An agreement to finalize
This is a DPA preparation document, not an executed processing agreement. Before live customer data is processed, the customer and the service operator must identify their roles and agree binding terms satisfying applicable data-protection law.
Processing scope
Proposed subject matter: hosting customer PWAs, recording configured visitor events and conversions, generating reports and delivering requested push campaigns. Data subjects include customer team members and visitors to customer PWAs.
Data can include browser/device and attribution identifiers, IP/browser information, country/platform, event timestamps, tracker conversion data and push subscription/delivery data. The customer defines permitted purposes, integrations and duration within the agreed service scope.
Instructions and confidentiality
The final DPA must limit processing to documented lawful customer instructions, including instructions for transfers. People with access must be bound by confidentiality. The processor must inform the customer if an instruction appears to infringe applicable data-protection law.
Security and assistance
The technical annex must describe actual access controls, tenant isolation, transport protection, credential handling, backups, recovery and verification procedures. Features in source code are not a security certification.
Agree assistance with rights requests, impact assessments and regulatory inquiries; incident reporting without undue delay, required information and operational contacts. Do not insert an unverified response-time SLA.
Subprocessors and transfers
Record each approved provider’s legal entity, function, data categories, processing locations and transfer mechanism. Agree authorization, change notifications and objection procedures, with equivalent obligations flowing to subprocessors.
The service-provider inventory is a technical starting point, not a completed or contractually approved subprocessor register.
Return, deletion and audit
Specify duration, return or deletion at the customer’s choice after termination, any statutory exceptions, backup expiry and evidence of completion. Verify that all stores, queues, aggregates and provider copies are covered.
Agree information needed to demonstrate compliance and reasonable audit arrangements. Complete these annexes before using this draft as a contract.