Controller and processor roles
For enquiries and our own business records, AryaSol is the controller. For campaign work inside your ad accounts, CRM and email platform, you are the controller and we are your processor.
Every retainer includes a data processing agreement setting out subject matter, duration, categories of data and instructions.
Lawful basis
We record a basis before processing begins.
- Contract: delivering the services in your statement of work
- Legitimate interests: responding to business enquiries, site security, aggregate analytics
- Consent: marketing cookies, marketing email, and any list you ask us to send to
- Legal obligation: tax, accounting and audit records
Data processing agreement
Our standard DPA is available on request and is signed before we touch a production account. It includes confidentiality obligations, security measures, breach notification within 72 hours, audit rights, and deletion on termination.
Where you provide your own DPA, we will review and sign it if the terms are compatible with our security posture.
Sub-processors
We use only the sub-processors needed to deliver the work, each under written contract with equivalent obligations. The current list is attached to your DPA and we give 30 days notice before adding one, so you can object.
For aryasol.com itself, where we are the controller of visitor enquiries:
- Zoho CRM (United States) — enquiries, quote requests and bookings
- Vercel — hosting and server logs
- Google — reCAPTCHA on the forms, and Calendar for booking invitations
- Zoom — meetings, where a caller chooses Zoom
Sub-processors for client work
Where you are the controller and we act as your processor, the sub-processors are the platforms your campaigns run on:
- Ad platforms you have chosen to run
- Your email service provider
- Google Workspace
- Cloud hosting and reporting infrastructure named in your DPA
International transfers
Our own Zoho CRM account is hosted in the United States, so enquiries submitted through aryasol.com are transferred there. Google, Vercel and Zoom likewise operate globally.
Where a sub-processor stores data outside the EEA or UK, transfers rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision.
We record a transfer impact assessment for each and review them annually.
Data subject rights
As a processor we do not respond to your customers directly. We forward any request we receive to you within five business days and assist with access, correction, deletion, restriction, portability and objection.
For data we control, requests go to legal@aryasol.com and are answered within 30 days.
Security measures
Technical and organisational measures include mandatory two-factor authentication, least-privilege access reviewed quarterly, encrypted devices, a managed credential vault, and no client data on personal accounts.
Staff are trained on data handling at onboarding and annually. Access is revoked the day someone leaves.
Breach notification
We notify you without undue delay and within 72 hours of becoming aware of a personal data breach affecting your data, with what we know, what we have contained, and what we recommend.
We keep a breach register regardless of whether notification to a supervisory authority is required.
Retention and deletion
On termination we return or delete client personal data within 30 days, except where law requires us to keep records. Deletion is confirmed in writing on request.
Records and accountability
We maintain records of processing activities, our sub-processor list, transfer assessments and our breach register, and we make them available to controllers on request.
For questions or to raise a concern, write to legal@aryasol.com. You also have the right to complain to your supervisory authority.
Questions about this document? Write to legal@aryasol.com and we will answer in writing.