Data processing agreement
Draft aligned with the selected policies; outstanding facts and review remain pending.
Version: 2026-10-19-selected-policies-v21. Scope and instructions
For customer-directed complaint and branch workflows, the business determines purposes and instructions and Sumaty processes information on its behalf. Sumaty separately determines its own account administration, security and support purposes. The actual contract and processing determine each party's role.
2. Data and confidentiality
Processing may include authorized staff identities, branch records, complaint messages and optional contact details, connected reviews and operational history. Authorized personnel must protect confidentiality and use this information only for documented purposes. Customers must not submit unnecessary sensitive information.
3. Security and assistance
Access is scoped to organizations, roles and branches. Requests for access, correction, export or deletion require identity and authority checks. Security incidents, rights requests and lawful assessments are escalated to the responsible controller through the agreed contact route and applicable deadlines.
4. Providers and transfers
The linked provider register identifies intended recipients and unresolved contracting entities, locations and transfer arrangements. A proposed provider is not an approved transfer. Necessary contractual safeguards, authorization and applicable transfer requirements must be established before affected production processing.
5. Return and deletion
On termination, the selected commercial policy provides a 30-day read-only/export window. Deletion, backup expiry and retention of necessary legal/security evidence follow the agreed lawful schedule. This draft does not invent a complaint retention period or promise instant erasure from all backups.
6. Review and changes
This is a draft data-processing agreement for review with the actual operator and customer. Operator identity, notices, subprocessor terms, data regions and any required review remain unresolved until verified. Material changes require updated documents and appropriate notice or acceptance.
Contact details are currently unavailable.