Data Processing Addendum

"Applicable Data Protection Law" means privacy and data-protection law applicable to the processing covered by this DPA. "Personal Data," "Process," "Controller," "Processor," "Data Subject," and "Supervisory Authority" have the meanings given by applicable law. "Subprocessor" means a processor engaged by BAM Meridian to process Personal Data on Customer's behalf.

Customer is the Controller and BAM Meridian is the Processor for Personal Data processed on Customer's documented instructions. Customer instructs BAM Meridian to process Personal Data as necessary to provide, secure, support, and maintain the contracted Orbit services and as otherwise documented by Customer in writing. BAM Meridian will not process Personal Data for unrelated purposes except as required by law.

Customer is responsible for the lawfulness of its instructions, notices, consents, and other legal bases; for determining whether Orbit is appropriate for the Personal Data it chooses to process; and for complying with obligations applicable to Customer as Controller.

BAM Meridian will ensure that persons authorized to process Personal Data are subject to appropriate confidentiality obligations and receive access only as reasonably necessary for their duties.

BAM Meridian will implement appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature of processing and reasonably available safeguards. Current measures include access controls, authentication controls, encrypted transport, row-level database authorization, secret management, controlled privileged operations, and privacy-conscious analytics design.

Customer generally authorizes BAM Meridian to engage Subprocessors to provide the Service. BAM Meridian will impose data-protection obligations appropriate to the services performed. Current categories include cloud database and authentication infrastructure, application platform and email tooling, authentication providers selected by users, app stores, notification infrastructure, and payment providers once paid functionality is enabled. A current subprocessor list or notice mechanism may be maintained at an Orbit legal or trust URL before enterprise use. Where required by contract or law, Customer may object to a new Subprocessor on reasonable data-protection grounds.

Where Personal Data subject to cross-border transfer restrictions is transferred internationally, BAM Meridian will use a legally recognized transfer mechanism where required, such as applicable standard contractual clauses or another valid safeguard. The parties will cooperate on transfer assessments where legally required.

Taking into account the nature of processing, BAM Meridian will provide reasonable assistance to Customer with requests by Data Subjects to exercise applicable rights, to the extent Customer cannot fulfill the request through available Service functionality. Customer remains responsible for responding to the Data Subject unless law requires otherwise.

BAM Meridian will notify Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting Personal Data processed under this DPA, where notification is required by applicable law. BAM Meridian will provide information reasonably available to assist Customer with its legal obligations and will take reasonable steps to contain and remediate the incident.

Taking into account the nature of processing and information available to BAM Meridian, BAM Meridian will provide reasonable assistance with Customer's legally required security, breach-notification, data-protection-impact-assessment, and regulatory-consultation obligations. Upon reasonable request, BAM Meridian will make available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality, security, and proportionality limitations.

At termination of the applicable services, BAM Meridian will delete or return Personal Data processed on Customer's behalf as required by the parties' agreement and applicable law, except to the extent retention is legally required or data remains temporarily in protected backups pending ordinary deletion cycles.

Subject matter

Provision, operation, security, support, and maintenance of contracted Orbit services.

Duration

For the term of the applicable agreement plus limited retention periods described in the agreement, Privacy Policy, or law.

Nature and purpose

Hosting, organizing, synchronizing, authenticating, supporting, securing, and analyzing use of Orbit as instructed by Customer.

Data subjects

Customer-authorized users and other individuals whose Personal Data Customer chooses to place in Orbit.

Types of Personal Data

Account and profile data; user-provided tasks, lists, habits, focus records, reflections and related content; usage and technical data; support data; and subscription or entitlement data where applicable.

Sensitive data

Orbit is not designed as a specialized repository for regulated sensitive data. Customer should not place special-category or highly regulated data in Orbit unless expressly supported and agreed.

If this DPA conflicts with the applicable agreement on data-protection matters, this DPA controls to the extent of the conflict. The governing-law and dispute provisions of the applicable agreement apply unless Applicable Data Protection Law requires otherwise.

Contact: [email protected] · BAM Meridian LLC (opens in a new tab) · orbitapp.day