Ordavela — Terms of Service and Data Processing Agreement
Version 1.0 | Effective 6 November 2026 | Aurican Analytics Ltd
Terms of Service
1. About these terms
1.1 These terms are between Aurican Analytics Ltd, a company registered in England and Wales with company number 16686611, whose registered office is at 27 Old Gloucester Street, London WC1N 3AX, United Kingdom (“Aurican”, “we”), and the business that signs up (“Customer”, “you”).
1.2 The Service is for businesses only. By signing up or clicking to accept, you confirm that you are accepting for a business, that you are authorised to bind it, and that you are not acting as a consumer.
1.3 Contract Documents and Order of Precedence
1.3.1 The agreement between Aurican and the Customer comprises:
(a) these Terms of Service;
(b) the Data Processing Agreement (DPA), including its annexes;
(c) the Customer's order form or subscription details confirmed during sign-up; and
(d) the applicable pricing and subscription plan details presented to and accepted by the Customer at the time of subscription, as subsequently amended in accordance with these Terms.
1.3.2 If there is any conflict or inconsistency between these documents, the following order of precedence shall apply:
(a) the Data Processing Agreement and its annexes, but only in relation to the processing and protection of personal data;
(b) the Customer's order form or confirmed subscription details, in relation to the specific commercial arrangements agreed with that Customer;
(c) these Terms of Service; and
(d) the applicable pricing and subscription plan details.
1.3.3 An order form or other document shall override the Data Processing Agreement only where the parties have expressly agreed to a specific amendment to the Data Processing Agreement in writing, and only to the extent permitted by applicable data protection law.
1.3.4 Where the documents can reasonably be interpreted consistently, they shall be read together and no conflict shall be deemed to exist.
1.4 Version. This is version 1.0, effective 6th November 2026. We record who accepted it, when, and which version.
2. Definitions
- Service: the hosted Ordavela service, including its website, apps and support.
- Customer Data: emails, attachments, purchase orders and other content you connect or send to the Service; your catalogue, customer and price data; matches and corrections your Users save; and the orders the Service creates from them.
- Account Data: information about your account: company, country, industry, contacts, Users, data region, plan, billing status, and health counts.
- Users: people you allow to use the Service under your account.
- Connected Systems: the mailbox and ERP you connect to the Service.
- Data Region: the region you choose for your Customer Data (clause 3.5).
- Prohibited Data: health information about patients or other individuals receiving care, other special category personal data (for example racial or ethnic origin, religious beliefs, biometric or genetic data, sex life or sexual orientation), criminal offence data, and personal data about children.
- Restricted Data: payment card numbers and government identity numbers (for example passport or national insurance numbers).
- Sensitive Data: Prohibited Data and Restricted Data together. Ordinary business information on purchase orders, including company names, addresses, contacts, VAT numbers and company bank details, is not Sensitive Data.
- Billable Order: as defined in clause 6.2.
- Trial: the free trial in clause 5.
3. The Service
3.1 What it does. The Service reads purchase orders from the mailbox you connect, suggests how each line matches your catalogue and prices, flags problems for your team to check, and sends orders your team approves to your Connected ERP.
3.2 Your team approves every order. The Service does not send any order to your ERP until a User has approved it. This applies to every route an order can take, including retries and background jobs. The AI model’s output is a suggestion only.
3.3 Who is responsible for what.
- You are responsible for checking the information the Service shows you before approving an order, and for your decision to approve it.
- We are responsible for our software and integrations working as described, including sending your ERP the order exactly as approved. If our software sends something different from what you approved, or a fault in our software causes a loss, that is our responsibility, subject to clause 13.
3.4 Accuracy. Reading documents automatically can make mistakes, which is why every order is checked and approved by your team. We measure accuracy and work to improve it, but we don’t promise that every value will be read or matched correctly.
3.5 Where your data is kept.
- You choose a Data Region when you sign up: United Kingdom, European Union or United States. Businesses in the UK, the EU and the US are offered their own region. Businesses elsewhere choose one of the three, with the United Kingdom suggested. The Data Region can’t be changed later, except by exporting your data and opening a new account.
- What stays in your Data Region: storage of your Customer Data (database, emails and attachments), document reading and matching, and AI processing, which runs in Microsoft's data centres for your Data Region (United Kingdom, European Union or United States). Backups stay in your Data Region.
- What may happen outside it:
- Account Data is held in Aurican’s account system in London, United Kingdom.
- Aurican provides support and operations from the United Kingdom. Staff access to Customer Data is remote, limited to the reasons in clause 9.2, and recorded.
- Aurican’s own service providers for billing, email and hosting of its website handle Account Data, some of them outside the UK (Annex C, part 2).
- Disclosures required by law.
- Any transfer of personal data outside your Data Region is covered by the safeguards in the Data Processing Agreement.
3.6 Changes to the Service. We may change or improve the Service. We won’t make a change that materially reduces its core function during your subscription without at least 30 days’ notice.
