Data Processing Agreement

This page is a temporary discussion draft. It is not an executed data processing agreement, does not appoint a processor, and does not authorize the processing of customer or client information. It does not describe the current data practices of the VakeelOS application.

Before any application or service processes personal data for a customer, the parties must enter into a separate written agreement that is complete for the specific service and accepted by both parties.

The separate agreement must identify the parties and their roles, the service covered, the subject matter and purpose of processing, the duration, the types of personal data and people concerned, and the customer's documented instructions. It must also describe how changes to those instructions will be handled.

The parties must agree who may access the data, the confidentiality obligations that apply, and the technical and organisational security measures required for the specific service. This draft does not claim that any particular safeguard has been implemented.

Before processing begins, the agreement must identify or describe the permitted sub-processors and processing locations, the authorization and notice process for changes, and any applicable transfer restrictions. This page does not publish or approve a sub-processor list.

The parties must agree how and when suspected personal data incidents will be reported, what information a notice will include, and how the service provider will assist with customer requests, investigations, and other legal obligations. This draft sets no incident-notification deadline or service level.

The agreement must set out how data can be returned or exported, when it must be deleted after the service ends, and how backups or records that must be retained by law will be handled. This draft does not promise a deletion period.

For questions about this discussion draft, contact legal@vakeelos.com.