Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Agreement between Global Linked Affiliates LLC, which operates OrbitForms ("OrbitForms," "we," "us"), and the Customer. It describes how OrbitForms processes personal data contained in Customer Content on the Customer's behalf when providing the Service.

This DPA is incorporated into the Agreement automatically, without any further action, for every Customer whose use of the Service is subject to Data Protection Laws. Customers who need a countersigned copy for their records can request one by emailing legal@orbitforms.ai; we will return a signed PDF of this same document. Capitalized terms not defined here have the meaning given in the Terms of Service.

1. Definitions

• "Agreement" means the Terms of Service, or a signed agreement between OrbitForms and the Customer that governs the Service, together with any order form.
• "Authorized Users" means the members of the Customer's team or teams in the Service.
• "CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations.
• "Customer Content" means data submitted to the Service by or for the Customer, including by its Authorized Users and by Respondents through the Customer's forms and scheduling pages, and data the Customer imports or syncs from connected integrations.
• "Customer Personal Data" means personal data contained in Customer Content.
• "Data Protection Laws" means all laws that apply to the processing of personal data under this DPA, including the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and the CCPA.
• "GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom.
• "Personal data," "controller," "processor," "data subject," "processing," "supervisory authority," and "personal data breach" have the meanings given in the GDPR. "Business," "service provider," "consumer," "sell," and "share" have the meanings given in the CCPA.
• "Respondents" means individuals who submit the Customer's forms, book through the Customer's scheduling pages, or receive the Customer's email sequences.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• "Subprocessor" means a third party OrbitForms engages to process Customer Personal Data on OrbitForms's behalf.

2. Scope and roles

For Customer Personal Data, the Customer is the controller (or, under the CCPA, the business) and OrbitForms is the processor (or service provider). Where the Customer is itself a processor acting for its own controllers, for example an agency running forms for its clients, OrbitForms acts as the Customer's subprocessor, and the Customer warrants that its instructions to OrbitForms are authorized by those controllers.

OrbitForms is an independent controller (or business) for the account, billing, support, and marketing data described in our Privacy Policy, such as Authorized Users' sign-in details, billing records, and product usage data. That processing is governed by the Privacy Policy, not this DPA.

3. Details of processing (Annex 1)

The following table describes the processing of Customer Personal Data and serves as Annex I.B to the SCCs and Table 3 of the UK Addendum where those apply.

4. Customer instructions

OrbitForms will process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to a third country, unless required to do otherwise by law that applies to OrbitForms. In that case OrbitForms will inform the Customer of the legal requirement before processing, unless the law prohibits that notice on important grounds of public interest.

The Customer's instructions are: the Agreement, this DPA, the configuration choices the Customer and its Authorized Users make in the Service (for example, which fields a form collects, which integrations are connected, which workflows and sequences run, which AI features are enabled, and retention settings), and the requests Authorized Users make through the Service, the API, or AI assistants they authorize through the OrbitForms MCP server. OrbitForms will inform the Customer without delay if, in OrbitForms's opinion, an instruction infringes Data Protection Laws.

When the Customer connects a third-party service, such as a CRM, a webhook endpoint, Slack, Zapier, or an AI assistant, OrbitForms transmits Customer Content to that service on the Customer's instruction. Those services are engaged by the Customer under its own terms with them and are not OrbitForms Subprocessors.

The Customer is responsible for the lawfulness of Customer Personal Data; for having a lawful basis and giving Respondents any required notices and obtaining any required consents, including consent to receive marketing emails; for its instructions; and for the actions of its Authorized Users. The Customer must not use the Service to knowingly collect personal data of children under 13.

5. Confidentiality of personnel

OrbitForms limits access to Customer Personal Data to personnel who need it to perform their duties, such as providing support the Customer requests, investigating abuse, or maintaining the Service; binds them to written confidentiality obligations that survive the end of their engagement; and requires multi-factor authentication for access to production systems.

6. Security measures (Annex 2)

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, OrbitForms implements and maintains the following technical and organizational measures. They serve as Annex II to the SCCs and Table 3 of the UK Addendum where those apply. A fuller description is published on our Security page.

