Parties and processing schedule
This is not an executed DPA and cannot establish processor compliance. The customer controller, Alethrai’s legal operator and authorised signatories remain to be identified.
The proposed purpose is to provide agreed organisation setup and configuration evidence services under customer instructions. The schedule must specify duration, operations, data categories and affected administrators or members. Current setup data and future device evidence require separate scope descriptions.
Proposed processor obligations
Alethrai would process customer personal data only on documented instructions, including transfer instructions; require confidentiality from authorised personnel; and implement agreed technical and organisational measures.
Alethrai would obtain required written subprocessor authorisation, provide a meaningful objection process, and impose equivalent protection obligations on subprocessors. It would inform the customer if an instruction infringes applicable data-protection law.
Alethrai would assist with individual rights, security, breach notification and impact assessments; notify the controller of a personal-data breach without undue delay; and provide compliance information and audit cooperation.
Return, deletion and transfers
At the controller’s choice, customer personal data would be returned or deleted at service end, unless law requires retention. The operational schedule must cover copies, backups, legal holds and completion evidence. These procedures are not yet implemented.
Complete the security schedule, provider list, transfer mechanism and retention schedule before execution. Article 28 terms do not themselves establish a lawful international transfer mechanism. No customer-data training permission is granted by this draft.
Official references
These sources inform the draft. They do not endorse Alethrai.