Data Processing Addendum

This Data Processing Addendum (the DPA) forms part of the Terms of Service between Orata Ltd, trading as REI Vantage (Orata), and the customer (Customer). It applies whenever Orata processes Customer Personal Data. Capitalised words not defined here have the meanings given in the Terms.

1. Definitions

• Data Protection Laws: all laws that apply to the processing of Customer Personal Data under the Terms. This includes the UK GDPR, the Data Protection Act 2018, the EU GDPR where applicable, and US state consumer privacy laws such as the California Consumer Privacy Act as amended (the CCPA).
• Customer Personal Data: personal data that Orata processes on the Customer's behalf in providing the Service. For example, data Orata can access in the Customer's instance during setup and support, personal data in error reports and support tickets, and data in Data Services requests and results.
• controller, processor, data subject, personal data breach, processing, business, service provider and sell / share have the meanings given in Data Protection Laws.

2. Roles

2.1 The Customer is the controller (or business) and Orata is the processor (or service provider) of Customer Personal Data.

2.2 Most Customer Personal Data stays in the Customer's own Customer Infrastructure, held in the Customer's name. The providers of that infrastructure, such as Cloudflare, Neon and Twilio, are engaged by the Customer directly and are not Orata's sub-processors.

3. Customer's obligations

The Customer is responsible for:

• having a lawful basis, and giving every notice and obtaining every consent required, for the processing it instructs, including notices to the people it contacts; and
• making sure its instructions comply with Data Protection Laws.

4. Orata's obligations

Orata will:

1. Instructions. Process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers, unless the law requires otherwise; in that case Orata will tell the Customer first unless the law prohibits it. The Terms, the Customer's configuration of the Service, and requests through the Service or support are the Customer's instructions. Orata will tell the Customer if it believes an instruction breaches Data Protection Laws.
2. Confidentiality. Ensure that everyone authorised to process Customer Personal Data is bound by a duty of confidentiality.
3. Security. Implement the technical and organisational measures in Annex 2. They are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
4. Sub-processors. Comply with section 5.
5. Data subject requests. Taking into account the nature of the processing, help the Customer respond to requests from data subjects to exercise their rights. If Orata receives a request directly, it will pass it to the Customer without responding to it beyond acknowledging receipt and redirecting the person, unless the Customer authorises otherwise.
6. Assistance. Give reasonable help with data protection impact assessments, prior consultations with regulators, and the Customer's security obligations, so far as they relate to Orata's processing.
7. Breach notification. Notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include the information the Customer reasonably needs to meet its own notification duties, as that information becomes available.
8. Deletion. When the Service ends, delete Customer Personal Data in Orata's possession within 30 days. If the Customer asks within that period, Orata will instead return it first, unless the law requires Orata to keep it. Backups are overwritten in the normal cycle, within a further 60 days.
9. Demonstrating compliance. Make available the information reasonably needed to demonstrate compliance with this DPA. Orata will allow audits, including inspections, by the Customer or an independent auditor it appoints. An audit requires at least 30 days' notice, may take place no more than once a year except after a personal data breach or at a regulator's request, is at the Customer's cost, and is subject to confidentiality. Orata may first answer written questions or provide existing reports to satisfy an audit request.

5. Sub-processors

5.1 The Customer gives general authorisation for Orata to use the sub-processors listed on the Sub-processors page.

5.2 Orata will give at least 30 days' notice of a new sub-processor by updating that page and emailing the Customer's account owner. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the affected part of the Service and receive a refund of prepaid Fees for it.

5.3 Orata will impose data protection obligations on each sub-processor that are no less protective than this DPA, and it remains liable to the Customer for each sub-processor's performance.

6. International transfers

6.1 Orata is established in the United Kingdom. Customer Personal Data may be processed in the UK, in the United States and in other locations where sub-processors operate.

6.2 Where Data Protection Laws restrict a transfer, Orata will ensure a valid transfer mechanism is in place. That may be UK adequacy regulations (including the UK–US data bridge for certified organisations), the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses as applicable. Where the Customer is in the United States, transfers from the Customer to Orata are not restricted transfers under UK law.

7. US state privacy laws

Where the CCPA or a similar US state law applies, Orata acts as a service provider (or processor) and will not:

• sell or share Customer Personal Data;
• retain, use or disclose it for any purpose other than the business purposes specified in the Terms, including a commercial purpose other than providing the Service;
• retain, use or disclose it outside the direct business relationship between Orata and the Customer; or
• combine it with personal data received from or on behalf of anyone else, or collected from Orata's own interactions with the data subject, except as Data Protection Laws allow.

Orata will comply with those laws and provide the same level of privacy protection they require. It will notify the Customer if it can no longer meet its obligations. The Customer may take reasonable steps to stop and remediate unauthorised use. Orata certifies that it understands and will comply with these restrictions.

8. Liability

Each party's liability under this DPA is subject to the limits in the Terms.

Annex 1: Details of processing

Annex 2: Security measures

• Isolation. Each Customer's instance and database run in the Customer's own Customer Infrastructure, separate from other customers.
• Encryption. TLS for data in transit. Encryption at rest provided by the hosting and database providers.
• Access control. Least-privilege access to Customer Infrastructure, limited to named Orata personnel; access is removed when no longer needed. Multi-factor authentication on Orata's administrative accounts.
• Authentication. Passwords stored only as salted hashes; session and API-token expiry; OAuth with explicit scopes for AI assistants; rate limiting and bot protection on authentication endpoints.
• Auditability. Audit logs of administrative actions and of tool calls made by connected AI assistants.
• Secrets. Credentials and API keys held in a secrets manager, never in source code.
• Software development. Code review, automated tests, dependency updates and security headers. Changes are tested on staging before production.
• Monitoring and response. Error monitoring with personal-data scrubbing, and a documented incident response process.
• Minimisation. Orata's data gateway does not keep copies of Customer lists beyond the caching described in the Data Services Terms.