• Hosting and residency. The application runs on Vercel and its database and file storage run on Supabase (Amazon Web Services, us-east-1). Customer Content is stored in the United States.
• Tenant isolation. Customer Content is scoped to the team that owns it. Postgres row-level security policies are enforced on every table, backed by team membership checks in application code.
• Encryption. All data in transit is protected with TLS 1.2 or higher, with HSTS enforced. Data at rest is encrypted by the infrastructure provider. Integration credentials, OAuth tokens, and API keys are additionally encrypted with AES-256-GCM, with keys held separately from the data.
• Data minimization. IP addresses are stored only as SHA-256 hashes. Abandoned partial submissions are purged after 7 days, and expired tokens, verification codes, and export files are removed by scheduled jobs.
• Authentication and access control. Sign-in by password (with a minimum complexity policy) or Google; optional time-based one-time password (TOTP) multi-factor authentication that, once enrolled, is required on every new sign-in; sessions end after 30 minutes of inactivity; users can review and revoke their active sessions. Role-based access within each team. API access uses scoped OAuth 2.0 tokens or team API keys that can be revoked instantly.
• Application security. CSRF protection by origin validation on state-changing requests; nonce-based Content Security Policy on application routes; sanitization of user-supplied HTML; parameterized database queries; SSRF protection on server-side requests; file uploads restricted by type allowlist, content inspection, and size limits; distributed rate limiting; and HMAC-SHA256 verification of inbound webhooks.
• Abuse prevention. reCAPTCHA spam protection on published forms, and an automated safety review of each form's configuration (never its submissions) at publish to detect phishing.
• Monitoring and incident response. Structured application and security event logging; error monitoring with personal data redacted before transmission; and a documented incident response plan covering detection, triage, containment, recovery, and post-incident review.
• Secure development. All changes go through pull requests that must pass automated security review, lint, type checks, and tests before deploying. Security-sensitive areas have named code owners and receive human review. Dependencies are monitored for known vulnerabilities and patched promptly. Deployments are immutable and can be rolled back.
• Availability and recovery. Managed, redundant infrastructure with automated daily database backups, encrypted at rest, and a documented disaster recovery plan.
• Data lifecycle. Customers can delete forms, submissions, contacts (together with their submissions), and other records at any time from the dashboard or the API, and Authorized Users can delete their own accounts.
• AI provider handling. AI features that touch submission or contact data run only when a user adds or invokes them. Requests go to AI providers under commercial API terms that do not permit training on Customer Content, and OrbitForms does not train foundation models on Customer Content.
• Compliance program. Controls are designed to align with the SOC 2 Trust Services Criteria and the ISO 27001 framework. OrbitForms does not currently hold a SOC 2 report or an ISO 27001 certification.

OrbitForms may update these measures from time to time, provided the updates do not materially reduce the overall level of protection for Customer Personal Data during the term of the Agreement.

7. Subprocessors

The Customer gives OrbitForms general written authorization to engage Subprocessors to process Customer Personal Data. OrbitForms's current Subprocessors, their purposes, and their locations are listed on our Subprocessors page. That list serves as Annex III to the SCCs where they apply.

OrbitForms will give the Customer at least 30 days' notice before a new Subprocessor processes Customer Personal Data, by updating that page and by emailing team owners. Customers who want notices sent to an additional address can subscribe as described on that page.

The Customer may object to a new Subprocessor on reasonable, documented data protection grounds by emailing privacy@orbitforms.ai within the notice period. OrbitForms will work with the Customer in good faith to find a solution. If none is found within 30 days of the objection, the Customer may terminate the affected part of the Service, or the Agreement if it cannot be separated, and OrbitForms will refund prepaid fees for the period after termination.

OrbitForms will bind each Subprocessor by written contract to data protection obligations at least as protective as those in this DPA, to the extent applicable to its services, and remains liable to the Customer for each Subprocessor's performance of those obligations.

