Data processing agreement

1. Subject and duration

We process the personal data of the Customer’s leads, customers, contacts and team members only to provide Ordyum, for as long as the Customer has an account and until the data is deleted as described in section 8.

Categories of data: identification and contact details, company data, deal and activity history, messages from connected inboxes and attribution data (UTM parameters and ad click identifiers). The Customer should not upload special categories of data unless it has a legal basis to do so.

2. Instructions

We process the data only on the Customer’s documented instructions: the Terms, this agreement and the settings and integrations the Customer turns on. If the law requires something else, we will tell the Customer first whenever we are allowed to.

3. Confidentiality and security

Everyone who can access the data is bound by confidentiality.

Measures in place: workspace isolation with row-level security in the database, encrypted integration credentials, hashed API keys, TLS in transit, two-factor authentication, an audit log of sensitive actions and of any staff access, and daily encrypted backups copied off-site and checked with automatic restore tests.

4. Sub-processors

The Customer authorises the sub-processors listed on our sub-processors page (/legal/subprocessors). We bind them with data-protection terms at least as protective as these and remain responsible for them.

We announce new sub-processors on that page before they start processing. The Customer may object on reasonable grounds; if we cannot resolve it, the Customer may end the affected service.

5. Assistance

We help the Customer answer requests from data subjects (access, rectification, erasure, portability). Most can be handled directly in Ordyum by editing or deleting records and with the full export in Settings → Workspace.

We also assist with security, impact assessments and prior consultations where the law requires them.

6. Personal data breaches

We notify the Customer without undue delay, and where possible within 48 hours of becoming aware of a breach affecting its data, with the information available to help it meet its own obligations.

7. Location and transfers

The service is hosted on OVHcloud servers in Canada, a country with an adequacy decision of the European Commission for commercial organisations. When a sub-processor processes data in another country without such a decision, we rely on the European Commission’s standard contractual clauses.

8. Deletion and return

The Customer can export all its data at any time. When the account is closed, we delete the data from our active systems; copies in backups expire on their regular rotation.

9. Information and audits

We make available the information needed to show compliance: this agreement, the security and status pages and our answers to reasonable questionnaires. Audits can be arranged with reasonable notice, at the Customer’s cost and at most once a year unless there has been a breach.