Both are possible, but we prefer to use your data processing agreement (DPA), as it is often already approved by your DPO and legal team.