Orbit

Data processing agreement

Last changed on 18 October 2026.

This agreement is between a space, as controller, and Kumonari, who run Orbit, as processor. It is part of the terms of use, applies whenever a space keeps personal data in Orbit, and is what Article 28 of the General Data Protection Regulation (GDPR) asks for. "We" are Kumonari.

What we process, and why

  • The subject: keeping and handling the personal data a space puts into Orbit, to give the space the service the terms describe.
  • How long: for as long as the space uses Orbit, until the data is deleted at the end.
  • What we do with it: store it, show it to the space's members, search it, send the space's letters and messages, and receive what reaches the space, such as bookings, mail from a mailbox it connected and whether a payment went through. We do this only to run Orbit for the space.
  • The kinds of data: names, contact details, birthdays, notes, appointments and the answers to a space's booking questions, messages and their attachments, documents, feedback, payment and invoice records, and the record of who changed what. A space that keeps special categories of data in Orbit, such as health notes in a practice, answers for having the basis the law asks for them.
  • Whose data it is: the space's clients and the people who contact it, its members, and anybody else its records mention.

What we promise

  1. We follow the space's instructions. We process its data only as these terms, this agreement and the space's own use of Orbit instruct, unless the law makes us do otherwise; then we tell the space first, unless the law forbids that. We tell the space when we think an instruction breaks data protection law.
  2. We keep it confidential. The people at Kumonari who can reach a space's data are bound to confidentiality, and reach it only to run Orbit, to help the space when it asks, or to fix a fault. Every look into a space is written down.
  3. We keep it safe with the measures in the annex below, and improve them as the risks change.
  4. We tell the space about subprocessors. The space allows the subprocessors in the annex. We announce a new or replaced one in Orbit a month before it starts. A space can object on reasonable grounds and, when we cannot meet the objection, end the terms before the change applies. Each subprocessor is bound to the same obligations as we are, and we answer for it.
  5. We help with people's requests. Most of what a person can ask a space, to see, correct or delete their data, the space can do in Orbit itself, and we help with the rest. A request that reaches us is passed on to the space.
  6. We report breaches. We tell the space without undue delay when a breach of security reaches its personal data, with what we know and what we are doing about it, and help it tell the supervisory authority and the people concerned.
  7. We help with assessments of data protection impact, and with consulting the supervisory authority, as far as Orbit is concerned.
  8. We delete at the end. Closing a space deletes its data. The space can copy what it needs before it closes.
  9. We show we keep to this. We give the space the information it needs to see that we do, and allow an audit by the space or an auditor it chooses, with reasonable notice and at its cost.
  10. The data stays in Europe. We keep it in the European Economic Area or Switzerland, and move it elsewhere only with the safeguards Chapter V of the GDPR asks for.

What the space promises

  • It has a basis the law accepts for every piece of personal data it keeps in Orbit, and tells the people concerned.
  • The instructions it gives through its use of Orbit are lawful.
  • It decides which of its members may see what, and keeps that up to date.

Services a space connects itself

Some services are chosen by a space or its members rather than by us: the space's own Mollie account for payments, a mailbox it connects so Orbit can read and answer its email, an AI assistant a member connects through Orbit's interface for assistants, and the calendar feeds a member shares. These are not our subprocessors. The space or member has its own agreement with each, and what Orbit passes to them it passes on their instruction.

Annex: subprocessors

Who What for Where
Infomaniak Network SA, Geneva The servers the data is kept on, and delivering email Switzerland

Annex: security measures

  • Encrypted on the way: every page, interface and letter link is served over HTTPS only.
  • Each space apart: a space's data is reached only from inside that space, and every read and write checks what the reader may do there.
  • Signing in without passwords: members sign in with emailed links or codes, or with passkeys, so no password of theirs is stored.
  • Secrets sealed: the passwords and tokens of connected mailboxes and the keys of payment accounts are stored encrypted, with a key kept apart from the database.
  • Few hands: only the people who run Orbit reach its servers, by key. Looking into a space to help it is read-only and written down.
  • Nothing from outside in the browser: no analytics, no tracking, and no scripts or fonts from anybody else; a content security policy holds what a page may load.
  • Checked before release: every change passes the automated tests, and the libraries Orbit uses are checked for published security advisories, before it is deployed.

Who runs Orbit

Orbit is run by Kumonari.