ARWANZAI POLICY
Data Processing Addendum
The DPA framework defines how customer data processing responsibilities are handled when ArwanzAI acts as a service provider/processor for customer-controlled data.
Version 0.9.0-web-policyUpdated 26/09/2026Automatic execution: NEVER
The page is a DPA framework/summary. A signed customer-specific DPA, where required, remains the controlling legal document.
1. Scope
The DPA applies where the customer and ArwanzAI need contractual data-processing terms beyond the general Terms and Privacy Notice. The signed DPA and customer order define the exact scope.2. Processing instructions
ArwanzAI processes customer data only for the contracted service purposes and according to documented customer instructions, subject to security, legal and service-integrity requirements.3. Data categories
Depending on use, customer data may include account identifiers, technical evidence, logs, application/database metadata, reports and support information. Customers should minimize unrelated personal or secret data.4. Security measures
The security measures include access control, encryption, customer isolation, bounded retention, controlled support access, logging/audit controls and incident-response procedures appropriate to the service.5. Subprocessors
Production subprocessors are maintained in a controlled register. Relevant contractual data-processing terms and customer disclosure/notice processes will be finalized according to the service configuration and applicable law.6. International transfers
Where processing involves a different jurisdiction, the applicable contractual and legal safeguards will be applied to the transfer and documented in the approved DPA/subprocessor framework.7. Assistance and incidents
ArwanzAI will use the agreed process to assist with applicable data-subject requests, security incidents and compliance questions within the limits of the service and available information.8. Deletion and return
At termination or on an applicable customer instruction, eligible customer data will be deleted or returned according to the service retention model, accepted order and applicable legal requirements.9. Finalization
The legal entities, processor/controller roles, governing law, international-transfer mechanism and final subprocessor schedule require legal review before execution of a customer-specific DPA.