Data Processing Agreement

01Parties and application

This data processing agreement is concluded between:

• Orbecta, Waldorpstraat 584, 2521 CK The Hague, the Netherlands, Chamber of Commerce 72579943, hereinafter: Processor;
• the organisation or independent professional that creates an account or takes out a subscription on the Orbecta platform, hereinafter: Controller.

This agreement forms part of the Orbecta Terms & Conditions (together: the Main Agreement). By creating an account or taking out a subscription, the Controller accepts it. On request, the Controller receives a signed copy with the same content.

For the data Orbecta itself uses to manage accounts, invoicing and the website, Orbecta is the controller. The privacy statement applies to that.

02Definitions

Terms in this agreement have the meaning given to them by the GDPR, such as personal data, processing, data subject, controller, processor and personal data breach (hereinafter: data breach). In addition:

• Sub-processor: a third party engaged by the Processor to process personal data for the Controller.
• Platform: the Orbecta platform, available at orbecta.com, with the modules the Controller uses.
• User: a person who has access to the Platform on behalf of the Controller.

03Subject and term

3.1 The Processor processes personal data only to deliver the services under the Main Agreement. Section 15 describes the nature and purpose of the processing, the types of personal data and the categories of data subjects.

3.2 This agreement applies as long as the Controller has an account, and thereafter as long as the Processor still processes personal data of the Controller.

3.3 In case of conflict between this agreement and the Terms & Conditions, this agreement prevails with regard to the processing of personal data.

04Processing on instructions

4.1 The Processor processes the personal data only on the instructions of the Controller. The Main Agreement, this agreement and the settings the Controller chooses in the Platform count as such instructions.

4.2 The Processor does not use the personal data for its own purposes or to train AI models. The Processor does not sell the personal data and does not share it with third parties, except with Sub-processors under article 7.

4.3 If the Processor is legally required to process personal data outside the instructions, the Processor informs the Controller beforehand, unless the law prohibits this.

4.4 The Processor informs the Controller immediately if, in its opinion, an instruction infringes the GDPR or other privacy law.

4.5 The Controller warrants that it has a legal basis for the processing and that the content Users enter into the Platform is lawful.

05Confidentiality

5.1 The Processor keeps the personal data confidential. Only those who need the data for their tasks get access.

5.2 Everyone who has access to the personal data on behalf of the Processor is bound by a duty of confidentiality.

06Security

6.1 The Processor takes appropriate technical and organisational measures to secure the personal data, as required by Article 32 GDPR. Section 16 describes the measures.

6.2 The Processor keeps the measures up to date and may change them, as long as the level of security does not decrease.

07Sub-processors

7.1 The Controller gives the Processor general authorisation to engage the Sub-processors listed in section 17.

7.2 If the Processor wants to add or replace a Sub-processor, it gives at least 30 days' notice, by email to business customers and on this page. The Controller may object on reasonable grounds within that period. If the parties cannot agree, the Controller may terminate the subscription as of the date the change takes effect.

7.3 The Processor imposes on each Sub-processor at least the same obligations as set out in this agreement, and remains responsible towards the Controller for their compliance.

08Transfers outside the EEA

8.1 The Processor processes personal data within the European Economic Area, unless section 17 states otherwise.

8.2 Transfers to a country outside the EEA only take place on a valid legal basis, such as an adequacy decision of the European Commission, the EU-US Data Privacy Framework or the Standard Contractual Clauses of the European Commission.

09Data breaches

9.1 The Processor informs the Controller without undue delay, and in any case within 48 hours after discovering a data breach affecting the Controller's personal data. This allows the Controller to notify within the legal deadline of 72 hours where required.

9.2 The notification contains, as far as known: the nature of the breach and since when it has been going on; the categories and approximate number of data subjects and records; the likely consequences; the measures taken or proposed by the Processor; and a contact person. Information not yet known is provided as soon as it becomes available.

9.3 The Processor immediately takes measures to limit the breach and prevent recurrence, and records every breach in a register.

9.4 The Controller decides whether the breach is reported to the supervisory authority and to data subjects. The Processor does not report to them itself, unless required by law.

