Data Processing Addendum

Purpose and scope

This DPA applies when a client or organization uses OrientShift to submit or manage personal data on behalf of another person or group. It supplements the applicable MSA or Order Form and Privacy Policy. For a person using OrientShift for their own purposes, the Privacy Policy and Terms apply directly.

Roles and instructions

For an organization engagement, the organization is the customer and Big BAM is the service provider or processor for customer data to the extent Big BAM processes it on the organization's documented instructions. Big BAM may process account details, contact information, responses, evidence records, progress, notes, tasks, calendar details, support communications, and payment or entitlement metadata to provide the contracted Services, maintain security, prevent abuse, provide support, administer access, and comply with law.

Customer responsibilities

The customer is responsible for having a lawful basis, providing required notices, obtaining permissions, limiting data to what is appropriate, responding to data-subject requests within its role, and ensuring instructions to Big BAM are lawful. The customer must not submit highly sensitive information unless the engagement expressly supports it.

Confidentiality and security

Big BAM will require personnel and contractors with access to customer data to protect it and will maintain reasonable administrative, technical, and organizational safeguards appropriate to the Services. Big BAM does not represent that it carries cyber-liability insurance.

Providers and incidents

Big BAM may use hosting, database, authentication, payment, email, calendar, analytics, security, and AI service providers. Processing may occur in the United States or another location where a provider operates. Big BAM will notify the customer without undue delay after confirming a security incident involving customer data and will reasonably assist with verified access, correction, deletion, export, or other requests.

Return, deletion, and audit

At the end of an engagement, Big BAM will return or delete customer data when reasonably requested, subject to legal retention, security backups, dispute records, and other lawful exceptions. Reasonable information about safeguards may be requested, but audits must be scoped, proportionate, and not expose another customer's data or security-sensitive details.

Last updated: November 5, 2026

These documents are provided for business use and are not legal advice. Big BAM LLC should obtain jurisdiction-specific legal review before relying on them for a particular engagement.