Last updated: 30 October 2026
Contents
- Parties and scope
- Roles and instructions
- Confidentiality and security
- Sub-processors
- Assistance and data subject rights
- Personal data breaches
- Deletion and return
- Audits and information
- International transfers
- Liability and general
- Annex 1: Details of processing
- Annex 2: Security measures
- Annex 3: Sub-processors
1. Parties and scope
This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between Orbis Digital Ltd, company number 17116737, of 66 Paul Street, London, EC2A 4NA ("we"), and the customer ("you"). It applies where we process personal data on your behalf in providing Orbis Social, and it is intended to meet Article 28 of the UK GDPR. It does not apply where we act as a controller, as described in our Privacy Policy.
2. Roles and instructions
You are the controller, and we are your processor. If you act for your own clients, you may be a processor and we your sub-processor, and you must have the authority you need from those clients. You are responsible for having a lawful basis for the personal data in your content.
We process that data only on your documented instructions, which include these Terms and your use of the service, such as publishing a post or using an AI feature, unless the law requires otherwise. We will tell you if we think an instruction breaks data protection law.
3. Confidentiality and security
We ensure that people authorised to process the data are bound by confidentiality. We maintain the technical and organisational measures in Annex 2, and we may update them provided that the overall level of protection is not reduced.
4. Sub-processors
You authorise the sub-processors in Annex 3 and give general authorisation for us to appoint others. We will give at least 30 days' notice of any new sub-processor, by email or in the application. You can object on reasonable data protection grounds. If we cannot resolve the objection, you may end the affected service. We put equivalent data protection terms in place with each sub-processor and remain liable for their performance.
5. Assistance and data subject rights
If we receive a request from an individual about your content, we will pass it to you unless the law prevents us. Taking into account the nature of the processing, we will give you reasonable help in responding to requests, and with security, breach notification, impact assessments and consultation with the regulator.
6. Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and we will give you the information we reasonably can to help you meet your own obligations.
7. Deletion and return
You can remove content in the service during the contract. Within 90 days after your account closes, we will delete your content, unless the law requires us to keep it. Deleted data drops out of rolling backups within 14 days. Our data deletion page explains how to make a request.
8. Audits and information
We will make available the information reasonably needed to show compliance with this DPA, and we will allow for and contribute to audits on reasonable written notice, no more than once a year unless a regulator requires it or there has been a breach. Audits must be conducted during working hours, must respect confidentiality and must not disrupt the service.
9. International transfers
Where we or a sub-processor transfer personal data outside the UK, we will rely on UK adequacy regulations or on appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum.
10. Liability and general
The limitations of liability in the Terms apply to this DPA. If this DPA conflicts with the Terms on data protection, this DPA takes priority. The law and courts of England and Wales apply.
11. Annex 1: Details of processing
| Subject matter | Providing Orbis Social |
|---|---|
| Duration | The term of the contract, then until deletion under section 7 |
| Nature and purpose | Hosting, storing, generating AI suggestions from, and publishing your content on your instructions |
| Data subjects | Anyone identified in your content, such as your staff, customers and clients |
| Personal data | Names, images, video and other information that you include in posts, captions, media, Brand Brain content, ideas and comments |
| Special category data | Not required by the service. You should avoid adding it unless you have a lawful basis |
12. Annex 2: Security measures
- Encrypted connections (HTTPS) between your browser and the service.
- Encryption of Facebook and Instagram access tokens at rest.
- Role-based access within workspaces, and an audit log.
- Access to production systems restricted to authorised people.
- Access-restricted backups, kept for up to 14 days on a rolling basis.
13. Annex 3: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| OVHcloud (OVH SAS) | Server hosting | Gravelines, France |
| OpenAI | Generating AI suggestions | United States |
| Brevo (Sendinblue SAS) | Transactional email | France |
| Cloudflare, Inc. | DNS and, where enabled, security and content delivery proxy | Global, including the US |
When you publish, content goes to Meta, which handles it as an independent controller under its own terms. It is not our sub-processor. Stripe processes billing data for us and on its own account as a payment provider, and it does not handle your customer content.