Terms & Conditions for Associations (Orbi Association)
Effective Date: [2025-06-26]
Published by: Ornamental Tree AB ("Orbi"), Reg. No. 559032-9735, Vallgatan 26, 411 16 Gothenburg, Sweden
Last updated: [2025-06-26]
1. Principles and Interpretation
1.1 The co-operation between the Parties in this Contract shall be influenced by the principles of transparency and accessibility.
1.2 By signing this Contract, the Buyer confirms that the content has been reviewed and understood in its entirety.
1.3 The Seller and the Buyer are in this Contract jointly referred to as the "Parties" or individually as a "Party."
2. Background
2.1 The Seller provides a digital platform aimed at simplifying operations for student associations, unions, and other similar organizations. Through the platform, student associations can:
- Sell tickets to events.
- Create profiles for themselves and their partner companies.
- Publish and manage job advertisements for exposure to their followers.
- Offer local discounts to their followers.
- Manage memberships and provide students with access to a digital student card.
- Facilitate corporate engagement through Connect, enabling access to tools such as the Talent Pool and analytics.
2.2 The Service includes key features such as Orbi Career, Connect, Discount, Orbi Ticket, and Membership Management System.
3. Period of Validity and Notice of Termination
3.1 This Contract shall apply for one (1) year from the date of its entry into force and is automatically renewed unless terminated with 30 days’ notice.
