Data Processing Agreement

Version: dpa-2026-09-20-v1 Effective date: 20 September 2026 Status: published

1. Parties and scope

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the Customer as controller (“Controller”) and Orsta Ltd, a company registered in England and Wales with company number 17403586 and registered office at Suite RA01, 195-197 Wood Street, London, United Kingdom, E17 3NU, as processor (“Processor”).

It applies where Orsta processes personal data contained in Customer Data on Controller's behalf (“Customer Personal Data”). It does not apply to account, security, support and administration data for which Orsta is independently controller, as described in the Privacy Notice.

“Data Protection Law” means the UK GDPR, Data Protection Act 2018, PECR and, where applicable to the processing, the EU GDPR and other applicable data-protection or privacy law. Terms such as controller, processor, personal data, personal data breach and processing have their meanings in Data Protection Law.

If this DPA conflicts with the Terms, this DPA prevails for Customer Personal Data.

2. Controller instructions and responsibilities

Controller instructs Processor to process Customer Personal Data:

• to provide, secure, support and administer the Service;
• through Customer's and its authorised users' use and configuration of the Service;
• to create requested reports and exports and perform the lifecycle actions in the Terms; and
• as otherwise documented in writing and agreed by Processor.

Processor will process Customer Personal Data only on those documented instructions, including for transfers, unless applicable law requires processing. If legally permitted, Processor will tell Controller before required processing. Processor will immediately tell Controller if it considers an instruction to infringe Data Protection Law and may suspend that instruction while the parties resolve it.

Controller determines the purposes and essential means of processing and is responsible for lawful instructions, transparency, lawful bases, data minimisation, accuracy, rights handling and authority to provide the data.

3. Confidentiality and personnel

Processor will restrict access to people who need it to perform this DPA. Anyone authorised to process Customer Personal Data will be subject to an appropriate contractual or statutory duty of confidentiality and receive instructions appropriate to their role.

4. Security

Taking account of the state of the art, implementation cost, processing nature, scope, context and purposes, and risks to people, Processor will maintain appropriate technical and organisational measures. The current measures are described in Schedule 2.

Processor does not promise absolute security. Controller must maintain its own source records, endpoint security, user access controls and secure handling of exports.

5. Personal data breaches

Processor will notify Controller without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. As information becomes available, notice will describe:

• the nature of the breach and, where possible, affected categories and approximate numbers of people and records;
• a contact point;
• likely consequences; and
• measures taken or proposed to address and mitigate it.

Processor will investigate, contain and provide reasonable cooperation needed for Controller's assessment, records, regulatory notification and communication to affected people. Controller remains responsible for deciding whether and how to notify the ICO or individuals unless it expressly authorises Processor to act.

6. Rights requests and compliance assistance

Taking account of the processing, Processor will use appropriate technical and organisational measures to assist Controller with requests to exercise data rights. If Processor receives a request relating to Customer Personal Data, it will forward it to Controller without undue delay and will not respond substantively except on documented instructions or where legally required.

Considering the nature of processing and information available, Processor will reasonably assist Controller with security, breach notifications, data protection impact assessments and prior consultation obligations. Assistance outside ordinary Service functionality may be subject to reasonable, pre-agreed costs, but not where required because Processor breached this DPA.

7. Subprocessors

Controller gives general written authorisation for the subprocessors in the Subprocessor List.

Processor will:

• use subprocessors that provide sufficient guarantees for appropriate measures;
• impose written data-protection obligations offering materially equivalent protection to the relevant obligations in this DPA;
• remain responsible to Controller for each subprocessor's performance of those obligations; and
• give at least 14 days' notice of an intended addition or replacement where practicable, or notice as soon as reasonably practicable for an urgent security, continuity or legal change.

Controller may object during the notice period on reasonable data-protection grounds. The parties will try in good faith to resolve the concern. If no reasonable alternative is available, either party may terminate the affected Service without charge.

8. International transfers

Processor will not transfer Customer Personal Data outside the UK or European Economic Area where Data Protection Law restricts that transfer, unless the transfer complies with Data Protection Law. Where required, Processor will rely on an applicable adequacy decision or regulation, or verified appropriate safeguards, and will provide relevant information on request, subject to confidentiality.

The current Subprocessor List records the primary runtime locations and the applicable provider transfer position. A runtime region does not prevent provider control-plane, security, subprocessor or customer-initiated support processing elsewhere. Processor will review the applicable provider DPA and transfer safeguard before adding or materially changing a subprocessor.

9. Return and deletion

During the Service, Controller may use available export functions. On termination, Processor will make an organisation export available on request for 30 days. Processor will then delete production Customer Personal Data, unless UK law requires specified data to be retained.

Daily database backups have a seven-day retention period. After production deletion, copies in those backups expire through that cycle. Backups are isolated from ordinary use. The operational target for removing any remaining backup copy is within 90 days after production deletion, subject to a required legal hold. This is an outer target for remaining copies, not the routine backup retention period. If a backup is restored, the deletion will be applied again. Controller may choose not to receive an export; production deletion still follows the 30-day process.

Minimal evidence that deletion occurred may be retained without names, emails, authentication identifiers, free text or Customer content.

10. Information and audits

Processor will make information reasonably necessary to demonstrate compliance with Article 28 available to Controller. No more than once in a 12-month period, unless a breach or credible compliance concern justifies more, Controller may audit relevant compliance on reasonable notice.

The parties will use documentation and remote review first. Any inspection must occur during reasonable hours, avoid access to other customers' data and security-sensitive material, and comply with confidentiality and safety requirements. Controller bears its audit costs unless the audit identifies a material Processor breach.

Processor will inform Controller if an audit instruction would endanger another customer, security or law and will propose a reasonable alternative.

11. Duration and liability

This DPA starts when Customer accepts it and continues while Processor holds Customer Personal Data. Liability is governed by the Terms except where Data Protection Law prevents that limitation.

Schedule 1 — Processing details

Schedule 2 — Security measures

• Managed authentication, strong password requirements and email verification.
• Access controls based on organisation, company and role, with database-level separation and restricted administrative credentials.
• HTTPS connections and controls on requests from other websites.
• Primary database hosting in London and application processing in Amsterdam, with international processing subject to the Subprocessor List safeguards.
• Upload minimisation: original files are processed without deliberate file retention; unselected values and temporary parsed rows are removed when no longer needed; abandoned drafts are removed after seven days of inactivity.
• Operational logging designed to exclude financial content and secrets.
• Controlled export and deletion procedures, including authority checks, confirmation and recovery from failed deletion attempts.
• Removal of temporary export files after the response and operator copies after confirmed delivery.
• Daily database backups with a seven-day retention period, isolated from ordinary use, and checks of backup availability.
• Documented incident response, data-rights, retention and access procedures.