3.7 Availability. We aim to keep the Service available and will give notice of planned maintenance where we can. We don’t promise any level of uptime at launch, and don’t offer service credits.
4. Who can use the Service
4.1 Businesses in any country may sign up, unless providing the Service would breach sanctions or export control laws that apply to Aurican, including those of the United Kingdom, the European Union and the United States. You confirm that, to your knowledge, you are not owned or controlled by, or acting for, a person subject to those sanctions, and that you will not use the Service in breach of them. Aurican may refuse or end an account where providing it would breach those laws.
4.2 You are responsible for making sure your own use of the Service is lawful where you operate. This doesn’t reduce Aurican’s own legal obligations as the provider of the Service.
5. Free trial
5.1 You can try the Service free for 30 days from the day your trial account is set up. No card is needed. One trial per business.
5.2 During the Trial, the Service is provided “as is”, without any availability commitment. Clause 13 applies with a total cap of £100.
5.3 When the Trial ends. We remind you before it ends. If you don’t subscribe:
- the Service stops reading new emails;
- you keep read-only access, and can export your Customer Data, for 30 days; and
- we then delete your Customer Data within 30 days, as set out in Annex D.
5.4 We may decline or end a trial that looks like misuse.
6. Fees and payment
6.1 After the Trial, you pay the monthly fee for your plan, as shown in our price list when you subscribe. Plans are tiered by the number of Billable Orders each month.
6.2 Billable Order. An order that a User approves and the Service sends to your ERP, counted once. These are not Billable Orders: duplicates the Service detects, orders rejected or put on hold, emails that couldn’t be read, re-reading the same email, and sending an order again after a fault on our side. You can see your count of Billable Orders in the Service at any time.
6.3 Currency. You pay in GBP if your business is in the United Kingdom, in EUR if it is in a country whose main currency is the euro, and in USD otherwise. Prices are fixed in each currency.
6.4 Fees are charged monthly in advance through our payment provider (Stripe). Fees exclude VAT and other taxes, which you pay where they apply.
6.5 Going over your plan. If your Billable Orders exceed your plan in a month, we tell you and move you to the next plan from your next billing month. We don’t charge for extra orders in the month they happen. You can move to a different plan at any time.
6.6 Price changes. We may change prices with at least 30 days’ notice, taking effect from your next billing period after the notice ends. You can cancel before then.
6.7 Late payment. If a payment fails and isn’t fixed within 14 days of our reminder, we may suspend the Service until it is paid.
7. Sensitive Data
7.1 Not supported. The hosted Service is not designed for Sensitive Data, and we don’t offer a HIPAA business associate agreement. You must not knowingly send Prohibited Data to the Service, or connect a mailbox you know receives orders for delivery to patients or other individuals receiving care unless you have marked it “always sensitive” in the Service. You must not knowingly send Restricted Data, except where it unavoidably appears in a purchase order; the Service does not use it.
7.2 How the Service reads email. To decide what an email contains, the Service reads it, including its attachments, in your Data Region, and the AI model may process its content. So some Sensitive Data in an email may be processed before it can be detected.
7.3 Detection is not guaranteed. The Service uses fixed rules to spot orders that appear to be for delivery to a patient. It can miss some, and can flag some wrongly.
7.4 If Sensitive Data is received.
- Orders the Service detects are set aside for your team to enter by hand. Their subject line is hidden, and their attachments and raw email are deleted automatically after 7 days. The Service tells your team; you don’t need to do anything else.
- If either of us becomes aware of Sensitive Data in Customer Data that wasn’t detected, we’ll tell each other, and you can delete it in the Service or ask us to.
- If a receipt of Sensitive Data is also a personal data breach, the breach terms in the Data Processing Agreement apply.
7.5 Our hosted Service does not offer the separate “sensitive orders” setting available for own deployments.
8. Your responsibilities
8.1 You will:
- keep your account details accurate and your Users’ sign-in details secure, and switch on multi-factor sign-in for Users where your Microsoft sign-in allows it;
- make sure your Users follow these terms;
- have the right to connect your mailbox and ERP, and to let the Service read the emails and send orders;
- have the right to give us the Customer Data, and give people any notice the law requires (Part 3);
- check orders before approving them (clause 3.3); and
- keep your own records of anything you must keep for legal or business reasons.
8.2 Acceptable use. You won’t use the Service to break the law, send spam or malware, attempt to get around its security, test or attack it without our written agreement, copy or resell it, or build a competing product using it.
9. Our responsibilities
9.1 We will provide the Service with reasonable skill and care, apply the security measures in Annex B, and follow the Data Processing Agreement.
9.2 Our access to your Customer Data. Our staff access Customer Data only to provide support you ask for, to keep the Service secure and running, or where the law requires. Each access is recorded, and you can ask for the record.
