Last updated: 1 November 2026
Contents
- Parties and scope
- Roles and instructions
- Confidentiality and security
- Sub-processors
- Assistance and data subject rights
- Personal data breaches
- Deletion and return
- Audits and information
- International transfers
- Liability and general
- Annex 1: Details of processing
- Annex 2: Security measures
- Annex 3: Sub-processors
1. Parties and scope
This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between Orbis Digital Ltd, company number 17116737, of 66 Paul Street, London, EC2A 4NA ("we"), and the customer ("you"). It applies where we process personal data on your behalf in providing Orbis Status, and it is intended to meet Article 28 of the UK GDPR. It does not apply where we act as a controller, as described in our Privacy Policy.
2. Roles and instructions
You are the controller, and we are your processor. If you run status pages for your own clients, you may be a processor and we your sub-processor, and you must have the authority you need from those clients. You are responsible for having a lawful basis for the personal data you handle through the service, and for telling your subscribers about it.
We process that data only on your documented instructions, which include these Terms and your use of the service, such as sending an incident update to your subscribers, unless the law requires otherwise. We will tell you if we think an instruction breaks data protection law.
3. Confidentiality and security
We ensure that people authorised to process the data are bound by confidentiality. Our authorised staff access your account only as needed to give support, investigate a problem or keep the service secure. We maintain the technical and organisational measures in Annex 2, and we may update them provided that the overall level of protection is not reduced.
4. Sub-processors
You authorise the sub-processors in Annex 3 and give general authorisation for us to appoint others. We will give at least 30 days' notice of any new sub-processor, by email or in the application. You can object on reasonable data protection grounds. If we cannot resolve the objection, you may end the affected service. We put equivalent data protection terms in place with each sub-processor and remain liable for their performance.
5. Assistance and data subject rights
If we receive a request from an individual about your data, we will pass it to you unless the law prevents us. You can export your subscribers and delete a subscriber to respond. Taking into account the nature of the processing, we will give you reasonable help in responding to requests, and with security, breach notification, impact assessments and consultation with the regulator.
6. Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and we will give you the information we reasonably can to help you meet your own obligations.
7. Deletion and return
You can export subscribers, delete a subscriber and delete your account in the service during the contract. After your account closes, we will delete your data, unless the law requires us to keep it.
8. Audits and information
We will make available the information reasonably needed to show compliance with this DPA, and we will allow for and contribute to audits on reasonable written notice, no more than once a year unless a regulator requires it or there has been a breach. Audits must be conducted during working hours, must respect confidentiality and must not disrupt the service.
9. International transfers
Where we or a sub-processor transfer personal data outside the UK, we will rely on UK adequacy regulations or on appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum.
10. Liability and general
The limitations of liability in the Terms apply to this DPA. If this DPA conflicts with the Terms on data protection, this DPA takes priority. The law and courts of England and Wales apply.
11. Annex 1: Details of processing
| Item | Details |
|---|---|
| Subject matter | Providing Orbis Status |
| Duration | The term of the contract, then until deletion under section 7 |
| Nature and purpose | Hosting and storing subscriber email addresses and mobile phone numbers, confirming subscriptions, and sending status emails and text messages to subscribers, and posting to Slack, Microsoft Teams and webhook addresses you provide, on your instructions |
| Data subjects | Your status page subscribers |
| Personal data | Subscriber email addresses and mobile phone numbers, confirmation and unsubscribe status, records of the status emails and text messages sent to them, and email addresses of invited private page viewers |
| Special category data | Not required by the service. You should avoid collecting it unless you have a lawful basis |
12. Annex 2: Security measures
- Two-factor login available to users.
- Role-based access (Owner, Admin and Member), and an audit log.
- Double opt-in for subscribers, and one-click unsubscribe.
- Subscriber export and delete tools, and account deletion.
- Hosting on a server in Europe.
13. Annex 3: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| OVH | Server hosting | Europe |
| Brevo | Sending email and SMS to subscribers | Europe |
| Stripe | Payments | Ireland and United States |
Stripe processes billing data for us and on its own account as a payment provider, and it does not handle your subscriber data.