Data Processing Agreement

Last updated: 29 October 2026

1. Parties and scope

1.1 This Data Processing Agreement ("DPA") is made between Orbis Digital Ltd, a company registered in England and Wales with company number 17116737, whose registered office is 66 Paul Street, London, EC2A 4NA ("Orbis", "we", "us"), and the business that holds an Orbis SMS account (the "Customer", "you").

1.2 This DPA forms part of, and is incorporated into, our Terms and Conditions (the "Terms"). It applies whenever we process Customer Personal Data on your behalf in providing the Service.

1.3 You accept this DPA when you accept the Terms. Your acceptance of the Terms is your signature of this DPA, and no separate signature is needed. The DPA meets the requirement for a written contract under Article 28(9) of the UK GDPR.

1.4 If this DPA conflicts with the Terms on a data protection matter, this DPA takes priority.

1.5 This DPA does not cover personal data that we process as a controller, such as data about your account users, billing and support. Our Privacy Policy explains that processing.

2. Definitions

2.1 In this DPA:

• "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended, including by the Data (Use and Access) Act 2025, and any other law relating to personal data that applies in the UK.
• "UK GDPR" has the meaning given in section 3(10) of the Data Protection Act 2018.
• "Customer Personal Data" means the personal data described in Annex 1 that we process on your behalf.
• "Sub-processor" means a third party we engage to process Customer Personal Data.
• "Commissioner" means the Information Commissioner's Office (ICO), or its successor, the Information Commission.
• "Restricted Transfer" means a transfer of Customer Personal Data outside the UK that is subject to Chapter V of the UK GDPR.
• "IDTA" means the International Data Transfer Agreement, and "UK Addendum" means the International Data Transfer Addendum to the EU Standard Contractual Clauses, each issued under section 119A of the Data Protection Act 2018.

2.2 "Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "special categories of personal data" have the meanings given in Data Protection Law. Other capitalised terms have the meanings given in the Terms.

3. Roles of the parties

3.1 For Customer Personal Data, you are the controller and we are your processor.

3.2 You are responsible for the lawfulness of the processing you instruct. In particular, you must make sure that you have a lawful basis for the processing, that you have any consent required under PECR, that you have given data subjects the information required by Articles 13 and 14 of the UK GDPR, and that Customer Personal Data is accurate.

3.3 The details of the processing are set out in Annex 1.

4. Your instructions

4.1 We will process Customer Personal Data only on your documented instructions, including with regard to transfers of Customer Personal Data outside the UK, unless UK law requires us to do otherwise. In that case we will tell you of the legal requirement before processing, unless the law prohibits this on important grounds of public interest.

4.2 Your documented instructions are: the Terms and this DPA; your use and configuration of the Portal and API (for example, uploading contacts, sending messages and setting opt-outs); and any other written instructions you give us that we agree to.

4.3 We will tell you immediately if, in our opinion, an instruction breaches Data Protection Law. We may suspend the relevant processing until you confirm or change the instruction.

4.4 We will not sell Customer Personal Data or use it for our own purposes. We may use it only to provide, secure and support the Service, which includes screening content to prevent fraud and spam and keeping a suppression list of numbers that have opted out.

5. Confidentiality of personnel

5.1 We will make sure that anyone we authorise to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory duty of confidentiality.

5.2 Access is limited to personnel who need it to provide, support or secure the Service.

6. Security

6.1 We will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR. These measures are described in Annex 2.

6.2 We may update the measures over time, provided the overall level of security is not reduced.

6.3 You are responsible for the security of your own systems, your users' login details and your API Keys, and for using the security features the Service provides.

7. Sub-processors

7.1 You give us general written authorisation to engage Sub-processors. Our current Sub-processors are listed in Annex 3.

7.2 To deliver messages, we use UK messaging network providers and SMS aggregators. We do not name them publicly. We will give you their names on request by email to support@orbisdigital.co.uk, and you must keep that information confidential.

7.3 We will give you at least 30 days' notice before we add or replace a Sub-processor, by email or in the Portal.

7.4 You may object to a new Sub-processor on reasonable data protection grounds by writing to us within that 30-day period. We will discuss your concerns in good faith. If we cannot resolve them, you may close your account before the change takes effect. In that case, as the closure arises from our change and not from any breach by you, we will refund your unused Credits.

