Data Processing Agreement Framework
This framework describes the expected processing relationship. A corporate customer and DAD TECHNOLOGIES must complete the processing schedule and any required transfer terms before relying on it as their signed DPA.
1. Parties, instructions and scope
The business customer is the controller for customer and staff data it supplies; DAD TECHNOLOGIES acts as processor when providing the hosted CRM and messaging service. Processing includes storage, retrieval, organization, communication and deletion for the subscription term, subject to agreed retention. Instructions are limited to the service agreement, configured features and lawful documented directions.
2. Data and people covered
Data may include names, contact details, conversation text, consent records, leads, store product and order metadata and customer-service requests. Data subjects may include the customer’s prospects, shoppers, business contacts and staff. Special-category data is not required for the service and should not be submitted without a separate assessment and written safeguards.
3. Confidentiality and safeguards
Restrict access to authorized personnel, impose confidentiality duties, protect credentials, use transport encryption, tenant-level access checks, audit records and appropriate backup and restoration processes. Exact hosting regions, recovery targets, retention periods and operational controls must be recorded in the deployment schedule and validated in practice.
4. Subprocessors and transfers
The completed schedule must list the actual hosting and SMTP providers, Meta, Google services when enabled and any other subprocessors, with roles and processing locations. State the agreed authorization and change-notice procedure. Identify international transfers and adopt appropriate legal mechanisms where required. This framework does not incorporate or replace executed EU Standard Contractual Clauses, a UK addendum or a transfer risk assessment.
5. Requests, incidents and cooperation
The processor assists with verified rights requests, impact assessments and regulator enquiries to the extent applicable and practicable. Notify the customer of a confirmed personal-data breach without undue delay and provide available facts as the investigation progresses. The customer remains responsible for its controller notifications and deadlines. A signed schedule should specify incident contacts and cooperation arrangements.
6. Return, deletion and assurance
On termination, provide an export and follow documented deletion instructions, subject to applicable law. Agree the backup deletion cycle and any legally retained records. Supply reasonable information to demonstrate compliance and agree proportionate audit arrangements that protect other customers and system security. The signed schedule should identify authorized signatories and its effective date.