This Data Processing Agreement ("DPA") forms part of the agreement between the customer organization (the "Controller") and Coborax ApS, c/o Innovation Solutions ApS, [address], CVR [CVR number], Denmark (the "Processor") regarding the Orbit platform, pursuant to GDPR article 28.
1. Subject matter and duration
The Processor processes personal data on behalf of the Controller as necessary to provide the Orbit platform, for the duration of the subscription plus the wind-down period in section 9.
2. Nature, purpose, and categories
- Purpose: workforce administration — HR records, recruiting, compliance, scheduling, project and asset management.
- Data subjects: the Controller's employees, candidates, and contractors.
- Categories of data: identification and contact details, employment data (role, hire date, competences, certificates), emergency contacts, bank details, passport and visa details, and — where the Controller records them — special categories such as health information (e.g. medical notes). Especially sensitive fields are encrypted at the column level in addition to encryption at rest.
3. Instructions
The Processor processes personal data only on documented instructions from the Controller — the agreement, the Controller's configuration and use of the platform — unless required by EU or Danish law, in which case the Processor informs the Controller before processing, unless the law prohibits it.
4. Confidentiality and security (art. 32)
- Persons authorized to process the data are bound by confidentiality.
- Encryption in transit (TLS) and at rest; column-level encryption for especially sensitive HR fields.
- Role-based access control and tenant isolation; access to HR records is restricted to the data subject and the Controller's owners/admins.
- Logging, backups, and documented change management.
5. Sub-processors
The Controller grants general authorization to use sub-processors. The current list: Amazon Web Services (hosting, EU region), Stripe (payment processing — billing contacts only), and the email delivery provider stated in the platform documentation. The Processor notifies the Controller of intended changes at least 30 days in advance, giving the Controller the opportunity to object. Sub-processors are bound by equivalent data protection obligations.
6. Transfers to third countries
Personal data is hosted in the EU. If a sub-processor processes data outside the EU/EEA, the transfer rests on the EU Commission's Standard Contractual Clauses or an adequacy decision.
7. Assistance
Taking into account the nature of the processing, the Processor assists the Controller with responses to data subject requests and with the Controller's obligations under GDPR articles 32–36, including via the platform's built-in export and deletion capabilities.
8. Personal data breaches
The Processor notifies the Controller without undue delay after becoming aware of a personal data breach, with the information required for the Controller's notification duties under articles 33–34.
9. Deletion and return
Upon termination, the Controller may export its data within 30 days. Thereafter the Processor deletes personal data processed on the Controller's behalf, unless EU or Danish law requires continued storage.
10. Audits
The Processor makes available the information necessary to demonstrate compliance with article 28 and allows for audits — including inspections — conducted by the Controller or an auditor mandated by the Controller, with reasonable notice, during business hours, and at the Controller's expense.
11. Governing law
This DPA is governed by Danish law and follows the term of the main agreement.