9.3 Support by email during UK business hours, Monday to Friday. We aim to reply within one business day.
9.4 If our software sends a wrong order. If our software sends your ERP something different from what you approved, we’ll fix the cause, help you correct the affected orders, and refund the fees for the affected period. You may also claim for your loss under clause 13. Refunds under this clause count towards the cap in clause 13.3.
10. Customer Data
10.1 You own your Customer Data. You give us the right to use it only to provide, support, secure and improve the Service for you, as set out in the Data Processing Agreement.
10.2 No training on your data. We don’t use your Customer Data to train AI models, and we don’t sell it or share it except as these terms allow. Under Microsoft’s terms for Azure OpenAI, Microsoft does not use it to train its models either.
10.3 Your saved corrections. When your team corrects a match and chooses to remember it, the Service saves that choice for your account only. It’s your Customer Data and is never shared with other customers.
10.4 Health counts. The Service records counts and times about its own running (for example, orders read and waiting), never order content, to help us spot and fix problems.
10.5 Retention. You set how long orders are kept. You choose whether old orders are deleted automatically or only after an admin approves. If you choose “approve first”, you also choose whether orders still not approved (or held with a reason) 30 days after they are due are then deleted automatically, or kept until approved. As controller, you’re responsible for these choices. Annex D sets out what is kept after deletion, and for how long.
10.6 Export. You can export all the Customer Data we hold for you at any time, in a standard format, while your account is active and for 30 days after it ends. Content already deleted under your retention settings can’t be exported.
11. Intellectual property
11.1 We own the Service and everything we make for it, including improvements. These terms give you a right to use it during your subscription (or Trial), and no other rights.
11.2 Your catalogues, prices, customer lists, saved matches and correction history are your Customer Data, not ours.
11.3 If you send us ideas or feedback about the Service, we can use them freely. This doesn’t include your confidential information or Customer Data.
12. Confidentiality
12.1 Each of us will keep the other’s confidential information secret and use it only for these terms, except information that is public, already known, independently developed, or required to be disclosed by law.
12.2 Either of us may share confidential information with professional advisers, insurers and potential investors or buyers who are bound by confidentiality.
12.3 This lasts for 5 years after these terms end, for trade secrets as long as they remain trade secrets, and for Customer Data as long as we hold it.
13. Liability
13.1 Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that can’t be limited by law.
13.2 Neither of us is liable for loss of profit, revenue, business, goodwill or anticipated savings, or for any indirect or consequential loss.
13.3 Except under clause 13.1, each party’s total liability arising out of or in connection with these terms (including the Data Processing Agreement), however it arises, including for data protection, security and confidentiality claims, is limited in any 12 months to the fees you paid in the 12 months before the claim. During the Trial, the limit is £100.
13.4 Clause 13.3 does not limit your obligation to pay fees.
13.5 These limits apply between you and us. They don’t affect the rights of regulators, or of individuals under data protection law.
14. Term, cancelling and ending
14.1 These terms start when you sign up and continue until ended.
14.2 Cancelling. You can cancel your subscription at any time in your account. It ends at the end of the current billing month. We don’t refund part months, except under clause 14.3 or where the law requires.
14.3 You may end these terms immediately by notice, with a refund of fees paid in advance for the remaining period, if:
- we materially reduce the Service’s core function;
- we don’t fix a serious security concern you have raised within 30 days; or
- we seriously break these terms and don’t fix it within 30 days of being asked.
14.4 Either of us may end these terms immediately if the other becomes insolvent. We may end them by notice if you seriously break them and don’t fix it within 30 days of being asked, or break clause 4.1.
14.5 Suspension. We may suspend the Service, in whole or in part, if needed to protect it or other customers, if you break clause 8.2, or under clause 6.7. We’ll tell you why and restore it as soon as the reason is resolved.
14.6 After ending. The Service stops reading new emails. You keep read-only access and can export your Customer Data for 30 days. We then delete it as set out in Annex D, and confirm on request.
15. Changes to these terms
We may update these terms with at least 30 days’ notice by email to your account’s admins and in the Service. Each version has a number and effective date. If a change materially disadvantages you, you can cancel before it takes effect, without penalty. Changes required by law may take effect sooner.
16. General
16.1 Notices to you go to your account admins’ email addresses, and important notices are also shown in the Service; notices to us go to legal@ordavela.com. Email notices take effect on the next business day after sending. If an email can’t be delivered, the notice in the Service counts. You must keep at least one admin email address working. Notices of a claim or to end these terms for breach must be sent by email to the addresses in this clause.
16.2 Subcontractors. We may use subcontractors and stay responsible for them. Sub-processors of personal data are covered by Part 3.
16.3 Events outside our control. Neither of us is liable for delays caused by events beyond reasonable control.
16.4 Assignment. You may not transfer these terms without our consent. We may transfer them as part of a sale or reorganisation of our business, and will tell you.
16.5 Entire agreement. These terms are the whole agreement about the Service. Nobody else can enforce them.
16.6 Law and courts. These terms are governed by the law of England and Wales, and its courts have exclusive jurisdiction.
