ORBITVU DATA PROCESSING ADDENDUM
Last updated: 15 April 2026
This Orbitvu Data Processing Addendum ("DPA") supplements and is incorporated into the Orbitvu Terms of Services and Orbitvu Privacy Policy, together with any terms applicable to any additional Orbitvu services that you choose to use (the "Terms") by and between You ( "Controller"), and the Processor as set forth in the Terms, which outline the specific business purposes and services related to this DPA. In case of any conflict between the Terms and this DPA, the DPA shall prevail with respect to the processing. You and the Processor (each a "Party", together the "Parties"), agree that this DPA sets forth the Parties' obligations governing the processing of Your Customer Personal Data. You shall act as a Data Controller and the Processor shall act as a Data Processor with respect to the processing of Your Customer Personal Data, in connection with Your use of our Services that rely on our processing of Your Customer.
1.1 "Processor" or “we” means OVTECH sp. z o.o. (a limited liability company incorporated under the laws of Poland), with its registered office at ul. Elzab 1, 41-813 Zabrze, Poland; registered in the National Court Register (KRS) kept by the District Court in Gliwice (Poland) under entry number KRS: 0001128324. OVTECH is the owner and provider of Orbitvu Station Software, Orbitvu (SUN) Cloud Platform as well as other Orbitvu-branded technologies and solutions.
1.2 "Applicable Data Protection Laws" means all privacy/data protection laws applicable to the Processing under this DPA, including the GDPR (where applicable).
1.3 "Customer" means an end user who visits, engages with, and/or purchases from Controller's websites, including its online storefront(s).
1.4 "Customer Personal Data" means Personal Data from or about Customers that Processor processes on Controller's behalf under this DPA.
1.5 "Data Subject Request" means a valid request by an individual to exercise rights under Applicable Data Protection Laws.
1.6 "Personal Data Breach" has the meaning set out in Applicable Data Protection Laws.
1.7 Other capitalized terms (including Controller, Processor, Processing, Personal Data) have the meaning given under Applicable Data Protection Laws.
2.1 Purpose. Controller instructs Processor to process Customer Personal Data solely to provide the Processor’s SaaS/API service used by Controller in connection with its websites to present, display, market and/or offer Customer’s products, including where such websites operate as online stores. This includes:
2.2 Nature of Processing. Technical request handling and delivery, short-term/log-based storage, controlled access, aggregation of statistics, and deletion.
2.3 Duration. Processing continues for the term of the Terms and any period required to delete/return data under Section 11 and Appendix 1.
3.1 Controller determines the purposes and means of Processing and acts as Controller. Processor acts as Processor.
3.2 Processor will process Customer Personal Data only on documented instructions from Controller, as set out in the Terms and this DPA, unless Processing is required by applicable law (in which case Processor will notify Controller unless legally prohibited).
3.3 If Processor reasonably believes Controller's instruction violates Applicable Data Protection Laws, Processor will inform Controller.
3.4 No legal advice. Processor does not interpret or advise Controller on Controller's obligations under Applicable Data Protection Laws. Controller is responsible for determining its compliance obligations and for assessing whether Processor's measures meet Controller's requirements.
4.1 Categories of Data Subjects: Customers visiting Controller's websites (including its online storefront(s)).
4.2 Categories of Personal Data (actual scope):
4.3 No production IP database. Processor does not store IP addresses in production customer databases for business/content purposes; IP may appear only in technical logs and security tooling.
4.4 Special categories. The service is not intended to process special categories of data. Controller shall not provide such data to Processor via the service.
5.1 Transparency. Controller represents and warrants it provides all notices required by Applicable Data Protection Laws to Customers regarding Controller's storefront operation and its use of Processor's service (including disclosure of content delivery, technical logging, and analytics where required).
5.2 Rights, permissions, lawful basis. Controller represents and warrants it has all necessary rights, permissions, and lawful bases (and consents where required) to make Customer Personal Data available to Processor and to permit Processing for the purposes in this DPA.
5.3 Cookies and similar technologies. If Controller's online storefront or integrations require consent for cookies/local storage/analytics, Controller is responsible for implementing an appropriate consent mechanism and honoring customer preferences. Processor does not require Controller to deploy any tracking beyond what is described in Section 4 and Appendix 1.
5.4 Data Subject Requests. Controller is responsible for enabling Customers to exercise Data Subject Requests for Processing where Controller is the Controller.
5.5 Regulatory inquiries. Unless prohibited by law, Controller will promptly notify Processor of any governmental/regulatory inquiry or complaint relating to Controller's use of the service that may affect Processing under this DPA.
6.1 Confidentiality. Processor will ensure persons authorized to process Customer Personal Data are bound by confidentiality obligations and receive appropriate privacy/security training.
