Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the agreement between the business or organization that subscribes to Orchcast (the Customer, acting as controller or business) and Orchcast, Inc. (the Service Provider). It applies where the Customer's use of Orchcast involves processing personal information.

• Customer (controller/business):Determines the purposes and means of processing personal information through the platform.
• Orchcast (processor/service provider):Processes personal information on behalf of the Customer only as instructed and in accordance with this DPA.

The Customer instructs Orchcast to process personal information only to the extent necessary to provide the Orchcast platform as described in the Terms of Service and documentation. Orchcast will not process personal information for its own commercial purposes outside the scope of providing the service.

Orchcast will process personal information only in accordance with the Customer's documented instructions, including those provided at signup, through the platform interface, or in writing from an authorized representative of the Customer.

• Access controls and role-based permissions within the platform
• Encryption in transit (TLS) for all data transfers
• Encryption at rest for stored data where supported by infrastructure providers
• Secrets management for API keys and integration credentials
• Audit logging of significant account and system events
• Regular security reviews of subprocessors and integrations
• Environment separation between development, staging, and production

Orchcast ensures that all personnel authorized to process personal information are bound by confidentiality obligations and receive appropriate privacy and security training. Access is limited to individuals who need the information to perform their job functions.

Orchcast may engage subprocessors to support delivery of the service. A current list of subprocessors, including their purpose, location, and data types, is maintained at:

/subprocessors

Before adding a new subprocessor, Orchcast will notify the Customer and provide an opportunity to object if the new subprocessor would materially change the terms of this DPA. If the Customer objects in writing within 14 days, the parties will discuss a resolution and, if none is reached, the Customer may terminate the agreement with 30 days notice.

In the event of a personal data breach, Orchcast will notify the Customer without undue delay, and in accordance with applicable law, providing:

• A description of the breach and the types of information involved;
• The likely consequences of the breach;
• The measures taken or proposed to address the breach and mitigate harm;
• Contact details for further information or support.

Orchcast will also cooperate with the Customer and regulatory authorities as required, and will provide updates as appropriate.

Upon termination or expiration of the agreement, or upon the Customer's written request, Orchcast will:

• Return all personal information provided by the Customer in a commonly used, machine-readable format;
• Delete copies of that information from active systems within 30 days, subject to legal retention requirements; and
• Provide written confirmation of deletion upon request.

Customers may request an account export at any time from Account Settings (Account → Export my data).

Orchcast will provide reasonable assistance to the Customer in responding to requests from data subjects to exercise their rights under applicable privacy laws, including access, correction, deletion, and portability. This may include providing account export data, correcting records, or deleting account data on the Customer's behalf upon verified request.

Orchcast is headquartered in British Columbia, Canada. Personal information may be processed in Canada or transferred to subprocessors in other jurisdictions (including the United States) as listed at /subprocessors. Where required, appropriate transfer safeguards are in place, including data-processing agreements with subprocessors that include confidentiality and security obligations.

The Customer may request an audit of Orchcast's compliance with this DPA, subject to:

• Reasonable advance notice (minimum 14 days);
• Scope limited to systems and records relevant to this DPA;
• Audit conducted during normal business hours and not more than once per year unless required by law or court order;
• Customer bearing the cost of the audit unless a material breach is found.

Alternatively, Orchcast will provide a completed security questionnaire, SOC 2 or equivalent report, or other compliance documentation upon reasonable request.

This DPA remains in effect for as long as the Customer processes personal information through the Orchcast platform. The clauses on confidentiality, security, breach notification, deletion, and audit survive termination for as long as Orchcast retains any personal information belonging to the Customer.

Questions about this DPA or subprocessor list should be directed to [email protected].