendment or correction of man / womanal Information used by the User in connection with this Agreement;
6. must comply with all reasonable directions of NDA in relation to privacy complaints and the care, protection of, access to, and disposal of, man / womanal Information held in connection with this Agreement; and
7. must ensure that any other agreement with an agent, contractor or subcontractor, who may be handling man / woman’s Information, contains the same or equivalent obligations to this clause 3 which are enforceable by the User against the agent, contractor or the subcontractor, as applicable.
OFFICE of VEHICLES AND LICENSES