Data Processing Agreement
1. About this agreement
1.1 This agreement forms part of the Terms of Service. It applies whenever Aurican processes personal data in Customer Data for the Customer.
1.2 “Data Protection Law” means the laws on personal data that apply to that processing, which may include the UK GDPR and Data Protection Act 2018, the EU GDPR, US state privacy laws, and the laws of other countries where the Customer operates.
2. Roles
2.1 The Customer is the controller (or, under US state laws, the business) of personal data in Customer Data. Aurican is its processor (or service provider).
2.2 Aurican is the controller of Account Data, as described in its privacy notice.
3. Instructions
3.1 Aurican processes personal data only on the Customer’s documented instructions. The Terms of Service, the Customer’s settings in the Service and its support requests are its instructions.
3.2 Aurican will tell the Customer if it believes an instruction breaks Data Protection Law.
3.3 Aurican will not sell personal data or use it for any purpose other than providing the Service.
3.4 Processing required by law. If the law requires Aurican to process personal data other than on the Customer’s instructions, Aurican will tell the Customer first, unless the law forbids it.
4. Confidentiality
Everyone Aurican allows to process personal data is bound by a duty of confidence.
5. Security
5.1 Aurican will apply the measures in Annex B, appropriate to the risk.
5.2 Aurican may update those measures, as long as the level of protection does not go down.
6. Sub-processors
6.1 The Customer gives general authorisation for the sub-processors of Customer Data listed in Annex C, part 1.
6.2 Aurican will tell the Customer at least 30 days before adding or replacing a sub-processor of Customer Data. The Customer may object on reasonable data protection grounds. If the objection can’t be resolved, the Customer may end the affected Service, with a refund of fees paid in advance for the remaining period.
6.3 Aurican will bind each sub-processor by written contract to data protection obligations no less protective than this agreement, and stays fully responsible to the Customer for each sub-processor’s performance.
7. Help to the Customer
Aurican will give reasonable help, taking into account the nature of the processing, with:
- requests from people exercising their data protection rights (most can be handled by the Customer directly in the Service, including export and deletion); and
- security, data protection impact assessments and consultations with regulators.
8. Personal data breaches
8.1 Aurican will tell the Customer without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting Customer Data.
8.2 The notice will include what happened, when, the data and people likely affected, likely consequences, what Aurican has done, and a contact. Information not yet known follows as soon as it is.
8.3 The Customer decides on any notice to regulators or individuals. Aurican’s notice is not an admission of fault.
9. Deletion and return
At the end of the Service, the Customer can export its Customer Data for 30 days. Aurican then deletes it as set out in Annex D, unless the law requires it to be kept, and will confirm deletion on request. If it must keep any, it will protect it under this agreement and delete it when the requirement ends.
10. Audits
Aurican will make available all information needed to show it meets this agreement and Article 28, and will allow and contribute to audits, including inspections, by the Customer or an auditor it appoints. Practical arrangements, such as reasonable notice and confidentiality, may be agreed, but they don’t limit these rights.
11. International transfers
Where a transfer of personal data outside the Customer’s Data Region requires safeguards under Data Protection Law, the terms in Annex F apply.
12. US state privacy laws
Where US state privacy laws apply, Annex E also applies.
13. Liability
Clause 13 of the Terms of Service applies to this agreement.
Annexes
Annex A. Details of processing
| Item | Detail |
|---|---|
| Subject matter and purpose | Reading purchase orders from the Customer’s mailbox, matching them to its catalogue and prices, flagging problems, and sending orders its team approves to its ERP. Support, and keeping the Service secure. |
| Duration | The subscription (and Trial), plus the export and deletion periods in Annex D. |
| Nature of processing | Collecting from the connected mailbox, storing, reading with an AI model, matching, displaying to Users, sending to the connected ERP, deleting. |
| Types of personal data | Names, job titles, work email addresses and phone numbers of the Customer’s customers’ staff who send purchase orders; delivery contact names and addresses; names and sign-in identifiers of the Customer’s Users. |
| Data subjects | The Customer’s customers’ staff and delivery contacts; the Customer’s Users. |
| Sensitive Data | Prohibited Data is not intended and is prohibited; Restricted Data is not used (Terms clause 7). Either may be received inadvertently and processed before detection; detected orders are set aside and their content deleted automatically. Company bank details on purchase orders are ordinary business information. |
| Retention | As set by the Customer in the Service, and Annex D. |
Annex B. Security measures
The following technical and organisational measures apply to the Service.
