Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Sage Digital LLC, d/b/a OrderSync ("OrderSync"), acting as Processor, and the entity that has entered into that agreement (the "Customer"), acting as Controller. Where the agreement and this DPA conflict on data protection, this DPA controls. It supplements our Terms of Service and Privacy Policy.

"Applicable Data Protection Laws" means all laws governing the processing of Personal Data, including the GDPR, UK GDPR, and US state privacy laws. "Personal Data", "Controller", "Processor", "Data Subject", "Processing", and "Personal Data Breach" have the meanings given in the GDPR. "Customer Personal Data" means Personal Data OrderSync processes on the Customer's behalf. "Subprocessor" means a third party engaged by OrderSync to process Customer Personal Data.

The Customer is the Controller and OrderSync is the Processor of Customer Personal Data. OrderSync processes it only to provide the Service and only on the Customer's documented instructions — the agreement, this DPA, and the Customer's configured use of the Service.

Subject matter and duration: for the term of the agreement plus the deletion period in section 9. Nature and purpose: ingesting purchase orders and related business documents, extracting and matching order data, and syncing orders to the Customer's connected systems. Types of Personal Data: business-contact and order data — names, business email addresses, business phone numbers, and shipping and billing addresses of the Customer's buyers and contacts. Categories of Data Subjects: the Customer's business customers, buyers, and their staff. See Annex I.

The Customer is responsible for the lawful basis of its instructions and for not submitting special-category or prohibited data unless expressly agreed.

OrderSync will:

• process Customer Personal Data only on documented instructions, including for international transfers, unless required by law — in which case it notifies the Customer unless legally prohibited;
• ensure persons authorized to process are bound by confidentiality;
• implement the technical and organizational measures in Annex II;
• respect the conditions in section 4 for engaging Subprocessors;
• assist the Customer, by appropriate measures, to respond to Data Subject requests (section 5);
• assist the Customer with security, breach notification, data protection impact assessments, and regulator consultation (sections 6 and 7);
• delete or return Customer Personal Data per section 9; and
• make available the information necessary to demonstrate compliance and allow for audits per section 8.

The Customer provides general authorization for OrderSync to engage the Subprocessors listed in Annex III. OrderSync imposes data protection terms on each Subprocessor no less protective than this DPA and remains liable for their performance.

OrderSync will give the Customer reasonable prior notice of any intended new Subprocessor and an opportunity to object on reasonable data-protection grounds.

Taking into account the nature of the processing, OrderSync will assist the Customer with appropriate technical and organizational measures, insofar as possible, to fulfil the Customer's obligation to respond to Data Subject requests — access, rectification, erasure, restriction, portability, and objection. Where a Data Subject contacts OrderSync directly, OrderSync will refer them to the Customer.

OrderSync will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide the information reasonably available to help the Customer meet its breach-notification obligations.

Taking into account the nature of processing and the information available to it, OrderSync will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities.

OrderSync will make available the information necessary to demonstrate compliance with this DPA and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, on reasonable prior notice and no more than once per year — unless required by a regulator or following a Personal Data Breach — subject to confidentiality. OrderSync may satisfy audit requests by providing then-current third-party audit reports or security documentation where available.

On termination or expiry of the agreement, OrderSync will, at the Customer's choice, delete or return all Customer Personal Data and delete existing copies within a reasonable period — target 30 days — unless retention is required by law. Deletion requests for individual Data Subjects are honored through the Service's redaction controls.

Where OrderSync processes Customer Personal Data subject to the GDPR or UK GDPR outside an adequate jurisdiction, the parties agree that the applicable Standard Contractual Clauses (EU 2021/914 and the UK Addendum) are incorporated by reference, with OrderSync as "data importer" and the Customer as "data exporter".

• Data Subjects: the Customer's business buyers and customers, and their staff.
• Categories of Personal Data: name; business email; business phone; billing and shipping address; order and purchase-order content.
• Special categories: none intended.
• Frequency: continuous, for the term.
• Nature and purpose: order-document ingestion, extraction, product and customer matching, and order sync to connected systems.
• Retention: for the term, plus up to 30 days after termination (see section 9).

These describe controls that are in place today. Where a control is planned rather than implemented, it is identified as such.

• Encryption in transit: TLS for all data in transit, including all API and browser traffic and all connections to subprocessors.
• Encryption at rest: source documents and attachments are stored in object storage that is encrypted at rest. Integration credentials, OAuth access tokens, and webhook secrets are encrypted at the application layer. Database storage relies on the hosting provider's platform-level protections; OrderSync does not currently operate customer-managed full-disk encryption. Backups are stored encrypted at rest.
• Access control: least-privilege access; multi-factor authentication on provider and administrative accounts. OrderSync is a solo-operator business today, and staff access is limited accordingly.
• Logging and monitoring: centralized log management, application error monitoring, and server and uptime monitoring.
• Subprocessor assurance: every subprocessor that touches customer data maintains SOC 2 Type 2 or an equivalent independent attestation.
• Secure development: an automated test suite runs on every CI/CD push, with environment separation between production and development.
• Incident response: on a suspected breach, affected data and scope are identified, credentials and tokens are rotated, impacted customers are notified without undue delay, the cause is remediated, and a running incident log is kept.
• Certifications: OrderSync does not hold an independent security audit today. SOC 2 Type 1 is targeted for Q4 2026 or Q1 2027, with ISO 27001 and SOC 2 Type 2 to follow.

AI provider commitments. All model providers are used through their paid enterprise or API tiers, under which submitted data is not used to train models and is retained only transiently for abuse monitoring. No customer data is sent to consumer chat products.

Notes on scope. Microsoft Graph is listed so that no additional notice is required when a Microsoft-based customer is onboarded. Anthropic sits off the steady-state extraction path and is reached only when both OpenAI and Google fail, but is listed because it can receive document contents. Model routing may change for cost or quality reasons; where a change would introduce a new provider, the notice obligation in section 4 applies, while substituting between providers already listed here does not.

Questions about this DPA, or a request to execute a countersigned copy? Contact us at james@ordersync.io.