Data Processing Addendum Summary

When a signed agreement applies

The firm provides advisory services. It does not present itself as a processor or host for client data unless a specific engagement says so in writing, in terms agreed for that engagement. Where a signed Data Processing Addendum is agreed, it would state, for that engagement: the subject matter of the engagement, and the services to which the agreement applies; the categories of material provided by the client for the engagement; the purpose for which that material may be used; the roles of each party for that engagement, as agreed in writing for that engagement; and how long the agreement applies, tied to the engagement term. No role, category, or term is fixed on this summary page for all engagements, because those items are set per engagement. Services covered by this summary, where an engagement is in scope: AI Governance; Privacy and Data Governance; Cookie and Script Governance; Process Excellence; Custom AI and Data Solutions; Fractional Advisory.

What a Data Processing Addendum for an engagement would cover

• Roles. The roles of the parties for the engagement, stated for that engagement, including who decides purposes and means for the material in scope. In general terms, a signed agreement would record which party determines the purposes for the material provided, and which party handles that material only on instruction for the engagement, within the limits stated in the agreement. The exact allocation for a given engagement is the allocation written in its signed agreement, not a general statement on this page.
• Confidentiality. Material provided for the engagement is treated as confidential for that engagement, under the terms of the agreement.
• Onward sharing. The agreement would state whether, and under what conditions, material may be shared with another party for that engagement, and what client agreement is required for such sharing.
• Scope and material. The material in scope for the engagement, the purposes for which it is used, and the data flows, purposes, and recipients in scope, as named in the written agreement.
• Data use limits. Client material is used only for the engagement it was provided for. It is not used for any other engagement, and it is not used for any other purpose. Client data is not sold, and client data is not used to train models.
• Access limits. Access to client material is limited to the people who need it to carry out the engagement, and access is removed as part of closing the engagement.
• Third parties for that engagement. Any third party that will handle client material for that engagement, as agreed for that engagement, rather than a single standing list.
• Security, screening, and insurance provisions. Any specific provision on security, screening, insurance, encryption, key management, or storage that applies to that engagement, confirmed in writing before work starts and written into the agreement for that engagement.
• Return or delete at engagement end. At the end of the engagement, client material is returned or deleted, on the client's instruction. The client states which of return or delete applies, and Movahedi Solutions acts on that instruction.
• Public naming. A client is not named as a client, in any public material or in any reference, without the client's written permission.

How the signed addendum is agreed

The signed Data Processing Addendum for an engagement is agreed in writing for that engagement, together with the written agreement for that engagement, before work that depends on it begins. Where the summary on this page and the signed addendum for an engagement differ, the signed addendum for that engagement governs, in the same way the written agreement governs under the Terms of Engagement. A buyer who needs a signed addendum should raise it during scoping, or request it at mohammad@movahedi.ca naming the engagement and the document needed.

Related pages

• Trust Center
• Privacy and Data Handling
• Privacy Notice for Engagements
• Terms of Engagement
• Encryption Statement

Scope and limits, stated briefly

This summary is company information, not legal advice for a specific client matter and not a law firm opinion. It is not a signed Data Processing Addendum, and it does not replace the signed addendum for an engagement. Contact: mohammad@movahedi.ca.