Data Processing Addendum

Last updated: October 15, 2026

This Data Processing Addendum (“DPA”) amends and forms part of the written agreement between Customer and Orb, Inc. (“Orb”) (collectively, “the parties”) for the provision and use of the Orb Service, including any support or implementation assistance (“Services”) to Customer (the “Agreement”). This DPA prevails over any conflicting term of the Agreement but does not otherwise modify the Agreement. Capitalized terms not otherwise defined herein have the meaning given to them in the Agreement.

1. Definitions

1.1 In this DPA:

a) “Controller,” “Processing / Processes / Process,” “Processor,” “Service Provider,” “Business,” “Sell,” and “Supervisory Authority” have the meaning given to them in Data Protection Law (as defined below);

b) "Authorized Affiliate” means an Affiliate of Customer who has not signed an Order Form but acts as a Controller or Processor for the Personal Data processed by Orb pursuant to the Agreement, for so long as such entity remains a Customer Affiliate.

c) “Data Protection Law” means, to the extent applicable to the Processing of Personal Data by Orb in performing the Services, (i) the General Data Protection Regulation (EU) 2016/679 ("GDPR") and all other Data Protection Laws of the European Union, the European Economic Area (“EEA”), and their respective Member States, the New Federal Act on Data Protection (nFADP) for Switzerland (“Swiss DPA”) and in respect to the United Kingdom, UK GDPR (“UK GDPR”) (collectively, GDPR, Swiss DPA and UK GDPR, “European Data Protection Laws”); (ii) certain U.S. federal and state privacy laws, including the California Consumer Privacy Act (California Civil Code § 1798.100) (“CCPA”) as amended by the California Privacy Rights Act of 2020; the Virginia Consumer Data Protections Act (“VCDPA”), the Connecticut Data Privacy Act (“CTDPA”), the Colorado Privacy Act (“CPA”) and the Utah Consumer Privacy Act (“UCPA”) (collectively, CCPA, VCDPA, CTDPA, CPA and UCPA, “US Privacy Laws”); and (iii) all laws implementing or supplementing the foregoing;

d) “Restricted Data Transfer” means (i) where the GDPR applies, a transfer of Personal Data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission (an “EEA Restricted Transfer”); (ii) where the UK GDPR applies, a transfer of Personal Data from the UK to any other country which is not subject to adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018 (a “UK Restricted Transfer”); and (iii) where the Swiss DPA applies, a transfer of Personal Data to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protection and Information Commissioner (a “Swiss Restricted Transfer”).

e) “Personal Data” means any information that constitutes “personal data” or “personal information” within the meaning of applicable Data Protection Law that Orb may access in performing the Services under the Agreement.

f) “Personal Data Breach” means actual unauthorized destruction, loss, control, alteration, disclosure of, or access to, Personal Data for which Orb is responsible. Personal Data Breaches do not include unsuccessful access attempts or attacks that do not compromise the confidentiality, integrity, or availability of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

g) “Subprocessor” means a Processor engaged by Orb to carry out Processing on behalf of Customer;

h) “Standard Contractual Clauses” means the clauses annexed to the EU Commission Implementing Decision 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council as amended or replaced from time to time; and

i) “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner for parties making restricted transfers.

1.2 Capitalized terms used but not defined herein have the meaning given to them in the Agreement.

2. Roles

If Data Protection Law applies to the Processing of Personal Data, the parties agree that Orb shall process Personal Data only as a Processor acting on behalf of Customer and, with respect to CCPA and other applicable U.S. state privacy laws, as a service provider, in each case, regardless of whether Customer acts as a Controller or as a Processor on behalf of a third-party Controller with respect to Personal Data.

3. Scope

3.1 This DPA applies to Processing of Personal Data by Orb in the context of the Agreement.

3.2 The subject matter, nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects are set out in Annex I, which is an integral part of this DPA.

4. Instructions

4.1 It is the parties’ intent that Orb is a Service Provider, and Orb certifies that it will not (a) Sell or Share Personal Data; (b) retain, use, or disclose the Personal Data for any purpose other than for the specific purpose of providing the Services under the Agreement, including retaining, using, or disclosing the personal information for a commercial purpose other than the provision of the Services; or (c) retain, use, or disclose the Personal Data to any person other than as necessary to provide the Services or outside of the direct business relationship between the parties.

4.2 Customer’s instructions are documented in Annex I and the Order Form(s) and Agreement.

4.3 Customer may issue additional instructions to Orb as it deems necessary to comply with Data Protection Law. Such instructions must be provided to Orb in writing and acknowledged in writing by Orb as constituting instructions for purposes of this DPA, and Orb may charge a reasonable fee to comply with any such additional instructions. Orb will inform Customer without undue delay if Orb believes that a written instruction amending this DPA by Customer violates Data Protection Law.

