This DPA forms an integral part of the Orchesi Terms of Service.
1. Parties
Controller:
The Association using the Service
Processor:
Asora B.V., trading as Orchesi
Industriestraat 22
6135 KH Sittard
The Netherlands
2. Subject matter
Processing of personal data by the Processor on behalf of the Controller in connection with providing the Service.
3. Duration
Processing continues for the term of the subscription and ends upon termination, subject to deletion obligations.
4. Nature and purpose of processing
Processing is limited to:
- hosting and storage of personal data
- enabling communication, scheduling, and member management
- access control and authentication
- security and availability of the Service
5. Categories of data subjects
- association members
- administrators
- invited users
6. Categories of personal data
- identification data
- contact details
- roles and permissions
- attendance and participation data
- uploaded content (photos, PDFs)
7. Processor obligations
The Processor shall:
- process data only on documented instructions
- ensure confidentiality
- implement appropriate security measures (Article 32 GDPR)
- assist with data subject requests
- notify the Controller of personal data breaches without undue delay
- delete personal data within 30 days after termination unless legally required otherwise
8. Sub-processors
8.1 The Controller grants general authorization for the use of sub-processors.
8.2 Orchesi maintains an up-to-date list of sub-processors in Appendix A.
8.3 Orchesi shall inform Controllers of material changes to sub-processors.
8.4 Sub-processors are bound by obligations no less protective than this DPA.
9. Assistance and audits
Orchesi provides reasonable assistance to enable compliance with GDPR obligations. On-site audits are excluded unless required by mandatory law.
10. Data breach notification
Orchesi notifies the Controller without undue delay after becoming aware of a personal data breach.
11. Return or deletion
Upon termination, Orchesi deletes personal data within 30 days, unless retention is required by law.
12. Governing law
This DPA is governed by the laws of the Netherlands.
Jurisdiction lies with the court in Maastricht.
Appendix A — Sub-processors
Orchesi uses the following sub-processors to provide the Service:
| Sub-processor | Purpose | Processing location |
|---|---|---|
| UpCloud Oy | Application and database hosting | EU (Amsterdam, Netherlands) |
| UpCloud Oy | File storage (such as sheet music and images) | EU (Frankfurt, Germany) |
| Mailgun Technologies (Sinch) | Transactional email and notification delivery | EU |
| Expo (650 Industries, Inc.) | Relaying push notifications to the mobile app | US |
| Google (Firebase Cloud Messaging) | Push notification delivery on Android | US / global |
| Apple (Push Notification Service) | Push notification delivery on iOS | US / global |
| Stripe Payments Europe Ltd. | Subscription billing and payments | EU (Ireland), with transfers to the US |
| PostHog Inc. | Product analytics | EU (Frankfurt, Germany) |
| Mapbox Inc. | Converting addresses to locations (geocoding) and map display | US |
| Pingen AG | Printing and mailing postal verification letters | Switzerland |
For sub-processors outside the European Economic Area, transfers are based on an adequacy decision (such as the EU-US Data Privacy Framework or the adequacy decision for Switzerland) or the European Commission's Standard Contractual Clauses.
All sub-processors process personal data only on documented instructions and under GDPR-compliant agreements.