1. Customer status and legal profile
Before conclusion, the workflow distinguishes business customers from consumers. Country profiles structure review and disclosure logic but do not replace case-specific legal assessment. Consumers outside configured profiles are held for manual review before provisioning.
2. Versioned contract evidence
Order details, package state, price, term, data region, clauses and incorporated annexes are frozen into a hashed snapshot. Later catalogue changes do not retroactively rewrite the accepted contract state.
3. DPA and role allocation
The data-processing agreement is kept separate from the customer contract. Whether it is required depends on processing roles and facts. A DPA is not generated merely because a private person places an order; the business workflow assesses where processing-on-behalf obligations apply.
4. TOM register and real evidence
Technical and organisational measures are tracked with states such as planned, partial, implemented or retired. “Implemented” should only be selected after the actual control and suitable evidence have been verified. A register entry is not an automatic security certification.
5. Subprocessors and changes
Providers that may process data as subprocessors can be recorded with service category, processing countries, safeguard, privacy link, approval state and review date. Material changes can be documented by a separate notice carrying effective and objection dates.
6. International data transfers
Cross-border transfers are maintained as separate records with source region, destination, mechanism, risk and review. Moroccan processing may require CNDP procedures; EU/EEA and UK data may require additional transfer tools and safeguards under their respective regimes.
7. Consumer period and early service start
Consumer withdrawal periods and early performance are reviewed using the customer’s country, service type and documented information. The technical workflow alone does not establish valid consent. Missing information or an unclear legal position requires manual review, without automatic activation.
8. Exit, portability and provider switching
Data export, switching provider and contract termination are handled separately. Statutory switching rights and restrictions on switching fees remain unaffected. Their applicability to the service is assessed before a fee is charged. Domain transfers also follow the relevant registry and registrar procedures.
9. Compliance hold, changes and audit
Unresolved legal profiles, transfer issues or consumer cases can technically hold provisioning. Contract changes are separate change requests with before/after hashes and the customer decision. Audit data is designed to show the decision, time and responsible role without unnecessarily logging secrets.