Data processing addendum — draft
Define processing roles, instructions and safeguards for the actual engagement.
#1. Roles by activity
A software installation without Sigillum access to institutional data differs from remote support that exposes data. Where Sigillum processes on institutional instructions, document controller/processor roles and responsibilities. Assess Sigillum’s own billing and business-contact processing separately.
#2. Processing schedule
| Schedule field | Content to agree |
|---|---|
| Subject, duration and purpose | Installation, maintenance or defined support activity |
| Individuals | Actual groups, such as customers, employees or applicants |
| Data categories | Required trace fields and any sensitive categories |
| Operations | Access, analysis, temporary copies, transfer and deletion |
| Location | Actual hosting/support countries and access boundary |
| Safeguards | Permissions, encryption, keys, logging and incidents |
| Retention and exit | Period, return/deletion method and evidence |
Complete these fields for the actual customer engagement.
#3. Instructions, confidentiality and subprocessors
A processor acts on documented lawful instructions and informs the institution of mandatory legal processing where legally permitted. Personnel are subject to confidentiality and access restrictions. Agree subprocessor identity, role, location and change-notice/objection procedures. A software component is not automatically a data-accessing subprocessor.
#4. Rights, incidents and audit assistance
Provide assistance with individual requests, risk assessments and investigations within the authorised scope and available information. Route institutional-data requests according to instructions. Communicate incidents to the institution without undue delay and allocate authority/individual notification duties. Audit arrangements must protect other customers’ data and confidential information.
#5. Transfers and required terms
Where applicable, include GDPR Article 28 terms and Chapter V transfer safeguards, alongside current KVKK security and transfer obligations. This draft does not execute or notify standard transfer clauses. KVKK standard-contract procedure; GDPR.