Prepared for review: 17 October 2026. Not adopted as final policy or an executed agreement. Effective date pending.
Details requiring confirmation
- Parties, processing roles and applicable law
- Processing particulars and customer instructions
- Security schedule and verified subprocessors
- Transfers, incident obligations and assistance
- Export, deletion, audit and execution arrangements
1. Parties, scope and role allocation
This draft is not an executed agreement. Identify the customer, the AQClouds contracting entity and the relevant processing activities. Allocate controller and processor responsibilities by activity, based on who determines purposes and means. Website enquiries and customer-uploaded platform data may involve different roles. The applicable law and agreement hierarchy require review.
2. Processing schedule and documented instructions
Before execution, specify the subject matter, purpose, nature and duration of processing, categories of personal data and data subjects, systems and countries involved. Processing should follow documented customer instructions within the agreed scope, including any agreed transfer instructions. Procedures for legally required or potentially unlawful instructions must be defined.
3. Customer responsibilities
The customer should establish authority and applicable grounds to provide personal data, issue lawful instructions, supply necessary notices and manage authorized users. Its responsibilities and rights in relation to records, accuracy and individual requests must be agreed.
4. Confidentiality and security
Access should be limited to authorized personnel subject to appropriate confidentiality duties. A verified security schedule should describe technical and organizational measures, access controls, incident processes, recovery and testing as appropriate. No certification, audit result or security guarantee is asserted by this draft.
5. Subprocessors and AI services
Identify actual hosting, email, AI and other subprocessors used for the contracted processing. Agree authorization, changes, notice, objection, contractual protections and responsibility before use. No list or provider-specific privacy promise is fabricated. AI data flows, training settings and retention must be documented.
6. International transfers
Document data locations and any cross-border transfers, applicable restrictions and appropriate legal mechanisms or safeguards. Transfer terms must be reviewed against the parties’ actual locations, providers and applicable law; no mechanism is assumed sufficient by this draft.
7. Data subject requests and assistance
Agree how requests will be forwarded, identity and authority verified, and the customer supported in responding. Define assistance with assessments, regulator enquiries and compliance obligations where applicable, including any agreed costs and practical limits.
8. Security incidents
Define incident reporting responsibilities, communication channels, information to be provided, escalation and cooperation. Applicable reporting obligations and notification timing must be reviewed and agreed. This draft does not invent an incident deadline or guarantee that an incident cannot occur.
9. Data return, deletion and retention
At the agreed end of processing, provide for return or deletion as instructed, subject to applicable obligations. Agree export formats, timelines, verification, backup treatment and any retained-data restrictions. Specific retention periods remain unresolved.
10. Audits and compliance responsibilities
Agree proportionate evidence, review and audit arrangements, confidentiality, security limitations, remediation and responsibilities. Do not imply an existing certification or unrestricted system access. Any audit rights required by applicable law must be addressed in the final agreement.
11. Execution and schedules
Complete and review the processing particulars, approved subprocessors, locations, security measures, transfer provisions, contacts and signature details. No customer should treat this website draft as a signed DPA. Contact hello@aqclouds.com for the agreement process.
This draft is provided for review rather than as a claim of compliance with any specific regulation or certification.