Version 1.0 · Last updated 2 November 2026
This Data Processing Agreement ("DPA") applies where Orbis Digital Ltd processes personal data on your behalf as a processor in connection with your use of Orbis Drive. It supplements our Terms of Service.
1. Roles
For personal data contained in files stored in your workspace, you are the controller and we are the processor. You are responsible for having a lawful basis for that data and for deciding whether the Service is suitable for it.
2. Scope of processing
We process personal data only to provide the Service (including storage, transmission, backup and support) and on your documented instructions, which include your use of the Service, unless the law requires otherwise. The data may include any personal data you choose to upload, about any data subjects you choose. Processing lasts for as long as you use the Service, plus the retention periods in our Privacy Policy.
3. Confidentiality
People we authorise to process personal data are bound by appropriate confidentiality obligations.
4. Security
We maintain appropriate technical and organisational measures, including encrypted connections, private storage, access controls and encrypted backups, as described on our Security page.
5. Sub-processors
You authorise the use of the suppliers named in our Privacy Policy and agree that we may engage others under written terms offering appropriate protection. We will update that list when suppliers change, and you may object on reasonable grounds by contacting us.
6. International transfers
Where personal data is transferred outside the UK, we will ensure appropriate safeguards are in place under UK data protection law.
7. Assistance
We will give reasonable assistance with data subject requests, data protection impact assessments and regulatory enquiries, taking into account the nature of the processing and the information available to us.
8. Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide the information reasonably available to help you meet your obligations.
9. Audits
We will make available the information reasonably needed to demonstrate compliance with this DPA, on reasonable written request.
10. Return or deletion
You can download your files at any time. On termination we will delete personal data in line with our retention practices, including backup cycles, unless the law requires us to keep it.
11. Contact
For DPA matters contact support@orbisdigital.co.uk.