Data processing agreement
DRAFT · 2026-10-20-draft · Not executed. Qualified counsel and operator review required before signature or production publication.
Parties and processing instructions
Customer/controller: [moving company legal name and address]. Provider/processor: [operator legal name and address]. Effective date, main agreement, privacy contact and authorized instruction contact: [complete in the order]. Counsel must confirm whether controller/processor terminology and relevant US, EU or other laws apply.
Proposed scope: store, organize, retrieve, transmit, export and delete operational data to provide the customer's configured Vozanto service and authorized support. Processing lasts for the service term and approved return/deletion period. Data subjects may include the customer's customers, prospects, workers, applicants, referral contacts and account users. Data can include contact information, addresses, job and billing records, crew records, messages, photos, documents and vehicle locations. Do not include special-category information or full payment credentials unless the parties expressly approve that scope and necessary safeguards.
The provider will process customer data on documented customer instructions, including instructions about transfers, except where law requires otherwise. The provider will inform the customer of a legal requirement unless prohibited and raise instructions it believes unlawful. Personnel authorized to process data must have appropriate confidentiality obligations and limited access for their duties.
Security, incidents and assistance
Attach a deployment-specific security schedule covering identity and access, privileged administration, encryption, network controls, vulnerability handling, backups, restoration, logging and incident response. Product features alone do not establish effective operation of those controls. The dedicated pilot instance must pass the operations checklist before it receives customer data.
The proposed incident obligation is to notify the customer without undue delay after the provider becomes aware of a personal-data breach affecting the customer's information, and provide available details, affected categories, likely effects, mitigation and a response contact, with updates as information becomes available. Counsel must settle the enforceable timing and coordinate it with applicable duties. This draft does not substitute a universal 72-hour rule for Massachusetts notice requirements. Massachusetts guidance addresses notice as soon as practicable and without unreasonable delay. See Massachusetts breach notification requirements.
The provider will assist with applicable access, correction, deletion and portability requests, security obligations, risk assessments and regulator inquiries, taking account of the nature of processing and available information. Agree request channels, identity checks, escalation, costs and response deadlines before signature. The provider will make appropriate compliance information available and permit an agreed, proportionate audit process; counsel must settle audit rights, confidentiality and operational safeguards.
Subprocessors and transfers
Attach the completed versioned subprocessor schedule before customer approval. Each entry must name the legal entity, processing purpose, categories, countries, contractual safeguards and relevant transfer mechanism. The provider will impose appropriate written obligations and remain responsible as required by applicable law. Agree prior authorization, advance notice and an objection/resolution process before any new recipient starts processing.
This draft authorizes no unknown recipient and supplies no international-transfer mechanism. If regulated transfers apply, counsel must select the required safeguards and attach the relevant instruments and assessments before the transfer. Do not assume this draft incorporates standard contractual clauses.
Return, deletion and exceptions
At termination, follow the customer's documented choice to return or delete data, subject to legal retention duties. Attach agreed formats, secure delivery, an access window, verification of attachment completeness, active-store deletion, backup expiry and written completion evidence. Identify exceptions and restrict further processing to the purpose that requires retention.
Current export and customer deletion tools have the limits described in the privacy notice. A company-wide purge, complete attachment archive, backup erasure schedule and third-party deletion proof require operator procedures and verification. Confirm the binding timeline before signature; a successful UI action alone does not establish complete erasure.
Schedule and signature gates
Before execution, complete parties and contacts; applicable law; processing categories; location and transfer schedule; security controls and evidence; approved recipients; incident and rights-request procedures; return/deletion plan; audit provisions; precedence against the main agreement; and any liability allocation. Both parties' authorized representatives must approve the final document.
For deployments subject to GDPR, counsel should assess the controller-processor contract requirements in GDPR Article 28. This draft is a review framework and does not assert GDPR compliance or applicability.