A data processing addendum between Orren LLC and a customer supplements the Terms of Service where agreed separately. The scope below reflects the current sales workspace; the signed agreement governs the parties’ obligations.
1. Roles
- You are the controller of the personal data in your records: your leads, clients, correspondents, invitees and the people who appear in your messages, notes and uploaded media. You decide why it is collected and what is done with it.
- We are the processor. We process it only to provide the service to you and on your documented instructions, which are the Terms of Service, this Addendum, and what you do in the app.
- For your own account data (your email, licence, payments, diagnostics) we are the controller, and the Privacy Policy applies.
2. What is processed
- Subject matter. Operating Orren for you: storing and synchronising your records, answering your questions about them, and running the automations you configure.
- Duration. The life of your account, plus the retention periods in section 8.
- Nature and purpose. Storage and synchronisation, AI assistance and conversation insights, messaging and configured automations, team coordination, and connecting link, booking and payment activity to leads.
- Categories of data subjects. Your leads and prospects, customers and clients, people who message or comment on your connected accounts, people invited to your calendar bookings, and people who appear in your uploaded media and notes.
- Categories of personal data. Names, usernames, platform identifiers, profile pictures, message and comment content, booking details, payment amounts and dates with the email the payment carried, notes and transcripts you make about people, and the relationships Orren infers between these.
- Special categories. Orren is not designed for them. If your notes contain health, financial-hardship or similar information about people, you are responsible for having a lawful basis for it.
3. Our obligations
The separately agreed DPA should address our obligations to:
- Process personal data only on your instructions, unless the law requires otherwise, in which case we tell you first where we may.
- Ensure the people who run Orren are bound by confidentiality.
- Apply the security measures in section 6.
- Engage subprocessors only under section 5.
- Help you respond to requests from data subjects, and to your own security and impact assessments, to the extent the tooling in the app does not already let you do it yourself.
- Delete or return the personal data at the end of the service, under section 8.
- Make available the information needed to show compliance, and allow audits under section 9.
- Tell you without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting your data, with what we know and what we are doing.
4. Your obligations
You will have a lawful basis for the personal data you put into Orren, give the people concerned the notices the law requires, and use available deletion and export controls or contact us to honour their rights. Hiding and disconnecting do not delete previously stored records. You will not put into Orren personal data you are not entitled to hold.
5. Subprocessors
The proposed provider list is at Subprocessors, which says what each one holds and where. We will give you at least 30 days' notice before adding one, by updating that page and its date, and you may object on reasonable data-protection grounds; if we cannot resolve the objection you may end the service and receive a pro-rated refund of any prepaid term. Each subprocessor is bound by data-protection terms no less protective than these.
6. Security
Safeguards include encryption in transit and cloud storage, account and workspace access controls, secure device credentials and restricted administrative access. The Security Policy describes these at a public level. Any additional contractual measures should be documented in the agreed DPA; this page does not disclose internal configurations.
7. International transfers
Orren’s primary processing is in the United States. Where required, the parties must establish applicable transfer safeguards, including completed Standard Contractual Clauses and annexes or other valid arrangements. UK or Swiss requirements may also apply. This page does not execute or incorporate incomplete transfer documents. Contact us before sending data that requires those arrangements.
8. Deletion and return
Use available export controls or request an export from privacy@tryorren.com. Verified account-deletion requests are completed within 30 days, subject to required retention and the rights of the organisation that controls business records. Backup copies expire through their retention cycle. Hiding or archiving a person does not delete their information. The deletion instructions explain the process; any additional contractual requirements belong in the agreed DPA.
9. Audit
Once a year, on 30 days' notice, and at your cost, you may audit our compliance with this Addendum, in the first instance by written questions and by reviewing the documentation we provide, and, where that is not enough to meet a legal obligation you have, by an inspection at a time that does not disrupt the service.
10. Liability
Liability under this Addendum is subject to the limits in the Terms of Service, except where data protection law does not allow it.
11. Contact
Data protection questions: privacy@tryorren.com. Orren LLC, a Wyoming limited liability company. The parties’ legal contact details and required annexes will be included in the separately agreed documents.
