Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Orchestrapay, LLC ("Orchestrapay", "we") and the merchant ("you", "Controller") and applies where Orchestrapay processes personal data on your behalf in providing the Service. If there is a conflict between this DPA and the Terms of Service on the subject of data protection, this DPA controls.
1. Roles
For end-customer and cardholder personal data that you submit to, or that is collected through, the Service, you are the controller and Orchestrapay is the processor (or, under US laws, the service provider). Orchestrapay may engage sub-processors as set out in section 5. For personal data of your account administrators and our website visitors, Orchestrapay is an independent controller as described in the Privacy Policy.
2. Scope and instructions
Orchestrapay will process personal data only to provide the Service, in accordance with this DPA, the Terms, and your documented lawful instructions (including your configuration of the Service), and as required by applicable law. We will inform you if we believe an instruction violates applicable data-protection law.
3. Subject matter and details of processing
- Subject matter: provision of the payment orchestration Service.
- Duration: for the term of the Terms, plus any legally required retention period.
- Nature and purpose: routing, processing, authorization, tokenization, vaulting, settlement support, fraud prevention, reporting and related operations.
- Types of personal data: cardholder and payer identifiers (name, email, phone, billing/address-verification data), payment credentials (PAN stored encrypted; CVV not retained), bank and mobile-money details, method-specific identifiers (which may include a national identification number), IP address and derived location, and transaction data.
- Categories of data subjects: your end customers, payers and cardholders.
4. Confidentiality and security
Orchestrapay will ensure that personnel authorized to process personal data are bound by confidentiality obligations, and will implement appropriate technical and organizational measures to protect personal data, including those described in our Privacy Policy and consistent with the PCI DSS: encryption in transit and at rest, least-privilege access with multi-factor authentication, network segmentation, logging and monitoring, vulnerability management and incident response.
5. Sub-processors
You authorize Orchestrapay to engage sub-processors to provide the Service. The current list of sub-processors is published on our Sub-processors page. We will impose data-protection obligations on sub-processors substantially similar to those in this DPA and remain responsible for their performance. We will provide a mechanism to be notified of new sub-processors and a reasonable opportunity to object on legitimate data-protection grounds.
6. Assistance to the Controller
Taking into account the nature of the processing, Orchestrapay will provide reasonable assistance to help you: (a) respond to data-subject requests to access, correct, delete, restrict, port or object; (b) meet your security, breach-notification and data-protection-impact-assessment obligations; and (c) demonstrate compliance. Where we receive a data-subject request that relates to data we process on your behalf, we will refer it to you.
7. Personal data breach
Orchestrapay will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and will provide information reasonably available to help you meet your notification obligations.
8. International transfers
Orchestrapay processes data across the United States, the European Union and Egypt and may transfer personal data to payment providers and sub-processors in other countries. Where required, such transfers are made under appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK Addendum, which are incorporated into this DPA by reference and completed by the details in this DPA and the Privacy Policy.
9. Return and deletion
On termination of the Service, Orchestrapay will, at your choice, make personal data available for export for a limited period and then delete or anonymize it, except to the extent retention is required by law or by payment-network and PCI DSS record-keeping obligations.
10. Audit
Orchestrapay will make available information reasonably necessary to demonstrate compliance with this DPA, including its PCI DSS attestation and relevant security summaries, and will allow for audits subject to reasonable confidentiality, scope, frequency and notice conditions.
11. US state privacy laws
To the extent US state privacy laws apply, Orchestrapay acts as a service provider or processor, will not sell or share personal information, will not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, and certifies that it understands and will comply with these restrictions.
12. Contact
Questions about this DPA: privacy@orchestrapay.com.