Data processing terms
Preview draftA procurement-oriented Article 28 schedule outline for review. It is not an executed DPA, and it does not attach or incorporate standard contractual clauses.
Owner and legal verification required before publication
This draft leaves material facts and commitments unresolved. It is not an operative notice, policy or agreement, and it does not claim regulatory or accessibility compliance.
- Complete the processing scope, duration, data subjects and data categories with each customer.
- Approve technical and organizational measures and the audit-evidence process.
- Identify subprocessors, regions, transfer safeguards and change-notice period.
- Set assistance, breach notice, return/deletion and audit terms in the executed agreement.
Status and order of documents
No executed DPA is represented by this preview. A processor relationship, controller instructions, security schedule and any transfer clauses must be established in a signed agreement that identifies the customer and the selected service.
The outline below identifies the Article 28 information a final schedule should contain. It is not a statement that all Article 28 terms or technical safeguards are currently in place, and it does not amend an existing customer agreement.
Annex I — processing details
| Required detail | Preview entry | Status |
|---|---|---|
| Subject matter and nature | Operate the contracted reconciliation service, including customer-authorized ingestion, preparation, matching, exception handling and audit records; exact modules depend on the order. | Customer-specific scope to confirm. |
| Duration | The service term plus any agreed return/deletion window and legally required retention. | Order term and exit period not supplied. |
| Processing location | Current FVI customer-processing cell: United Kingdom. US, EU, India and Singapore cells are planned only. | Confirm exact deployment and all provider, edge, support and onward-transfer paths for the customer service. |
| Purpose and documented instructions | Perform only the service activities and instructions defined in the final order and DPA. | Instruction channel and exceptions to approve. |
| Data subjects | Potentially customer users, employees, customers, counterparties and other persons represented in source records. | Exact groups depend on customer data mapping. |
| Personal data categories | Potentially business identifiers and contact details, account/reference data, transaction, cash, securities, intercompany or ledger records, exception notes and audit events. | Customer-specific categories and sensitivity to confirm. |
| Special categories or criminal-offence data | No category or processing purpose is approved by this preview. | Customer and counsel must decide whether in scope and what safeguards apply. |
Annex II — security and organizational measures
The final DPA should attach the applicable, versioned security schedule and explain how it applies to the selected deployment. FVI's public Security page is informational; it is not an audit report, certification, or substitute for the agreed schedule.
| Control area | Evidence needed for final schedule |
|---|---|
| Access and confidentiality | Service-specific identity, role, approval and personnel-confidentiality controls. |
| Protection in transit and at rest | Selected deployment configuration, cryptographic scope and key-management responsibilities. |
| Resilience and recovery | Applicable backup, restoration, recovery objectives and evidence. |
| Testing and assurance | Current test scope, results, exceptions and remediation evidence; no certification is implied. |
| Incident management | Notification route, legal assessment responsibilities and customer communication period. |
Processor terms to negotiate
- Documented instructions, confidentiality, appropriate security and prior authorization for subprocessors.
- Assistance with data-subject requests, security obligations, breach assessment, and controller impact assessments, with defined scope and fees if applicable.
- A subprocessor list, change process, notification period, objection route and allocation of responsibility.
- Audit and inspection rights, including reasonable evidence, notice, confidentiality and scope conditions.
- At the controller's choice, return or delete personal data at the end of service, subject to documented legal-retention exceptions.
International transfers and end of service
The current customer-processing cell is in the United Kingdom; this does not determine the locations of every supplier, support access path or network edge. US, EU, India and Singapore cells are planned only. No SCC module, UK transfer instrument or transfer assessment is represented as signed or active. The final agreement must identify each actual transfer, the applicable mechanism and any supplementary measures before customer data is transferred.
Return format, deletion schedule, backup wind-down, legal holds and written confirmation are not set by this preview. These details must be agreed for the selected service and reflected in the executed DPA.
Reference material
- GDPR, Regulation (EU) 2016/679See Article 28 for processor-contract requirements.
- European Commission SCCs for controller–processor relationshipsOfficial reference; publication here does not mean FVI has executed these clauses.
Privacy and DPA enquiries: privacy@falconveritas.com