Data Processing Agreement

1. Scope and roles

The Customer decides why and how personal data in its workspace is processed and acts as controller. Ombric processes that personal data only to provide the Service, as processor (or “service provider”, where that term is used by applicable law).

2. Details of the processing

• Subject matter: hosting and processing of Customer Data in the Service.
• Duration: the subscription term, plus the deletion period described in section 9.
• Nature and purpose: storing procedures and checklists, recording completion, keeping history, sending reminders and producing reports.
• Categories of data subjects: the Customer’s Users and any people mentioned in Customer Data.
• Categories of personal data: names, email addresses, roles, sites, initials, time stamps of actions, photos and notes added to checklists, and technical data such as IP addresses and device information.
• Special categories: none are required by the Service. The Customer should not use it to record such data.

3. Instructions

Ombric processes personal data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use of the Service’s settings. Ombric will inform the Customer if it believes an instruction breaks applicable data protection law. Ombric does not sell Customer personal data and does not use it for any purpose other than providing the Service.

4. Confidentiality

Ombric ensures that people authorized to process personal data are bound by confidentiality obligations.

5. Security

Ombric maintains technical and organizational measures appropriate to the risk, including encrypted connections (HTTPS), password-protected accounts, role-based access within the Service, restricted internal access, and backups held with its hosting provider.

6. Sub-processors

The Customer gives general authorization for Ombric to use sub-processors, such as its hosting provider and email delivery provider, to provide the Service. The current list is available on request at contact@ombricllc.com.

Ombric will give the Customer notice of a new sub-processor before it begins processing Customer personal data. The Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Customer may terminate the affected part of the Service.

Ombric imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for them.

7. Assistance

Taking into account the nature of the processing, Ombric will help the Customer respond to requests from data subjects and meet its obligations on security, breach notification and data protection impact assessments, using the functions of the Service where possible.

8. Personal data breaches

Ombric will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, and will provide the information reasonably available to help the Customer meet its own obligations.

9. Return and deletion

At the end of the subscription, the Customer may request a copy of its Customer Data within 30 days. Ombric then deletes Customer personal data from the Service within a further 60 days, and from backups as they expire on their normal cycle, unless the law requires it to be kept.

10. Information requests

Ombric will make available the information reasonably necessary to show that it meets its obligations under this DPA, by answering written questions from the Customer, no more than once a year unless a breach or a regulator requires it.

11. International transfers

Ombric is based in the United States. Where the Customer is subject to rules that restrict transfers of personal data to the United States, the parties will rely on an appropriate transfer mechanism, such as standard contractual clauses, which Ombric will sign on request.

12. Order of precedence

If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails. Governing law and courts are as set out in the Terms.