Data Processing Terms

These terms are effective from 11 October 2026. They form part of the agreement between the organization (“Controller”) and Orishare LLC (“Processor”) and apply whenever the Service processes personal data on the Controller's behalf. If the organization itself processes the data for another controller, it acts as processor and Orishare as its subprocessor, and these terms apply in the same way. Where they conflict with the Terms of Service on personal data, these terms prevail. A countersigned copy is available on request from support@orishare.com.

1. Subject matter, duration and details

Processing of player identifiers, events and attributes to evaluate loyalty and rewards rules, keep balances and deliver notifications, for the duration of the agreement plus the export window.

• Data subjects: the Controller's players, and the Controller's staff who use the Service.
• Categories of data: player identifiers and aliases, attributes the Controller chooses to send, events, balances and ledger entries, and contact details used for notifications.
• Special-category data: none. The Controller must not send it, nor payment card data.
• Nature and purpose: storage, rule evaluation, ledger keeping, notification delivery, export and deletion, as instructed through the Service.

2. Instructions

The Processor processes personal data only on documented instructions: the API calls, configuration and dashboard actions of the Controller's users and the AI tools they authorize. The Processor informs the Controller if an instruction appears to infringe applicable law.

3. Confidentiality and security

Personnel are bound by confidentiality. Technical and organisational measures include tenant isolation per environment, hashed credentials, encryption in transit and at rest, audited configuration changes, audited staff access with a stated reason, least-privilege service accounts, and automated database backups. Details are on the security page.

4. Subprocessors

The Controller authorises the subprocessors listed on the subprocessors page. The Processor gives organization owners at least 30 days' notice of additions; the Controller may object on reasonable grounds, in which case the parties seek a solution or the Controller may terminate the affected part of the Service. The Processor binds each subprocessor to data protection obligations equivalent to these terms and remains responsible for its performance.

5. Assistance

The Processor provides the player export and deletion endpoints so the Controller can answer access, portability and erasure requests directly. Taking into account the nature of the processing and the information available to it, the Processor also assists with other data subject requests, security obligations, breach assessments and notifications, data protection impact assessments and consultations with regulators.

6. Personal data breaches

The Processor notifies the Controller without undue delay, and at the latest within 48 hours of becoming aware of a breach affecting the Controller's data, with the information available at that time.

7. Deletion and return

On termination the Controller has 30 days to export data; the Processor then deletes or anonymizes it, subject to legal retention obligations. Database backups expire within 15 days. Deleting a player during the agreement redacts their attributes and events and removes their aliases, while pseudonymous ledger entries are kept so balances and financial history stay correct.

8. Audits

The Processor makes available the information needed to demonstrate compliance and allows audits by the Controller or a mandated auditor, on reasonable notice, at most once a year. Further audits are allowed when required by a supervisory authority, or when reasonably necessary after a personal data breach or evidence of non-compliance.

9. International transfers

Data is hosted in the United States (Google Cloud us-central1); other providers' locations are on the subprocessors page. For transfers from the EU, the EU Standard Contractual Clauses (Module Two, controller to processor, Commission Decision 2021/914) are incorporated by reference, with the Controller as data exporter, Orishare as data importer and these terms supplying the annex details. For transfers from the UK, the UK International Data Transfer Addendum to those clauses applies. Onward transfers to subprocessors rely on the EU-US Data Privacy Framework where the subprocessor is certified, and on Standard Contractual Clauses otherwise. A countersigned copy of the transfer terms is available on request.