API Terms of Use

01About these API Terms

1.1  These API Terms govern access to and use of the Diba API by any person or entity (Integrator, you) that requests, receives or uses API Credentials. They are issued by Diba Technology (ABN 38 581 526 417) of 1408, 11 Solent Circuit, Norwest NSW 2153 (Diba, we).

1.2  You accept these API Terms by the earliest of: signing a document that refers to them, clicking to accept them, requesting API Credentials, or making a call to the Diba API.

1.3  If you accept on behalf of an organisation, you warrant that you have authority to bind it, and you means that organisation.

1.4  If you are a Customer under a Customer Services Agreement (CSA) with Diba, these API Terms apply in addition to the CSA and Diba's Terms & Conditions. Clause 18.2 sets the order of precedence.

1.5  If you integrate on behalf of a Customer, you may only access that Customer's data with the Customer's authorisation, and only for as long as that authorisation and the Customer's Diba subscription remain current.

02Definitions

• API Credentials means API keys, client IDs and secrets, tokens, certificates and any other access credentials Diba issues to you.
• Application means the software, service or integration you build or operate that calls the Diba API.
• Customer means an entity that has a current CSA with Diba for the Diba Platform.
• Customer Data means data relating to a Customer's sites, gates, users, access events and attendance that is made available through the Diba API, including Personal Information.
• Diba API means Diba's application programming interfaces, webhooks, SDKs, sample code and sandbox environments, and any updates to them.
• Diba Platform means Diba's cloud software, Access Control Units (ACUs), firmware and related services.
• Documentation means the technical documentation, specifications and usage policies Diba publishes or provides for the Diba API.
• End User means a person who uses your Application.
• Personal Information and Sensitive Information have the meanings given in the Privacy Act 1988 (Cth).
• Usage Limits means the rate limits, quotas and other technical limits set out in the Documentation or notified by Diba.

03Licence and scope

3.1  Subject to these API Terms, Diba grants you a limited, revocable, non-exclusive, non-transferable, non-sublicensable licence to access and use the Diba API and Documentation solely to develop, test and operate your Application so that it interoperates with the Diba Platform for the benefit of Customers.

3.2  Access is limited to the endpoints, scopes and Customer accounts Diba has enabled for your API Credentials.

3.3  Endpoints that change the physical state of a gate (including remote open, lock, unlock or mode change), or that enrol, modify or remove site users, are Control Endpoints. You must not use Control Endpoints unless Diba has approved that use for your Application in writing. Diba may attach conditions to that approval.

3.4  Sandbox or test environments are provided for evaluation only. You must not put real Personal Information into them.

3.5  All rights not expressly granted are reserved by Diba.

04Credentials and security

4.1  API Credentials are confidential and personal to you. You must not share, sell, transfer or embed them in client-side code, public repositories or any place where a third party can retrieve them.

4.2  You are responsible for all activity under your API Credentials, whether or not you authorised it.

4.3  You must:

• store API Credentials encrypted and restrict access to personnel who need it;
• use TLS for all calls and verify webhook signatures where Diba provides them;
• maintain security measures for your Application and systems that meet good industry practice;
• rotate API Credentials when Diba asks, and immediately if you suspect compromise.

4.4  You must notify Diba without undue delay, and in any case within 24 hours, after becoming aware of any actual or suspected unauthorised access to API Credentials, the Diba API or Customer Data, and give Diba the information and cooperation it reasonably needs to investigate and respond.

4.5  Diba may monitor use of the Diba API to operate, secure and improve it and to check compliance with these API Terms. On reasonable notice you must give Diba information it reasonably requests to verify your compliance.

05Usage Limits

5.1  You must comply with the Usage Limits. Diba may change them on notice through the Documentation or by email.

5.2  If you exceed a Usage Limit, Diba may throttle, queue or reject requests. You must not try to get around Usage Limits, including by using multiple accounts or credentials.

5.3  Your Application must handle errors, throttling and unavailability gracefully, including by backing off on retry. You should prefer webhooks to polling where Diba offers them.

