Business Processing Policy

BUSINESS PROCESSING POLICY

RECITALS

This Business Processing Policy ("Policy") is made effective as of by and between Controller Name: with address ("Controller"), and Processor Name: with address ("Processor").

WHEREAS, Controller engages Processor to perform certain business processing activities involving Controller's business information and personal data for the purposes set forth below; and

WHEREAS, Processor has represented that it maintains appropriate administrative, technical and physical safeguards designed to protect the confidentiality, integrity, and availability of data processed on behalf of Controller; and

WHEREAS, the parties desire to document the scope, responsibilities, security controls, retention, and other terms applicable to the processing of Controller's data.

SCOPE OF WORK

PROCESSING ACTIVITIES

Describe the types of processing activities Processor will perform on behalf of Controller, including any automated decision-making or profiling:

DATA CATEGORIES AND PURPOSE

SECURITY MEASURES

Processor shall implement and maintain technical and organizational measures appropriate to the risk, including but not limited to encryption, access controls, logging, vulnerability management, and incident response as described below:

SUB-PROCESSORS

Processor shall not engage any sub-processor to perform processing on Controller's behalf without Controller's prior written authorization, except as listed below. For any authorized sub-processor, Processor shall impose equivalent contractual obligations.

DATA RETENTION AND DELETION

Processor shall retain Controller data only for as long as necessary to fulfill the purposes set forth in this Policy or as required by law. Upon termination or expiry of services, Processor will, at Controller's direction, return or securely erase Controller data in accordance with the schedule below:

ACCESS, AUDIT RIGHTS, AND INCIDENTS

Controller may exercise reasonable audit rights, subject to confidentiality constraints, to verify Processor's compliance with this Policy. Processor will notify Controller without undue delay upon becoming aware of any incident that results in unauthorized access to Controller data and will provide reasonable cooperation in investigation and remediation.

Controller audit right requested: (check to permit audits under the terms set forth in this Policy)

PAYMENT TERMS

In consideration for services rendered under this Policy, Controller shall pay Processor as follows.

TERM AND TERMINATION

This Policy commences on and shall continue until unless earlier terminated in accordance with this section.

Either party may terminate this Policy for material breach by the other if the breach is not cured within the notice period specified above. Termination does not relieve either party of liabilities incurred prior to termination.

CONFIDENTIALITY

Each party acknowledges that in the course of performance they may receive Confidential Information of the other party. Confidential Information shall mean non-public information that is designated as confidential or should reasonably be understood to be confidential. The receiving party shall (i) use Confidential Information only to perform its obligations under this Policy, (ii) restrict access to employees and contractors with a need to know and who are subject to confidentiality obligations, and (iii) not disclose Confidential Information to third parties except as required by law, provided the disclosing party is given notice when permissible.

GOVERNING LAW

This Policy shall be governed by and construed in accordance with the laws of the state of without regard to its conflicts of law principles.

ENTIRE AGREEMENT

This Policy, together with any statement of work and fee schedules referenced herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior and contemporaneous understandings, agreements, and communications, whether oral or written.

NOTICES

Sign Now