Effective date: September 2, 2026
Last updated: September 2, 2026
This Data Processing Addendum (“DPA”) forms part of the agreement between Orbit Info Tech (OiT), Muscat, Sultanate of Oman (“OiT”, “73PiXEL”, “Processor”, “we”, or “us”) and the customer identified in the applicable order (“Customer” or “Controller”) where 73PiXEL processes Personal Data on Customer’s behalf in connection with the services.
1. Scope and Roles
This DPA applies only to Personal Data processed by 73PiXEL as a processor or service provider on Customer’s documented instructions. For data we process for our own account administration, legal compliance, fraud prevention, product security, or direct commercial relationship, we may act as an independent controller as explained in our Privacy Policy. Freemius acts as merchant of record for checkout and may independently determine purposes required for payments, tax, invoicing, fraud prevention, and legal compliance under its own terms.
2. Definitions
“Applicable Data Protection Law” means the data-protection and privacy law applicable to the processing, including, where applicable, Oman’s Personal Data Protection Law and its Executive Regulation. “Personal Data”, “process”, “controller”, “processor”, and “data subject” have the meanings given by applicable law. “Subprocessor” means a third party engaged by 73PiXEL to process Personal Data on Customer’s behalf.
3. Processing Details
- Subject matter: provision, licensing, support, security, maintenance, and operation of the services.
- Duration: the service term plus the limited period needed for deletion, backup rotation, dispute resolution, and legal obligations.
- Nature and purpose: hosting, transmitting, organizing, retrieving, troubleshooting, securing, and deleting data as necessary to provide the services.
- Data subjects: Customer personnel, administrators, authorized users, support contacts, and individuals whose data Customer submits through the services.
- Data types: contact and account information, site and license identifiers, IP and device data, diagnostic logs, support content, and other data Customer chooses to submit.
Customer must not submit special-category, highly sensitive, children’s, payment-card, authentication-secret, or regulated data unless expressly supported and agreed in writing.
4. Customer Instructions and Responsibilities
Customer instructs 73PiXEL to process Personal Data as necessary to provide the services, comply with the agreement, and follow additional lawful written instructions accepted by us. Customer is responsible for the lawfulness, accuracy, transparency, notices, consents, legal bases, and data-subject requests relating to data it controls.
5. Confidentiality
We will ensure personnel authorized to process Personal Data are subject to appropriate confidentiality obligations and receive access only as needed for their duties.
6. Security Measures
Taking account of the nature, scope, context, purposes, risk, and available technology, we will maintain reasonable technical and organizational measures designed to protect Personal Data. Measures may include access control, least privilege, authentication safeguards, encrypted transport, logging, backups, vulnerability management, secure development practices, provider due diligence, and incident-response procedures.
7. Subprocessors
Customer provides general authorization for the Subprocessors listed in our Subprocessor List. We will require a Subprocessor to protect Personal Data through written terms appropriate to the services it performs. We remain responsible for our obligations under this DPA to the extent required by applicable law. We may update the list and will provide a reasonable opportunity to object to a new Subprocessor on legitimate data-protection grounds.
8. International Transfers
Customer authorizes processing in Oman and in other countries where 73PiXEL or approved providers operate. We will use a lawful transfer mechanism and supplementary safeguards where required. Customer is responsible for any transfer instructions it originates and for obtaining required approvals that apply to it.
9. Data-Subject Requests
Taking account of the nature of processing, we will provide reasonable assistance for Customer to respond to lawful requests from data subjects. If we receive a request concerning data processed solely for Customer, we may direct the requester to Customer unless law requires otherwise.
10. Security Incidents
We will notify Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting Customer data, to the extent required by law. Notice will include available information reasonably needed for Customer’s response. Notification is not an admission of fault or liability. Customer is responsible for any notification or remediation obligations applicable to it.
11. Deletion and Return
At the end of services, and upon Customer’s reasonable request, we will delete or return Personal Data processed on Customer’s behalf unless retention is required by law. Data may remain temporarily in secure backups until ordinary rotation, subject to continued protection and no further active use.
12. Compliance Information and Audits
We will make available information reasonably necessary to demonstrate compliance with this DPA. Before requesting an audit, Customer must use available documentation and questionnaires. Any audit must be legally required or reasonably justified, occur no more than once annually unless following a material incident, protect confidentiality and security, avoid disruption, and be at Customer’s cost unless material noncompliance is found.
13. Liability and Order of Precedence
The liability limitations in the main agreement apply to this DPA to the maximum extent permitted by law. If this DPA conflicts with the main agreement regarding processing of Personal Data, this DPA controls. Mandatory law prevails over both.
14. Governing Law and Contact
This DPA is governed by the laws of the Sultanate of Oman, subject to mandatory applicable data-protection law. Privacy and DPA requests: info@73pixel.com.