1. Roles
Customer decides what personal data about its members and clients goes into its workspace and why. Customer is the controller of that data (“Customer Personal Data”). Ordre processes Customer Personal Data only to provide Ordre to Customer, as a processor (a “service provider” under US state laws, an “operador” under the LGPD).
Ordre is a separate controller for its own account, billing, security and analytics data, as described in the Privacy Policy.
2. Instructions
Ordre processes Customer Personal Data only on Customer’s documented instructions. The Terms, Customer’s configuration of its workspace, and actions taken in the dashboard are those instructions. Ordre won’t sell Customer Personal Data, use it for its own purposes, or combine it with data from other sources, except as needed to provide the service. If Ordre believes an instruction breaks data protection law, it will tell Customer.
3. Customer’s responsibilities
Customer is responsible for having a lawful basis, and any notices or consents required, to give Ordre its clients’ data and to contact them through Ordre. Customer won’t put special-category or highly sensitive data on boards, such as health information, payment card numbers or government ID numbers.
4. Confidentiality
Anyone at Ordre who can access Customer Personal Data is bound by confidentiality and accesses it only as needed for support, security or operations.
5. Security
Ordre maintains the technical and organisational measures in Annex 2 and may improve them over time, but won’t reduce their overall protection.
6. Sub-processors
Customer authorises Ordre to use the sub-processors on the Sub-processors page. Ordre binds each one to data protection terms at least as protective as this DPA and stays responsible for their work.
Ordre will give at least 15 days’ notice before adding or replacing a sub-processor, by updating that page and emailing workspace owners who’ve asked for notifications. Customer may object on reasonable data protection grounds within that period. If we can’t resolve the objection, Customer may close its workspace and receive a pro-rata refund of any prepaid fees for the unused period.
7. Helping Customer
Ordre will:
- forward to Customer any request it receives from a data subject about Customer Personal Data, without responding itself unless Customer asks;
- give Customer reasonable help, mainly through dashboard features, to answer access, correction, deletion and portability requests;
- give reasonable help with impact assessments and regulator inquiries, using information Ordre has.
8. Security incidents
If Ordre becomes aware of a breach affecting Customer Personal Data, it will notify Customer without undue delay and within 72 hours, with the information it has about the nature of the breach, the data and people affected, likely consequences and the steps taken. Ordre will update Customer as it learns more. Notifying data subjects or regulators is Customer’s decision, and Ordre will help.
9. International transfers
Customer Personal Data is processed in Brazil and in the countries where Ordre’s sub-processors operate, mainly the United States. Where a transfer needs a legal mechanism, such as the EU Standard Contractual Clauses or the LGPD’s standard clauses, Ordre relies on those its sub-processors offer, and both parties agree to put any further required mechanism in place.
10. Deletion and return
Customer can export or delete boards in the dashboard at any time. When a workspace is closed, Ordre deletes Customer Personal Data after the 30-day grace period, except where law requires it to keep some data. Backups are overwritten on the normal backup cycle and are not restored except for disaster recovery.
11. Audits
On written request, no more than once a year, Ordre will answer reasonable questions about its compliance with this DPA and provide relevant documents, such as its sub-processors’ security certifications. Any on-site audit requires agreement on scope, timing and cost.
12. Liability and term
Each party’s liability under this DPA is subject to the limits in the Terms. This DPA lasts as long as Ordre processes Customer Personal Data.
Annex 1: Details of processing
| Item | Detail |
|---|---|
| Subject matter | Providing the Ordre client status board service |
| Duration | The term of the Customer’s use, plus the 30-day grace period after closure |
| Nature | Storage, display, transmission (email, SMS, WhatsApp), and deletion |
| Purpose | Letting Customer share job progress, photos, approvals and messages with its clients |
| Data subjects | Customer’s members; Customer’s clients and their contacts |
| Personal data | Names, company names, email addresses, phone numbers, addresses, job details, serial numbers or plates, photos, messages, approval responses, IP addresses and device information |
| Special categories | None intended. Customer must not submit them |
| Frequency | Continuous, while Customer uses Ordre |
Annex 2: Security measures
- Encryption: TLS for all traffic; data encrypted at rest by the database and storage providers.
- Access control: the database is reachable only by the Ordre API; production access limited to Ordre’s operator, with multi-factor authentication on provider accounts.
- Authentication: hashed passwords, session-based login, rate limiting and CSRF protection; one person per account.
- Client boards: unguessable board tokens; sensitive fields hidden until the viewer verifies a registered contact; entered verification values not stored.
- Uploads: photos uploaded directly to object storage through short-lived signed URLs.
- Logging: structured logs with secrets and credentials redacted; error monitoring and uptime alerts.
- Resilience: managed database backups and point-in-time recovery from the database provider.
- Development: separate staging and production environments; dependency updates and code review before deploys.