Sample contract schedule
Data Processing Addendum
1. Roles and instructions
Customer is controller and Tauri Pro is processor for personal data submitted to the service, except where Tauri Pro acts independently as controller. Tauri Pro will process data only on documented instructions and to provide, secure and support the service.
2. Processing details
Subjects may include Customer personnel, contractors and stakeholders. Data may include identity, contact, role, project, resource, time, financial-reference and usage data. Processing continues for the subscription and applicable deletion period.
3. Security and confidentiality
Tauri Pro will maintain appropriate access control, encryption, logging, vulnerability management, backup, incident response and personnel confidentiality measures proportionate to risk.
4. Subprocessors and transfers
Customer authorizes documented subprocessors subject to equivalent data-protection duties. Tauri Pro should maintain a public list and notice process. International transfers require a valid legal mechanism.
5. Assistance and incidents
Tauri Pro will reasonably assist with data-subject requests, impact assessments and regulator inquiries, and will notify Customer without undue delay after confirming a qualifying personal-data breach.
6. Return, deletion and audit
On termination, Customer may export data during the documented window. Tauri Pro will delete or return data unless law requires retention. Compliance information and proportionate audit rights should be defined in the final DPA.