5.4  If you need higher limits, ask Diba. Diba may agree, refuse or make them subject to fees.

06Restrictions

You must not, and must not allow anyone else to:

• (a)  use the Diba API for any purpose other than the purpose in clause 3.1;
• (b)  use the Diba API in a way that could compromise the safety of any person or the physical security of any site, or to bypass, disable or weaken any access control, induction, compliance or safety function of the Diba Platform;
• (c)  rely on the Diba API or your Application as the sole means of emergency egress, life safety or emergency response;
• (d)  access or attempt to access data, accounts or endpoints you are not authorised to access;
• (e)  reverse engineer, decompile or attempt to derive the source code, models or underlying structure of the Diba Platform, except to the extent the law does not allow this restriction;
• (f)  scrape, bulk-export or cache Customer Data beyond what your Application reasonably needs, or use it to build a database for another purpose;
• (g)  use the Diba API or Customer Data to build or improve a product that competes with the Diba Platform, or to benchmark the Diba Platform for publication, without Diba's written consent;
• (h)  use Customer Data to train or fine-tune machine learning models, including facial recognition models, or to identify, profile or track individuals outside the Customer's site access purposes;
• (i)  sell, rent, sublicense or resell access to the Diba API, or let a third party call it through your API Credentials;
• (j)  introduce malware, run load, penetration or vulnerability tests against the Diba API without Diba's written consent, or interfere with its operation;
• (k)  use the Diba API in breach of any law, including privacy, surveillance, workplace and anti-spam laws; or
• (l)  misrepresent your Application's relationship with Diba or its use of Customer Data.

07Data, privacy and biometrics

7.1  As between the parties, Customer Data belongs to the relevant Customer. You receive it only to provide your Application's integration to that Customer, and you must use it only for that purpose and on that Customer's instructions.

7.2  You must comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles and all other privacy, surveillance and workplace laws that apply to your handling of Customer Data, whether or not you would otherwise be exempt.

7.3  You must maintain a privacy policy that accurately describes how your Application collects, uses, stores and discloses Personal Information, and make it available to End Users.

7.4  Biometric information. The Diba Platform uses facial recognition. Biometric templates and face images are Sensitive Information. The Diba API does not provide raw biometric templates. You must not attempt to obtain, reconstruct or infer them. Where the Diba API returns an enrolment photo or a match result, you must treat it as Sensitive Information, must not store it for longer than the transaction requires, and must not use it for any biometric matching outside the Diba Platform.

7.5  Where your Application collects Personal Information that is sent to Diba (for example, enrolling a worker), you are responsible for giving the required collection notices and obtaining the required consents, including express consent to the collection of biometric information, before sending it.

7.6  You must not transfer, store or access Customer Data outside Australia unless the relevant Customer has agreed in writing and you have complied with APP 8.

7.7  Retention and deletion. You must delete Customer Data when it is no longer needed for the integration and, in any case, within 90 days after the earliest of: the Customer's request; the end of the Customer's authorisation or Diba subscription; or termination of these API Terms. Where a site user is de-registered from the Diba Platform, you must delete that user's Personal Information from your systems within 90 days. On request you must confirm deletion in writing. You may keep a copy only where and for as long as the law requires.

7.8  If you become aware of a data breach involving Customer Data, you must comply with clause 4.4, take reasonable steps to contain and remedy it, and cooperate with Diba and the affected Customer on any assessment or notification under the Notifiable Data Breaches scheme. You must not notify a regulator or affected individuals about a breach involving Customer Data without first consulting Diba and the Customer, unless the law requires you to act sooner.

7.9  Diba handles Personal Information you give it about your own personnel in accordance with its Privacy Policy.

08Your Application and End Users

8.1  You are solely responsible for your Application, including its development, operation, support, security and legal compliance, and for your dealings with End Users.

8.2  You must give Diba accurate information about your Application and its use of the Diba API when asked, and reasonable access to it for review.

8.3  Your terms with End Users must be at least as protective of Diba and of Customer Data as these API Terms, and must not make any promise on Diba's behalf.

8.4  You must name a technical contact and keep those details current. Diba will send notices about changes, deprecation and incidents to that contact.

8.5  Nothing in these API Terms stops Diba from building or offering products or features that are similar to or compete with your Application.

09Intellectual property, feedback and branding

9.1  Diba and its licensors own all rights in the Diba API, Documentation, Diba Platform and Diba's trade marks. You get no rights in them except the licence in clause 3.