| Area | Measure |
|---|---|
| Separation | Each customer’s data is separated in the database by enforced row-level security. |
| Credentials | The Service signs in to its database, storage and AI model with a managed identity. Database password sign-in is switched off. No stored passwords between services. |
| Encryption | In transit (TLS) and at rest (Azure storage and database encryption, with Microsoft-managed keys). |
| User access | Users sign in with Microsoft Entra. Roles limit what each User can do. |
| Staff access | Aurican staff access to Customer Data only for the reasons in Terms clause 9.2. Each access recorded. Access rights reviewed every 3 months. Multi-factor sign-in on every Aurican account. |
| Logs | Application logs hold ids and counts only, never order content (lines, prices, addresses, names). |
| Health reports | Counts and times only; the receiving service refuses any other field. |
| AI | The model only suggests; rules decide what needs review; a person approves every order. No training on Customer Data. |
| Approval | No order reaches the ERP without a User’s approval, including retries and background jobs. |
| Testing | Every change is tested automatically, including a browser test and an accuracy check on synthetic data. Real customer documents are never used in development or testing. |
| Vulnerabilities | Security updates to the Service and its components applied within 14 days, or 72 hours for critical issues being exploited. |
| Backups and recovery | Database backups kept for 7–35 days in the Data Region, then expire. Restore tested at least once a year. |
| Incidents | Written procedure for detecting, assessing, containing, escalating and notifying incidents, tested before launch. |
Annex C. Sub-processors and service providers
Part 1. Sub-processors of Customer Data (covered by DPA clause 6)
| Sub-processor | What it does | Location |
|---|---|---|
| Microsoft (Azure, Azure OpenAI) | Hosting, database, file storage, AI model, connection to the Customer’s Microsoft 365 mailbox | The Customer’s Data Region (United Kingdom, European Union or United States), including AI processing |
Part 2. Aurican’s own service providers (Account Data only, no Customer Data; Aurican is controller; listed for transparency and in Aurican’s privacy notice)
| Provider | What it does | Location |
|---|---|---|
| Supabase | Aurican’s account database | United Kingdom (London) |
| Vercel | Hosting for Aurican’s account system and sign-up page | US |
| Stripe | Billing and payments | UK entity; may process in the US |
| Resend | Service emails (sign-up confirmation, reminders) | US |
Annex D. Retention by data category
| Category | What it holds | How long |
|---|---|---|
| Order content (Customer Data) | Purchase order lines, prices, addresses, contact details, issue details, email subject and body, attachments | The period the Customer sets. Then deleted automatically, or after admin approval; under “approve first”, the Customer chooses whether unapproved orders are deleted after 30 days’ grace or kept until approved. |
| Set-aside (Sensitive Data) material (Customer Data) | Attachments and raw email of orders set aside under Terms clause 7.4 | Deleted automatically after 7 days. |
| Order records after deletion (Customer Data) | Ids, dates, status, issue codes, sensitive flag (no names, addresses or order content) | For the life of the account; included in exports; deleted with the account. |
| Audit log (Customer Data) | Who did what and when, by id (Users’ ids, order ids) | For the life of the account; included in exports; deleted with the account. |
| Security and access logs (Aurican’s records) | Sign-ins, staff access records | 12 months, for security, then deleted. Not exported. |
| Billing records (Account Data, Aurican’s records) | Invoices, payments, Billable Order counts | 6 years, for UK tax law. |
| Backups | Copies of the database | 7–35 days, then expire. Deleted data drops out of backups when they expire. |
| After the account ends | All Customer Data | Export available for 30 days, then deleted within 30 days. Backups expire as above. |
Annex E. US state privacy terms
Where US state privacy laws (for example the California Consumer Privacy Act, as amended) apply, Aurican as service provider:
- processes personal information only for the business purpose of providing the Service, as described in Annex A;
- does not sell or share it (including for cross-context behavioural advertising);
- does not retain, use or disclose it outside the direct business relationship with the Customer, or for any other purpose;
- does not combine it with personal information from other sources, except as those laws allow;
- complies with those laws and provides the same level of privacy protection they require;
- tells the Customer if it can no longer meet these obligations, and lets the Customer take reasonable steps to stop and remedy unauthorised use; and
- certifies that it understands and will comply with these restrictions.
Annex F. International Data Transfers
F.1 General principles
F.1.1 Aurican shall process Customer Data in accordance with the Data Processing Agreement and the Data Region selected by the Customer, subject to the permitted access arrangements and exceptions described in the Terms of Service.
F.1.2 Where processing involves a transfer of personal data that is restricted under applicable Data Protection Law, Aurican shall ensure that the transfer is supported by a valid legal transfer mechanism before it takes place.
F.1.3 Such mechanisms may include:
(a) an applicable adequacy decision or adequacy regulation;
(b) the EU–US Data Privacy Framework or its UK Extension, where the recipient holds an applicable and valid certification;
(c) the European Commission's Standard Contractual Clauses for international transfers;
(d) the United Kingdom's International Data Transfer Agreement (IDTA) or International Data Transfer Addendum to the EU Standard Contractual Clauses; or
(e) another transfer mechanism expressly permitted by applicable Data Protection Law.
F.1.4 The transfer mechanism used shall depend on the countries involved, the roles of the transferring and receiving parties, and the applicable legal requirements.