6.2 Security measures. Processor will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, including at least:
Processor may update its security measures over time, provided updates do not materially reduce protection.
6.3 Personal Data Breach.
6.4 Assistance. Taking into account the nature of Processing and the information available to Processor, Processor will provide reasonable assistance to Controller to help Controller comply with obligations under Applicable Data Protection Laws (including security obligations, breach handling, DPIAs where relevant, and supporting responses to Data Subject Requests where feasible).
6.5 Article 11 GDPR / inability to identify. The Parties acknowledge that the data processed by Processor (IP in logs) generally does not enable Processor to directly identify individuals. Processor is not required to identify individuals for Data Subject Requests unless Controller provides information sufficient to locate the relevant log record(s) with high confidence.
7.1 Authorized Subprocessors (as of the Effective Date):
7.2 Processor will ensure each Subprocessor is bound by written obligations substantially similar to those in this DPA regarding Customer Personal Data protection.
7.3 Processor remains responsible for Subprocessors' performance to the extent required by Applicable Data Protection Laws.
7.4 Changes; notice; objection; termination of impacted services. Processor may add or replace Subprocessors and will provide Controller a means to receive notice of changes (e.g., email notice, dashboard notice, or an updated list). Where Applicable Data Protection Laws grant Controller the right to object, Controller may object on reasonable data-protection grounds. If Processor cannot reasonably accommodate the objection, Controller may terminate use of the impacted part of the service within 30 days of the notice, without affecting the remainder of the Agreement where feasible.
8.1 Processor will make available information reasonably necessary to demonstrate compliance with this DPA.
8.2 Audit via documentation first. Processor may satisfy audit requests by providing relevant security documentation and/or third-party audit reports made available by Subprocessors (e.g., ISO/SOC reports), subject to confidentiality.
8.3 Additional audits (only if necessary). If Controller has a legal right that cannot be satisfied under Section 8.2, Controller may request an audit subject to: scope limited to what is necessary; confidentiality; mutually agreed timing; no more than once per 12 months (unless required by law); limited to Processor-controlled systems; and conducted without unreasonable disruption.
8.4 Controller bears its audit costs unless the audit identifies material non-compliance by Processor.
9.1 Controller acknowledges Customer Personal Data may be accessed/processed in countries where Processor, its affiliates, or Subprocessors operate (e.g., support or incident response), even if primary hosting is in the EU.
9.2 Where transfers occur outside the EEA/UK/Switzerland to a destination lacking adequacy, the Parties will ensure appropriate safeguards are in place (e.g., EU Standard Contractual Clauses (Controller-to-Processor) and, where applicable, UK Addendum/IDTA and Swiss adaptations), incorporated into this DPA by reference or executed as needed.
10.1 Legal requests. Controller acknowledges Processor may disclose Customer Personal Data to: (i) comply with legal requirements, court orders, or lawful regulatory demands; or (ii) prevent/investigate suspected fraud, threats to safety, illegal activity, or violations of the Agreement/policies.
10.2 Where legally permitted, Processor will make reasonable efforts before disclosing Customer Personal Data to ensure disclosure is lawful and treated as confidential under the applicable legal framework, and will notify Controller unless legally prohibited.
10.3 Corporate transactions. Controller acknowledges Processor may share Customer Personal Data with potential counterparties in a merger, acquisition, financing, restructuring, or similar transaction, subject to appropriate confidentiality protections.
11.1 Log retention. Technical logs containing Customer Personal Data are archived (e.g., compressed) and permanently deleted within a maximum of 90 days, except where longer retention is required by law or temporarily necessary to investigate security incidents, fraud, or abuse (in which case access is restricted and retention limited to what is necessary).
11.2 During term. Controller may use available service tools (if any) to access or delete non-log data (e.g., hosted assets and statistics) where applicable.
11.3 End of Processing. Upon termination/expiry of the Terms, Processor will delete Customer Personal Data to the extent Processor holds it in non-log form, subject to legal retention and standard backup practices (with continued protection and no further Processing except as permitted by law). Technical logs are deleted per Section 11.1.
12.1 Processor may update this DPA from time to time by notice (email/dashboard) or by posting an updated version. The updated DPA becomes effective as of the stated effective date. If Controller does not agree, Controller may stop using the service and terminate in accordance with the Agreement.
13.1 Liability under this DPA is subject to the limitations and allocations of risk in the Terms, to the extent permitted by law.
14.1 This DPA and any disputes arising out of or in connection with it are governed by the laws of Poland.
14.2 The competent courts in Poland shall have jurisdiction, unless mandatory provisions of Applicable Data Protection Laws require otherwise.