Data Processing Agreement
Last updated: 2026-10-25
1. Parties and subject
This Data Processing Agreement (“DPA”) forms part of the agreement between the customer (“Controller”) and REMIGIUS Tomasz Karkoszka operating Orbilyn (“Processor”) for processing of personal data in customer-uploaded product and catalog content. Contact: hello@orbilyn.com.
2. Duration
Processing lasts for the term of the Controller’s Orbilyn account and any period required to delete or return data after termination, unless law requires longer retention of specific records.
3. Nature and purpose
The Processor hosts, stores, compares, monitors, and exposes via API/MCP/OAuth (as configured by the Controller) product and catalog data so the Controller can operate ecommerce data control workflows in Orbilyn.
4. Types of data and data subjects
Categories typically include product identifiers, titles, descriptions, prices, stock, offers, and related operational metadata that the Controller uploads or syncs. Data subjects may include the Controller’s personnel (account users) and, where present in catalog fields, end customers or other third parties whose data the Controller chooses to process in Orbilyn. The Controller determines the categories.
5. Processor duties
The Processor shall: process personal data only on documented instructions of the Controller (including via product configuration); ensure persons authorised to process data are bound by confidentiality; implement appropriate security measures; respect the conditions for engaging sub-processors; assist the Controller with data-subject requests and with security/DPIA obligations, taking into account the nature of processing; notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data; and delete or return personal data after the end of services, at the Controller’s choice, unless Union or Member State law requires storage.
6. Sub-processing
The Controller authorises the Processor to engage sub-processors listed at /subprocessors. The Processor will impose data-protection obligations on sub-processors no less protective than those in this DPA. Material changes to the list will be reflected on that page.
7. Security measures
Measures include encryption of integration credentials at rest, hashed secrets for API/MCP/OAuth tokens, row-level security, network and application controls (including SSRF protections and rate limiting), TLS in transit, and access control. A factual summary is published at /security.
8. Assistance with rights and incidents
Taking into account the nature of processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising data-subject rights, and for breach notification and cooperation with supervisory authorities when required.
9. Deletion and return
Upon account deletion by the Controller (Settings → Account) or written request, the Processor deletes user-scoped product and account data from active systems as described in the /privacy policy. Export of a machine-readable copy of profile, non-secret integration configs, monitors, and comparison histories is available from Account settings before deletion.
10. Audits
The Processor shall make available information necessary to demonstrate compliance with Art. 28 GDPR and allow for audits by the Controller or an auditor mandated by the Controller, subject to reasonable notice, confidentiality, and protection of other customers’ data and Processor security.
11. Governing terms
This DPA is governed by the same law as the /terms. In case of conflict on data-protection matters for processor services, this DPA prevails. Related documents: /privacy, /subprocessors.
Stop paying for invisible mismatches
Create a free account for your own files, or open the app if you already have one.
No card required. Free forever for files.