5. Customer Responsibilities

Customer is responsible for the lawfulness of Personal Data processing under or in connection with the Services. Customer shall (i) have provided, and will continue to provide all notices and have obtained, and will continue to obtain, all consents, permissions and rights necessary under applicable Data Protection Law for Orb to lawfully process Personal Data for the purposes contemplated by the Agreement (including this DPA); (ii) make appropriate use of the Services to ensure a level of security appropriate to the particular content of the Personal Data; (iii) have complied with all Data Protection Law applicable to the collection of Personal Data and the transfer of such Personal Data to Orb and its Subprocessors; and (iv) ensure its processing instructions comply with applicable laws (including applicable Data Protection Law). Orb has no obligation to assess the contents or accuracy of Customer Personal Data, including to identify information subject to any specific legal, regulatory, or other requirement. Customer is responsible for making an independent determination as to whether its use of the Services will meet Customer’s requirements and legal obligations under Data Protection Laws.

6. Subprocessing

6.1 Orb will provide to Customer prior written notice to engage Subprocessors. Customer hereby authorizes Orb to engage the Subprocessors listed at https://www.withorb.com/terms/subprocessors.

6.2 Orb will inform Customer at least thirty (30) days prior to any intended change of Subprocessor, thereby giving Customer the opportunity to object to such change. Customer may only object to the addition or change of a Subprocessor based on reasonable grounds relating to a potential or actual violation of Data Protection Law by providing written notice detailing the grounds of such objection. Customer and Orb will work together in good faith to address Customer’s objection. If no such resolution can be reached, Orb will, at its sole discretion, either not appoint Subprocessor, or permit Customer (as Customer’s sole and exclusive remedy) to suspend or terminate the Services in accordance with the termination provisions in the Agreement without liability to either party (but without prejudice to any fees incurred by Customer prior to suspension or termination).

6.3 Orb will enter into a written agreement with all Subprocessors which imposes substantially similar obligations on the Subprocessors as this DPA imposes on Orb and remain responsible for each Subprocessor’s compliance with the obligations of this DPA and for any acts or omissions of the Subprocessor that cause Orb to breach any of its obligations under this DPA.

7. Jurisdiction Specific Terms

7.1 Restricted Data Transfers

a) To the extent required by GDPR, by agreeing to this DPA Customer and Orb conclude module 2 (Controller-to-Processor), where Customer is the Controller, or module 3 (Processor-to-Processor), where Customer is a Processor, of the Standard Contractual Clauses, which are hereby incorporated by reference and completed as follows: the “data exporter” is Customer; the “data importer” is Orb; the optional docking clause in Clause 7 is implemented for Authorized Affiliates only; Clause 9(a) option 2 is implemented and the time period therein is specified in Section 6.2 of this DPA; for Clause 9(c), where confidentiality restrictions prohibit Orb from providing a copy of the Subprocessor agreement to Customer, Orb shall provide, on a confidential basis, all information that it reasonably can in connection with such Subprocessor Agreement to Customer; the optional redress clause in Clause 11 is struck; Clause 13, (a) paragraph 2 is implemented; Clause 17 option 1 is implemented and the governing law is the law of the Republic of Ireland; the court in Clause 18(b) are the Courts of the Republic of Ireland; Annex 1, 2 and 3 to module 2 of the Standard Contractual Clauses are Annex I, II and III to this DPA respectively.

b) To the extent required by UK GDPR, by signing this DPA Customer and Orb agree to be bound by the UK Addendum. Part 1, table 1 of the UK Addendum will be deemed to be completed like its equivalent provisions in the Standard Contractual Clauses (module 2) and (module 3) in Annex I, Section 1. For the purpose of Part 1, Table 2 of the UK Addendum, the Approved EU SCCs are the Standard Contractual Clauses (module 2) or (module 3) incorporated by reference into this DPA pursuant to Section 7.1.a) of this DPA. For the purpose of Part 1, Table 3, Annex 1, 2 and 3 to the Standard Contractual Clauses (module 2) are Annex I, II and III to this DPA respectively. For the purpose of Part 1, Table 4, the party that may end the UK Addendum in accordance with Section 19 of the UK Addendum is the importer. For the purposes of any transfers covered by the Data Protection Law in the UK, the Standard Contractual Clauses (module 2) and (module 3) will be deemed to be amended as set out in Part 2 of the UK Addendum.

c) To the extent required by the Swiss DPA applies, the Standard Contractual Clauses shall apply in accordance with Section 7.1.a) above, but with the following modifications: (i) any references in the Standard Contractual Clauses to “Regulation (EU) 2016/679” shall be interpreted as references to the Swiss DPA and the equivalent articles or sections therein; (ii) any references to “EU,” “Union,” “Member State,” and “Member State law” shall be interpreted as references to Switzerland and Swiss law, as the case may be; (iii) any references to the “competent supervisory authority” and “competent courts” shall be interpreted as references to the relevant data protection authority and courts in Switzerland; and (iv)the Standard Contractual Clauses shall be governed by the laws of Switzerland and disputes shall be resolved before the competent Swiss courts.

