Data Processing Addendum

This addendum is part of the Ortix Aislo terms of service between your shop and Ortix Group LLC. It applies to personal information about other people that your shop puts into Ortix Aislo, mainly your customers, their drivers and fleet contacts, and your staff (“shop personal data”). It applies automatically; there is nothing to sign. If you need a signed copy, ask through our contact form.

• Your shop is the controller (in some state laws, the “business”): you decide why and how shop personal data is used.
• Ortix Group is the processor (or “service provider”): we process shop personal data only for you.
• For information about the users who sign in to your account, and for our own billing and security, Ortix Group decides as described in the privacy policy.

• People: your customers and their contacts, fleet and account contacts, drivers, vehicle owners, and your staff.
• Information: names, phone numbers, email and postal addresses, vehicles and VINs, plates, repair history, estimates, invoices, payment records, photos, inspection results, messages, texting consent and opt-outs, and anything else you choose to enter.
• Purpose: to provide Ortix Aislo to your shop: storing and showing records, sending the texts, emails and notifications you send or set up, taking payments, syncing to the services you connect, backups, support and security.
• How long: for as long as the terms run, and then as when the terms end describes.

The terms, your settings and what you and your users do in Ortix Aislo are your instructions. We follow them, and tell you if we believe an instruction breaks the law. You are responsible for having a lawful basis for the shop personal data you put into Ortix Aislo and for the messages you send, including consent to texts where the law requires it, and for giving your customers any privacy notice the law requires.

• We do not sell or share shop personal data, or use it for targeted or any other advertising.
• We do not use it for any purpose other than providing Ortix Aislo to you, or combine it with information from other shops or sources, except combined counts that identify no shop or person, used to run and improve Ortix Aislo.
• We do not keep, use or disclose it outside our direct business relationship with you.
• Everyone at Ortix Group who can reach it is bound to keep it confidential and reaches it only when the work needs it.
• We give it the same protection that the law requires of you, and tell you if we can no longer meet these promises.

You allow us to use the companies on the subprocessors page. Each is bound by a written contract with data protection terms at least as protective as this addendum, and we remain responsible for their work. We tell account owners by email at least 30 days before we add or replace one. If you object for a reasonable data protection reason, tell us; if we cannot address it, you can cancel and we refund any prepaid time you have not used.

We keep appropriate technical and organizational measures in place, including:

• encryption in transit (HTTPS) and at rest, and separate encryption keys for connection secrets;
• each shop's data kept separate in the database by row-level security, and permissions checked on our servers on every request;
• two-step sign-in for users, and limited, audited access for Ortix Group staff;
• an audit log of changes that cannot be edited;
• nightly encrypted backups, with restores tested regularly;
• releases tested before they go out, rolled out step by step, and able to be rolled back.

If we learn of a breach of security that affects shop personal data, we tell the account owner without undue delay, and within 72 hours of confirming it, with what happened, what information is involved, what we are doing, and who to contact. We help you meet any duty you have to tell customers or authorities.

You can export all shop personal data at any time, including after you cancel. When you ask us to delete it, or when it is deleted under the terms after non-payment, we delete it from Ortix Aislo. Copies in encrypted backups are deleted as those backups expire, on the schedule in the privacy policy, and are never restored except to recover from a failure; we keep only what the law requires us to keep.

• Requests from people: most requests to see, correct, export or delete information can be handled in Ortix Aislo itself. If someone asks us directly, we pass it to you and do not answer it ourselves unless you ask us to.
• Assessments: we give you the information you reasonably need for a data protection assessment of your use of Ortix Aislo.
• Checks: once a year, or after an incident, you may ask us to show that we meet this addendum. We answer in writing, and agree a review by an independent auditor under confidentiality if a written answer is not enough. You may also stop and fix any use of shop personal data you believe is unauthorized by telling us.
• Legal demands: if a government or court asks us for shop personal data, we tell you first unless the law forbids it, and disclose only what we must.

Shop personal data is stored and processed in the United States.

For shop personal data, this addendum wins over the rest of the terms. The terms' limits on liability apply to this addendum too.

Ortix Group LLC · Contact form

• 2026-10-30First published version.

Questions: use our contact form.