F.2 Transfers involving the United Kingdom
F.2.1 Where personal data is transferred from the European Economic Area to Aurican in the United Kingdom, the transfer may rely on the European Commission's applicable adequacy decision for the United Kingdom for as long as that decision remains valid and covers the transfer.
F.2.2 Where Aurican transfers personal data from the United Kingdom to a recipient in a country not covered by applicable UK adequacy regulations, Aurican shall ensure that appropriate safeguards are in place, including the IDTA or the UK Addendum where applicable, or another legally recognised transfer mechanism.
F.2.3 Where required, Aurican shall undertake an appropriate transfer risk assessment and implement supplementary safeguards.
F.3 Transfers involving the European Economic Area
F.3.1 Customer Data hosted within the Customer's selected European Data Region shall be stored and processed in accordance with the regional commitments in the Terms of Service.
F.3.2 Where personal data subject to the EU GDPR is transferred to a recipient outside the European Economic Area and the transfer is not covered by an applicable adequacy decision, Aurican shall ensure that a lawful transfer mechanism is established.
F.3.3 Where the EU Standard Contractual Clauses are required, the parties shall enter into the applicable clauses under Commission Implementing Decision (EU) 2021/914, using the modules corresponding to their respective roles.
F.3.4 The applicable Standard Contractual Clauses, including the selected modules, options and completed annexes, shall be incorporated into the relevant contractual arrangements and made available to the Customer as required by Data Protection Law.
F.4 Transfers involving the United States
F.4.1 Where Customer Data is hosted in the United States at the Customer's request, Aurican shall apply the security, access and regional processing commitments described in the Data Processing Agreement.
F.4.2 Where a transfer from the United Kingdom to a United States recipient is subject to the UK GDPR's international transfer requirements, Aurican shall use an applicable transfer mechanism, including the UK Extension to the EU–US Data Privacy Framework where the recipient qualifies, or appropriate contractual safeguards.
F.4.3 Where a transfer subject to the EU GDPR is made to a United States recipient, Aurican shall rely on an applicable adequacy decision, including the EU–US Data Privacy Framework where the recipient qualifies, or other appropriate safeguards such as the EU Standard Contractual Clauses.
F.4.4 Aurican shall verify any relevant Data Privacy Framework certification before relying on it and shall reassess the transfer mechanism if the recipient ceases to qualify.
F.5 Subprocessors and onward transfers
F.5.1 Aurican may engage subprocessors in accordance with the Data Processing Agreement and the subprocessor arrangements described in Annex C.
F.5.2 Aurican shall ensure that subprocessors receiving Customer Data are subject to written contractual obligations and appropriate safeguards required by applicable Data Protection Law.
F.5.3 Aurican shall ensure that any restricted onward transfer by a subprocessor is subject to an applicable lawful transfer mechanism.
F.5.4 Aurican shall remain responsible to the Customer for its subprocessors' performance of their data protection obligations, as provided in the Data Processing Agreement.
F.6 Customers in other jurisdictions
F.6.1 Where a Customer is established outside the United Kingdom, European Economic Area or United States, the Customer is responsible for identifying legal requirements applicable to its disclosure of personal data to Aurican and for informing Aurican of any additional transfer restrictions relevant to the Service.
F.6.2 Aurican shall comply with international transfer requirements applicable to Aurican and shall reasonably cooperate with the Customer in establishing any additional safeguards required for the Service.
F.6.3 Where additional contractual arrangements are legally required and cannot be satisfied through the standard Data Processing Agreement, the parties shall agree those arrangements before the affected personal data is transferred.
F.6.4 Aurican shall not be required to undertake a transfer or processing activity that would violate applicable law.
F.7 Changes to transfer mechanisms
F.7.1 Aurican shall periodically review the transfer mechanisms on which it relies and shall take appropriate action where a mechanism is withdrawn, invalidated or ceases to cover an applicable transfer.
F.7.2 Where necessary, Aurican shall implement an alternative lawful mechanism, apply additional safeguards or suspend the affected transfer until it can lawfully resume.
F.7.3 Aurican shall notify affected Customers of material changes that significantly affect the lawful processing of their personal data.
F.8 Relationship with other contractual provisions
F.8.1 This Annex forms part of the Data Processing Agreement.
F.8.2 Where applicable Standard Contractual Clauses, an IDTA or a UK Addendum conflict with another provision of the agreement, the mandatory provisions of the relevant transfer instrument shall prevail to the extent of that conflict.
F.8.3 Nothing in this Annex shall be interpreted as reducing any mandatory protection afforded to individuals under applicable Data Protection Law.
Schedule F1 — International Data Transfer Particulars
Ordavela — Terms of Service and Data Processing Agreement
Effective date: The date on which the Customer accepts the Agreement, or such other date as the parties agree.
This Schedule forms part of Annex F of the Data Processing Agreement between Aurican Analytics Ltd ("Aurican") and the Customer.
