# Data Processing Notes A one-line statement such as "always processor" or "always controller" is not sufficient for Virusis. ## General framing In enterprise use, it is often the case that: * the customer acts closer to a controller for the data it uploads * Virusis acts closer to a service provider or processor in the scanning and technical processing layer That distinction still needs to be clarified by use case and contract. ## Topics a DPA should define clearly * which data types are processed * retention periods * subprocessors * security measures * incident notification timelines * return and deletion flow ## Note This page does not replace a signed DPA. It exists to connect the product's technical reality to contract preparation. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.virusis.com/legal/data-processing-agreement.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.