# Data Processing Agreement (Draft Outline)

Effective Date: February 26, 2026

This draft is a template outline for institutional review and legal completion.

## Parties

- Institution (Controller)
- Sukma (Processor / Service Provider)

## Processing Scope

- Course and session operations
- Audience query lifecycle records
- Session summaries

## Processor Obligations

- Process personal data only on documented instructions
- Implement technical and organizational safeguards
- Support controller rights requests where applicable
- Notify controller of confirmed incidents without undue delay

## Retention and Deletion

- Organization-configured retention: 7-90 days (default 30)
- Redaction of conversation payload fields post-retention
- Metadata retained for audit trail continuity

## Subprocessors

Sukma maintains and provides a subprocessors list by request and contract.

## Audit and Assistance

Sukma provides contractually defined assistance for audits, legal requests, and
data handling inquiries.