Roles and instructions
Where a customer determines purposes and means, the customer acts as controller and the NewsForensics operator acts as processor only on documented, lawful instructions.
DATA PROCESSING ADDENDUM
A contract framework for customer-controlled data.
This draft DPA records controller and processor duties, security measures, subprocessors and deletion instructions for enterprise review.
Confidentiality and security
Authorised personnel are bound to confidentiality. Technical controls include tenant scoping, access roles, session revocation, provider credential references, evidence hashes, audit events and incident workflows.
Subprocessors
Processors may be engaged only for documented purposes with appropriate contractual and security review. Material additions are recorded in the public register and enterprise agreements may define notice and objection rights.
Assistance and incidents
Reasonable assistance is provided for data-subject requests, risk assessments and confirmed personal-data incidents, subject to identity, tenant scope and contractual terms.
Return and deletion
At termination, customer data is returned or deleted according to configured retention rules unless law, fraud prevention, dispute preservation or a legal hold requires limited continued retention.