Data Processing Agreement

1.Parties and roles

The customer is the controller. Orbox Labs s.r.o., company ID 29910340, registered office Pernerova 676/51, Karlín, 186 00 Prague 8, Czech Republic, is the processor (“we”).

2.Subject, duration and nature of processing

• Subject: providing the Orbox service under the Terms of Service.
• Duration: for the term of the contract and until the data is deleted under this agreement.
• Nature and purpose: storing, organising, displaying and analysing content with AI, so that processes can be described and an automation plan prepared.
• Types of data: names, work contact details, job roles and any other personal data the customer enters into process descriptions, attachments and chat, and, if the customer turns on monitoring, personal data contained in the records Orbox reads from the tools the customer connects in order to check that a process step took place.
• Data subjects: the customer’s employees and users, and people the customer mentions in its content (for example customers or suppliers).
• Special categories of data are not intended to be processed. The customer will not enter them unless strictly necessary.

3.Our obligations

We will:

• process personal data only on documented instructions of the customer, which are given by the Terms of Service and by the customer’s use of the service, unless EU or Member State law requires otherwise, in which case we inform the customer first unless the law forbids it;
• inform the customer immediately if, in our opinion, an instruction infringes the GDPR or other data protection law;
• ensure that everyone authorised to process the data is bound by confidentiality;
• implement the technical and organisational measures under Article 32 GDPR described below;
• help the customer, taking into account the nature of the processing, to respond to requests from data subjects;
• help the customer meet its obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessments and prior consultation);
• notify the customer of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it;
• at the end of the contract, delete or return all personal data at the customer’s choice, unless the law requires us to keep it;
• make available all information needed to demonstrate compliance and allow audits by the customer or an auditor it appoints, on reasonable notice and at most once a year unless there is a breach.

4.Security measures

• encryption of data in transit (TLS) and at rest;
• access to customer data only for authorised staff, based on least privilege, with access logging;
• separation of customer workspaces;
• regular backups and tested recovery;
• regular updates and vulnerability management;
• multi-factor authentication for staff and periodic reviews of who has access;
• security monitoring, centralised logging and a documented incident response process;
• confidentiality obligations and regular security training for staff;
• assessment of every subprocessor before we use it, and a contract binding it to these measures.

5.Subprocessors

The customer gives a general authorisation to engage the subprocessors listed on the Subprocessors page. We will tell the customer at least 30 days before adding or replacing a subprocessor. The customer may object on reasonable grounds; if we cannot resolve the objection, the customer may terminate the contract.

We impose the same data protection obligations on every subprocessor as this agreement imposes on us, and we remain liable for their performance.

6.Transfers outside the EEA

We transfer personal data outside the European Economic Area only where an adequacy decision applies or under the European Commission’s Standard Contractual Clauses, together with any supplementary measures needed.

7.Final provisions

Liability under this agreement follows the Terms of Service. In case of conflict between this agreement and the Terms of Service on the protection of personal data, this agreement prevails. It is governed by Czech law.

This agreement takes effect on 18 August 2026.