1. Parties to the Agreement
1.1 Data Exporter — Customer
| Particular | Detail |
|---|---|
| Legal entity | The Customer identified in the accepted order form or subscription registration |
| Registered address | As provided during registration |
| Contact details | The Customer's designated account administrator or privacy contact |
| Role | Controller, or processor acting on behalf of another controller, as applicable |
| Relevant activities | Provision of purchase orders, catalogue information, customer records and associated personal data for processing through the Service |
| Acceptance date | Recorded electronically when the Customer accepts the Agreement |
1.2 Data Importer / Service Provider — Aurican
| Particular | Detail |
|---|---|
| Legal entity | Aurican Analytics Ltd |
| Jurisdiction | England and Wales, United Kingdom |
| Company registration number | 16686611 |
| Registered office | 27 Old Gloucester Street, London WC1N 3AX, United Kingdom |
| Privacy contact | privacy@ordavela.com |
| Role | Processor or subprocessor, as applicable |
| Relevant activities | Hosting, document extraction, order validation, customer support, security monitoring and transmission of approved orders to the Customer's ERP |
| Acceptance date | The effective date of the Agreement |
Where the applicable transfer mechanism requires additional parties, including a Microsoft contracting entity, those parties shall be identified in the relevant transfer instrument.
2. Description of Personal Data Processing
2.1 Categories of data subjects
The personal data processed may relate to:
(a) employees, representatives and authorised users of the Customer;
(b) employees and representatives of the Customer's own customers;
(c) individuals identified as delivery contacts; and
(d) other individuals whose information is incidentally included in purchase orders or related business correspondence.
2.2 Categories of personal data
The personal data may include:
(a) names, business email addresses, telephone numbers and job titles;
(b) business and delivery addresses;
(c) purchase order references, transaction records and correspondence;
(d) user identifiers, approval records and audit information; and
(e) other ordinary business information contained in documents submitted to the Service.
Prohibited Data and Restricted Data are governed by clause 7 of the Terms of Service. Such information is not intentionally collected for the Service's ordinary processing purposes but may be incidentally received and processed before detection.
2.3 Processing activities and purposes
The processing comprises:
(a) retrieving emails and attachments from authorised customer mailboxes;
(b) extracting and interpreting purchase order information;
(c) validating information against customer catalogues, prices and records;
(d) presenting extracted information for review and approval;
(e) transmitting approved orders to the Customer's connected ERP or producing the applicable export file;
(f) maintaining operational and security records; and
(g) providing customer support and maintaining the Service.
2.4 Frequency and duration
Processing occurs continuously or as initiated by the Customer throughout the subscription or trial period.
Personal data is retained in accordance with the Customer's configured retention settings and Annex D of the Data Processing Agreement, including any applicable post-termination export and deletion periods.
3. Customer Data — International Transfer Register
The following arrangements apply only where the relevant service region or data flow is enabled.
| Reference | Data flow | Parties and roles | Expected transfer mechanism |
|---|---|---|---|
| T1 | UK Customer to UK-hosted Service | Customer (controller) → Aurican (processor) | No restricted international transfer solely from UK hosting and UK processing |
| T2 | EEA Customer to UK-hosted Service | EEA Customer (controller) → Aurican (UK processor) | European Commission adequacy decision for the UK, while applicable |
| T3 | EEA Customer to EU-hosted Service | EEA Customer (controller) → Aurican (UK processor), with EU infrastructure | Assess whether any restricted transfer occurs through UK access or other processing; EU→UK adequacy where applicable |
| T4 | UK Customer to EU-hosted Service | UK Customer (controller) → Aurican (UK processor), with EU infrastructure | UK adequacy regulations for the relevant EEA destination, where applicable |
| T5 | EEA Customer to US-hosted Service | EEA Customer (controller) → Aurican (UK processor), with US infrastructure | Assess the relevant exporter/importer and onward transfer arrangements; valid EU–US Data Privacy Framework certification or EU SCCs where required |
| T6 | UK Customer to US-hosted Service | UK Customer (controller) → Aurican (UK processor), with US infrastructure | UK Extension to the EU–US Data Privacy Framework, where applicable; otherwise UK IDTA, UK Addendum or another lawful mechanism |
| T7 | Aurican UK support access to EU-hosted Customer Data | EU-hosted service → Aurican personnel in the UK | EU→UK adequacy where applicable; verify the parties and whether a restricted transfer occurs |
| T8 | Aurican UK support access to US-hosted Customer Data | US-hosted service → Aurican personnel in the UK | Assess applicable US, contractual and onward-transfer requirements; UK processing remains subject to UK data protection obligations |
| T9 | Aurican to Microsoft for Customer Data processing | Aurican (processor) → Microsoft contracting entity (subprocessor) | Applicable Microsoft contractual safeguards and transfer arrangements, as verified for the relevant service and region |
| T10 | Customer located outside the UK, EEA or US | Customer → Aurican and relevant service providers | Applicable origin-country requirements, adequacy arrangements or contractual safeguards, to be determined before the affected transfer |
The table records expected arrangements and does not itself establish that every listed transfer mechanism applies to a particular deployment.
