BlackOrbis

Data Handling for Clients

Version 1 · Effective 26 October 2026

This page is the data processing addendum that forms part of our Terms of Service. It applies whenever we handle personal data for a client through an agent, automation or website we build and run. A signed copy for your records is available on request.

1. Roles

The client is the controller (in US terms, the business) and decides why and how personal data is used. BlackOrbis is the processor (service provider). We process personal data only on the client’s written instructions, which are the agreed scope, these terms and the client’s settings. If we think an instruction breaks the law, we tell the client and may pause it.

2. What we process

• Purpose: building, running, testing and supporting the client’s agent or website.
• Data subjects: the client’s customers, leads and staff.
• Data types: names, phone numbers, email addresses, message content, booking and order details, and any files or voice notes people send.
• Duration: for as long as the service runs, and until deletion under section 8.

The client must not send us special-category or sensitive data (for example health records or government ID numbers) unless we agree in writing first.

3. Our duties

• Keep the data confidential and limit access to people who need it, all bound by confidentiality.
• Use reasonable security: encrypted connections, separate access per client, two-step login on our accounts and least-privilege access for our developer.
• Never sell or share the data, never combine it with data from another client, and never use it for anything outside the client’s purposes.
• Never use client or customer data to train AI models. We use paid AI services whose terms do not train on business data.
• Help the client answer rights requests from their customers, run impact assessments and meet regulator duties, within a reasonable time.
• Keep logs of what the agent did for at least 180 days.

4. Sub-processors

The client agrees that we use these kinds of providers: Meta (WhatsApp and Instagram messaging), AI model providers, hosting and database providers, and payment providers. We give the current list for a client’s project on request and tell the client before adding a new one. The client may object within 14 days on reasonable grounds; if we cannot resolve it, either side may end the affected service. We stay responsible for our sub-processors and bind them to terms no weaker than this page.

5. Breach notice

If we find a personal data breach affecting the client’s data, we tell the client without undue delay and within 48 hours, with what we know: what happened, what data, what we have done and what we recommend. Where the law requires it, we also report to CERT-In within 6 hours. This lets clients meet their own deadlines, which can be as short as 72 hours.

6. International transfers

We process data in India and use providers in other countries, including the US. For data from the EU or UK, the Standard Contractual Clauses (Module 2, and Module 3 for onward sub-processors) or the UK Addendum or IDTA apply and are incorporated here by reference. For data from other countries, we apply the transfer safeguard that country requires.

7. Client duties

• Have a lawful basis, notices and consents for every person whose data is processed, including WhatsApp opt-in records, and show us on request within 5 working days.
• Tell people that they are speaking to an AI, as the law and platform rules require, and offer a way to reach a human.
• Respond to rights requests from their own customers, with our help.
• Keep the agent’s instructions and settings lawful, and monitor its work.

8. Deletion and return

When the service ends, or when the client asks, we make one export of the data available to download and then delete it from our systems within 30 days, unless the law requires us to keep it (for example security logs we must retain). We confirm deletion in writing if asked.

9. Audits

Once a year, or after a breach, the client may ask for information showing that we follow this page, and, at the client’s cost and with reasonable notice, review our controls remotely.

10. Voice notes and recordings

Where an agent handles voice notes, it asks for consent on screen, records only the person speaking, deletes the audio after it is turned into text, and does not create voiceprints.

11. Regulator requests

If a regulator or authority asks us for the client’s data, we tell the client first unless the law forbids it, and we cooperate with the client and the relevant authority (including Taiwan’s and India’s data protection authorities, where they apply).