A processing agreement before customer data
This page describes the processing terms to agree. It is not a signed Data Processing Agreement (DPA), and does not replace one. Arshad Ahamed trading as Arshadify and the customer must identify their roles and complete a binding agreement where Article 28 applies before the relevant processing begins.
The schedule must name the parties, services, duration, purposes, categories of individuals and data, authorized instructions, Azure deployment, other recipients and transfer arrangements. Two years from collection is the default customer-data retention maximum, subject to earlier deletion or a documented legal requirement.
Terms the agreement must cover
- Processing only on documented instructions, including transfers; notification of instructions that infringe applicable data-protection law.
- Confidentiality duties and access limited to authorized personnel.
- Documented, risk-appropriate technical and organizational security measures, with actual deployment evidence.
- Subprocessor authorization, change notices, objection procedures and equivalent obligations.
- Assistance with individuals’ rights, security, impact assessments and regulator consultations where required.
- Notification to the customer without undue delay after becoming aware of a personal-data breach, with cooperation on assessment and response.
- Return or deletion at the customer’s choice when processing ends, including copies except where law requires retention; an explicit backup-deletion schedule.
- Information demonstrating compliance and proportionate audit and inspection rights.
Human approval is not data-subject consent
A customer approving a contact list or an outreach draft authorizes that workflow. It does not by itself provide the lawful basis, individual notice, recording consent, or marketing permission required by law. Those requirements must be established separately.
Customer-provided data, transcripts and AI prompts should be limited to the approved purpose. Model-training restrictions and provider retention terms must be explicitly documented; this website does not claim that a no-training agreement has already been signed with an unidentified AI provider.
Request the documents
Request a customer DPA and deployment schedule. The signed agreement must include the confirmed legal address, processing locations, provider list, safeguards and retention schedule. This website does not display SOC 2, ISO 27001, or GDPR certification claims for Arshadify.