7.5 We will put a written contract in place with each Sub-processor that imposes data protection obligations which give the same level of protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures.

7.6 We remain fully liable to you for the performance of each Sub-processor's obligations.

8. Data subject rights

8.1 Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects to exercise their rights under Chapter III of the UK GDPR.

8.2 The Portal lets you view, edit, export and delete contacts, and manage opt-outs, so that you can handle most requests yourself.

8.3 If we receive a request directly from a data subject about Customer Personal Data, we will pass it to you without undue delay and will not respond to it ourselves, except to tell the person to contact you. Opt-out replies such as STOP are processed automatically as part of the Service.

9. Assistance with compliance

9.1 Taking into account the nature of the processing and the information available to us, we will give you reasonable assistance with your obligations under Articles 32 to 36 of the UK GDPR. This covers security, notifying personal data breaches to the Commissioner and to data subjects, data protection impact assessments and prior consultation with the Commissioner.

9.2 We may charge a reasonable fee for assistance that goes beyond providing the information in this DPA and our standard documentation, unless the assistance is needed because of our breach.

10. Personal data breaches

10.1 We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

10.2 Our notice will describe, so far as the information is available: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to deal with it and reduce its effects; and a contact point for more information. Where we cannot give all the information at once, we will provide it in stages without undue further delay.

10.3 We will take reasonable steps to contain and investigate the breach and to prevent it happening again, and will co-operate with you so that you can meet your own obligations.

10.4 Notifying you of a breach is not an admission of fault or liability.

11. Deletion and return

11.1 You can export your contacts and message history from the Portal at any time while your account is open.

11.2 When your account closes, we will delete Customer Personal Data within 90 days, unless UK law requires us to keep it. If you ask us in writing before closure, we will return a copy in a common electronic format before deletion.

11.3 Customer Personal Data in our rolling backups expires within 14 days of deletion from our live systems.

11.4 You may also instruct us to delete specific Customer Personal Data earlier, for example by deleting it in the Portal.

12. Audits and information

12.1 We will make available to you all information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, and will allow for and contribute to audits, including inspections, by you or an auditor you appoint.

12.2 To keep audits proportionate, you agree to first ask for information through a written questionnaire, which we will answer within a reasonable time. You may carry out an audit or inspection only if the written answers are not reasonably sufficient to show compliance, or where the Commissioner requires it.

12.3 You must give us at least 30 days' written notice of an audit or inspection, except after a personal data breach or where the Commissioner requires a shorter period. Audits must be reasonable in scope, take place during normal business hours on Working Days, avoid disrupting our business, and respect the confidentiality of other customers' data and our security. Any auditor must be bound by confidentiality obligations.

12.4 Audits are at your cost. Unless a personal data breach or a regulatory requirement makes it necessary, you may not audit more than once in any 12-month period.

13. International transfers

13.1 Our main hosting is in the European Economic Area, which the UK recognises as providing adequate protection.

13.2 We will not make a Restricted Transfer of Customer Personal Data unless it is covered by: UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework where the recipient is certified); the IDTA; the UK Addendum; or another safeguard or exception allowed by Chapter V of the UK GDPR.

13.3 Annex 3 shows where each Sub-processor processes data.

14. Liability, term and general

14.1 Each party's liability under this DPA is subject to the exclusions and limits of liability in the Terms.

14.2 This DPA lasts for as long as we process Customer Personal Data on your behalf, and ends when that data has been deleted or returned under section 11.

14.3 We may update this DPA on the notice set out in the Terms, or with less notice where needed to comply with Data Protection Law.

14.4 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

15. Annex 1: Details of processing

16. Annex 2: Technical and organisational measures

17. Annex 3: Sub-processors

The following Sub-processors may process Customer Personal Data. Stripe is not listed because it processes payment data for which we are the controller, not Customer Personal Data.

To ask for the names of our messaging network providers, or with any question about this DPA, contact us at support@orbisdigital.co.uk or on 0330 223 7919.