Data processing agreement

1. Parties and scope

This agreement is between the business that uses Ordstage (“you”, the controller) and Ordstage Ltd (“Ordstage”, “we”, the processor). It forms part of our terms of service and applies whenever we process personal data for you under those terms. If this agreement and the terms conflict about personal data, this agreement wins.

“Data protection law” means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation 2016/679) and any other law that applies to the processing. Terms such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meaning given there.

2. The processing

• Subject matter and purpose: providing the Ordstage service to you: an AI assistant and team inbox for your customer conversations, with orders, bookings, leads, campaigns, flows, reports and integrations.
• Duration: for as long as you use the service, and until the data is deleted under section 10.
• Nature of processing: receiving, storing, organising, searching, analysing with AI models, generating replies to, sending, exporting and deleting data.
• Data subjects: your customers and prospects who contact you on connected channels or your website chat, recipients of your campaigns, and your own staff who use Ordstage.
• Types of personal data: names, phone numbers, email addresses, social profile IDs, message content and media (including images and voice notes), order, booking and lead details, delivery addresses, preferences the assistant remembers, and any other data your customers share in conversation or you upload.
• Special category data: not intended. If your business (for example a clinic) expects customers to share health or other special category data, you are responsible for having a lawful basis and setting up the assistant appropriately.

3. Your instructions

We process personal data only on your documented instructions. These terms, your settings in Ordstage and your use of its features (such as connecting a channel, switching on the assistant, sending a campaign or calling the API) are your instructions. We will tell you if we believe an instruction breaks data protection law, unless the law forbids us to. If the law requires us to process data in another way, we will tell you first unless the law forbids that too.

You are responsible for the lawfulness of the processing you instruct, including having a lawful basis, giving your customers a privacy notice, and getting consent for marketing messages where it is needed.

4. Confidentiality

Everyone at Ordstage who can access your personal data is bound by a duty of confidentiality and has access only as far as they need it to provide, support or secure the service.

5. Security

We take appropriate technical and organisational measures to protect your data, including:

• encryption in transit (HTTPS) between browsers, apps, channel providers and our servers;
• application-level encryption of stored channel, integration and API credentials, webhook payloads from Meta, and the customer preferences the assistant remembers;
• passwords stored as one-way bcrypt hashes, and API keys stored only as keyed hashes;
• separation of each workspace’s data, with every request checked against the workspace it belongs to;
• role-based access inside each workspace, with owner, admin, manager and member roles;
• two-factor login available to every user, which workspace owners can make compulsory;
• a list of signed-in sessions that users can review and end, with sign-in tokens kept in secure, HTTP-only cookies;
• an audit log of changes to workspace settings, members, roles, assistants, channels and security;
• rate limits on sign-in and the API, and bot protection on sign-up;
• signed webhooks (HMAC-SHA256), so you can verify that a webhook came from Ordstage;
• export files that expire and are deleted 24 hours after they are ready;
• separate staging and production environments, and secrets kept on the server only.

We review these measures as the service changes and may update them, provided the overall protection does not decrease.

6. Subprocessors

You give us general authorisation to use subprocessors. We will send you our current list of subprocessors, with what each one does and where, when you ask at privacy@ordstage.com. We will:

• put data protection terms in place with each subprocessor that are at least as protective as this agreement;
• tell you at least 30 days before we add or replace a subprocessor, by email to your workspace owner;
• let you object on reasonable data protection grounds within that period. If we cannot address the objection, you may end the affected part of the service and we will refund any prepaid fees for it;
• remain responsible to you for our subprocessors’ performance of their obligations.

Services you connect yourself, such as your own Shopify store, Google account, databases or other apps, are not our subprocessors. You choose them, and they process data under your own agreements with them.

7. Helping you with data subject requests

If someone contacts us to use their data protection rights about data we process for you, we will pass the request to you without undue delay and not answer it ourselves unless you ask us to. Taking into account the nature of the processing, we will help you respond. Ordstage lets you, for example, find and delete what the assistant remembers about a customer and export your records; for anything you cannot do yourself, contact privacy@ordstage.com and we will do it for you.

8. Other assistance

We will give you reasonable help with data protection impact assessments, consultations with supervisory authorities and your security obligations, as far as they relate to our processing and using the information available to us.

9. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data. We will tell you what happened, the likely consequences, the data and people affected as far as we know them, and what we are doing about it, and keep you updated as we learn more. We will help you meet your own duty to notify the regulator and the people affected.

10. Return and deletion

You can export your records at any time while you use Ordstage. When the service ends, you have 30 days to export your data. After that we delete the personal data we process for you within a further 60 days, unless the law requires us to keep it. Data in backups is deleted as the backups expire and is not restored except to recover the service.

11. Audits

We will make available the information you reasonably need to show that we meet this agreement, and answer your written security and privacy questions. If that is not enough, or a regulator requires it, you may audit our compliance (yourself or through an independent auditor bound by confidentiality) once a year, on 30 days’ notice, during business hours and at your own cost, without access to other customers’ data.

12. International transfers

Some subprocessors process data outside the UK and the European Economic Area, mainly in the United States. We transfer personal data only where data protection law allows it, relying on adequacy regulations or decisions where they apply (such as the UK Extension to the EU-US Data Privacy Framework for certified providers), or the European Commission’s Standard Contractual Clauses with the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement. Where you transfer data to us from the European Economic Area and the Standard Contractual Clauses are needed, Module 2 (controller to processor) applies and is incorporated into this agreement by reference.

13. Liability and term

Each party’s liability under this agreement is subject to the limits in the terms of service, except where data protection law does not allow it. This agreement lasts as long as we process personal data for you.