Data Processing Addendum
ORCHIMATE DATA PROCESSING ADDENDUM
Version: July 2026.
This Data Processing Addendum (this "DPA") forms part of the Orchimate Terms of Service (the "Terms") between Atomic Wire Technology Limited ("Atomic Wire", "we", "us", "our") and you (the "Customer") and applies to Atomic Wire's processing of Personal Data on Customer's behalf in connection with Orchimate. Capitalised terms used but not defined in this DPA have the meanings given in the Terms.
1. Definitions and Interpretation
1.1 In this DPA, unless the context otherwise requires:
"Applicable Data Protection Law" means (a) the UK GDPR, the UK Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, in each case as amended and in force from time to time; and (b) EU Regulation 2016/679 (the EU General Data Protection Regulation);
"Customer Personal Data" means Personal Data processed by Atomic Wire on behalf of Customer in connection with Orchimate;
"Data Subject", "Personal Data", "Personal Data Breach", "processing" and "Supervisory Authority" have the meanings given in Applicable Data Protection Law;
"Sub-processor" means any third party engaged by Atomic Wire to process Customer Personal Data on its behalf; and
"Sub-processor List" means the list of Sub-processors published by Atomic Wire at https://orchimate.org/legal/subprocessors.
1.2 The terms "Controller" and "Processor" have the meanings given in Applicable Data Protection Law. Clause 13 of the Terms describes which role Atomic Wire acts in for particular processing activities.
1.3 "Customer" in this DPA has the same meaning as "you" and "User" in the Terms.
2. Scope and Roles
2.1 This DPA applies to Atomic Wire's processing of Customer Personal Data where Atomic Wire acts as Processor on Customer's behalf, as contemplated by Clause 13.3 of the Terms.
2.2 Where Atomic Wire acts as an independent Controller as described in Clause 13.4 of the Terms, that processing is not subject to this DPA but is governed directly by the Terms and the Orchimate Privacy Policy.
2.3 The subject matter, duration, nature, purpose, types of Personal Data and categories of Data Subjects for Atomic Wire's processing as Processor are set out in Schedule 1.
3. Processing Instructions
3.1 Atomic Wire shall process Customer Personal Data only on Customer's documented instructions. Customer's instructions comprise (a) the Terms, this DPA and any Order Form, (b) Customer's use of Orchimate through its features and functionality, and (c) any further instructions Customer gives in writing that are consistent with the foregoing.
3.2 Atomic Wire shall inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. Atomic Wire is not required to conduct a legal review of Customer's instructions.
3.3 Atomic Wire may process Customer Personal Data as required by law, in which case it will inform Customer of the requirement before processing, unless prohibited from doing so by law.
4. Compliance
4.1 Each party shall comply with its obligations under Applicable Data Protection Law in connection with the processing of Customer Personal Data.
4.2 Customer warrants that (a) it has a lawful basis for the collection, use and disclosure of Customer Personal Data (including its publication via Orchimate), (b) it has provided all notices and obtained all consents required by Applicable Data Protection Law, and (c) its instructions to Atomic Wire will not cause Atomic Wire to breach Applicable Data Protection Law.
5. Security
5.1 Atomic Wire shall implement and maintain the technical and organisational measures set out in Schedule 2 to protect Customer Personal Data against Personal Data Breaches.
5.2 Atomic Wire may update the measures in Schedule 2 from time to time provided that any updates do not materially reduce the overall level of protection.
5.3 Atomic Wire shall ensure that its personnel who have access to Customer Personal Data are bound by obligations of confidentiality, and that access is limited to persons with a legitimate need to process it.
6. Sub-processors
6.1 Customer generally authorises Atomic Wire to engage Sub-processors to process Customer Personal Data, subject to this Clause 6.
6.2 Atomic Wire shall (a) maintain the current list of Sub-processors on the Sub-processor List, (b) impose data-protection terms on each Sub-processor that are no less protective than those in this DPA, and (c) remain fully liable to Customer for the acts and omissions of any Sub-processor as if they were its own.
6.3 Atomic Wire shall give Customer not less than 30 days' notice (which may be given by updating the Sub-processor List) before engaging any new Sub-processor. Customer may object to a proposed new Sub-processor on reasonable data-protection grounds within that period, in which case the parties shall discuss the objection in good faith. If Atomic Wire cannot accommodate Customer's objection, Customer may, as its sole remedy, terminate its use of Orchimate to the extent affected by that Sub-processor and receive a pro-rata refund of any prepaid Fees for the unused portion of any subscription term.
7. Data Subject Rights
7.1 Taking into account the nature of the processing, Atomic Wire shall provide reasonable assistance to Customer in responding to requests from Data Subjects to exercise rights under Applicable Data Protection Law.
7.2 Where Atomic Wire receives a request from a Data Subject relating to Customer Personal Data, it shall forward the request to Customer without undue delay and shall not respond to it directly, save to acknowledge receipt or to direct the Data Subject to Customer.
8. Personal Data Breaches
8.1 Atomic Wire shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.
8.2 The notification shall include, to the extent then known: the nature of the Personal Data Breach; the categories and approximate number of Data Subjects and Personal Data records concerned; the likely consequences; and the measures taken or proposed to address it and mitigate its adverse effects.
8.3 Atomic Wire shall provide reasonable assistance to Customer in Customer's own compliance with its obligations under Applicable Data Protection Law in respect of the Personal Data Breach, including any notifications to Supervisory Authorities or Data Subjects that Applicable Data Protection Law requires Customer to make.
9. International Transfers
9.1 Atomic Wire processes Customer Personal Data within the United Kingdom and the European Economic Area. Transfers between the United Kingdom and the European Economic Area occur under the adequacy decisions in force between them.