9.2  You own your Application, excluding anything belonging to Diba or a Customer.

9.3  If you give Diba suggestions or feedback about the Diba API, Diba may use them without restriction or payment.

9.4  You may state factually that your Application integrates with Diba. Any other use of Diba's name, logo or trade marks needs Diba's prior written consent and must follow any brand guidelines Diba provides. You must not suggest that Diba endorses, certifies or supports your Application unless Diba has agreed in writing.

9.5  Diba may identify you and your Application as an integration partner in its marketing and integration listings, unless you ask it in writing not to.

10Fees

10.1  Unless a CSA or other written agreement says otherwise, Diba does not currently charge for access to the Diba API within the Usage Limits.

10.2  Diba may introduce or change fees for the Diba API, or for particular endpoints or volumes, by giving you at least 60 days' written notice. If you do not agree, you may stop using the Diba API and terminate under clause 17.1 before the fees take effect.

10.3  Where fees apply, they are in AUD and exclusive of GST, and invoices are payable within 7 days of issue. Overdue amounts bear interest at the lower of 10% per annum and the rate fixed under the Penalty Interest Rates Act 1983, calculated daily.

10.4  Each party bears its own costs of building and maintaining its side of the integration.

11Changes, versioning and deprecation

11.1  Diba may add to, change or remove features of the Diba API at any time. You are responsible for keeping your Application compatible.

11.2  Diba will give at least 90 days' notice before making a change it reasonably expects to break a correctly built Application, or before retiring a supported API version.

11.3  Diba may give shorter or no notice where a change is needed to address a security or safety risk, comply with law, prevent harm to a Customer or the Diba Platform, or where the feature is labelled beta, preview or experimental.

11.4  Diba may update these API Terms by publishing a new version and notifying your technical contact at least 30 days before it takes effect. Continuing to use the Diba API after that date is acceptance. If you do not agree, your remedy is to stop using the Diba API and terminate under clause 17.1.

12Availability and support

12.1  Diba will use reasonable efforts to keep the Diba API available but does not promise uninterrupted or error-free operation, and these API Terms contain no service level commitment. Any service level Diba owes a Customer is set out in that Customer's CSA and is owed to the Customer only.

12.2  Diba may carry out maintenance and will try to give advance notice of planned downtime.

12.3  Diba may, but need not, provide technical support for the Diba API. Diba does not support your Application or your End Users.

12.4  The ACUs are designed to continue operating from a local cache when cloud connectivity is lost. Your Application must not assume that an API call has changed the physical state of a gate until the Diba API confirms it.

13Confidentiality

13.1  Confidential Information means non-public information one party discloses to the other that is marked confidential or would reasonably be understood to be confidential. For Diba it includes API Credentials, non-public Documentation, security information, roadmap and pricing. It does not include information that is public other than through a breach, already known to the recipient, independently developed, or lawfully received from a third party.

13.2  Each party must keep the other's Confidential Information confidential, use it only for the purposes of these API Terms, and disclose it only to personnel and advisers who need to know and are bound to keep it confidential.

13.3  A party may disclose Confidential Information where the law requires, after giving the other party notice where it lawfully can.

13.4  This clause continues for 3 years after termination, and indefinitely for API Credentials, security information and trade secrets.

14Warranties and disclaimer

14.1  Each party warrants that it has the right and authority to enter into these API Terms.

14.2  You warrant that your Application and your use of the Diba API will comply with these API Terms and all applicable laws, and will not infringe any third party's rights.

14.3  To the extent the law allows, the Diba API and Documentation are provided "as is" and "as available", and Diba excludes all warranties, conditions and guarantees not expressly stated in these API Terms, including as to accuracy, availability and fitness for a particular purpose.

14.4  Nothing in these API Terms excludes, restricts or modifies any guarantee, right or remedy under the Australian Consumer Law or any other law that cannot lawfully be excluded. Where Diba's liability for breach of such a guarantee can be limited, it is limited, at Diba's option, to supplying the services again or paying the cost of having them supplied again.

15Liability

15.1  Subject to clauses 14.4 and 15.3, Diba's total liability arising out of or in connection with these API Terms and the Diba API, whether in contract, tort (including negligence), statute or otherwise, is limited to the greater of (a) the fees you paid Diba for access to the Diba API in the 12 months before the claim arose and (b) AUD $1,000.

15.2  Subject to clauses 14.4 and 15.3, neither party is liable to the other for loss of profit, revenue, business, goodwill or anticipated savings, loss or corruption of data, or any indirect or consequential loss.