8. Data subject requests

Taking into account the nature of the processing, OrbitForms will assist the Customer with appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests from data subjects to exercise their rights (access, rectification, erasure, restriction, portability, objection, and, under the CCPA, the rights to know, delete, correct, and limit). The Service's self-service tools for viewing, exporting, editing, and deleting submissions and contacts, and the API, are the primary means of assistance.

If OrbitForms receives a request directly from a data subject that relates to a Customer's form, scheduling page, sequence, or team, OrbitForms will direct the data subject to the Customer and forward the request to the Customer within 5 business days, without otherwise responding on the merits unless the Customer asks it to or the law requires it.

9. Personal data breach notification

OrbitForms will notify the Customer without undue delay, and in any event no later than 48 hours after becoming aware of a personal data breach affecting Customer Personal Data. Notice will go to the team owners' email addresses and any security contact the Customer has given us. Where the details are not all available at once, OrbitForms will provide them in phases.

The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed in response, and a contact point. OrbitForms will cooperate reasonably with the Customer's investigation and notifications. OrbitForms's notice is not an acknowledgement of fault or liability.

10. Assistance with impact assessments and consultations

Taking into account the nature of the processing and the information available to OrbitForms, OrbitForms will provide reasonable assistance to the Customer with data protection impact assessments and with prior consultations with supervisory authorities that the Customer is required to carry out in connection with the Service. This DPA and our Security and Subprocessors pages are the first source for such assessments; send follow-up questions to privacy@orbitforms.ai.

11. Audits

OrbitForms will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA. The primary mechanisms are:

• OrbitForms's SOC 2 report, once available, provided under confidentiality on request; and
• OrbitForms's written responses to the Customer's reasonable security questionnaires, no more than once per 12 months unless a personal data breach or a supervisory authority requires otherwise.

If those materials are insufficient to demonstrate compliance, the Customer, or an independent auditor it mandates and binds to confidentiality, may conduct an audit, including an inspection, subject to the following: no more than once in any 12-month period unless required by a supervisory authority or following a personal data breach; at least 30 days' written notice; during business hours with minimal disruption; scope agreed in advance and limited to the processing under this DPA; no access to other customers' data or to infrastructure providers' facilities (their own audit reports cover those layers); and at the Customer's cost, including OrbitForms's reasonable costs of supporting the audit. Audit findings are confidential and may be used only to verify compliance with this DPA.

12. Return and deletion

At any time during the term, the Customer can export submissions and contacts and delete Customer Content using the Service or the API. The Customer may also request a complete export of Customer Content by emailing privacy@orbitforms.ai.

After termination or expiry of the Agreement, the Customer has 30 days to export Customer Content, as described in the Terms of Service. OrbitForms will then delete Customer Personal Data within 30 days after that export period ends, or within 30 days of the Customer's earlier written request, unless applicable law requires OrbitForms to retain some of it, in which case OrbitForms will keep that data confidential and process it only as the law requires. Copies in backups expire on the normal backup cycle, remain encrypted, and are restored only for disaster recovery.

13. CCPA service provider terms

To the extent Customer Personal Data includes personal information of California consumers, OrbitForms acts as a service provider to the Customer, and the parties agree as follows:

1. OrbitForms processes Customer Personal Data only for the specific business purposes described in Annex 1 and the Agreement, on behalf of the Customer, and for no commercial purpose other than providing the Service.
2. OrbitForms will not sell or share Customer Personal Data.
3. OrbitForms will not retain, use, or disclose Customer Personal Data for any purpose other than those business purposes, including for any purpose outside the direct business relationship between OrbitForms and the Customer, except as permitted by the CCPA.
4. OrbitForms will not combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted by the CCPA (for example, to detect security incidents or prevent abuse).
5. OrbitForms will comply with the CCPA and provide the same level of privacy protection as the CCPA requires of the Customer.
6. OrbitForms will notify the Customer within 5 business days if it determines it can no longer meet its obligations under the CCPA.
7. The Customer may take reasonable and appropriate steps to ensure OrbitForms uses Customer Personal Data consistently with the Customer's CCPA obligations, using the audit mechanisms in Section 11, and, on notice, may take reasonable steps to stop and remediate any unauthorized use.
8. OrbitForms will cooperate with the Customer in responding to verifiable consumer requests as described in Section 8, and will flow down these obligations to any Subprocessor that processes Customer Personal Data.

