Roles
The parties define controller and processor responsibilities according to the engagement scope and data flows.
Processing Scope
Processing activities, categories of data, and retention expectations are documented in the applicable commercial agreement.
Security Measures
Appropriate technical and organizational measures should reflect the sensitivity, volume, and operational context of the data involved.
Sub-processors
Where relevant, sub-processor usage and transfer considerations should be addressed transparently.