Data Processing Addendum

Draft updated: October 13, 2026. For contract review; not an executed DPA.

This draft is intended to form part of a customer agreement after the parties complete the schedules and accept it in writing. Publication alone does not execute this DPA, its transfer safeguards, or a business associate agreement.

1. Parties and scope

The provider is [full legal name of Orthalon's operator], at [registered address and country] ("Orthalon"). The customer is [customer's legal name and address] ("Customer"). Their services agreement is [agreement reference and date]. The DPA's effective date is [date of acceptance].

This DPA governs personal data Orthalon processes on Customer's behalf through the agreed Services ("Customer Personal Data"). Customer is the controller, or a processor with authority from its controller; Orthalon is respectively a processor or subprocessor. Account, sales, and billing information processed by Orthalon for its own purposes is addressed separately in the Privacy Policy. Workforce information in security records is not excluded merely because the person is a business contact or employee.

"Applicable law" means the data-protection law applicable to the processing, including EU GDPR, UK GDPR, Swiss data-protection law, and applicable US state privacy laws where relevant. "Personal data," "processing," "controller," and "processor" have their meanings under that law. A "personal data breach" means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

2. Documented instructions

Orthalon will process Customer Personal Data only to provide the agreed Services under Customer's documented instructions, including authorized organization settings and the completed schedules. Orthalon will inform Customer if an instruction appears to infringe applicable data-protection law. If law requires different processing, Orthalon will notify Customer before processing unless prohibited by law.

Changes outside the Services' agreed scope require a written agreement; no customer instruction authorizes unlawful processing. Orthalon will not use Customer Personal Data for advertising or to train or improve general-purpose AI models without a separate lawful agreement. Providing a protection service is not general permission to reuse inspected content.

3. Confidentiality and security

Orthalon will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations. It will maintain measures appropriate to the risk and agreed in Schedule B. Changes must not materially reduce the agreed overall protection. Customer is responsible for securing its devices, identities, configuration, third-party credentials, and permitted destinations; this does not reduce Orthalon's own obligations.

Orthalon will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. It will provide available information about the nature, affected categories, likely consequences, contact point, and containment or remediation, with further information in stages as necessary. Orthalon will cooperate with Customer's investigation and legally required notifications. An unsuccessful attack that does not compromise personal data is not by itself a personal data breach.

4. Rights requests and privacy assistance

Taking account of the nature of processing and information available, Orthalon will assist Customer with applicable individual-rights requests, security obligations, breach assessment, DPIAs, and supervisory-authority consultation. If a request relates to data processed solely for Customer, Orthalon will promptly refer it to Customer unless law requires another response.

The privacy workspace supplies records and workflow support, not legal advice or a substitute for Customer's DPO. Additional assistance and any reasonable charges outside agreed support must be agreed in advance; assistance required by law must not be withheld solely because a fee has not been agreed.

Customer is responsible for a lawful basis, additional conditions for sensitive data where needed, notices, and lawful workforce monitoring. Customer must assess evidence collection, session titles, hosted files, and disclosures to its selected model providers. It must not use automated findings alone for employment or other legally significant decisions without required safeguards.

5. Subprocessors and destinations

Customer gives general written authorization for the subprocessors named in the completed Schedule C. Orthalon will give advance written notice of a new or replacement subprocessor at least [agreed notice period] before it begins processing. Customer may object on reasonable data-protection grounds within that period. The parties will seek an alternative, mitigation, or an agreed termination of affected Services if the objection cannot be resolved.

Orthalon will impose corresponding data-protection obligations on its subprocessors and remain responsible for their performance as required by law. Customer-selected model providers, connector sources, and external tool destinations must be classified in the schedule: they are not automatically Orthalon subprocessors solely because Customer connects them.

6. Information and audit

Orthalon will make information necessary to demonstrate its obligations available to Customer and allow and contribute to required audits and inspections by Customer or an authorized independent auditor. The parties will agree reasonable notice, scope, confidentiality, and safeguards for other customers' data and service security. Those arrangements must not prevent legally required audits or regulator access. No certification or third-party audit report is promised unless specifically listed in the signed agreement.

