Data processing agreement

Parties

The Customer, the organisation that has a workspace on Orderbook (the controller), and Orderbook (Orderbook, the processor).

1. Definitions

“Data Protection Law” means the EU General Data Protection Regulation 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, and any other data protection law that applies to the processing. “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject” and “Personal Data Breach” have the meanings given in the GDPR. “Customer Data” means the Personal Data Orderbook processes for the Customer through the service.

2. Roles and instructions

2.1 The Customer is the controller and Orderbook is the processor of Customer Data. 2.2 Orderbook processes Customer Data only on the Customer’s documented instructions, which are this agreement, the terms of service, and the Customer’s use and configuration of the service, unless the law requires otherwise; in that case Orderbook tells the Customer first unless the law forbids it. 2.3 Orderbook tells the Customer straight away if it believes an instruction breaks Data Protection Law. 2.4 The Customer is responsible for having a lawful basis for the Customer Data it puts into Orderbook and for the outreach it sends through it.

3. Confidentiality

Orderbook makes sure everyone authorised to process Customer Data is bound by confidentiality, and gives access only to those who need it to provide, support or secure the service.

4. Security

Orderbook implements the technical and organisational measures in Annex 2, which are designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Orderbook may update these measures as long as the overall level of protection doesn’t go down.

5. Sub-processors

5.1 The Customer gives general authorisation for Orderbook to use the sub-processors listed in Annex 3. 5.2 Orderbook gives at least 30 days’ notice, by email or in the service, before adding or replacing a sub-processor, and the Customer may object on reasonable data protection grounds; if the parties can’t resolve it, the Customer may end the affected service and receive a refund of prepaid fees for the unused period. 5.3 Orderbook puts data protection terms in place with each sub-processor that are no less protective than these, and remains responsible for them.

6. Helping the Customer

6.1 Taking into account the nature of the processing, Orderbook helps the Customer respond to Data Subject requests (access, rectification, erasure, restriction, portability and objection), mainly through the export, edit, delete and do-not-contact features in the service. 6.2 Orderbook gives reasonable help with data protection impact assessments and consultations with supervisory authorities about the service.

7. Personal Data Breaches

Orderbook notifies the Customer without undue delay, and within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Data, with the information the Customer reasonably needs to meet its own obligations, and takes reasonable steps to contain and remedy it.

8. Deletion and return

The Customer can export Customer Data at any time. When the Customer deletes its workspace, or 30 days after the subscription ends, Orderbook deletes Customer Data from the live service, and from backups within a further 35 days, unless the law requires it to be kept.

9. Audits

Orderbook makes available the information reasonably needed to demonstrate compliance with this agreement, including its security documentation and its sub-processors’ certifications. Where that isn’t enough, the Customer may carry out an audit, at its own cost, with 30 days’ notice, no more than once a year (unless a supervisory authority requires it or after a Personal Data Breach), during business hours and without accessing other customers’ data.

10. International transfers

Where Customer Data is transferred outside the UK or the European Economic Area to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (Module 2 for controller to processor, Module 3 for processor to sub-processor) and, for UK data, the UK International Data Transfer Addendum, which are incorporated by reference, together with appropriate supplementary measures.

11. Liability and term

Each party’s liability under this agreement is subject to the limits in the terms of service. This agreement lasts as long as Orderbook processes Customer Data. If this agreement and the terms of service conflict on data protection, this agreement wins.

Annex 1: Details of the processing

Subject matter and purpose

Providing Orderbook, a sales CRM: storing and organising the Customer’s contacts, companies, deals and activity; syncing email and calendars the Customer connects; sending email the Customer writes or approves; AI drafting and analysis the Customer asks for; reporting.

Duration

The term of the Customer’s subscription, and the deletion period in clause 8.

Data subjects

The Customer’s prospects, customers and their staff; the Customer’s own users; website visitors the Customer chooses to track.

Categories of data

Names, job titles, business contact details (email, phone, LinkedIn), company details, the content and metadata of emails and meetings with those people, notes, call records (and, where the Customer turns on recording, call recordings and transcripts), deal information, email opens and clicks, and website visits where tracking is turned on. No special category data is intended to be processed.

Frequency

Continuous, while the service is in use.

Annex 2: Technical and organisational measures

• Isolation: row-level security in the database restricts every read and write to the workspace’s members; reps can be limited to their own records.
• Encryption: TLS for all traffic; encryption at rest for the database and backups; OAuth and API credentials additionally encrypted with AES-256-GCM.
• Access control: sign-in with Google or Microsoft, which admins can require; roles (admin, manager, rep); immediate removal of access; production access limited to those who need it.
• Logging: an audit log of sign-ins, exports, deletions, permission and setting changes, available to the Customer’s admins.
• Minimisation: mailbox sync only keeps conversations with people already in the CRM, and can be limited to subject lines; AI requests include only the records needed; call recordings are deleted automatically after the period the Customer sets (30 to 365 days).
• Resilience: hosting with automatic backups and point-in-time recovery from the database provider.
• Respecting people: unsubscribe links, a do-not-email list enforced on every send, and bounce handling.
• Vendors: sub-processors are chosen for their security certifications (Annex 3) and bound by written data protection terms.