Data Processing Addendum (DPA)
Effective Date: March 18, 2026
This Data Processing Addendum (“DPA”) forms part of the Terms of Service (“Agreement”) between OrangeBall Creative (“OrangeBall.ai,” “Processor”) and the customer (“Customer,” “Controller”).
This DPA applies where OrangeBall.ai processes Personal Data on behalf of Customer in connection with the Services.
1. Definitions
“Personal Data” means any information relating to an identified or identifiable natural person.
“Processing” means any operation performed on Personal Data.
“Controller” means the entity determining the purposes and means of processing.
“Processor” means the entity processing data on behalf of the Controller.
“Security Incident” means unauthorized access to, disclosure of, or loss of Personal Data processed by Processor that materially compromises the security or confidentiality of such data.
“Subprocessor” means any third party engaged to process Personal Data.
Terms such as “Services,” “Customer Input,” and other capitalized terms not defined in this DPA have the meanings assigned in the Agreement.
2. Roles of the Parties
Customer is the Controller of Personal Data.
OrangeBall.ai acts as a Processor, processing Personal Data solely on behalf of Customer and only as necessary to provide the Services in accordance with the Agreement and Customer’s use of the Services.
3. Scope of Processing
a. Subject Matter
Processing necessary to provide the Services described in the Agreement, including AI-powered branding and marketing services.
b. Nature of Processing
Collection, storage, analysis, and generation of content based on Customer Input submitted through the Services.
c. Duration
For the duration of the Agreement, and thereafter only as described in the Agreement or Privacy Policy.
d. Categories of Data
May include:
- Account information (name, email);
- Business data;
- Customer lists or contact information uploaded by Customer.
e. Categories of Data Subjects
May include:
- Customer personnel; and
- Customer clients or end users.
4. Processing Instructions
OrangeBall.ai will process Personal Data only:
- in accordance with Customer’s instructions;
- as necessary to provide the Services; or
- as required by law.
OrangeBall.ai will promptly notify Customer if any material change to applicable privacy law or to the terms or capabilities of OrangeBall.ai’s Subprocessors materially affects OrangeBall.ai’s ability to fulfill its obligations under this DPA.
5. Customer Responsibilities
Customer remains responsible for ensuring that it has the legal right to collect, use, and submit Personal Data to the Services and that such data processing complies with applicable laws.
Customer agrees not to submit Sensitive Data or other prohibited categories of data identified in the Agreement.
Customer agrees to defend, indemnify, and hold harmless OrangeBall.ai from and against any claims, losses, or expenses (including reasonable attorneys’ fees) arising from Customer’s breach of this section, including any claim arising from Customer’s submission of data it did not have the legal right to submit or its failure to comply with applicable privacy laws in connection with data processed under this DPA.
6. Confidentiality
OrangeBall.ai will use commercially reasonable measures to limit access to Personal Data to personnel or service providers who require such access to operate or support the Services and who are subject to confidentiality obligations.
7. Security Measures
OrangeBall.ai implements commercially reasonable administrative, technical, and organizational safeguards designed to protect Personal Data and uses infrastructure and service providers that implement appropriate security safeguards.
Customer acknowledges that no system is completely secure.
8. Subprocessors
Customer authorizes OrangeBall.ai to use Subprocessors to support the operation of the Services, including cloud hosting providers, artificial intelligence providers, analytics providers, and payment processors.
OrangeBall.ai may identify significant Subprocessors through the Services or on its website and may update Subprocessors from time to time as the Services evolve.
OrangeBall.ai will use commercially reasonable efforts to ensure that Subprocessors are subject to appropriate data protection obligations.
OrangeBall.ai will provide at least 30 days’ advance notice before adding a new Subprocessor that will process Customer’s Personal Data. Customer may object to a new Subprocessor within that 30-day period by providing written notice to OrangeBall.ai. If OrangeBall.ai and Customer cannot resolve the objection, Customer’s sole remedy is to terminate the Agreement on 30 days’ written notice.
9. International Transfers
Personal Data may be transferred to and processed in the United States or other jurisdictions where OrangeBall.ai or its Subprocessors operate.
Customer consents to such transfers.
10. Data Subject Rights
OrangeBall.ai will provide reasonable assistance to Customer, where technically feasible, in responding to requests from data subjects, to the extent required by applicable law.
11. Data Breach Notification
OrangeBall.ai will notify Customer of a confirmed Security Incident without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of the incident. Notification will include, to the extent known at the time: (a) a description of the nature of the Security Incident; (b) the categories and approximate number of data subjects affected; (c) the likely consequences of the Security Incident; and (d) the measures taken or proposed to address the incident. OrangeBall.ai will provide updates as additional information becomes available.
12. Data Retention and Deletion
Upon termination of the Agreement, OrangeBall.ai will:
- delete or return Personal Data, at Customer’s request;
- retain data only as described in the Agreement or Privacy Policy, or as required for legal, security, or operational purposes;
Upon Customer’s written request following termination or expiration of the Agreement, OrangeBall.ai will provide written confirmation that Customer’s Personal Data has been deleted or returned, within 30 days of completing that deletion.
13. Audits
Upon reasonable request, OrangeBall.ai may provide documentation reasonably necessary to demonstrate compliance with this DPA.
Formal audits are limited to reasonable scope and frequency and may require a confidentiality agreement.
14. Liability
Liability under this DPA is subject to the limitations of liability stated in the Agreement, except that OrangeBall.ai’s liability for a Security Incident caused by OrangeBall.ai’s gross negligence or willful misconduct is not subject to those limitations.
15. Conflict
In the event of conflict between this DPA and the Agreement, this DPA will control with respect to data protection matters.
16. Contact
OrangeBall Creative, Inc.
207 N Chestnut St #210, Chaska, MN 55318