Controller
Defines the lawful purpose, processing instructions, data scope, retention requirements and authorized users.
Data protection · Enterprise assurance
Enterprise data processing.
Governed by design.
Aries Reach provides a clear controller–processor framework for enterprise deployments, aligning processing instructions, security, Subprocessor oversight and operational accountability.
This public template supports procurement and legal review. It becomes binding only when incorporated into an Order Form, master services agreement or another written agreement executed by the parties.
PROCESSING RELATIONSHIP
Clear roles. One accountable operating model.
The Customer determines why and how Personal Data is processed. Aries AI processes that data to deliver Aries Reach under the Agreement and the Customer’s documented instructions.
Processor
Operates the contracted Reach services, applies agreed safeguards and supports Customer compliance obligations.
Subprocessors
Perform defined service functions under written protections and the Reach Subprocessor governance process.
CORE COMMITMENTS
Protection across the full data lifecycle.
The framework is designed around practical enterprise review points—from instruction and access through transfer, incident response and end-of-service deletion.
Documented instructions
Personal Data is processed only for the contracted services, the Agreement and the Customer’s documented instructions.
Confidentiality
Authorized personnel are subject to appropriate confidentiality duties and role-based access requirements.
Risk-based security
Technical and organizational measures are selected for the processing scope, deployment model and assessed risk.
Subprocessor governance
Subprocessors are subject to written data-protection obligations and a governed change process.
Individual rights support
Reach supports reasonable Customer requests relating to access, correction, deletion and other applicable rights.
Incident coordination
Confirmed Personal Data Breaches are escalated without undue delay with information reasonably available to support response.
Lawful transfers
International transfers use an applicable legal mechanism, including Standard Contractual Clauses where required.
Return and deletion
At the end of the Services, Personal Data is returned or deleted in accordance with the Agreement and applicable law.
TECHNICAL & ORGANIZATIONAL MEASURES
Security mapped to risk and deployment.
The applicable controls are selected and documented for the contracted processing scope and architecture. Deployment-specific commitments are captured in the Order Form, solution design or security schedule.
Request the security questionnaire- Governance and risk management
- Identity and access control
- Encryption and key management
- Network and environment protection
- Secure development and change control
- Logging, monitoring and incident response
- Resilience, backup and recovery
- Data lifecycle and deletion
- Supplier and Subprocessor assurance
RESPONSIBILITY MODEL
Governance that follows the architecture.
Reach supports managed cloud, private cloud, on-premise and hybrid configurations. The parties allocate controls and operating responsibilities before production use.
Managed cloud
Aries AI operates the contracted managed environment. Region, retention, access, integrations and service controls are defined during contracting.
Private cloud
A dedicated cloud boundary is configured for the Customer, with operational and security responsibilities allocated in the solution design.
On-premise
The Customer controls the hosting environment while both parties document infrastructure, access, monitoring and incident responsibilities.
Hybrid
Processing is segmented across approved environments, with data routes, regional boundaries and shared controls agreed before production use.
ENTERPRISE DPA STRUCTURE
The agreement, at a glance.
The downloadable Word document contains the full clauses, processing schedules, technical and organizational measures, Subprocessor governance and deployment responsibility model.
- Purpose of the DPA
A Data Processing Agreement (DPA) is a legally binding contract that defines how a service provider (Processor) handles personal data on behalf of a company (Controller).
It ensures that personal data is processed only as instructed and with appropriate safeguards.
- Controller vs. Processor
Controller
The business or user of Aries AI Reach who determines why and how personal data is collected.
Processor
Aries AI Reach and its third-party analytics providers, who process data strictly based on the Controller's instructions.
- GDPR Compliance
Article 28 Compliance
We adhere to GDPR Article 28 requirements when engaging third-party processors.
Data Protection
Ensures that personal data is protected, and misuse or unauthorized processing is prevented.
- Data Security
Both Aries AI Reach and its processors implement technical and organizational measures to prevent:
- Data breaches
- Unauthorized access
- Loss of data
- Responsibilities
- Respecting data subject rights (access, correction, deletion)
- Notification of data breaches in accordance with legal requirements
- Approval and monitoring of sub-processors to ensure compliance
- Limiting international data transfers to compliant jurisdictions
- Example Scenario
A business (Controller) collects customer feedback through Aries AI Reach. The platform uses third-party analytics services (Processor) to analyze data.
Under the DPA, these processors handle the data strictly according to the Controller's instructions and implement necessary security measures to protect customer information.
- Conclusion
By using Aries AI Reach, businesses can confidently leverage analytics while ensuring compliance with applicable data protection laws.
This is supported by formal Data Processing Agreements with all third-party processors.
REGULATORY BASIS
Built for enterprise review—not vague assurances.
The template is structured to support controller–processor contracting under Article 28 of the GDPR. Where Personal Data is transferred internationally and the law requires an approved safeguard, the applicable EU Standard Contractual Clauses can be incorporated.
Exact terms depend on the Customer, processing scope, deployment and relevant jurisdiction. Customers should have their legal and privacy advisers confirm the required documents.
Enterprise review
Bring data protection into
the deployment conversation.
Request an executed DPA, the current Subprocessor register, a security questionnaire response or a deployment-specific security schedule.