Data Processing Addendum
Draft pending attorney review. Do not rely on this version.
This Data Processing Addendum (the "DPA") forms part of the Terms of Service between Orbit Pool Software ("Orbit") and the company that holds an Orbit account (the "Customer"). It applies whenever Orbit processes personal information contained in Customer Data on the Customer's behalf. Capitalized terms not defined here have the meaning given in the Terms.
1. Roles
The Customer decides what Customer Data to enter into the Service and why. For the personal information in Customer Data, the Customer is the business (or controller) and Orbit is the service provider (or processor). Orbit processes that personal information only to provide the Service as described in the Terms and this DPA.
2. What is processed
- Whose information: the Customer's clients (pool owners, property managers and HOA contacts), the Customer's technicians, supervisors and office users.
- What information: names, service addresses, phone numbers, email addresses, gate codes and site access notes, pool and equipment details, service history, chemical readings and doses, photos, quotes, invoices and payment status, time clock entries and odometer readings.
- Purpose: building routes, recording service visits, producing documents, invoicing and payment processing, reporting and support, each at the Customer's direction.
- Duration: for as long as the Customer's account exists, then as described in Section 8.
3. Orbit's obligations
Orbit will:
- process personal information only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use of the Service, unless required by law;
- not sell personal information, not share it for cross-context behavioral advertising, not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service, and not combine it with personal information received from other sources except as permitted for a service provider under applicable law;
- ensure that the people who process personal information are bound by confidentiality obligations;
- notify the Customer if Orbit determines it can no longer meet its obligations under applicable privacy law, and allow the Customer to take reasonable steps to stop and remediate unauthorized use;
- assist the Customer, by appropriate technical and organizational measures and at the Customer's reasonable request, in responding to requests from individuals to access, correct or delete their personal information.
4. Security
Orbit maintains the technical and organizational measures described on the Security page, including: encryption of data in transit and at rest; isolation of each company's data by access rules enforced in the database; role-based access for owners, supervisors and technicians; server-side storage of integration credentials; and an audit log of changes. Orbit may update these measures provided the overall level of protection does not decrease.
5. Subprocessors
The Customer authorizes Orbit to use the following subprocessors to provide the Service:
- Supabase, Inc.: database, file storage and authentication, hosted on Amazon Web Services in the United States.
- Stripe, Inc.: subscription billing and, where the Customer enables it, card payments from the Customer's clients.
- Resend, Inc.: transactional email delivery.
- Google LLC (Google Maps Platform): geocoding of service addresses and route maps.
- Functional Software, Inc. (Sentry): error monitoring, with company identifiers stripped from reports.
- Netlify, Inc.: hosting of the dashboard and website.
- PostHog, Inc.: product usage events (screens used, setup progress) tied to user, company and role; no record contents.
- Intuit Inc. (QuickBooks Online): only where the Customer connects its own QuickBooks company file.
Orbit will give account owners at least 30 days' notice by email before adding a subprocessor that will process personal information. If the Customer objects on reasonable data protection grounds and Orbit cannot resolve the objection, the Customer may terminate the affected service and receive a refund of any prepaid fees for the remainder of the billing month.
6. Security incidents
If Orbit becomes aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal information processed for the Customer, Orbit will notify the account owner without undue delay, and in any case within 72 hours of confirming the breach, with the information Orbit has at the time and updates as the investigation proceeds. Orbit's notice is not an admission of fault.
7. Audits
On the Customer's written request no more than once per year, Orbit will provide a written description of its security measures and answer reasonable questions about its processing of personal information. Where applicable law gives the Customer a right to audit, the parties will agree a reasonable scope, timing and confidentiality terms in advance.
8. Return and deletion
While the account exists, the Customer can export its records and photos as described on the Security page or by request to support. When the account is deleted, whether at the Customer's request or under the retention rules in the Terms, Orbit deletes the Customer's personal information within 30 days, except for records Orbit must keep for tax, accounting or legal reasons, which are kept only as long as required and remain subject to this DPA.
9. Location of processing
Orbit processes and stores personal information in the United States. The Service is offered to businesses in the United States.
10. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms.
11. Term and precedence
This DPA applies for as long as Orbit processes personal information for the Customer. If this DPA conflicts with the Terms on the processing of personal information, this DPA controls.
12. Contact
Orbit Pool Software
Email: support@orbitpoolsoftware.com