7.2 Standard Contractual Clauses Precedence. It is not the intention of either party, nor the effect of this DPA, to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses. Accordingly, if and to the extent the Standard Contractual Clauses, as applicable, conflict with any provision of this DPA, the Standard Contractual Clauses shall prevail to the extent of such conflict.

7.3 US Privacy Laws. Orb shall comply with its applicable obligations under US Privacy Laws and shall provide the level of privacy protection required of US Privacy Laws. Orb will engage other Service Providers as detailed in Section 6 of this DPA pursuant to a written contract binding such Service Provider to observe the applicable requirements of US Privacy Laws.

8. Security and Personal Data Breaches

8.1 Orb will implement technical and organizational measures to protect Personal Data from Personal Data Breaches, such as:

a) encryption of Personal Data;

b) measures to ensure the ongoing confidentiality, integrity, availability, and resilience of Processing;

c) measures to detect Personal Data Breaches in a timely manner;

d) measures to restore the availability and access to Personal Data in a timely manner in the event of an incident;

e) regularly testing, assessing and evaluating the effectiveness of the security measures; and

f) as appropriate, the measures listed in Annex II.

8.2 Orb will inform Customer without undue delay after becoming aware of a Personal Data Breach. Orb will inform Customer to the extent possible, of the nature of the Personal Data Breach, the categories and number of Data Subjects, the categories and amount of Personal Data, the likely consequences of the Personal Data Breach, and the measures taken or proposed to be taken to address the Personal Data Breach and mitigate possible adverse effects.

8.3 Orb’s notification of or response to a Personal Data Breach under Section 8.2 will not be construed as an acknowledgement by Orb of any fault or liability with respect to the Personal Data Breach.

8.4 In the event of a Personal Data Breach, Customer is solely responsible for complying with all laws relating to investigation of such Personal Data Breaches and notification of affected individuals, regulators and other parties.

9. Assistance

9.1 To the extent that Customer is unable to independently access the Personal Data within the Service, Orb will reasonably assist Customer, including by implementing appropriate technical and organizational measures, with the fulfilment of Customer’s own obligations under Data Protection Law, including:

a) complying with Data Subjects’ requests to exercise data subject rights under Data Protection Law;

b) replying to inquiries or complaints from Data Subjects;

c) replying to investigations and inquiries from Supervisory Authorities;

d) conducting data protection impact assessments, and prior consultations with Supervisory Authorities; and

e) notifying Personal Data Breaches.

9.2 Unless prohibited by Data Protection Law, Orb will inform Customer as soon as reasonably practicable if Orb:

a) receives a request, complaint or other inquiry regarding the Processing of Personal Data from a Data Subject or Supervisory Authority;

b) receives a binding or non-binding request to disclose Personal Data from law enforcement, courts or any government body;

c) is subject to a legal obligation that requires Orb to Process Personal Data in contravention of Customer’s instructions; or

d) is otherwise unable to comply with Data Protection Law or this DPA.

9.3 Unless prohibited by Data Protection Law, Orb will obtain Customer’s written authorization before responding to, or complying with any requests, orders, or legal obligations referred to in Section 9.2.

10. Audit

Orb shall make available to Customer information to demonstrate compliance with the obligations set forth in this DPA as set forth in this Section 10. The exercise of the audit rights under the Standard Contractual Clauses shall be as described in this Section 10 and Customer agrees that these rights are carried out on behalf of Customer and any End Customer or other third-party Controller for who Customer is acting as Processor subject to the confidentiality restrictions of the Agreement.

10.1 If Customer’s requested audit scope is addressed in an SSAE 16/ISAE 3402 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within twelve (12) months of Customer’s audit request and Orb confirms there are no known material changes in the controls audited, Customer agrees to accept those findings in lieu of requesting an audit of the controls covered by the report. Such report shall be the Confidential Information of Orb. Such report may also be disclosed to Customer’s Supervisory Authority upon such Supervisory Authority’s request.

10.2 To the extent the report in Section 10.1 does not address Customer’s inquiries related to Processing of Personal Data or if requested by a Supervisory Authority, upon Customer’s prior written request, and no more than once in a calendar year during the term of the Agreement, Orb will make available to Customer the required written information reasonably necessary to demonstrate compliance with the obligations of Data Protection Law and this DPA.