7. Return, deletion, and retained history

At the end of processing, Customer may elect return or deletion of Customer Personal Data, including copies, unless law requires retention. The signed agreement must specify the export window, deletion deadline, backup expiry, and any lawful retention exception. Retained data must remain protected and be used only for the permitted retention purpose.

Current product controls are not a complete termination-erasure procedure. Disabling evidence collection does not delete prior evidence. Imported DPIA facts can expire, but immutable revisions, screening, decisions, snapshots, and audits remain separately protected. Schedule A must document which of these contain personal data and how export, lawful retention, and eventual deletion will be fulfilled. These operational arrangements must be resolved before executing this DPA; immutability is not a legal exemption from erasure. Downloaded copies held by Customer remain Customer's responsibility.

8. International transfers

The parties must identify processing locations, onward transfers, and a valid mechanism for each restricted transfer before processing begins. Where needed, they will complete and execute the applicable EU Standard Contractual Clauses under Decision 2021/914, the UK IDTA or UK Addendum, and appropriate Swiss adaptations, with the required assessments and supplementary safeguards.

Schedule D records the selected mechanism, modules, authority, governing law, forum, annexes, and signatures. This draft does not deem incomplete clauses signed or assert Data Privacy Framework certification. Mandatory transfer clauses take precedence over conflicting commercial or DPA provisions, and their data-subject rights are not limited by an agreement's liability cap.

9. US state-law processing

Where applicable state law treats Orthalon as a processor, service provider, or contractor, Orthalon will process Customer Personal Data only for the specified business purposes in Schedule A or as otherwise permitted by that law. It will not sell or share that data, retain or disclose it outside the direct business relationship, or combine it with data from another customer or its own interactions except where permitted by law and necessary for the agreed Services.

Orthalon will notify Customer if it determines it cannot meet applicable obligations. Customer may take reasonable and appropriate steps to verify compliance and stop and remediate unauthorized use. Orthalon acknowledges these restrictions; the final agreement must include any jurisdiction-specific certifications and required terms identified in professional review.

10. Order of precedence and duration

This DPA continues while Orthalon processes Customer Personal Data. It controls conflicting personal-data provisions in the services agreement. Mandatory transfer terms control conflicts concerning their covered transfers. Changes require the agreed written process and must not remove mandatory protections.

Schedule A. Processing description

Schedule B. Security measures

Record the measures verified for the contracted deployment, including:

• tenant-scoped authorization, membership checks, roles, and least-privilege reviewer and evidence access;
• TLS for hosted transport; scoped credentials and supported device-bound authentication; OS credential storage where supported;
• authenticated encryption of retained prompt evidence and a managed key rotation/retention procedure;
• private analysis storage, expiring upload authorization, bounded extraction, object cleanup, and a verified lifecycle backstop;
• privacy evidence provenance and access records, version controls, independent approval where configured, and integrity-protected approved exports; and
• operational incident response, staff access review, backups, restore tests, patching, deletion procedures, and hosting-provider controls.

Product controls do not prove that the final operational procedures exist. Complete this schedule with the actual deployment, responsibilities, testing evidence, and any agreed service commitments. No SOC 2, ISO, HIPAA, universal residency, or hardware-backed-key certification is implied.

Schedule C. Subprocessor register

Complete legal provider names, service, data categories, processing/support countries, contract safeguards, and notification contact. Review hosting, database, object storage, real-time messaging, jobs, email, payments, and any optional analytics or model-processing services actually used. An SDK in the repository is not evidence that its provider processes customer data.

Schedule D. Transfer and signature record

Complete exporter/importer identities, contact points, roles, destination countries, selected transfer mechanism, assessment reference, modules/options, competent authority, annexes, supplementary measures, and any UK/Swiss terms. Attach required authoritative clauses without amendments that conflict with their mandatory provisions.

Customer authorized representative: [name, title, signature, date].

Orthalon authorized representative: [name, title, signature, date].

---

Adapted from General Legal's CC0 Global DPA template. General Legal has not reviewed or endorsed this adaptation. This draft is not legal advice.