10Data subject rights and assistance

10.1 The Processor assists the Controller with requests from data subjects for access, rectification, erasure, restriction, portability or objection. Much of this the Controller can do itself in the Platform, such as deleting data.

10.2 If the Processor receives such a request directly, it forwards it to the Controller within five working days and does not handle it itself.

10.3 The Processor reasonably assists the Controller in meeting its obligations under Articles 32 to 36 GDPR, such as a data protection impact assessment (DPIA), including with the information in the Trust Center and the Security and Privacy Pack.

11Audit

11.1 The Processor makes available all information necessary to demonstrate compliance with this agreement, including the Security and Privacy Pack and the certification reports of the Sub-processors.

11.2 The Controller may have an audit carried out once a year, or after a data breach, by an independent expert bound by confidentiality. The parties agree on timing and scope in advance, and the audit may not unnecessarily disrupt the service.

11.3 The costs of an audit are borne by the Controller, unless the audit shows that the Processor materially fails to comply with this agreement.

12Termination and deletion

12.1 When the account or subscription ends, the Controller may request an export of its data within 30 days.

12.2 The Processor then deletes the personal data, including attachments, unless the law requires retention. Data in backups expires within the backup retention period (7 days).

12.3 The AI audit log and the email log are kept until the period in section 15 ends. An anonymous summary of claims, not linked to the Controller, may be kept for the benchmark, only if that benchmark has been switched on for the Controller.

12.4 On request, the Processor confirms the deletion in writing.

13Liability

The liability of the parties under this agreement is governed by the Terms & Conditions, including the limitation to the amount the Controller paid in the 12 months before the event causing the damage. This limitation does not apply in case of intent or wilful recklessness.

14Changes and final provisions

14.1 The Processor may change this agreement. Material changes are announced by email at least 30 days in advance to customers with a subscription. The Processor may update section 17 in accordance with article 7.

14.2 If a provision is void or voidable, the other provisions remain in force. The parties then replace it with a valid provision that comes as close as possible to its intent.

14.3 This agreement is governed by Dutch law. Disputes are submitted to the competent court in the district of The Hague.

15Description of the processing

Purpose. Delivering the Platform: analysis of supplier claims (Claim Check), preparation of supplier meetings (Supplier Warroom), contract analysis and monitoring (Contract Intelligence), the AI chat, monitoring of markets and compliance, and managing accounts and team accounts.

Nature of the processing. Storing, organising, analysing with AI, displaying to Users, sharing within a team account according to the administrator's settings, and deleting.

Categories of data subjects. Users of the Controller, and contact persons at suppliers and other business relations, insofar as their data appears in content Users enter or upload.

Types of personal data.

• User account data: name, business email address, job title, company name, role within a team account;
• content Users enter or upload: claims, contracts, Warroom sessions, attachments, notes and questions to the AI chat, including the names and contact details they contain;
• AI results for that content;
• technical data: sign-in data, timestamps, use of features and the AI audit log (time, function, model, tokens).

The Controller does not enter special categories of personal data, such as health data, or criminal data.

Retention periods.

16Security measures

• Access. Per-user isolation in the database; within a team account the administrator decides per module what colleagues can see, and only the creator can change or delete something. Two-factor authentication, mandatory for Orbecta administrators and available to every User. Plans and limits are enforced in the database. API keys are kept on the server only.
• Encryption. Database and files encrypted at rest (AES-256); all traffic over TLS/HTTPS, enforced with HSTS; attachments in private storage, separated per User, opened only through temporary links.
• AI processing. Every AI function checks that the User is signed in and that the record is theirs. Each request only contains that one record. Documents are treated as data, never as instructions to the AI. At most 3 re-analyses per record per 24 hours.
• Auditability. An immutable audit log of every AI analysis, without prompts or AI text; Users can see their own AI activity in their profile.
• Web security and operations. Content Security Policy and sanitising of entered and AI-generated text (XSS protection); verification of payment messages; automatic cleanup of logs and chats; a fixed data breach procedure with an incident register.

More details are in the Trust Center.

17Sub-processors

On request, Orbecta processes the AI analysis within the EU, through Claude on AWS Bedrock or Google Cloud in an EU region. The parties then record this in writing.

Google Analytics only processes website visit data, not the content Users enter; see the cookie statement.

18Contact