OrbitForms certifies that it understands the restrictions in this Section and will comply with them.

14. International transfers

OrbitForms is located in the United States and hosts Customer Content in the United States. OrbitForms is not currently certified under the EU-US Data Privacy Framework, the UK Extension to it, or the Swiss-US Data Privacy Framework. Transfers of Customer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to OrbitForms rely instead on the mechanisms below, which the parties enter into by accepting this DPA.

EEA transfers

The SCCs are incorporated into this DPA by reference and apply to transfers from the EEA. The parties make the following selections:

• Module Two (controller to processor) applies where the Customer is a controller of Customer Personal Data. Module Three (processor to processor) applies where the Customer is a processor.
• Clause 7 (docking clause) applies.
• Clause 9(a): Option 2 (general written authorization) applies, with the notice period in Section 7 of this DPA.
• Clause 11(a): the optional language does not apply.
• Clause 13 and Annex I.C: the competent supervisory authority is the authority of the EU member state in which the Customer (as data exporter) is established, or, if the Customer is not established in the EU, the authority of the member state in which its Article 27 representative is established or, failing that, in which the data subjects are located.
• Clause 17: Option 1 applies and the SCCs are governed by the law of Ireland. Clause 18(b): disputes are resolved before the courts of Ireland.
• Annex I.A (parties): the Customer is the data exporter and Global Linked Affiliates LLC (d/b/a OrbitForms), 41 University Drive, Suite 400, Newtown, Pennsylvania 18940, United States (contact: privacy@orbitforms.ai), is the data importer; each party's acceptance of the Agreement is its signature and date. Annex I.B is Section 3 of this DPA. Annex II is Section 6 of this DPA. Annex III is the list on our Subprocessors page.

UK transfers

For transfers from the United Kingdom, the UK Addendum is incorporated by reference and amends the SCCs as set out in it. Table 1 is completed with the party details above; Table 2 refers to the SCCs with the selections above; Table 3 refers to Sections 3, 6, and 7 of this DPA; and for Table 4, either party may end the UK Addendum as set out in its Section 19. Where the UK Addendum conflicts with the SCCs, the UK Addendum prevails for UK transfers.

Swiss transfers

For transfers from Switzerland, the SCCs apply with these adjustments: references to the GDPR are read as references to the FADP; the competent supervisory authority under Clause 13 is the Swiss Federal Data Protection and Information Commissioner; references to "member state" are read so that data subjects in Switzerland are not excluded from suing for their rights in Switzerland; and the SCCs protect the data of legal entities to the extent the FADP does.

General

If OrbitForms later obtains a certification or another recognized transfer mechanism, it may rely on it in addition to the SCCs after notifying the Customer. If the SCCs or the UK Addendum are amended, replaced, or invalidated, the parties will cooperate in good faith to adopt a valid successor. Onward transfers to Subprocessors are covered by Section 7.

15. Liability

Each party's liability arising out of or related to this DPA is subject to the exclusions and limitations of liability in the Agreement, which apply to the Agreement and this DPA together as a single aggregate. Nothing in this Section limits either party's liability to data subjects under the SCCs.

16. Order of precedence

If there is a conflict between the documents that make up the Agreement with respect to the processing of Customer Personal Data, the following order applies, from highest to lowest: the SCCs and the UK Addendum (for the transfers they govern); this DPA; a signed agreement or order form; the Terms of Service; and the Privacy Policy and other policies referenced in the Agreement.

17. Governing law

This DPA is governed by the law that governs the Agreement and is subject to the Agreement's dispute resolution provisions, except that the SCCs and the UK Addendum are governed by the law and courts stated in them.

18. Changes

OrbitForms may update this DPA to reflect changes in Data Protection Laws or the Service. Updates that materially reduce the Customer's protections will be announced by email to team owners at least 30 days before they take effect. The date at the top of this page reflects the latest revision; earlier versions are available from legal@orbitforms.ai.