Data processing agreement

The subscribing organisation (the customer) is the controller of the personal data it and its members enter into Orbiz. Innovation Insight (the processor) processes that data only to provide the service. Where the customer is itself a processor for its own clients, the processor acts as its sub-processor on the same terms.

Processing lasts for the term of the subscription and the deletion period after it. The nature of the processing is hosting, storage, computation on the customer’s instructions (for example a payroll run), transmission of notifications, and deletion.

• Process personal data only on the customer’s documented instructions — which are the terms, this agreement, and the configuration and actions the customer’s administrators and members take in the product — unless the law requires otherwise, in which case the processor tells the customer first where it may.
• Ensure that anyone with access to the data is bound by confidentiality and has access only to the extent needed to run and support the service.
• Implement and maintain the technical and organisational measures in the next section.
• Engage sub-processors only as set out below.
• Help the customer respond to requests from data subjects, and to meet its own obligations on security, breach notification and impact assessment, taking into account what the processor can see.
• Delete or return all personal data at the end of the service, as the customer chooses, and delete remaining copies unless the law requires them to be kept.
• Make available the information needed to demonstrate compliance, and allow audits as set out below.

• Isolation. Each customer has its own database and its own storage prefix. The tenant is resolved by the API gateway from the authenticated session, never from anything a browser sends, so a query cannot span two customers.
• Single entry point. Every request passes through one authenticated gateway that validates identity and permissions. No internal service is reachable from the internet.
• Encryption. TLS for every connection. Encryption at rest by the database and storage providers. Passwords stored as salted hashes. Vault items encrypted in the browser with a key derived from the member’s passphrase; the processor holds ciphertext only.
• Access control. Permission-based roles composed by the customer. Certain actions — making an Admin, viewing salaries, erasing a member — are restricted to Admin-level roles and require re-authentication or confirmation.
• Audit. Reads, shares and changes of Vault items, changes to roles and permissions, attendance corrections, leave decisions and payroll approvals are recorded with actor and time.
• Operational security. Production access limited to the engineers who run the platform, over authenticated cloud tooling rather than open ports; dependencies and images updated regularly; secrets held outside the codebase.
• Resilience. Managed database and storage services with provider-level durability; the customer may export a full copy of its organisation at any time.

The customer authorises the sub-processors listed on the sub-processors page. The processor imposes data-protection obligations on each of them no less protective than this agreement and remains responsible for their performance. The processor gives the customer’s administrators at least 30 days’ notice by email before adding or replacing a sub-processor; a customer that objects on reasonable data-protection grounds may end the subscription without penalty before the change takes effect.

Where a member of the customer’s organisation connects a third-party AI assistant to Orbiz through Orbiz MCP, the processor discloses personal data to that assistant on the customer’s instruction, limited to what that member is permitted to access. The assistant’s provider is not a sub-processor of the processor; the customer is responsible for its own terms with that provider, and its administrators can disable such connections for the organisation.

The application and its storage run on Amazon Web Services in the Asia Pacific (Mumbai) region and on MongoDB Atlas. Transactional email and AI features involve providers in the United States, as listed. Where a transfer of personal data out of the customer’s jurisdiction requires a legal mechanism, the parties rely on the provider’s standard contractual clauses or equivalent, and the processor will sign the clauses the customer’s jurisdiction requires on request. Dedicated or region-specific hosting is available on the Enterprise plan.

The processor notifies the customer’s administrators without undue delay, and in any case within 72 hours of confirming a personal data breach affecting the customer’s data, with the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact. Information that is not yet available is provided as it becomes available.

The processor answers the customer’s reasonable written security questionnaires and provides the documentation on the security page and any further documentation it holds. Where documentation is not sufficient to demonstrate compliance, the customer may, no more than once a year and on reasonable notice, carry out or commission an audit at its own cost, scoped to the processing under this agreement and conducted so as not to disrupt the service or expose other customers’ data.

At the end of the subscription the customer has 30 days to request a full export of its organisation — the database and every stored file. The processor then deletes the organisation’s database, storage prefix and backups within a further 30 days, and confirms deletion in writing on request. A customer may also, at any time during the subscription, have an Admin erase an individual data subject across every tool from inside the product.

Liability under this agreement is subject to the limits in the terms of service, except that neither party may limit its liability for a breach of this agreement below what the applicable data-protection law allows. If this agreement conflicts with the terms, this agreement prevails for the processing of personal data. A signed agreement between the parties prevails over both.

To request a countersigned copy, standard contractual clauses, or to ask a question about this agreement, write to orbiz-support@innovation-insight.com.