15.3  Nothing in this clause limits a party's liability for fraud, for death or personal injury caused by its negligence, for breach of clause 13, for your breach of clauses 4, 6 or 7, or under the indemnity in clause 16.

15.4  A party's liability is reduced to the extent the other party caused or contributed to the loss. Each party must take reasonable steps to mitigate its loss.

15.5  Diba is not liable for your Application, for any act or omission of your End Users, or for anything done through the Diba API using your API Credentials.

16Indemnity

16.1  You indemnify Diba and its officers, personnel and contractors against any loss, damage, cost (including reasonable legal costs) or liability arising from a claim by a third party, including a Customer, an End User, a site worker or a regulator, to the extent it arises from:

• (a)  your Application;
• (b)  your breach of these API Terms or of any law;
• (c)  your handling of Customer Data or Personal Information, including any failure to give a required notice or obtain a required consent (including biometric consent);
• (d)  any unauthorised use of your API Credentials caused by your failure to comply with clause 4; or
• (e)  a claim that your Application infringes a third party's intellectual property rights.

16.2  Diba will notify you of the claim promptly, let you conduct the defence with counsel reasonably acceptable to Diba, and give reasonable assistance at your cost. You must not settle a claim in a way that imposes an obligation or admission on Diba without its written consent.

17Suspension and termination

17.1  You may terminate these API Terms at any time by ceasing all use of the Diba API and notifying Diba in writing.

17.2  Diba may terminate these API Terms, or withdraw the Diba API, for convenience on 30 days' written notice.

17.3  Diba may suspend or limit your access immediately, with or without prior notice, where it reasonably believes that:

• (a)  you have breached these API Terms;
• (b)  your Application or API Credentials pose a security, privacy or safety risk;
• (c)  suspension is needed to comply with law or a regulator's request;
• (d)  the relevant Customer has withdrawn its authorisation, or its Diba subscription has ended or been suspended; or
• (e)  your use is degrading the Diba Platform for others.

Diba will tell you the reason as soon as practicable and will restore access once the cause is resolved to its reasonable satisfaction.

17.4  Diba may terminate immediately on written notice if you commit a material breach that cannot be remedied or is not remedied within 14 days of notice, if you breach clause 6 or 7, or if you become insolvent.

17.5  Fail-safe. Suspension or termination under these API Terms applies to API and software access only. It does not affect the mechanical operation of gate hardware or free egress from a site.

17.6  On termination: all licences end; you must stop using the Diba API and API Credentials; you must delete Customer Data in accordance with clause 7.7 and return or destroy Diba's Confidential Information; and any accrued fees remain payable.

17.7  Clauses 4.2, 4.4, 7, 9, 10.3, 13, 14.3, 14.4, 15, 16, 17.6, 17.7 and 18 survive termination, together with any other clause that by its nature is intended to survive.

18General

18.1  Governing law. These API Terms are governed by the laws of New South Wales, Australia. Each party submits to the non-exclusive jurisdiction of the courts of New South Wales.

18.2  Order of precedence. If there is an inconsistency, the following prevail in this order: (a) a signed CSA or other signed agreement between you and Diba that expressly deals with API access; (b) Diba's Terms & Conditions, where you are a Customer; (c) these API Terms; (d) the Documentation.

18.3  Disputes. Before starting court proceedings (other than for urgent injunctive relief), a party must give written notice of the dispute, and senior representatives of each party must try in good faith to resolve it within 20 business days.

18.4  Relationship. The parties are independent contractors. Nothing in these API Terms creates a partnership, joint venture, agency or exclusive arrangement.

18.5  Assignment. You must not assign or transfer your rights or obligations without Diba's prior written consent. Diba may assign these API Terms to a successor to its business on notice.

18.6  Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, other than an obligation to pay money.

18.7  Entire agreement. Subject to clause 18.2, these API Terms are the entire agreement between the parties about the Diba API.

18.8  Severance and waiver. If a provision is unenforceable it is severed and the rest continues. A right is waived only in writing.

18.9  Notices. Notices to Diba must be sent to [legal contact email] and to 1408, 11 Solent Circuit, Norwest NSW 2153. Diba may give notice to your technical contact by email or through the developer portal. Email notices are taken to be received on the next business day after sending.

18.10  Version. API Terms v1.0. Effective date: [insert].