Data Processing Agreement (DPA)
The terms under which Asrar Studio SARL processes your clients’ personal data on behalf of your firm — the firm is the controller, Asrar the processor.
On this page (10 sections)
This agreement (the “DPA”) forms part of the Terms of Service between Asrar Studio SARL (“the Processor”) and the firm that owns the workspace (“the Controller”). It applies automatically as soon as Asrar processes personal data on the firm’s behalf. A signed copy is available on request at legal@asrar.example.
1. Definitions and applicable law
Applicable laws: Moroccan Law No. 09-08 and, where data subjects are located in the European Union, Regulation (EU) 2016/679 (GDPR). Firm data: the personal data contained in the content entered or uploaded by the firm about its clients and their contacts.
2. Roles
2.1. The firm is the controller of its clients’ data: it decides which clients it follows, what information it enters and to whom it sends reports. Asrar is the processor.
2.2. Asrar processes firm data only on the firm’s documented instructions: the Terms, this DPA and the use of the Service by authorised members (creating profiles, approvals, sending reports).
3. Details of the processing
| Item | Description |
|---|---|
| Subject matter | Provision of the QSE regulatory watch Service |
| Duration | Term of the agreement, then the deletion periods of § 8 |
| Nature | Hosting, storage, analysis, matching, generating and sending deliverables |
| Data subjects | Contacts of the firm’s clients (QSE managers, executives, report recipients), members of the firm |
| Data categories | Identity and business contact details, position, preferred language, delivery history; no sensitive data |
4. Processor obligations
Asrar undertakes to: ensure the confidentiality of authorised persons; apply the security measures of § 9; not use the data for its own purposes, nor to train AI models; help the firm answer data-subject requests and meet its obligations (security, breach notification, impact assessments); make available the information needed to demonstrate compliance.
5. Subprocessors
The firm authorises the use of the listed subprocessors. Asrar informs firms at least 30 days before adding or replacing one; the firm may object on legitimate grounds and, failing agreement, terminate the affected Service. Asrar remains liable for its subprocessors.
6. Personal data breaches
Asrar notifies the firm without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting its data, with the information needed for its own notification obligations.
7. International transfers
Any transfer of firm data outside Morocco or the European Union to a country without an adequate level of protection is governed by the European Commission’s Standard Contractual Clauses and by the formalities provided for by Law No. 09-08.
8. Deletion and return
The firm can export its data at any time. At the end of the agreement or when a firm is deleted, Asrar erases the data from active systems within 30 days and from backups within a further 35 days, unless retention is required by law.
9. Security measures
Encryption in transit (TLS) and of secrets at rest; logical isolation of each firm (every query is scoped to the firm); role-based access control; private files served only through temporary links; audit log of approvals, sendings and permission changes; regular backups; vulnerability management and staff access limited to what is strictly necessary.
10. Audits
Asrar answers a reasonable security questionnaire once a year. If required by law or an authority, the firm may carry out an audit with 30 days’ notice, at its own cost, without access to other firms’ data.
In case of discrepancy between this English version and the French version, the French version prevails.