Data Breach Response Plan

SORONE LIMITED

Data Breach Response Plan

NZBN 9429052981753

Last updated: October 2026

1. Purpose

This Data Breach Response Plan sets out the steps Sorone Limited ("Sorone") will take in the event of a personal data breach. It applies to all personal data processed by Sorone, including data uploaded by users through the Sorone mobile application and web companion.

This plan is referenced in both Sorone's Privacy Policy and Terms and Conditions, and is followed by all personnel involved in the handling of personal data.

2. What is a Data Breach?

A data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. This includes:

Unauthorised access to user accounts or Sorone's systems

Accidental loss or deletion of personal data

Data transmitted to the wrong recipient

A security vulnerability exploited by a third party

A breach involving a sub-processor (e.g. Supabase, Deepgram)

3. Roles and Responsibilities

Sorone Limited is a small organisation. The following responsibilities apply:

Role	Responsibility
Helen Bartlett, Founder / Privacy Lead	Lead breach assessment, notifications, and remediation. Primary point of contact for all data breach matters.
Development team	Assist with technical investigation, containment, and vulnerability patching.
Euverify Ltd (EU/UK Representative)	Receive and forward regulatory communications from EU/UK supervisory authorities and data subjects. Contact: gdpr@euverify.com
Sub-processors (Supabase, Deepgram)	Notify Sorone without undue delay of any breach affecting Sorone's data, in accordance with their respective Data Processing Agreements.

4. Response Steps

Step 1 — Identify and Contain (Within 24 hours)

Identify the nature, scope, and cause of the breach

Take immediate steps to contain the breach (e.g. revoke access, isolate affected systems)

Preserve evidence for investigation

Notify the development team to assist with technical containment

Step 2 — Assess the Risk (Within 24–48 hours)

Determine what personal data is affected and whose data is involved

Assess the likely consequences and severity of harm to affected individuals

Determine whether the breach is 'notifiable' under applicable law (see section 5)

Document findings in the Breach Log (see section 6)

Step 3 — Notify (Within 72 hours of discovery where required)

Notify the NZ Privacy Commissioner if the breach is likely to cause serious harm, as soon as practicable under the Privacy Act 2020 (NZ)

Where GDPR applies, notify the relevant supervisory authority without undue delay and within 72 hours of becoming aware of the breach (Article 33 GDPR)

Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR / NZ Privacy Act 2020)

Forward all regulatory communications to Euverify (gdpr@euverify.com) for EU/UK matters

Notify affected users at help@sorone.app with clear information about the breach, the data involved, potential impacts, and steps they can take to protect themselves

Step 4 — Remediate

Address the root cause of the breach

Implement additional safeguards to prevent recurrence

Review and update security measures, sub-processor agreements, and internal procedures as required

Follow up with affected individuals as needed

5. Notification Thresholds

Law	Notify Regulator When…	Notify Individuals When…
Privacy Act 2020 (NZ)	Breach is likely to cause serious harm to one or more individuals	As soon as practicable after notifying the Privacy Commissioner
EU/UK GDPR	All breaches unless unlikely to result in risk to individuals — within 72 hours	Where breach is likely to result in high risk to rights and freedoms — without undue delay

6. Breach Log

All breaches, whether notifiable or not, must be recorded. The breach log must include:

Date and time the breach was discovered

Nature of the breach and data affected

Number and categories of individuals affected

Likely consequences of the breach

Steps taken to address the breach

Whether notification was made and to whom

The breach log is maintained by Helen Bartlett and is available for review by supervisory authorities upon request.

7. Sub-Processor Breaches

Where a breach occurs at a sub-processor level (e.g. Supabase or Deepgram), Sorone requires those processors to notify Sorone without undue delay in accordance with their Data Processing Agreements. Upon receiving such notification, Sorone will follow the response steps in section 4 and assess notification obligations accordingly.

8. Contact

For inquiries about this plan or to report a suspected breach, please contact:

Helen Bartlett — Privacy Lead / Founder

Email: help@sorone.app

Post: 2/3 Nuffield Ave, Napier, New Zealand 4110

EU/UK GDPR Representative:

Euverify Ltd

gdpr@euverify.com

EU: Unit 3D, North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland

UK: 3rd Floor, 86–90 Paul Street, London EC2A 4NE, United Kingdom