Strata Help Desk — Master Services Agreement
Version: 1.0 | Incorporates Release and Indemnity
This Schedule governs the process by which a Subscriber's tenancy on the System is ended, their data returned, and the obligations of both parties during and after the offboarding process. Capitalised terms have the meaning given in the MSA body.
Offboarding is initiated when any of the following events occur:
Offboarding does not apply to Suspension, which is a temporary state (clause 8.2) during which the System is inaccessible but data is preserved. Suspension may precede Termination if the underlying breach is not cured.
Upon confirmation of termination, the Provider will initiate the following phased process. The phases are sequential and each phase must be completed before the next begins.
The Provider records the termination notice and transitions the building's status to notice. The System remains fully operational. The Provider generates the export token and notifies the Designated Technical Contact by email with instructions for accessing the Data Export. The 30-day export window commences. During this period, the Subscriber should complete any data entry, download any documents needed for immediate use, and verify that the Data Export received in Phase 2 is complete.
The Provider prepares the Data Export (as defined in section C3) and delivers it as a secure export manifest containing pre-signed download URLs for each file and structured data export. The manifest is delivered by email to the Designated Technical Contact. Each pre-signed URL is valid for 7 days. The Subscriber must download all files within the download window. If files are not downloaded before URL expiry, the Provider will regenerate links on written request (subject to the export window remaining open).
At the earlier of: (a) the Subscriber's written confirmation that the Data Export has been successfully received, or (b) 30 days after Notice is served — the Provider suspends access and initiates deletion of Subscriber Data from the live System. A Deletion Confirmation Notice is sent to the Designated Technical Contact confirming what has been deleted and what, if anything, the Provider retains under section C4. This phase triggers the Release and Indemnity in section C5 if the Subscriber has confirmed receipt of the Data Export.
All remaining Subscriber Data (including operational records, logs, and system events referencing the building) is permanently deleted from the Provider's systems, including all database backups that fall within the backup rotation window. The Provider provides a final written confirmation of deletion. After this point, the Provider holds no Subscriber Data. Individual User personal data rights (access, correction, deletion) under the Privacy Act survive and are addressed under section C6.
The Data Export includes all Subscriber Data held in the System at the time the export is generated, structured in a portable, machine-readable format. Specifically:
| Category | Format | Notes |
|---|---|---|
| Committee Matters & Votes | CSV / JSON | All committee motions, votes, outcomes, and supporting materials |
| Renovation Applications & Decisions | CSV / JSON + PDF attachments | Application records, committee decisions, completion certificates |
| Pet Applications & Approvals | CSV / JSON + PDF attachments | Application records and approval/rejection decisions |
| Work Orders & Service Records | CSV / JSON | All work orders, status history, PO records |
| Service Agreements | CSV / JSON + uploaded contract PDFs | Contractor agreements, terms, expiry dates |
| Building Assets & Maintenance Records | CSV / JSON | Asset register, maintenance schedules, compliance calendar entries |
| Insurance Claims | CSV / JSON | Claim records and associated documents |
| Facility Bookings (historical) | CSV / JSON | All booking records for the building's booking history |
| Building Documents | Original uploaded files (PDF, DOCX, etc.) | All documents uploaded to the building's document library |
| User Directory (anonymised) | CSV | Lot associations and roles — email addresses excluded per Privacy Act obligations |
| Lot Register | CSV | Lot numbers, types, ownership records as at export date |
| Visitor Logbook | CSV / JSON | All visitor records, sign-in/out logs |
| Bulletin Board Posts & Announcements | CSV / JSON | All published content and attachments |
The Data Export is delivered as a structured export manifest containing:
The manifest is emailed to the Designated Technical Contact. The Provider does not deliver a server-side ZIP archive; files are downloaded directly by the Subscriber from the secure URLs provided. This approach is used because of the potentially large volume of uploaded files that cannot be safely compressed in memory on the Provider's infrastructure.
