Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between Orbis Digital Ltd, company number 17116737, of 66 Paul Street, London, EC2A 4NA ("we"), and the customer ("you"). It applies where we process personal data on your behalf in providing Orbis Chat, and it is intended to meet Article 28 of the UK GDPR. It does not apply where we act as a controller, as described in our Privacy Policy.

2. Roles and instructions

You are the controller, and we are your processor. If you act for your own clients, you may be a processor and we your sub-processor, and you must have the authority you need from those clients. You are responsible for having a lawful basis for the personal data you handle through the service, and for telling your visitors about it.

We process that data only on your documented instructions, which include these Terms and your use of the service, such as replying to a chat or using an AI feature, unless the law requires otherwise. We will tell you if we think an instruction breaks data protection law.

3. Confidentiality and security

We ensure that people authorised to process the data are bound by confidentiality. We maintain the technical and organisational measures in Annex 2, and we may update them provided that the overall level of protection is not reduced.

4. Sub-processors

You authorise the sub-processors in Annex 3 and give general authorisation for us to appoint others. We will give at least 30 days' notice of any new sub-processor, by email or in the application. You can object on reasonable data protection grounds. If we cannot resolve the objection, you may end the affected service. We put equivalent data protection terms in place with each sub-processor and remain liable for their performance.

5. Assistance and data subject rights

If we receive a request from an individual about your data, we will pass it to you unless the law prevents us. You can use the GDPR export and delete tools to respond. Taking into account the nature of the processing, we will give you reasonable help in responding to requests, and with security, breach notification, impact assessments and consultation with the regulator.

6. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and we will give you the information we reasonably can to help you meet your own obligations.

7. Deletion and return

You can export and delete data, and set retention, in the service during the contract. After your account closes, we will delete your data straight away, unless the law requires us to keep it. Deleted data drops out of backups within 35 days.

8. Audits and information

We will make available the information reasonably needed to show compliance with this DPA, and we will allow for and contribute to audits on reasonable written notice, no more than once a year unless a regulator requires it or there has been a breach. Audits must be conducted during working hours, must respect confidentiality and must not disrupt the service.

9. International transfers

Where we or a sub-processor transfer personal data outside the UK, we will rely on UK adequacy regulations or on appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum.

10. Liability and general

The limitations of liability in the Terms apply to this DPA. If this DPA conflicts with the Terms on data protection, this DPA takes priority. The law and courts of England and Wales apply.

11. Annex 1: Details of processing

12. Annex 2: Security measures

• Tenant isolation between customers.
• Two-factor login (TOTP) available to users.
• Role-based access (owner, admin and agent), and an audit log.
• GDPR export and delete tools, and data retention settings.
• Nightly encrypted backups.

13. Annex 3: Sub-processors

Channels that you connect, such as Telegram, WhatsApp Business, Facebook Messenger and Twilio, are used on your instruction under your own accounts and are not our sub-processors. Stripe processes billing data for us and on its own account as a payment provider, and it does not handle your customer content.