Data processing agreement
1. Parties, scope and status
This agreement sets out data processing terms between the business customer named in an OrsunPay service agreement (the “Customer”) and Orsun Tech OÜ, registry code 17418287, Sepapaja tn 6, Lasnamäe linnaosa, Tallinn, Harju maakond, 15551, Estonia (“OrsunPay”). It becomes binding only when incorporated into an agreement accepted by both parties, with its processing and security schedules completed.
For the processing covered here, the Customer determines the purposes and essential means and OrsunPay processes personal data on the Customer’s behalf. Where the Customer is itself a processor, it must have its controller’s authority to appoint OrsunPay. Processing for OrsunPay’s own website, business contact and account-administration purposes is described in the privacy notice.
“Personal data”, “controller”, “processor” and related terms have the meanings given by applicable data protection law, including the GDPR where it applies. This DPA takes priority over conflicting service terms on the processing it covers; mandatory transfer clauses take priority where applicable.
2. Processing description
| Item | Processing scope |
|---|---|
| Subject matter | Personal data handled through the Customer’s agreed payment orchestration services and related support. |
| Nature of operations | Receiving, recording, organising, retrieving, transmitting and displaying records; acting on routing and operational instructions; troubleshooting; and returning or deleting data. |
| Purposes | Operate configured payment workflows, exchange information with selected providers, maintain transaction and webhook records, provide authorised access and investigate service issues. |
| Individuals | The Customer’s buyers and other payment participants, and the Customer’s authorised users or representatives where processed on its instructions. |
| Data categories | Customer and transaction references, contact details where supplied, amounts and currencies, payment and refund statuses, provider references, tokenised or masked payment-method information, technical connection data and relevant support material. The final schedule must reflect the actual integration. |
| Duration and frequency | During service use and the agreed return or deletion period; continuous or event-driven processing according to the features used. |
| Sensitive data | Special-category data, criminal-offence data and full payment credentials are outside this general description unless a separate written scope and appropriate controls expressly cover them. |
3. Instructions and Customer responsibilities
The service agreement, completed schedules, authorised settings and documented API requests form the Customer’s instructions. OrsunPay will process covered data only on those instructions, including instructions concerning transfers, unless applicable law requires otherwise. It will inform the Customer of a legal requirement before processing unless the law prohibits that notice.
The Customer must provide lawful instructions, necessary privacy information and a valid basis for the collection and processing it requests. It must limit supplied data to what the service needs and maintain appropriate account permissions. OrsunPay will inform the Customer if it considers an instruction to infringe applicable data protection law and may pause the affected processing while the issue is resolved.
4. Confidentiality and security
OrsunPay will restrict access to authorised people with a need to perform the service and ensure they are subject to confidentiality duties. It will maintain technical and organisational measures appropriate to the nature of the data and the risks of processing.
The security schedule must document access control, authentication, encryption arrangements, separation of customer environments, logging, incident handling, backup and recovery, deletion and the process for assessing these measures. It must distinguish deployed controls from planned controls and identify the applicable service scope. No audit certification or security attestation is incorporated merely by publishing this agreement.
5. Sub-processors
OrsunPay may appoint sub-processors only with the Customer’s prior specific or general written authorisation. The final authorised schedule will identify the legal entity, function and relevant processing locations. The supplier register is supporting information and includes website suppliers and arrangements under review; inclusion alone is not customer authorisation.
For general authorisation, OrsunPay will give advance written notice of intended additions or replacements and allow the Customer a meaningful opportunity to object on data protection grounds before the new processing starts. The executed schedule must specify the notice period, delivery channel and resolution procedure. If an objection cannot be resolved, the parties will agree a lawful alternative or end the affected service under their contract.
OrsunPay will impose the applicable data protection obligations on each sub-processor by contract and remains responsible for the sub-processor’s performance of those obligations as required by law.
6. Assistance and personal data breaches
Taking account of the processing and information available to it, OrsunPay will assist the Customer with individual rights requests, security obligations, impact assessments and consultations with competent authorities. If it receives a request concerning the Customer’s data, it will notify the Customer and will not respond substantively except on instruction or where legally required.
OrsunPay will notify the Customer without undue delay after becoming aware of a personal data breach affecting covered data. Available information will describe the incident, affected data and individuals, likely consequences, mitigation and a contact for follow-up. Information may be supplied in stages as the investigation develops. OrsunPay will cooperate with the Customer’s response; the Customer remains responsible for notifications for which it is legally accountable.
7. International transfers
Before processing involves a restricted transfer, the parties must identify the exporter, importer, destinations and appropriate transfer mechanism. Where relevant, this includes an applicable adequacy decision or completed standard contractual clauses with the correct module, annexes and supplementary measures. UK or Swiss requirements must be addressed when applicable.
A link to a supplier’s DPA does not by itself complete the Customer’s transfer documentation. The executed schedule must include the actual arrangements, including remote access and onward transfers.
8. Return, deletion and retention
At the end of processing, OrsunPay will, at the Customer’s choice, return or delete covered personal data and delete remaining copies unless applicable law requires retention. The parties must agree the export format, request process, completion period and backup expiry in the processing schedule.
Where retention is legally required, OrsunPay will identify the requirement where permitted, restrict the retained data to that purpose and delete it when the obligation ends. Backup copies awaiting scheduled expiry must remain protected and unavailable for ordinary use. OrsunPay will provide confirmation of completion on request.
9. Information and audits
OrsunPay will make available information needed to demonstrate compliance with its processor obligations and allow and contribute to audits, including inspections by the Customer or its mandated auditor. The parties will coordinate reasonable notice, confidentiality and measures protecting other customers’ information. Practical arrangements must not prevent an audit required by law or a competent authority.
10. Completing the agreement
Before execution, the parties must complete the service-specific data categories, processing locations, approved sub-processors, transfer documents, security measures, retention and return arrangements, notification contacts and supplier-change procedure. Liability and governing-law provisions follow the executed service agreement to the extent lawful; nothing here removes an individual’s statutory rights. Contract and DPA enquiries can be submitted through Contact.