Draft for legal and processing-partner review. This document is not in effect, has not been approved by counsel or any payment provider, and does not create binding obligations. Bracketed items are unresolved and are tracked in the Launch Decision Register.

Data Processing Addendum

Version 0.1 — Effective date: not set

1. Application

1.1 This addendum applies where Orion Payments handles personal information about a merchant's customers on the merchant's behalf (for example, order details and payment status in checkout). It forms part of the Merchant Services Agreement.

1.2 Under Canadian private-sector privacy law, an organization remains accountable for personal information it transfers to a service provider for processing and must use contractual or other means to ensure comparable protection. This addendum is intended to support that accountability.

2. Roles

2.1 For customer information processed to provide checkout and payment tracking to the merchant, the merchant decides the purposes and Orion processes on the merchant's behalf.

2.2 For information Orion uses for its own purposes (security, fraud prevention, legal obligations, provider underwriting of the merchant), Orion is responsible under its Privacy Policy.

3. Orion's commitments

3.1 Process customer information only to provide the Services, on the merchant's documented instructions, and as required by law. 3.2 Limit access to personnel who need it and who are bound by confidentiality. 3.3 Maintain the safeguards described in the Privacy Policy and the controls register, appropriate to the sensitivity of the information. 3.4 Notify the merchant without undue delay after becoming aware of a breach of security safeguards affecting the merchant's customer information, with the information the merchant reasonably needs to meet its own obligations. 3.5 Assist the merchant, at reasonable cost, with access and correction requests. 3.6 Use sub-processors only under written terms with comparable protections, and maintain a list of sub-processors (none selected yet). 3.7 Disclose that information may be processed outside Canada (hosting: [Hosting region to be confirmed]). 3.8 On termination, return or delete customer information, subject to legal retention obligations ([Retention periods to be set]).

4. Merchant commitments

4.1 Provide notice to customers and obtain any consent required for Orion and the provider to process their information. 4.2 Not instruct Orion to process information unlawfully.

5. Payment providers

5.1 Providers process payment information under their own legal responsibilities and terms; they are not Orion's sub-processors for that purpose.

6. Public blockchains

6.1 Information recorded on a public blockchain is outside Orion's control and cannot be deleted or corrected by Orion.