4. Account Data — Provider Transfer Register
Aurican acts as controller for the Account Data identified in the Terms of Service.
| Provider | Processing purpose | Data categories | Primary location / transfer status |
|---|---|---|---|
| Supabase | Account database and subscription administration | Company details, account contacts, user identifiers, subscription information and operational counts | UK (London) database region; verify support access, subprocessors and other processing locations |
| Vercel | Hosting the website and account portal, including account registration | Account registration details, session information and related technical metadata | Vercel’s primary processing facilities are in the United States. Processing may also occur in other locations through its global infrastructure and service providers. Where a transfer mechanism is required, the applicable safeguards are set out in Schedule 3 of Vercel’s Data Processing Addendum. (vercel.com/legal/dpa) |
| Stripe | Subscription billing and payment processing | Billing contact details, payment information and transaction records | Personal data may be transferred to Stripe, LLC in the United States and processed by Stripe affiliates and service providers in other jurisdictions. Stripe acts as a processor or controller depending on the activity. Where a transfer mechanism is required, the applicable safeguards are set out in Stripe’s Data Transfers Addendum. |
| Resend (Plus Five Five, Inc.) | Sending transactional service emails | Recipient email addresses, service notification content and delivery metadata | Resend’s primary processing operations are in the United States. Where a transfer mechanism is required, the applicable safeguards are set out in section 6 of Resend’s Data Processing Addendum. |
Aurican shall maintain appropriate controller-side arrangements with these providers, including applicable data processing contracts and international transfer safeguards.
No purchase order content shall intentionally be transmitted to these providers through Aurican's account and operational systems, except where separately authorised and documented.
5. Applicable Transfer Instruments
5.1 European Union Standard Contractual Clauses
Where required, the parties shall use the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, including the applicable module:
- Module One: Controller to controller.
- Module Two: Controller to processor.
- Module Three: Processor to processor.
- Module Four: Processor to controller, where applicable.
For each transfer requiring the EU SCCs, the parties shall complete the required contractual particulars, including the identities and roles of the parties, applicable options, transfer description, competent supervisory authority, technical and organisational measures, and subprocessor information.
5.2 United Kingdom International Data Transfer Instruments
Where required for a transfer subject to the UK GDPR, the parties shall use:
(a) the United Kingdom International Data Transfer Agreement; or
(b) the United Kingdom International Data Transfer Addendum to the EU Standard Contractual Clauses;
or another valid transfer mechanism permitted by applicable law.
The applicable instruments shall be completed and made legally binding before the relevant restricted transfer.
5.3 Adequacy and Data Privacy Framework
Where a transfer relies on adequacy regulations or an adequacy decision, Aurican shall verify that the arrangement remains applicable to the relevant transfer.
Where reliance is placed on the EU–US Data Privacy Framework or its UK Extension, Aurican shall verify that the recipient has a valid certification covering the relevant personal data and processing.
6. Technical and Organisational Safeguards
The technical and organisational measures set out in Annex B apply to Customer Data processing, subject to the actual systems and processing arrangements implemented.
These measures include:
(a) encryption of data in transit and at rest;
(b) access restrictions based on authorised roles;
(c) separation of customer data;
(d) access logging and security monitoring;
(e) controls governing administrative access;
(f) restrictions on the use of Customer Data for AI model training;
(g) incident detection and response procedures; and
(h) retention, deletion, backup and recovery controls.
Where the applicable transfer instrument requires additional, transfer-specific safeguards, those safeguards shall be documented and implemented.
7. Transfer Assessments
Before relying on contractual safeguards for a restricted international transfer, the responsible party shall complete any data protection test, transfer impact assessment or equivalent assessment required by applicable law.
The assessment shall consider, as applicable:
(a) the relevant countries, recipients and processing activities;
(b) the categories and sensitivity of personal data;
(c) the legal and practical risks affecting protection of the data;
(d) access by public authorities;
(e) the technical, contractual and organisational safeguards in place; and
(f) whether supplementary measures are necessary.
Assessments shall be reviewed where material changes occur.
8. Contractual Incorporation and Changes
8.1 This Schedule forms part of Annex F of the Data Processing Agreement.
8.2 The Customer's identity, selected Data Region and acceptance date shall be determined from the Customer's accepted subscription or order form and the associated electronic acceptance record.
8.3 Where an additional transfer instrument is legally required, it shall be completed and incorporated into the parties' contractual arrangements before the relevant restricted transfer takes place.
8.4 Aurican shall maintain a record of applicable transfer arrangements and shall review them when adding subprocessors, enabling new Data Regions or materially changing international processing arrangements.
8.5 Where mandatory provisions of an applicable transfer instrument conflict with this Schedule or other contractual provisions, the mandatory provisions of that instrument shall prevail to the extent of the conflict.
8.6 This Schedule does not authorise any transfer prohibited by applicable Data Protection Law.
End of Schedule F1