Orgacha Data Processing Addendum

1 Status and definitions

The terms controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in Applicable Data Protection Law. Applicable Data Protection Law means the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 and other data-protection law applicable to the processing under the Agreement.

Customer Personal Data means personal data contained in Customer Data that Orgacha processes as processor. This DPA does not apply to personal data for which Orgacha independently determines the purposes and means of processing, including its own contracting, billing and legal-compliance records, which is covered by Orgacha’s Privacy Notice.

If this DPA conflicts with the main Agreement on the protection or processing of Customer Personal Data, this DPA prevails.

2 Roles and instructions

The Customer is controller and Orgacha is processor unless the parties’ factual roles require a different classification. The Customer instructs Orgacha to process Customer Personal Data to provide, secure, support and maintain the Service; enable features and integrations selected or used by the Customer and its Authorised Users; comply with the Agreement; and follow additional documented lawful instructions agreed by the parties. AI translation remains disabled for an organisation unless its administrator enables it. Personal automatic translation remains disabled unless the relevant user enables it. Private-message text is submitted for translation only when a user selects Translate and acknowledges the displayed notice.

Colleague email and telephone sharing is separately controlled by each worker and remains subject to the Customer’s configured profile audience. Authorised management contact access is separate: it is limited to active workers at lower access levels within the manager’s assigned venue or area responsibility, including descendant locations, with organisation-wide scope for Organisation Administrators and Owners subject to the same lower-access-level restriction. This access may include personal contact details even where colleague sharing is off or profiles are disabled. Staff-contact reads are logged. The Customer instructs this processing only for lawful, relevant workplace communication and must provide appropriate worker information, limit permissions to relevant responsibilities and prohibit unrelated use or disclosure.

The Customer is responsible for the lawfulness, fairness and transparency of its processing; the accuracy and minimisation of Customer Personal Data; required worker notices; lawful bases and any conditions for special-category data; and the legality of its instructions.

Orgacha must notify the Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law, unless prohibited from doing so. Orgacha may suspend the affected processing while the parties resolve the issue.

3 Processing details

4 Orgacha obligations

• process Customer Personal Data only on documented instructions, including for international transfers, unless law requires otherwise; where permitted, notify the Customer before legally required processing;
• ensure that persons authorised to process Customer Personal Data are subject to confidentiality obligations;
• implement and maintain the security measures in Schedule 1;
• provide reasonable assistance with data-subject requests, security obligations, breach notifications, DPIAs and prior consultation, taking account of the nature of processing and information available to Orgacha;
• make information reasonably necessary to demonstrate compliance with this DPA available to the Customer; and
• maintain records and cooperate with competent supervisory authorities as required by law.

5 Data subject requests

If Orgacha receives a request relating to Customer Personal Data, it will notify the Customer and must not respond on the Customer’s behalf unless authorised or legally required. Taking account of the nature of processing, Orgacha will provide reasonable technical and organisational assistance to enable the Customer to respond.

The Customer remains responsible for determining whether and how to respond. Orgacha may charge reasonable costs for assistance that is unusually burdensome and not caused by Orgacha’s breach, after giving advance information about those costs.

6 Personal data breaches

Orgacha will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notification will include, as information becomes available, the nature of the breach, likely consequences, categories and approximate numbers affected, measures taken or proposed, and a contact point.

Orgacha will take reasonable steps to contain, investigate and mitigate the breach and will provide updates reasonably required for the Customer’s assessment and notification duties. A notification is not an admission of fault or liability.

The Customer is responsible for notifications to data subjects and supervisory authorities unless the parties agree otherwise.

7 Subprocessors

The Customer gives general written authorisation for Orgacha to use the subprocessors on its published Subprocessor List to provide the Service. Orgacha must enter into a written agreement with each subprocessor imposing data-protection obligations that provide materially equivalent protection for Customer Personal Data.

Orgacha remains responsible to the Customer for the performance of its subprocessors’ data-protection obligations. Orgacha will give reasonable advance notice of a new subprocessor where required by the Agreement.

The Customer may object on reasonable, documented data-protection grounds within the notice period. The parties will work in good faith on a reasonable solution. If none is available, the Customer may terminate the affected Service before the new subprocessor begins processing and receive a pro-rata refund of prepaid Fees for the unused affected period.

8 International transfers

Orgacha must not make a restricted transfer of Customer Personal Data unless it uses a lawful transfer mechanism and completes any assessment or supplementary measures required by Applicable Data Protection Law.

Where Customer Personal Data protected by UK data-protection law is transferred to a country not covered by UK adequacy regulations, the parties incorporate the then-current UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another valid UK transfer mechanism identified by Orgacha. The appropriate controller-to-processor module applies, completed using the processing details in this DPA and the relevant Subprocessor List information.

Orgacha will provide reasonable information about applicable transfer safeguards on request, subject to confidentiality and security restrictions.

9 Return and deletion

On expiry or termination, and at the Customer’s choice where technically available, Orgacha will return or delete Customer Personal Data within a reasonable period after any agreed export window, unless law requires retention. Where immediate deletion from backups is not technically practicable, the data will remain protected, isolated from ordinary use and deleted through the normal backup cycle.

Orgacha may retain minimal records required for legal claims, accounting, fraud prevention or proof of compliance where it acts as controller. Those records are not Customer Personal Data processed under this DPA.

On request, Orgacha will confirm completion of deletion, subject to backup cycles and legally required retention.

10 Audits and compliance information

Orgacha will provide current third-party audit reports, certifications, security summaries or completed questionnaires that it reasonably has available. If that information is insufficient to demonstrate compliance, the Customer may conduct one proportionate audit in any 12-month period, and more frequently following a material breach or regulator requirement.

Audits require reasonable advance notice, must occur during normal business hours, avoid access to other customers’ data and minimise disruption. The Customer must ensure auditors are independent and bound by confidentiality. Each party bears its own costs unless an audit identifies a material breach by Orgacha, in which case Orgacha will reimburse reasonable audit costs.

Nothing requires Orgacha to disclose information that would compromise security, breach another person’s confidentiality, or reveal legally privileged material.

11 Liability

Each party’s liability arising from this DPA is subject to the exclusions and caps in the main Agreement, except to the extent a limitation is prohibited by Applicable Data Protection Law. Nothing in this DPA relieves either party of responsibilities or liabilities imposed directly by law.

12 Governing law

This DPA follows the governing-law and jurisdiction provisions of the main Agreement.

Schedule 1 Technical and organisational measures

Schedule 2 Approved subprocessors

The current approved subprocessors are identified in Orgacha’s Subprocessor List, which forms part of this DPA. That list must identify the relevant provider, service, categories of data, processing locations and applicable transfer safeguard before the DPA is used with a customer.