3.2 It enters into force when signed.
3.3 Termination must be in writing and is effective upon receipt.
4. Profile
4.1 The Buyer receives a profile with access from the first day of the Contract.
4.2 Uses include managing events, jobs, discounts, and memberships.
4.3 Access may be restricted for violations or misuse.
5. The Seller’s Commitment
5.1 The Seller provides tools for profile management, events, memberships, analytics, support, and training.
6. Limitations of the Service
6.1 No illegal activities.
6.2 Buyer may not target users outside their audience.
6.3 Content must comply with laws.
6.4 The Seller may moderate content at its discretion.
7. Payment
7.1 The Service is free of charge, except for transaction fees.
7.2 The standard transaction fee is 1.5 SEK + 1.5% per ticket sold.
7.3 Weekly payouts are made to the Buyer's bank account.
8. Intellectual Property Rights
8.1 The Seller retains rights to the platform.
8.2 The Buyer retains rights to their content.
8.3 Logos may be used for marketing.
9. Limitations of Responsibility
9.1 No liability for indirect damages.
9.2 Liability capped at transaction fees over the past 12 months.
9.3 No guarantees beyond what's stated.
10. Personal Data
10.1 The Seller processes data per GDPR.
10.2 The Buyer is the data controller for all collected data.
10.3 Consent is required for data sharing in Connect/Talent Pool.
10.4 The Buyer must ensure GDPR compliance and user information.
10.5 The Seller shares data only when legally required or for investigations.
10.6 No marketing without consent.
10.7 Both parties must ensure data security.
10.8 Breach notifications must be handled promptly.
11. Confidentiality
11.1 All exchanged information is confidential.
11.2 The obligation lasts three (3) years after termination.
12. Force Majeure
12.1 Neither party is liable for events beyond their control, such as natural disasters or system failures.
13. Breach of Contract
13.1 Material breach allows immediate termination.
13.2 The breaching party must compensate damages.
14. Dispute and Governing Law
14.1 Governed by Swedish law.
14.2 Disputes handled by SCC arbitration in Gothenburg.
15. Connect
15.1 Connect enables associations to offer tools (e.g., Talent Pool) to clients.
15.2 The Buyer informs clients and ensures GDPR compliance.
15.3 Clients must accept Seller’s Terms.
15.4 Data is shared only with student consent.
15.5 Misuse is prohibited.
15.6 The Buyer is responsible for client compliance.
15.7 Content may be moderated by the Seller.
15.8 Data must be protected securely.
16. Orbi Career
16.1 Enables associations to publish jobs and create profiles for employers.
16.2 The Buyer must ensure accuracy and compliance.
16.3 Misuse of student data is prohibited.
16.4 The Buyer manages payments with employers.
16.5 Matching is not guaranteed.
16.6 The Seller only provides the platform.
16.7 The Buyer must protect and delete student data when appropriate.
16.8 The Seller may remove inappropriate content.
16.9 Misuse may result in suspension or legal action.
17. Discounts
17.1 Allows the Buyer to create local offers.
17.2 Discounts must be lawful and targeted.
17.3 Misuse or fraud is prohibited.
18. Version Management
18.1 Last updated: [2025-01-15].
18.2 Previous versions available on request.
18.3 Material changes require 30 days’ notice.
Schedule A – Data Processing Agreement (DPA)
1. Subject Matter and Duration
This DPA applies to the processing of personal data performed by Orbi on behalf of the Buyer within the scope of services described in the Terms and Conditions for Associations. It remains valid for the duration of the main agreement.
2. Nature and Purpose of Processing
Orbi processes personal data solely for the purpose of providing services such as ticketing, membership management, digital student cards, discount offerings, student engagement, and recruitment tools through Orbi Career and Connect.
3. Categories of Data Subjects
Students, ticket buyers, association members, administrators, and individuals who interact with the Buyer's content or services on the Orbi platform.
4. Categories of Personal Data
Name, email address, phone number, academic affiliation, study program, graduation year, IP address, payment metadata, event attendance, engagement behavior, and other data voluntarily submitted by users.
5. Obligations of the Data Processor (Orbi)
- Process personal data only on documented instructions from the Buyer.
- Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
- Ensure confidentiality and training of personnel authorized to process personal data.
- Assist the Buyer in fulfilling obligations related to data subjects’ rights (access, rectification, erasure, etc.).
- Notify the Buyer without undue delay in the event of a personal data breach.
- At the end of the agreement, delete or return all personal data unless otherwise required by law.
6. Subprocessors
The Buyer authorizes Orbi to engage the subprocessors listed in appendix A. Orbi shall ensure that any subprocessor is bound by data protection obligations no less protective than those in this DPA.
7. International Transfers
Orbi will not transfer personal data outside the EU/EEA unless such transfer is subject to appropriate safeguards under GDPR Chapter V.
8. Data Subject Rights
Orbi will assist the Buyer, as far as possible, to fulfill data subject requests under GDPR Articles 15–22.
9. Audit and Inspections
Upon request, Orbi will make available all necessary information to demonstrate compliance with this DPA and allow for and contribute to audits conducted by the Buyer or a third-party auditor mandated by the Buyer.
10. Liability and Indemnity
Each party shall be liable for its own actions or omissions under this DPA and GDPR. Orbi shall indemnify the Buyer for any damage caused by processing in violation of this DPA.
11. Termination and Deletion of Data
Upon termination of the main agreement, Orbi shall, at the Buyer’s choice, delete or return all personal data processed on the Buyer’s behalf, unless retention is required by Union or Member State law.
12. Governing Law and Jurisdiction
This DPA shall be governed by the laws of Sweden. Any disputes shall be resolved in accordance with the arbitration clause in the main agreement.
Appendix A – Subprocessors
Orbi uses the following trusted subprocessors to provide its services in accordance with GDPR Article 28. All data is processed within the EU/EEA unless otherwise stated.
|
Provider |
Purpose |
Data Location |
Categories of Personal Data |
|
Google Cloud Platform (GCP) |
Infrastructure and backend operations |
EU |
Identifiers, user activity, technical metadata |
|
HubSpot |
CRM, customer support, and sales processes |
EU |
Contact details, communication history, behavioral data |
|
Mailgun |
Transactional and system-related email delivery |
EU |
Email addresses, delivery metadata |
|
Customer.io |
Automated email and push notifications |
EU |
Email addresses, push tokens, user behavior |
|
Stripe |
Payment processing and invoicing |
EU |
Payment details, name, email, IP address |
|
Google Analytics |
Web analytics and behavioral analysis |
EU |
IP address, cookies, user interactions |
Orbi ensures that all subprocessors are bound by data processing agreements with equivalent safeguards and obligations as required under GDPR.