Data processing terms
These data processing terms ("DPA") form part of the Terms of sale and service between Orbix Technologies Ltd, trading as Tapqora, a private company limited by shares registered in England and Wales under company number 16973554, whose registered office is at 437–441 Coventry Road, Small Heath, Birmingham B10 0TH, United Kingdom ("Processor") and each Tapqora account holder or team owner ("Controller"). They apply to personal data that visitors share with the Controller through Tapqora profiles and to team members' data managed by a team owner ("Controller Data"), and meet Article 28 of the UK GDPR and EU GDPR.
1. Subject matter, duration, nature and purpose
The Processor hosts, stores, displays, exports and transmits Controller Data to provide the Service, for the duration of the Controller's account and the deletion period below.
2. Types of data and data subjects
- Data subjects: people who share their details through the Controller's profile; the Controller's team members.
- Types of data: name, email, phone, company, LinkedIn profile, message, event tag, notes the Controller adds, and team membership and activity data.
- No special category data is intended to be processed; the Controller must not request it.
3. Processor obligations
The Processor will:
- process Controller Data only on the Controller's documented instructions, which are these Terms and the Controller's use of the Service, unless required by law (in which case it will tell the Controller first unless legally prohibited);
- ensure everyone authorised to process Controller Data is bound by confidentiality;
- implement appropriate technical and organisational security measures, including encryption in transit, access controls, row-level security and logging;
- notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Controller Data, with the information reasonably available;
- assist the Controller, taking into account the nature of processing, with data subject requests, security, breach notification, data protection impact assessments and prior consultation;
- make available the information necessary to demonstrate compliance with this DPA and allow for reasonable audits, on at least 30 days' written notice, no more than once a year, at the Controller's cost, subject to confidentiality;
- on termination, delete Controller Data within 30 days (the Controller can export it beforehand from the dashboard), unless the law requires storage.
4. Sub-processors
The Controller authorises the Processor to use the sub-processors listed in section 5 of the Privacy policy (Supabase, Cloudflare, Resend and, for exports the Controller triggers, the destination the Controller chooses). The Processor will impose data protection terms on each sub-processor that are no less protective than this DPA, remains liable for their performance, and will give at least 14 days' notice of new sub-processors by email or on this page, during which the Controller may object and, if the objection cannot be resolved, close its account.
5. International transfers
Where Controller Data is transferred outside the UK or EEA, the Processor will rely on an adequacy decision or on the UK International Data Transfer Agreement / Addendum or EU Standard Contractual Clauses.
6. Controller obligations
The Controller is responsible for having a lawful basis to collect and use Controller Data, for giving data subjects the information the law requires, for the lawfulness of its instructions and integrations (including webhooks it configures), and for not using Controller Data for unsolicited marketing without the consent required by law.
7. Liability and precedence
Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow it. If this DPA conflicts with the Terms, this DPA prevails for the processing of Controller Data.