Data Processing Agreement
How Orra handles your customers' personal data when it answers calls for you.
1. Parties and scope
This Data Processing Agreement ("DPA") is between the business that has agreed to Orra's Terms of Service (the "Customer", controller) and Clymb Marketing Ltd, trading as Orra ("Orra", processor). It forms part of the Terms and applies whenever Orra processes personal data on the Customer's behalf in providing the Service. It is intended to meet the requirements of Article 28 of the UK GDPR.
Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR.
2. Details of the processing
| Item | Details |
|---|---|
| Subject matter | Answering and making calls and messages for the Customer, taking details and bookings, sending summaries and follow-ups, and providing dashboards and reports. |
| Duration | For the term of the Customer's subscription, plus the deletion period in section 9. |
| Nature and purpose | Collection, recording, transcription, storage, analysis, organisation, retrieval, transfer to the Customer and deletion, so that the Service can be provided. |
| Data subjects | The Customer's callers, customers, prospective customers and staff. |
| Types of personal data | Names, phone numbers, email addresses, call recordings and transcripts, reasons for calling, appointment and booking details, and any other information a caller chooses to share. |
| Special category data | Not intended. Callers may volunteer information such as health details. The Customer should configure its assistant not to ask for special category data unless it has a lawful basis to process it. |
3. Orra's obligations
Orra will:
- process personal data only on the Customer's documented instructions, which are given by the Terms, this DPA, the Customer's configuration of the Service and any further written instructions, unless the law requires otherwise (in which case Orra will tell the Customer first, unless the law forbids it);
- tell the Customer if it believes an instruction breaks data protection law;
- make sure everyone authorised to process the personal data is bound by confidentiality;
- not use the Customer's personal data for its own purposes, sell it, or use callers' conversations to train public AI models.
4. Security
Orra will put in place appropriate technical and organisational measures to protect personal data, taking into account the risks involved. These include encryption of data in transit and at rest, role-based access controls, strong authentication for staff and administrators, logging of access to customer data, separation of each customer's data, regular backups, and secure deletion.
5. Sub-processors
The Customer gives Orra general authorisation to use sub-processors to provide the Service, such as providers of cloud hosting and databases, telephone connectivity, speech and AI processing, email and payments. Orra will:
- keep an up-to-date list of its sub-processors and provide it to the Customer on request;
- give the Customer at least 30 days' notice by email before adding or replacing a sub-processor, so the Customer can object on reasonable data protection grounds (if the parties cannot resolve the objection, the Customer may end the Service without penalty);
- put in place a written contract with each sub-processor that gives at least the same level of protection as this DPA; and
- remain responsible to the Customer for the performance of its sub-processors.
6. International transfers
Orra will not transfer the Customer's personal data outside the UK unless appropriate safeguards are in place, such as adequacy regulations, the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.
7. Helping the Customer
Taking into account the nature of the processing, Orra will help the Customer, at no extra charge for reasonable requests:
- respond to requests from data subjects to exercise their rights, and pass on any such request it receives directly without delay;
- meet its obligations on security, breach notification, data protection impact assessments and consultation with the Information Commissioner's Office.
8. Personal data breaches
Orra will tell the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Customer's personal data. It will give the Customer the information it reasonably needs to meet its own reporting obligations, and will take reasonable steps to contain and remedy the breach.
9. Deletion and return
When the Service ends, the Customer may ask Orra for a copy of its personal data within 30 days. After that, Orra will delete the Customer's personal data within a further 30 days, unless the law requires Orra to keep it. Backups are overwritten in the normal course of business within 35 days. Recordings and transcripts may also be deleted earlier on the Customer's instruction or according to retention settings in the Service.
10. Audits and information
Orra will make available to the Customer the information reasonably needed to show that it is meeting this DPA, and will allow for and contribute to audits by the Customer or an auditor it appoints, on reasonable notice, no more than once a year (unless required following a breach or by a regulator), during business hours and subject to confidentiality.
11. Customer responsibilities
The Customer confirms that it has a lawful basis to process the personal data it asks Orra to handle, that it will give data subjects the privacy information they need (including that calls may be answered by an AI assistant and recorded), and that its instructions to Orra comply with data protection law.
12. General
Each party's liability under this DPA is subject to the limits in the Terms, except where the law does not allow it. If there is a conflict between this DPA and the Terms about personal data, this DPA applies. This DPA is governed by the law of England and Wales.
Need a signed copy for your records or compliance file? Email hello@orrahq.com and we will send one for signature, together with our current sub-processor list.