Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Diverse AS (org. nr. 937 775 466), Friis' gate 4, 0187 Oslo, Norway (“Orden”, the “Processor”) and the business customer (the “Controller”), and applies whenever you use Orden to process personal data on behalf of your business. It implements Article 28 of the GDPR. No signature is required — the DPA applies automatically to every business account.

Subject matter and duration

Orden processes personal data on the Controller's behalf for the duration of the customer relationship, solely to provide the service described in the Terms: collecting, storing, parsing, and displaying invoices and receipts from the vendor accounts and inboxes the Controller connects.

Nature of the data

• Data subjects:the Controller's users (employees/team members) and, incidentally, individuals appearing in invoices and receipts (e.g. contact persons at vendors).
• Categories of data: names, email addresses, invoice and receipt contents (amounts, dates, vendor details, line items), vendor session tokens, and Gmail message metadata where the Controller connects an inbox.
• No special categories (Art. 9) are intentionally processed.

Processor obligations

Orden shall:

• process personal data only on the Controller's documented instructions — in practice, the instructions embodied in the service itself and the Controller's configuration of it;
• ensure persons authorised to process the data are bound by confidentiality;
• implement appropriate technical and organisational measures (encryption in transit and at rest, per-user row-level access control, encrypted credential storage — see the Privacy Policy Security section);
• assist the Controller in responding to data-subject requests (access, erasure, portability) and in meeting its Art. 32–36 obligations, taking into account the nature of the processing;
• notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data;
• delete the Controller's personal data on account deletion as described in the Privacy Policy (30 days from primary systems, 90 days from backups), unless law requires retention;
• make available the information reasonably necessary to demonstrate compliance with Art. 28, and allow for audits by the Controller or its mandated auditor, at the Controller's expense and with reasonable notice.

Sub-processors

The Controller gives general authorisation for the sub-processors listed in the Privacy Policy (“Who we share data with”): Supabase, Vercel, Google, OpenAI, Stripe, Resend, and — for consented analytics only — PostHog. Orden will update that list before adding or replacing a sub-processor; if the Controller objects on reasonable data-protection grounds and no resolution is found, the Controller may terminate the affected service. Each sub-processor is bound by data-protection obligations equivalent to this DPA.

International transfers

Primary storage is in the United Kingdom (adequacy decision). Where a sub-processor processes data outside the EU/EEA/UK (OpenAI, Stripe, Vercel, Google), transfers rely on the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses, as set out in the Privacy Policy.

Contact

Questions about this DPA: hello@ordenapp.no.