1. Scope
This Data Processing Addendum (“DPA”) supplements the Master Agreement between Orgainse Pvt. Ltd. (“Processor”) and Customer (“Controller”) and governs the processing of Personal Data by Orgainse in the course of providing the ORQYNE service.
2. Roles
- Controller — Customer, who determines the purposes and means of processing
- Processor — Orgainse, who processes Personal Data only on documented instructions from the Controller
- Sub-processors — third parties Orgainse engages under contractual flow-down terms (current list available on request)
3. Processing details
- Nature — provision of the ORQYNE PMaaS platform
- Purpose — workflow management, AI-assisted project execution, analytics
- Duration — the term of the Master Agreement + statutory retention
- Data subjects — Customer employees, contractors, project stakeholders
- Categories — names, work emails, role data, project content the Customer uploads
4. Processor obligations
- Process Personal Data only on documented Controller instructions
- Ensure all personnel are bound by confidentiality obligations
- Implement appropriate technical and organisational measures (Annex II below)
- Assist the Controller with data-subject requests within 10 business days
- Notify the Controller of a personal-data breach without undue delay (≤ 72 hours)
- Delete or return Personal Data at the end of services, per Controller choice
- Make available all information necessary to demonstrate compliance and allow audits
5. Sub-processors
Customer authorises Orgainse to engage sub-processors listed in our current sub-processor registry. Orgainse will notify Customer of any intended changes at least 30 days in advance, giving Customer the opportunity to object on reasonable grounds.
6. International transfers
Where Personal Data is transferred outside the EEA/UK/India, transfers are protected by Standard Contractual Clauses (SCCs) 2021/914, the UK Addendum, and (where applicable) the EU-US Data Privacy Framework. Customer-specific transfer impact assessments are available on request.
Annex II — Security measures
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Role-based access control with least-privilege defaults; MFA enforced on admin paths
- Quarterly access reviews and immutable audit logging
- Network isolation via VPC + private service connect
- Annual penetration testing by an independent third party
- SOC2 Type II programme; report available under NDA
- Backup retention 35 days; tested disaster recovery procedures
- Vendor risk management for every sub-processor
Governing law
This document is governed by the laws of India for engagements originating from the Corporate Office in Bengaluru, and by the laws of the State of Texas, USA for engagements originating from the Headquarters in Austin. Forum selection follows the engagement origin.
Contact for legal matters
For any legal notice, data-subject request, or compliance enquiry related to this document, contact support@orgainse.com with the relevant subject line (“Privacy”, “DPA Request”, “SLA Claim”, “Cookie Preferences”, etc.).