1. Status, parties and scope
Draft only: not effective by browsing or opening an account. These proposed clauses require identified legal parties, authorised signatures, a main services agreement and completed processing schedules before use. Contact privacy@auntynow.com to discuss a business arrangement.
They apply only where AuntyNow acts on another controller’s documented instructions. Its own marketplace, account, payment-record and safety processing remains controller processing under the Privacy Policy. A business relationship does not automatically change those roles.
2. Instructions and lawful processing
Under an executed agreement, the controller must establish lawful purposes, provide notices and obtain required authorisations. The processor must process only on documented instructions, including approved transfers, or an applicable legal requirement; notify the controller of an instruction it considers unlawful; and not repurpose the entrusted data for unrelated advertising.
3. Confidentiality and security
The signed security schedule must set access controls, confidentiality commitments, encryption scope, logging, incident response, backup/recovery and testing responsibilities appropriate to the risk. Existing application controls are described in the Privacy Policy; this draft does not certify unverified provider contracts, staff training or security audits.
4. Sub-processors and transfers
The controller and processor must agree a written authorisation procedure, the relevant providers and services, notification and objection arrangements, and equivalent downstream obligations. The public provider list is informational, not blanket authorisation for every provider. Record actual processing countries and a valid NDPA transfer basis in the schedule before a transfer. A provider’s headquarters alone does not establish where processing occurs.
5. Rights, impact assessments and incidents
The executed terms must require timely assistance with individual rights, impact assessments, regulator inquiries and security obligations. The processor must notify the controller without undue delay after becoming aware of a personal-data breach, provide available facts and updates, and preserve relevant evidence. Agree named contacts and an operational notification deadline that allows the controller to meet applicable statutory deadlines.
6. Records and assurance
The processor must provide information reasonably needed to demonstrate its compliance with the executed terms and cooperate with appropriate audits and regulator access. Agree reasonable confidentiality and security arrangements without blocking mandatory oversight. This draft does not confirm any certification or audit has occurred.
7. End of service and legal holds
The executed agreement must specify return or deletion at the controller’s choice, formats, timing, provider copies, backup expiry and evidence of completion. Necessary legal holds must identify the legal reason, affected categories and review trigger. A legal hold is not permission for unrelated use. No automatic deletion deadline is promised by this unsigned draft.
8. Schedules to complete before signing
- Parties: registered legal names, business addresses, authorised representatives, notice contacts, signatures and effective date.
- Processing: services, subject matter, purpose, duration, operations, data-subject categories, exact data fields and any sensitive-data restrictions.
- Security: required controls, responsible owners, approved access, breach contact/deadline and assurance evidence.
- Providers and transfers: relevant sub-processors, contractual entities, countries, onward transfers, legal mechanism and change/objection procedure.
- Exit: retention periods, legal holds, export format, deletion process, backup cycle and confirmation method.
9. Governing terms
The main agreement must settle precedence, duration, remedies and change control consistently with applicable law. Nothing may remove non-excludable rights or regulatory jurisdiction. An update to this public draft does not amend a signed agreement without its agreed change procedure.