This web page is not an executed DPA and does not create data-processing terms. A current draft must be reviewed and signed by the authorised parties before production personal data is supplied where a DPA is required.
What the signed DPA must define
- Controller, processor and subprocessor roles.
- Processing subject matter, duration, purpose and data categories.
- Documented instructions and confidentiality commitments.
- Security measures actually applicable to the deployment.
- Subprocessor notification and objection process.
- Deletion or return at the end of service.
- Incident assistance and data-subject request cooperation.
- Applicable international-transfer mechanism and annexes.
Request the current draft
Email support@blastrai.com with the contracting entity, buyer country, intended audience, expected data categories, required data location, subprocessors and procurement deadline.
International transfers
No transfer mechanism is claimed by default. For EU deployments, the parties must document the actual hosting and transfer configuration and, where appropriate, the European Commission Standard Contractual Clauses or another valid mechanism.
Need the customer-specific version?
Ask for the current scope, processing details or security response.
support@blastrai.com