Orbital
فارسی

Data Processing Agreement

Last updated: July 2026. This is a standard draft template — have it reviewed by qualified counsel before relying on it.

1. Purpose

This Data Processing Agreement ("DPA") describes how Orbital processes personal data on behalf of a client ("Controller") in the course of delivering a website, platform, or agent workflow build, where Orbital acts as a data processor.

2. Roles

The client is the data controller for any end-user personal data flowing through a system we build or operate for them (for example, a client's own customers submitting a checkout or lead form). Orbital acts as the processor for that data and as an independent controller only for data collected directly through orbitalwebstudio.com (see our [Privacy Policy](/legal/privacy)).

3. Scope of processing

Processing is limited to what is necessary to build, host, and operate the agreed system: storing submitted records, triggering the automations specified in the project scope, and providing the client access to their own data.

4. Subprocessors

We rely on the following categories of subprocessor, engaged strictly to operate the infrastructure described in a project's statement of work:

  • Cloudflare — hosting, edge compute, database, and storage.
  • Email delivery provider — transactional and consented marketing email.
  • SMS delivery provider — consented SMS notifications, where enabled.
  • Scheduling provider — call booking, where enabled.

An up-to-date, named subprocessor list is available on request.

5. Security measures

Orbital applies the technical and organizational measures described in our [Security page](/legal/security), and requires subprocessors to maintain security measures appropriate to the data they handle.

6. Data subject requests

Orbital will assist the Controller in responding to data subject access, correction, and deletion requests relating to data we process on their behalf, within a reasonable time.

7. Data deletion

On termination of an engagement, Orbital will delete or return controller data within a reasonable period, except where retention is required by law.

8. International transfers

Where personal data is transferred across borders as part of hosting or delivery infrastructure, we rely on our subprocessors' published data-transfer safeguards.

9. Contact

Questions about this DPA, or requests for the current subprocessor list, can be sent to hello@orbitalwebstudio.com.