10.3 If an audit pursuant to Section 10.2 takes place on-site, the audit must be conducted during regular business hours at the applicable facility, subject to an audit plan agreed to between the parties at least two weeks in advance and Orb’s health and safety or other relevant policies and may not unreasonably interfere with Orb’s business activities. If a third party is to conduct the audit, Orb may object to the auditor if the auditor is, in Orb’s reasonable opinion, not suitably qualified or independent, a competitor of Orb or otherwise manifestly unsuitable. Such objection by Orb will require Customer to appoint another auditor or conduct the audit itself. Any third-party auditor must enter into a non-disclosure agreement with Customer.

10.4 Any Customer-requested audits are at Customer’s expense. Customer shall reimburse Orb for any time expended by Orb or its Subprocessors in connection with any Customer-requested audits or inspections at Orb’s then-current professional services rates, which shall be made available to Customer upon request. Any third party auditor is at Customer’s full expense.

10.5 Customer may use the audit reports only for the purposes of meeting Customer’s regulatory audit requirements and/or compliance with the requirements of this DPA. The audit reports are confidential information of Orb under the terms of the Agreement.

11. Liability

The total combined liability of either party and its Affiliates towards the other party and its Affiliates, whether in contract, tort or any other theory of liability, under or in connection with Agreement and this DPA combined, will be limited to limitations on liability or other liability caps agreed to by the parties in the Agreement. For the avoidance of doubt, a Personal Data Breach is subject to the liability cap of the Agreement and is not an uncapped obligation.

12. Confidentiality

Orb will keep all Personal Data and all information relating to the Processing thereof, in strict confidence.

13. Analytics

Customer acknowledges and agrees that Orb may create and derive from Processing related to the Services anonymized and/or aggregated data that does not identify Customer or any natural person, and use, publicize or share with third parties such data to improve Orb’s products and services and for its other legitimate business purposes.

14. Term and Duration of Processing

On expiration or termination of the Agreement, or upon written request from Customer at any time, Orb will, as soon as reasonably practicable, return or securely delete and destroy all Personal Data in Orb’s possession or control, except as otherwise required by law or set out in the Agreement. For the avoidance of doubt, analytics as described under Section 13 above are not Personal Data.

15. Miscellaneous

This DPA may only be modified by a written amendment signed by both Customer and Orb. Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by Data Protection Laws.

Annex I

A. List of Parties

Customer is the Controller and the data exporter and Orb is the Processor and the data importer.

B. Description of Transfer

C. Competent Supervisory Authority

The competent supervisory authority is the Irish Data Protection Commission.

Annex II

Orb shall implement and maintain the controls listed in this Annex II in accordance with industry standards generally accepted by information security professionals as necessary to reasonably protect Personal Data during storage, processing and transmission.

Virtual access control

Technical and organizational measures to prevent data Processing systems from being used by unauthorized persons include (a) role-based access control requests and requirements for data systems, (b) monitoring and audit alarms of key datastores as well as configuration changes, (c) encryption of archived data media, (d) user identification and authentication procedures including the use of firewalls and secure (virtual) key access.

Data access control

Technical and organizational measures to ensure that persons entitled to use a data Processing system gain access only to such Personal Data in accordance with their access rights, and that Personal Data cannot be read, copied, modified or deleted without authorization, include: (a) internal policies and procedures; (b) control authorization schemes; (c) differentiated access rights (profiles, roles, transactions and objects); (d) monitoring and logging of accesses; (e) disciplinary action against employees who access Personal Data without authorization; (f) reports of access; (g) access procedure; (h) change procedure; (i) deletion procedure; and (j) encryption.

Disclosure control

Technical and organizational measures to ensure that Personal Data cannot be read, copied, modified or deleted without authorization during electronic transmission, transport or storage on storage media (manual or electronic), and that it can be verified to which companies or other legal entities Personal Data are disclosed, include: (a) encryption/tunneling; (b) logging; and (c) transport security.

Entry control

Technical and organizational measures to monitor whether Personal Data have been entered, changed or removed (deleted), and by whom, from data Processing systems, include: (a) logging and reporting systems; and (b) audit trails and documentation.

Control of instructions

Technical and organizational measures to ensure that Personal Data are Processed solely in accordance with the instructions of the Controller include: (a) unambiguous wording of the contract; (b) formal commissioning (request form); and (c) criteria for selecting the Processor.

Availability control

Technical and organizational measures to ensure that Personal Data are protected against accidental destruction or loss (physical/logical) include: (a) backup procedures; (b) mirroring of hard disks (e.g. RAID technology); (c) uninterruptible power supply (UPS); (d) remote storage; (e) antivirus/firewall systems; and (f) disaster recovery plan.

Separation control

Technical and organizational measures to ensure that Personal Data collected for different purposes can be Processed separately include: (a) separation of databases; (b) “internal client” concept / limitation of use; (c) segregation of functions (production/testing); and (d) procedures for storage, amendment, deletion, transmission of data for different purposes.

Annex III

List of Subprocessors

The list of Subprocessors authorized by Customer pursuant to Section 6.1 is available at https://www.withorb.com/terms/subprocessors.