Data Processing Agreement

Last updated: 12 August 2026

This Data Processing Agreement ("DPA") applies where Orbi Hosting ("Processor") processes personal data on behalf of a customer ("Controller") in the course of providing the Services, and forms part of our Terms of Service. It is designed to help meet the requirements of Article 28 of the UK GDPR. If you are a business customer who needs a signed DPA, contact [Company Email].

1. Roles and scope

For customer content that contains personal data and which we process on your instructions (for example data stored on your hosting or in your applications), you are the Controller and we are the Processor. For our own account, billing and security purposes we are a Controller in our own right, as described in our Privacy Policy.

2. Our obligations as Processor

• We process personal data only on your documented instructions, including as set out in the Terms and as needed to provide the Services, unless required by law.
• We ensure that persons authorised to process the data are bound by confidentiality.
• We implement appropriate technical and organisational security measures.
• We assist you, taking into account the nature of processing, with data-subject requests and with your obligations around security, breach notification and data protection impact assessments.
• We notify you without undue delay after becoming aware of a personal data breach affecting your data.
• On termination, we delete or return personal data as you choose, save where retention is required by law.
• We make available information necessary to demonstrate compliance and allow for reasonable audits.

3. Sub-processors

You give general authorisation for us to engage sub-processors (for example infrastructure, control-panel, email and payment providers) to deliver the Services. We impose data-protection obligations on our sub-processors that are consistent with this DPA, and we remain responsible for their performance. We will inform you of intended changes to sub-processors where required so you can object.

4. International transfers

Where processing involves transferring personal data outside the UK, we put in place an appropriate transfer mechanism (such as the UK International Data Transfer Agreement or Standard Contractual Clauses).

5. Details of processing

• Subject matter & duration: provision of the Services for the term of the agreement.
• Nature & purpose: hosting, storage, transmission and processing as required to deliver the Services.
• Types of data & data subjects: as determined by the Controller through its use of the Services.

6. Contact

Data protection queries can be sent to [Company Email].