9.2 Where Atomic Wire is required to transfer Customer Personal Data outside the United Kingdom and the European Economic Area, it shall do so only in accordance with Applicable Data Protection Law and using an appropriate transfer mechanism, including (as applicable) the Standard Contractual Clauses issued by the European Commission and the United Kingdom International Data Transfer Agreement or Addendum.
10. Audit and Attestations
10.1 Atomic Wire shall make available to Customer, on reasonable request, information reasonably necessary to demonstrate compliance with this DPA. Where held, this may include summaries of third-party audit reports or certifications relevant to the security of Orchimate (such as SOC 2 or ISO/IEC 27001 reports).
10.2 Where the information made available under Clause 10.1 is not sufficient for Customer to verify Atomic Wire's compliance, Atomic Wire shall permit and contribute to a reasonable audit conducted by Customer or an independent auditor mandated by Customer, at Customer's expense, on not less than 30 days' prior written notice, during business hours, in a manner that does not disrupt Orchimate's operations, and subject to reasonable confidentiality obligations.
11. Deletion and Return
11.1 On the earlier of (a) termination of Customer's use of Orchimate and (b) removal of the relevant Content by Customer, Atomic Wire shall delete Customer Personal Data or, at Customer's written request received before the deletion, return it in a commonly used format, in each case within a reasonable period.
11.2 Atomic Wire may retain Customer Personal Data (a) in backups, archives and logs as reasonably necessary for the ordinary operation of Orchimate, consistent with Clause 15.3(b) of the Terms, and (b) to the extent required by law. Retained Customer Personal Data shall continue to be protected in accordance with this DPA for so long as it is retained.
12. Liability
12.1 Each party's liability under this DPA is subject to the limitations of liability set out in the Terms, including the aggregate cap in Clause 11.3 of the Terms.
13. Precedence, Term and General
13.1 This DPA forms part of the Terms and is subject to their acceptance by Customer. In the event of any conflict between this DPA and the Terms in respect of the processing of Customer Personal Data, this DPA prevails.
13.2 This DPA takes effect on the effective date of the Terms and continues for so long as Atomic Wire processes Customer Personal Data on Customer's behalf. Clauses 5, 8, 10, 11 and 12 survive termination for so long as reasonably necessary or required by law.
13.3 This DPA, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it, is governed by and construed in accordance with the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.
14. Notices
14.1 Notices from Customer to Atomic Wire under this DPA — including in respect of data-subject requests, audit requests, Sub-processor objections and other data-protection matters — shall be sent to dpo@atomicwire.io.
14.2 Notices from Atomic Wire to Customer under this DPA — including Personal Data Breach notifications and Sub-processor change notifications — may be sent to any contact address or email Customer has provided in its Account or in an Order Form, or made by notice via Orchimate.
SCHEDULE 1 — DESCRIPTION OF PROCESSING
Subject matter of the processing: Atomic Wire's provision of Orchimate to Customer.
Duration of the processing: For the duration of Customer's use of Orchimate and, in respect of retained copies, the periods referred to in Clause 11.2 of this DPA and Clause 15.3(b) of the Terms.
Nature and purpose of the processing: Hosting, storage, transmission, display and delivery of Content published by Customer via Orchimate, and provision of related features and functionality of Orchimate.
Types of Personal Data: Any Personal Data that Customer includes in Content it publishes via Orchimate. Customer determines what Personal Data (if any) is contained in such Content.
Categories of Data Subjects: Individuals whose Personal Data Customer chooses to include in Content published via Orchimate.
SCHEDULE 2 — TECHNICAL AND ORGANISATIONAL MEASURES
Atomic Wire implements and maintains the following technical and organisational measures to protect Customer Personal Data.
1. Access controls a) role-based access controls to production systems, granted only to personnel with a legitimate need; b) multi-factor authentication for administrative access; c) periodic review of access rights and removal of access on personnel change or role change.
2. Encryption a) encryption of Customer Personal Data in transit using TLS 1.2 or higher; b) encryption of Customer Personal Data at rest using industry-standard algorithms.
3. Network and infrastructure security a) firewalls, network segmentation and intrusion detection appropriate to the hosting environment; b) regular vulnerability scanning and remediation processes; c) separation of production and non-production environments.
4. Personnel a) confidentiality obligations imposed on all personnel with access to Customer Personal Data; b) data-protection training on onboarding and periodically thereafter; c) background checks where permitted by applicable law and appropriate to the role.
5. Business continuity and disaster recovery a) regular backups of Customer Personal Data; b) documented incident response and business continuity procedures; c) periodic testing of backup restoration and recovery.
6. Logging and monitoring a) logging of significant system events and administrative access to Customer Personal Data; b) ongoing monitoring for anomalous or malicious activity.
7. Physical security a) hosting on infrastructure operated by Sub-processors that maintain physical access controls appropriate to their published security standards.
8. Sub-processor management a) due diligence on Sub-processors before engagement; b) contractual data-protection obligations on Sub-processors no less protective than those in this DPA; c) periodic review of Sub-processors.
9. Incident response a) documented Personal Data Breach identification, containment and notification procedures; b) periodic testing and review of those procedures.
10. Governance a) periodic review of these technical and organisational measures; b) updates in response to evolving threats and industry practice.
SCHEDULE 3 — SUB-PROCESSORS
The current list of Sub-processors engaged by Atomic Wire to process Customer Personal Data is published at https://orchimate.org/legal/subprocessors. Atomic Wire shall keep this list current and shall give Customer notice of changes in accordance with Clause 6.3 of this DPA.