Data Processing Agreement

Why there are two roles, not one

AOG Hub acts in two capacities and a serious agreement has to separate them. For the directory of organizations, AOG Hub decides what is held and why, and is therefore a controller in its own right. For the cases, messages and members your organization creates on the platform, AOG Hub processes that data on your instructions - and that is what this document governs.

What the finished document will cover

• Subject matter and duration - what is processed, for how long, and what happens at the end.
• Nature and purpose - hosting the case, delivering messages and calls, notifying the right people, and keeping the record.
• Categories of data subjects - your members, and the people at the organizations you communicate with.
• Instructions - the confirmation that AOG Hub processes only on your instructions, and what happens if an instruction appears unlawful.
• Confidentiality - who at AOG Hub can access what, and on what basis. Message content is not among the things support can read.
• Security measures - the technical and organizational measures, described concretely enough to be audited.
• Sub-processors - the hosting and infrastructure providers used, notice of changes, and your right to object.
• International transfers - where processing happens and the transfer mechanism relied on.
• Assistance - help with data-subject requests, impact assessments and regulator enquiries.
• Breach notification - what you are told, and how quickly.
• Audit - what you may inspect, and how.
• Deletion and return - what happens to your cases and records when your organization stops using the platform.

If somebody asks us for your messages

This is the question operators ask, and it deserves an answer in advance of the paperwork. AOG Hub can produce what it holds: that a message travelled between two organizations, when, and how large it was. It is not in a position to hand over what was said, and a platform that could would be asked to. The finished agreement will state the position, and how your organization is told when a request is received.