Data-processing schedule

1. Attach this to an agreed order

This schedule must identify the customer, authorised instructions, term, purposes, categories of records and people, locations, approved subprocessors and retention requirements before signature. Typical activities are hosting, account access, storage, retrieval, operational support, export and—only when approved—AI inference. It is not a signed agreement merely because it appears on the website.

2. Instructions and confidentiality

The customer determines lawful purposes and instructions for its workspace data, supplies appropriate notices and obtains required authorisation. VasKem processes on documented instructions, limits access to authorised personnel subject to confidentiality duties, and raises instructions it reasonably believes conflict with applicable law. Processing for VasKem's own billing or security purposes is addressed separately in the privacy notice.

3. Safeguards and incidents

The parties agree appropriate technical and organisational measures, including access management, encrypted transport, protected credentials, tenant-scoped access, backups and recovery arrangements. The final schedule must specify actual controls rather than imply unverified certifications or recovery targets.

Where acting as an operator, VasKem must notify the responsible party immediately when there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, and assist investigation and containment. The responsible party determines required regulator/data-subject notifications, with assistance; neither party may delay a legally required notice by relying on this contract.

4. Subprocessors and transfers

Before use, document each approved processor, service, processing location, data scope, applicable safeguards and authorisation. Changes require the agreed notice and objection process. Overseas processing needs an applicable lawful transfer basis and contractual protections where required. The confidential register must identify the AI service; public branding does not replace customer transparency or authorisation.

5. Rights, evidence and end of service

VasKem assists the customer with proportionate access, correction, objection, deletion and incident requests, and supplies appropriate compliance evidence under a confidentiality-protecting review process. The parties agree responsibilities and reasonable assistance costs without limiting mandatory duties.

On termination, follow the agreed return/deletion instructions and retention schedule, including backups and legal holds. Record completion and exceptions. Exact backup expiry, recovery objectives and processor deletion arrangements are outstanding owner/contract-review items and must not be assumed from this draft.