Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between Orbit Technologies, LLC, a Louisiana limited liability company ("Orbit"), and the customer that has agreed to the Agreement ("Customer"). It applies automatically whenever Orbit processes Customer Personal Data in providing the Services, and needs no separate signature.

United States only. The Services are offered only to businesses located in the United States, and all data is processed in the United States. This DPA is written for U.S. privacy laws. It does not cover processing that is subject to the EU or UK GDPR or Swiss data-protection law (see Section 8). A countersigned copy is available on request at hello@goorbit.app.

Company: Orbit Technologies, LLC
Address: 627 Opelousas Ave STE 71290, New Orleans, LA 70114
Contact: hello@goorbit.app (subject: "DPA")

Capitalized terms not defined here have the meanings given in the Agreement. If this DPA and the Agreement conflict on data-protection matters, this DPA controls.

1. Definitions

• Data Protection Laws: all U.S. federal and state laws that apply to the processing of Customer Personal Data under the Agreement. These include the California Consumer Privacy Act, as amended by the CPRA ("CCPA"), and other U.S. state comprehensive privacy laws (for example, those of Virginia, Colorado, Connecticut, Utah, Texas, and Oregon).
• Customer Personal Data: personal data contained in Customer Content, or otherwise provided to Orbit by or for Customer through the Services, that Orbit processes on Customer's behalf.
• Controller and Processor: a "business" or "controller," and a "service provider" or "processor," as those terms are defined in the applicable Data Protection Laws.
• Data Subject: an individual whose personal data is included in Customer Personal Data (a "consumer" under the CCPA).
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• Sub-processor: any third party Orbit engages to process Customer Personal Data.

2. Roles and scope

2.1 Roles. For Customer Personal Data, Customer is the Controller (or a Processor acting for its own clients) and Orbit is the Processor (or Sub-processor). Under the CCPA, Customer is the "business" and Orbit is the "service provider."

2.2 Orbit's own data. This DPA does not cover data Orbit processes as an independent controller, such as account and billing data, website analytics, and security logs. The Privacy Policy covers that data.

2.3 Details of processing. The subject matter, duration, nature, purpose, data types, and data subjects are described in Annex I.

3. Customer's responsibilities

3.1 Customer is responsible for:

• the lawfulness of the Customer Personal Data it provides;
• having a valid legal basis and giving all required notices;
• obtaining all consents and releases, including from its own clients and from people who appear in media.

3.2 Restricted data. Customer will not provide the restricted data described in Section 5 of the Terms: protected health information, payment-card data, government identifiers, or special-category data beyond what is incidental and properly consented.

3.3 Instructions. Customer's instructions to Orbit are those in the Agreement and this DPA, and those given through the Services' features and settings. Additional instructions require written agreement.

4. Orbit's obligations

4.1 Processing on instructions. Orbit processes Customer Personal Data only on Customer's documented instructions, including for international transfers, unless the law requires otherwise. In that case, Orbit will inform Customer first where legally permitted. Orbit will tell Customer if it believes an instruction violates Data Protection Laws.

4.2 Purpose limitation. Orbit will not:

• sell or share Customer Personal Data, as those terms are defined in the CCPA;
• use it for advertising;
• combine it with data from other sources, except as the Services require;
• retain, use, or disclose it for any purpose other than providing the Services.

4.3 No AI training. Orbit will not use Customer Personal Data or Customer Content to train or fine-tune any artificial-intelligence or machine-learning model, whether Orbit's own or a third party's. Where optional AI features are enabled, content is sent to an AI Sub-processor only to return a result to Customer, under terms that prohibit model training.

4.4 Confidentiality. Orbit ensures that everyone authorized to process Customer Personal Data is bound by confidentiality obligations. Personnel access it only as needed to provide support, keep the Services secure, or comply with law, and such access is logged.

4.5 Security. Orbit maintains the technical and organizational measures described in Annex II. Orbit may update these measures, provided the overall level of protection is not materially reduced.

4.6 Assistance. Taking into account the nature of the processing, Orbit will reasonably assist Customer:

• in meeting its obligations for security, breach notification, and any data protection assessments required by Data Protection Laws;
• in responding to Data Subject requests (Section 7).

4.7 CCPA certification. Orbit certifies that it understands and will comply with the restrictions in Section 4.2. Orbit will notify Customer if it can no longer meet its obligations under the CCPA.

5. Sub-processors

5.1 Authorization. Customer gives general authorization for Orbit to engage Sub-processors. The current list is in Annex III and is also available at goorbit.app/privacy (Section 7.1).

5.2 Obligations. Orbit engages each Sub-processor under a written agreement with data-protection obligations no less protective than this DPA, as appropriate to the service provided. Orbit remains responsible for its Sub-processors' performance.

5.3 Changes. Orbit will update the list and give Customer at least 15 days' notice before a new Sub-processor begins processing Customer Personal Data. Notice is given by updating the list and, for Customers who have asked for notices at hello@goorbit.app, by email.

