Parties and instructions
This DPA is between [COMPLETE: customer legal identity] (“Customer”) and [COMPLETE: AskEngineAI operator] (“Provider”). It applies when Provider processes personal data on Customer's behalf to deliver the contracted service. Customer may be a controller or an authorized processor for its clients. The parties' actual roles govern.
Provider will process covered personal data only on documented instructions, including this agreement and authorized service configuration, unless applicable law requires otherwise. Provider will inform Customer of a legal requirement before processing unless prohibited, and will inform Customer if it considers an instruction infringes applicable data protection law. Customer is responsible for lawful instructions and necessary notices and permissions.
Confidentiality and safeguards
Provider will ensure authorized personnel are bound by confidentiality obligations and implement appropriate technical and organizational measures described in Annex B. Access is limited to what is needed for the agreed processing. Annex B must describe verified measures, not intended features.
Subprocessors
Subject to Customer's general written authorization, Provider may use the subprocessors listed in completed Annex C. Provider will give [COMPLETE: agreed advance notice period and mechanism] for intended additions or replacements and provide an opportunity to object on reasonable data-protection grounds. [COMPLETE: objection resolution and termination arrangements.] Provider will impose equivalent data-protection obligations on subprocessors and remains responsible for their performance of those obligations.
Assistance and incidents
Taking account of the processing and available information, Provider will assist Customer with individual rights requests, security obligations, breach notifications, impact assessments and regulatory consultations. Provider will notify Customer without undue delay after becoming aware of a personal data breach affecting covered data, provide available information about its nature, consequences and mitigation, and provide updates as information becomes available. [COMPLETE: working incident contacts and escalation procedure.]
Information, audits and transfers
Provider will make available information needed to demonstrate compliance and allow and contribute to appropriate audits or inspections by Customer or its mandated auditor. Reasonable confidentiality and scheduling arrangements must not defeat this right. International transfers must follow documented instructions and applicable law. [COMPLETE: relevant transfer agreements and annexes; a generic reference to SCCs does not execute them.]
End of processing
At Customer's choice, Provider will return or delete covered personal data at the end of the services and delete copies unless applicable law requires retention. [COMPLETE: return format, period, backup isolation/deletion timetable and verification method.] Retained data remains protected and limited to the permitted purpose. This DPA takes precedence over conflicting general terms for covered data processing.
Annex A — Processing details
- Subject and purpose: requested visibility analysis, audits, drafting, reporting and authorized integrations.
- Operations: collection, storage, retrieval, analysis, generation, transmission, export and deletion as instructed.
- Duration: contracted service plus the agreed return/deletion period.
- Data subjects: customer personnel, client representatives and individuals included in submitted or retrieved content.
- Data types: business contact details, online identifiers and personal information in prompts, website content, drafts, reports or connected data. [COMPLETE: exact customer-specific scope.]
- Sensitive data: not intended; [COMPLETE: restrictions and handling procedure for unexpected sensitive data].
- Customer obligations and rights: lawful collection, documented instructions, permissions, user access management and rights under this DPA.
Annex B — Security measures
[COMPLETE: deployed access control and tenant isolation, encryption and key management, logging/redaction, staff access, secure development, backup/restore, retention/deletion, incident response and testing evidence.]
Annex C — Authorized subprocessors
[COMPLETE: verified legal entities, services, locations, roles and applicable transfer safeguards from the register below.]