This draft reflects the intended controller/processor relationship where a business uses My Business Control Center to manage its own customers. It requires specialist review before launch.
The business customer is expected to act as controller for much of its customer data, while My Business Control Center may act as processor when processing that data to provide the service.
Production terms will describe subject matter, duration, nature and purpose of processing, categories of data and data subjects, confidentiality, security, subprocessors, assistance with rights requests, deletion/return and audit obligations.
Any international transfers and safeguards will be documented after final providers and regions are selected.
The production DPA will reflect the actual technical and organisational measures implemented in the live service.