5.4 Objections. Customer may object on reasonable data-protection grounds within that 15-day period. The parties will discuss in good faith. If no resolution is reached, Customer may terminate the affected Services and receive a pro-rated refund of prepaid fees for the unused period.

6. Personal Data Breaches

6.1 Notice. Orbit will notify Customer without undue delay, and where feasible within 72 hours, after confirming a Personal Data Breach affecting Customer Personal Data.

6.2 Content of the notice. The notice will describe, to the extent known:

• the nature of the breach;
• the categories and approximate number of Data Subjects and records affected;
• the likely consequences;
• the measures taken or proposed.

Orbit will provide further information as it becomes available.

6.3 Containment. Orbit will take reasonable steps to contain, investigate, and reduce the effects of the breach.

6.4 No admission. Notifying Customer is not an acknowledgment of fault or liability.

7. Data Subject requests

7.1 If Orbit receives a request directly from a Data Subject about Customer Personal Data, Orbit will not respond except to redirect the Data Subject to Customer, unless the law requires otherwise. Where possible, Orbit will also notify Customer.

7.2 The Services let Customer access, correct, export, and delete Customer Personal Data. Where Customer cannot fulfil a request through the Services, Orbit will provide reasonable assistance.

8. United States only

8.1 Location. Orbit and its Sub-processors store and process Customer Personal Data in the United States.

8.2 No GDPR processing. The Services are offered only to Customers located in the United States. Customer will not use the Services to process personal data that is subject to the EU GDPR, the UK GDPR, or Swiss data-protection law, and Orbit does not act as a processor under those laws, unless Orbit has agreed otherwise in a separate written agreement. If Customer becomes aware that such data has been uploaded, it will notify Orbit and remove it.

9. Audits

9.1 On written request (no more than once per year, unless a regulator requires otherwise or following a Personal Data Breach), Orbit will provide information reasonably necessary to show compliance with this DPA. This may include:

• written answers to security questionnaires;
• a summary of Orbit's security measures;
• available third-party reports of its Sub-processors.

9.2 On-site audits. If that information is reasonably insufficient, Customer may conduct an audit, at its own cost:

• with at least 30 days' notice;
• during business hours;
• by an independent auditor bound by confidentiality;
• in a way that does not disrupt the Services or compromise other customers' data.

10. Return and deletion

10.1 During the subscription. Customer can export Customer Content through the Services at any time while its subscription is active.

10.2 After it ends. When the Agreement ends, the workspace becomes read-only for 30 days so Customer can export. Orbit then deletes Customer Personal Data from active systems. Residual copies in encrypted backups are overwritten within a further 30 days.

10.3 Legal retention. Orbit may keep data where the law requires, and will continue to protect it under this DPA for as long as it is kept.

11. Liability and term

11.1 Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, except where Data Protection Laws do not allow this.

11.2 This DPA lasts as long as Orbit processes Customer Personal Data under the Agreement.

12. Changes

Orbit may update this DPA to reflect changes in Data Protection Laws or the Services. Orbit will give at least 30 days' notice of changes that materially reduce Customer's protections. Customers who need a fixed version may request a countersigned copy.

Annex I — Details of processing

Annex II — Technical and organizational security measures

• Encryption: TLS 1.2+ for all data in transit, and AES-256 encryption at rest for the database and file storage.
• Tenant isolation: Postgres row-level security enforces that each agency's data is visible only to that agency's authorized users, and to each client only for its own portal.
• Access control:
  • role-based permissions for staff (Owner, Operator, team) and clients (Approver, Reviewer, Viewer);
  • one-time-code sign-in;
  • time-limited invitation and share links;
  • short-lived signed URLs for every file download and stream.
• Private storage: file buckets are private. Files are never served from public URLs.
• Personnel access: production access is limited to authorized Orbit personnel on a need-to-know basis. Administrative access is logged.
• Audit logging: sensitive actions (invitations, role changes, deletions, approvals, plan changes) are recorded in audit logs.
• Monitoring: application error monitoring and alerting. Dependencies are updated regularly.
• Resilience:
  • managed infrastructure with automated backups;
  • deleted items stay recoverable for 30 days before permanent deletion;
  • scheduled jobs are protected by secret authentication.
• Data minimization:
  • analytics and session replay are consent-based;
  • form inputs are masked;
  • no third-party advertising trackers in the application or portals.
• Secure development:
  • code review;
  • type checking and automated tests before deployment;
  • preview environments with separate storage for testing.
• Vendor management: Sub-processors are selected for their security posture and bound by written data-protection terms.
• Incident response: a documented process for investigating, containing, and notifying on security incidents (Section 6).

Annex III — Sub-processors

---

Orbit Technologies, LLC · 627 Opelousas Ave STE 71290, New Orleans, LA 70114 · hello@goorbit.app