Status, parties and instructions
This published framework is not a signed processing agreement. It can become operative only when the parties, processing annexes and acceptance mechanism are completed. It does not replace an EU or Turkish international-transfer instrument.
Where the customer determines the purposes and essential means of workspace processing, the customer is controller and the provider processes personal data on documented instructions. Different roles, including independently collected candidate information, must be assessed rather than automatically classified as processor activity.
Processor obligations under the agreed addendum
- Process only under documented lawful instructions, and flag instructions that appear incompatible with applicable data-protection law.
- Limit authorised access and ensure appropriate confidentiality obligations for personnel who handle customer data.
- Apply risk-appropriate technical and organisational measures described in the completed security annex. Do not treat an unverified certification or encryption statement as part of this framework.
- Assist with data-subject requests, incident response, impact assessments and compliance information to the extent required for the processing relationship.
- Notify the customer of a personal-data breach without undue delay after awareness, with available information and follow-up. The final incident contacts and escalation process must be completed.
- At the end of the service, return or delete customer-directed personal data according to the agreed instructions and applicable retention duties; document backup handling and deletion windows.
Subprocessors and transfers
The final register must identify each authorised subprocessor, legal entity, service, processing location, data category and transfer safeguard. Changes require the agreed notice and objection procedure. A provider listed in source code is not, by itself, proof of an executed processing contract.
Where international transfers require additional safeguards, the relevant mechanism must be assessed and completed for the actual exporter/importer roles. This framework does not automatically incorporate every standard contractual clause or assert that all transfers are already compliant.
Annexes to complete
| Annex | Required detail |
|---|---|
| A · Processing | Parties, products, subject matter/duration, purposes, instructions, data categories and groups of people. Task: team/client work. Scale: metrics/files/reports. Compete: research inputs/results. Recruit: sourcing, enrichment and candidate pools, with roles separately assessed. |
| B · Security | Verified access controls, authentication, encryption scope, logs, backups, incident handling, isolation and deletion procedures. |
| C · Recipients | Confirmed subprocessor list, regions, contracts, transfer instruments and change-notice mechanism. |
| D · Exit and oversight | Export/return format, deletion and backup windows, audit evidence, contacts and any proportionate audit terms. |