Upon delivery of the export manifest, the Subscriber is solely responsible for:
After Phase 4 deletion, the Provider retains only the following information, solely for the purposes stated:
| Item Retained | Reason | Retention Period |
|---|---|---|
| Archive manifest record (metadata only) | Internal audit record of the offboarding process; no Subscriber Data content | 7 years from offboarding date |
| Billing records (invoices, payments) | Tax and financial compliance — Australian Taxation Office (ATO) minimum 5-year requirement | 7 years from last invoice |
| Executed Agreement (Schedule A) | Legal record of the contractual relationship | 7 years from termination |
| Deletion Confirmation Notice | Evidence of compliance with deletion obligations | 7 years from issue |
| All other Subscriber Data | — | Deleted in Phase 4 |
Upon written confirmation by the Subscriber that the Data Export has been successfully received (or, if no such confirmation is given, upon the expiry of the 30-day Notice period under Phase 1) ("Release Trigger Date"), the following Release and Indemnity takes effect automatically:
1. Acknowledgment. The Subscriber acknowledges and agrees that:
(a) the Body Corporate and Community Management Act 1997 (Qld) s237 requires the Body Corporate to retain body corporate records for a period of not less than seven (7) years;
(b) the record-keeping obligation under the BCCM Act is the obligation of the Body Corporate — it is not an obligation of the Provider, who is a service provider engaged by the Body Corporate to host and manage records on its behalf;
(c) the Provider has, by delivering the Data Export, fulfilled its data return obligations under this Agreement; and
(d) from and after the Release Trigger Date, the Body Corporate is solely responsible for retaining all body corporate records delivered in the Data Export for the full 7-year period required by the BCCM Act, in such form and location as the Body Corporate determines.
2. Release. In consideration of the delivery of the Data Export, and other valuable consideration, the Subscriber irrevocably releases and discharges the Provider and its officers, employees, contractors, and successors from all claims, demands, actions, proceedings, and liabilities (whether arising in contract, tort, statute, or otherwise) arising from or related to:
(a) the Provider's deletion of Subscriber Data from its systems following the Release Trigger Date;
(b) any failure by the Subscriber to adequately store, maintain, or produce body corporate records after the Release Trigger Date; and
(c) any regulatory investigation, enforcement action, penalty, or finding arising under the BCCM Act relating to the availability of body corporate records for any period after the Release Trigger Date.
3. Indemnity. The Subscriber indemnifies and holds harmless the Provider against all losses, costs, claims, and expenses (including legal costs on a solicitor-client basis) arising from any claim made against the Provider by a third party (including another lot owner, the Body Corporate Commissioner, or any regulatory authority) in connection with the unavailability of body corporate records after the Release Trigger Date, where the claim arises from the Subscriber's failure to retain the records delivered in the Data Export.
4. Survival. This Release and Indemnity survives termination of the Agreement and is binding on the Body Corporate's successors and assigns.
5. Exclusion. This Release and Indemnity does not apply to any loss or liability arising from the Provider's failure to include records in the Data Export that were in its possession and which the Provider was obligated to include under section C3.1 of this Schedule. The Provider's obligation to provide a complete Data Export is not released by this clause.
The offboarding of a building does not extinguish the rights of individual Users under the Privacy Act 1988 (Cth). The following rights survive building offboarding:
Individual User data rights are separate from the Body Corporate's BCCM Act obligations. Personal data of individual Users is not included in the Data Export (see section C3.3) because it belongs to the individual, not to the Body Corporate.
By executing Schedule A and this Agreement, the Subscriber:
| Milestone | Timing | Responsibility |
|---|---|---|
| Termination notice given | Day 0 | Subscriber (or Provider in breach cases) |
| System remains fully operational | Days 0–30 | Provider |
| Data Export manifest delivered | Within 14 days of notice | Provider |
| Subscriber downloads all files | Within 7 days of each URL batch | Subscriber |
| Subscriber confirms receipt | Before Day 30 | Subscriber |
| Access suspended; Phase 3 deletion begins | Day 30 (or earlier if confirmed) | Provider |
| Release and Indemnity effective | On Release Trigger Date | Automatic upon confirmed receipt or Day 30 |
| Deletion Confirmation Notice issued | Within 5 days of Phase 3 completion | Provider |
| Full deletion (Phase 4) complete | Within 90 days of Phase 3 | Provider |
| Final deletion confirmation | Within 5 days of Phase 4 completion | Provider |
Schedule C — Offboarding & Data Return v1.0 | Part of the Strata Help Desk Master Services Agreement | MSA Body | Schedule A | Schedule B | Schedule D