Data processing agreement
Last updated: 14 November 2026. This agreement forms part of the Orgbright terms of service and meets UK GDPR Article 28.
1. Parties and roles
The customer is the controller and Ironbit Ltd (NI729290) is the processor of personal data processed through Orgbright.
2. Details of processing
| Subject matter | Showing the customer's staff an org chart and directory built from the customer's Google Workspace™ directory |
|---|---|
| Duration | For the term of the customer's use of Orgbright, plus the deletion periods in the privacy policy |
| Data subjects | The customer's Google Workspace™ users |
| Personal data | Directory profile fields (name, email, job title, department, location, work phone, photo address, organisational unit, manager); administrator emails in the activity log |
| Special category data | None intended |
| Nature of processing | Reading, temporary caching for up to 10 minutes, displaying to the customer's own users and, only if the customer turns on editing, writing values the customer's admins enter into the customer's own Google directory |
3. Processor obligations
- Process personal data only on the customer's documented instructions, which are these terms and the customer's configuration of Orgbright.
- Ensure everyone with access is bound by confidentiality.
- Apply appropriate technical and organisational security measures, including encryption in transit and at rest and least-privilege access.
- Use only the sub-processors listed in the privacy policy, give 30 days' notice before adding one, and let the customer object. Each sub-processor is bound by equivalent terms.
- Help the customer respond to data subject requests and with data protection impact assessments, where reasonable.
- Notify the customer without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach.
- At the end of the service, delete customer personal data as set out in the privacy policy, unless law requires retention.
- Make available information needed to demonstrate compliance and allow reasonable audits, normally by questionnaire, on 30 days' notice.
4. International transfers
Where personal data is transferred outside the UK, it is protected by UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.