Are you a data processor or a controller?

For the systems we build and maintain for you, we are a processor and you are the controller. We process personal data only on your documented instructions and never for our own purposes.

Where is our data stored?

Production usually runs in your own cloud account, in the EU region you choose. Test environments we host ourselves are on servers in Poland. Processing takes place in the EEA, and data leaves it only if you decide it should.

How fast will you tell us about an incident?

Without undue delay and no later than 24 hours after we become aware of it, so you can meet your 72-hour deadline towards the supervisory authority.

What happens to our data when the contract ends?

Within 10 business days we delete or return your data, including copies, as you choose. Within 7 business days after that we confirm it in writing. Backups are deleted when their retention cycle ends.

Do you sign a separate DPA for each project?

Yes. Each project has its own DPA and its own entry in our record of categories of processing activities.

Security and data protection at Order Group

Since 2013 we have delivered 160+ software projects in 15+ industries, including energy, fintech and IoT companies. Their compliance teams ask the same questions before they sign: who sees our data, where does it live, what happens when something goes wrong, who owns the code.

What you'll find below

Our role under GDPR
Where your data lives
Who gets access
How we protect systems
When something goes wrong
You own the code
Documents on request

Request security documents

Order Group team photo outdoors in matching black branded t-shirts

When we build or maintain a system that holds personal data, you are the controller and we are the processor. We process personal data only on your documented instructions and never for our own purposes.

For each project we sign a separate data processing agreement (DPA). It starts from our template based on Article 28(3) GDPR and is filled in for the actual work: the scope of services, the categories of data and data subjects, and the security measures that apply.

Each project also gets an entry in our record of categories of processing activities, as Article 30(2) GDPR requires. It lists the categories of data and data subjects, the security measures, where processing takes place and any subprocessors.

Our data protection policy and procedures are approved and signed by the management board. They cover authorisations and access rights, personal data breaches, privacy by design and by default, risk assessment and DPIA, retention and deletion, data subject rights and relations with suppliers. We review the procedures at least once every 12 months.

Where your data lives

Production: your cloud account

In most projects, production runs in your own cloud account, for example AWS, in the EU region you choose. You are the party to the contract with the cloud provider, so the provider is not our subprocessor. We get access to that environment to do our work. Your production data is not copied to our servers.

Data centre hall with rows of server cabinets and overhead cable trays

Test environments: Poland

The test environments we host ourselves run on servers in Poland. Processing takes place in the European Economic Area. Data goes outside the EEA only if you, as the controller, decide that it should. As the processor, we do not make that decision.

Smartphone with a padlock security screen on a desk (Unsplash, Dan Nelson)

Who gets access, and for how long

Named accounts only

Everyone on your project has their own account. Access to cloud infrastructure goes through roles (AWS IAM Identity Center), following the principle of least privilege. Shared accounts are not allowed unless there is a technical reason for them.

Approved requests and authorisations

Permissions are granted on a request approved by the head of the relevant department, and nobody processes personal data without a written or electronic authorisation. Temporary access has an expiry date. We keep a register of authorised people.

Multi-factor authentication

Applied according to the role and the risk.

Access ends with the role

When someone leaves the team, their accounts are removed without delay. We also review periodically who has access to project infrastructure.

Confidentiality without an end date

Everyone authorised to process data is bound by confidentiality that continues after the contract ends.

How we protect systems

We protect systems at the network, application and workstation level.

Network and traffic

Servers and databases are not exposed to the public internet. They are reachable only through a load balancer or a VPN, behind firewall rules.
TLS is enforced for all traffic that leaves the internal server network.
Where a project needs it, the application sits behind the Cloudflare proxy for DDoS protection and traffic filtering, and all traffic from the internet goes through Cloudflare.

Backups and logs

Databases are backed up automatically. A typical setup is a full daily backup kept for 14 days. The exact parameters depend on the project: in one project, for example, we run a weekly backup kept for 28 days.
Application logs are typically kept for 30 days, though in some projects they rotate by available disk space instead. Our error tracking removes sensitive values such as card numbers and credentials from logs by default.

Workstations

Computers used for client work have disk encryption managed centrally by our system administrator, plus endpoint protection, a firewall and current updates. Client data does not go to private email accounts or messengers without approval.

Privacy by design, in practice

Separate environments

Separate development, test and production environments.

Test data

Test data anonymised or pseudonymised, depending on what the project allows.

Role-based access

Role-based access inside the application, with administrative and operational functions kept apart.

Optional processing off

Optional processing, such as profiling or marketing, switched off by default.

Only the fields needed

Only the fields the purpose needs.

A real-world example

Users verify their identity with a document scan and a national ID number, and confirm income through their bank. Screens with sensitive data are masked in analytics and session recordings, so the national ID number and card number never reach external tools, and analytics starts only after the user consents.

When something goes wrong

Everyone on our team must report a suspected breach internally without delay. We then secure the evidence (logs, configuration), assess the risk and record the event. We record every incident and every suspicion.

When we act as your processor, our standard DPA commits us to inform you without undue delay and no later than 24 hours after we become aware of the incident. That is stricter than the GDPR wording and leaves you time to meet your own 72-hour deadline towards the supervisory authority.

Shield icon representing security and reliability

Report internally without delay

Secure evidence and assess the risk

Inform you within 24 hours

Our commitments at a glance

The deadlines and retention periods from this page in one place. Backup and log periods depend on the project.
Commitment	Our standard
Incident notice to you	Within 24 hours of becoming aware (standard DPA)
Help during a supervisory inspection	Within 2 business days
Delete or return your data after the contract ends	Within 10 business days
Written confirmation of deletion or return	Within 7 business days after that
Database backups	Typically daily, kept for 14 days (varies by project)
Application logs	Typically kept for 30 days (varies by project)
Review of our procedures	At least every 12 months

Audits and the end of the project

Audits and inspections

Our DPA gives you the right to audit and inspect how we process your data. If a supervisory authority inspects you, we help with the information you need within 2 business days.

When the project ends

Within 10 business days after the main contract ends, we delete or return your data, including copies. The choice is yours. Within 7 business days after that we confirm it in writing. Backups are deleted when their retention cycle ends.

You own the code

Economic rights pass to you with each payment

The economic rights to the code pass to you with each payment, for the fields of use set out in the contract. You do not wait until the end of the project to own what you have paid for, and you get the source code. The working repository stays in our controlled environment, where only people on your project have access.

Business meeting in a glass-walled conference room

SLA, hypercare and documents

Founded

2013

The year five co-founders registered the company and started taking on client work together.

Projects delivered

160+

Software projects shipped for clients since 2013.

Industries served

15+

From energy and fintech to healthcare and industrial IoT.

Clutch rating

5.0

Clutch rating from 18 verified client reviews.

Why work with us: what you get

Your data stays in your cloud account, you get a DPA per project and 24-hour incident notice, and the code is yours.