Skip to content

Legal

Privacy noticeTerms of serviceCancellation and refundsData processing agreementCookiesYour dataImprint

Data processing agreement

Last updated 2026-10-16

This agreement applies when an organisation uses OrganMatch™. It is part of our Terms of service and applies automatically to every organisation: nothing needs to be signed. It is the contract that Article 28 of the EU General Data Protection Regulation (GDPR) requires between a controller and its processor.

The parties are the organisation ("you", the controller) and Organthis FlexCo, Villefortgasse 11, 8010 Graz, Austria, registered under FN 647245g at the Landesgericht für ZRS Graz ("we", the processor).

1. What this agreement covers

It covers the personal data that your organisation and its members enter into OrganMatch, and the records OrganMatch keeps for your organisation (section 4 lists them).

It does not cover the data we process for our own purposes, as controller. Our privacy notice describes that data, for example each person's own account, billing and invoices, security records, and the records of how accounts use protocols.

2. How long it runs

For as long as your organisation uses OrganMatch, and after that until we have deleted the data as section 11 says.

3. What we do with the data, and why

We store, organise, show, back up, export and delete the data. We do this only to provide OrganMatch to your organisation under the Terms of service: to keep your Lab Book, to manage your members and invitations, to keep your organisation's audit trail, and to send the emails and webhook messages your organisation sets up.

4. Which personal data

  • names, email addresses and roles of your members, and of the people you invite;
  • what members record in the Lab Book: runs, steps, notes, deviations and their reasons, reagents, lot and batch numbers, yields and outcomes, and who did what and when;
  • your organisation's audit trail: which member took which action, and when;
  • the API keys and webhook endpoints your organisation creates, and their delivery records;
  • any other personal data a member types into a free-text field.

Do not enter special categories of personal data (Article 9 GDPR), such as health data that identifies a patient or a tissue donor. OrganMatch is not built for them.

5. Whose data

Your members, the people you invite, and the people your members name in Lab Book records, for example a colleague who carried out a step.

6. Your instructions

We process the data only on your documented instructions. These terms, and the settings and actions of your organisation's owner, administrators and members in OrganMatch, are your instructions. If the law requires us to process the data in another way, we tell you first, unless that law forbids it. If we think an instruction breaks data protection law, we tell you.

One of these settings is a member's choice to contribute a Lab Book run's outcome. A run is kept private unless a member chooses otherwise. A member who contributes an outcome does so on your organisation's behalf, and that choice is your instruction. What happens to a contributed outcome is set out in section 9 of the Terms of service.

7. Confidentiality

Everyone at Organthis FlexCo who can access the data is bound to confidentiality. We treat the data as your confidential information, as section 9 of the Terms of service describes. We do not use it for our own purposes, we do not sell it, and we do not use it to train AI models. We never send it to an outside AI service.

Contributed run outcomes are used only as part of the service: their viability values count towards the anonymised network median that Professional and Enterprise accounts see, on the instruction of the member who contributed them on your organisation's behalf (section 6). The median holds no personal data: no name, no account and no single run.

8. How we keep the data secure

  • Every connection to OrganMatch is encrypted (HTTPS only).
  • Passwords are stored only as hashes, never as the password itself.
  • Repeated sign-in attempts to an account are refused for up to 15 minutes.
  • Each member sees only what their role in your organisation allows, and your organisation's audit trail cannot be changed afterwards.
  • The servers run in Hetzner data centres in the European Union. Only web traffic and our own administrative access reach them, and only our staff who need it can sign in to them.
  • We back up the database every night and keep each backup for about two weeks. A copy goes over an encrypted connection to a separate Hetzner storage box in the European Union.
  • Server logs do not record visitors' network addresses, and email addresses in them are masked.

9. Sub-processors

We use one sub-processor for your organisation's data:

  • Hetzner Online GmbH (Gunzenhausen, Germany): hosting. The application, the database and the backups, including the copy on a Hetzner storage box, run on servers we rent from Hetzner in the European Union. The emails OrganMatch sends, such as invitations, are sent through Hetzner's mail servers.

You give us general authorisation to use it. We bind every sub-processor to the same data protection duties as this agreement, and we remain responsible to you for its work.

We tell your organisation's owner by email at least 30 days before we add or replace a sub-processor. You can object within that time. If we cannot meet your objection, you can end your plan, or stop using OrganMatch for your organisation, before the change takes effect, and we refund the unused part of the period you paid for.

Not sub-processors for this data: Mollie (payments), the European Commission's VIES service (VAT ID checks) and our tax adviser receive billing data, which we handle as controller under our privacy notice. Anthropic receives only the text of published papers, never your data.

10. How we help you

As far as we reasonably can, we help you to answer requests from people who use their data protection rights, such as access, correction and erasure. If such a request about your organisation's records reaches us directly, we pass it to you.

We also help you with security, with data protection impact assessments and with consulting a supervisory authority (Articles 32 to 36 GDPR). If we become aware of a personal data breach that affects your data, we tell your organisation's owner without undue delay.

11. At the end

Your organisation's data stays in OrganMatch after a plan ends, as section 13 of the Terms of service says. When your organisation stops using OrganMatch, you choose what we do with it, and we do it within one month of your request:

  • return it: we prepare a machine-readable copy and send it to you;
  • delete it;
  • or both: first the copy, then the deletion.

Your organisation's audit trail is the exception. It cannot be changed or deleted: it is what shows who changed which record and when, and it may be needed to establish or defend legal claims. We keep it with the closed organisation's record. When we close an organisation, we rename it, revoke its API keys and switch off its webhooks. Deleted data can remain in a backup until that backup expires, about two weeks later. We also keep what the law requires us to keep.

12. Checks and audits

When you ask, we give you the information you need to show that we meet this agreement. We also allow audits, including inspections, by you or by an auditor you appoint who is bound to confidentiality. Please give us reasonable notice, and keep other customers' data out of reach of the audit.

13. Where the data is held

We store and process your organisation's data in the European Union, and we do not transfer it outside the European Economic Area.

14. The rest of the contract

If this agreement and the Terms of service disagree about how we process your organisation's personal data, this agreement applies. Everything else, such as liability, law and courts, follows the Terms of service.

Questions: contact@organthis.com or support@organthis.com, +43 680 55 00 909.