Data Processing Policy

• Controller (Customer): determines the purposes and means of processing workspace data and is responsible for the lawful basis of the data they submit.
• Processor (OMS): processes workspace data only on documented instructions from the customer, per these terms and the Terms of Service.
• Sub-processors: engaged only under written contracts imposing equivalent obligations.

• Subject matter: provision of the OMS AI Nexus platform (Workora AI, OMS Developer AI, BanglaGPT, AEGIS Security).
• Duration: for the term of the customer's subscription plus retention windows required by law.
• Data categories: account identifiers, workspace content (documents, prompts, embeddings, conversation history), usage telemetry, security logs.
• Data subjects: customer's authorized users, staff, and any individuals referenced in workspace content.

OMS uses vetted infrastructure and AI providers to deliver the platform. Current sub-processor categories:

• Managed database & auth hosting (backend platform provider).
• Edge compute & CDN (application delivery).
• AI model providers routed via the OMS AI Nexus AI Gateway (chat, embeddings, vision).
• Payment processing (Stripe, when enabled by the customer).
• Transactional email delivery.

Customers will receive at least 30 days' notice before a material change to sub-processors and may object under the Terms.

Where personal data is transferred outside the customer's jurisdiction, OMS relies on recognized transfer mechanisms including the EU Standard Contractual Clauses (2021), the UK IDTA, and equivalent safeguards. OMS performs a transfer risk assessment before adding a sub-processor located outside the EEA/UK.

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Row-Level Security (RLS) enforced on every tenant table; multi-tenant isolation by workspace.
• Mandatory MFA (AAL2) for administrative and Founder accounts.
• Audit logs for authentication, admin actions, and workspace-level access.
• Least-privilege access, secret rotation, and quarterly access reviews.
• Backups with tested restore procedures (RTO ≤ 1h for platform data).

Where OMS is a processor, requests from data subjects are forwarded to the customer (controller) without undue delay. Where OMS is a controller (account/billing), individuals may exercise access, correction, deletion, portability, restriction, and objection rights by writing to the contact below. OMS will respond within 30 days as required by GDPR / UK GDPR / CCPA.

OMS will notify affected customers without undue delay, and in any case within 72 hours of confirming a personal data breach, with sufficient information for the customer to meet its own notification obligations.

Workspace data is retained while the subscription is active. On termination, customer data is deleted or returned within 30 days, except where retention is required by law (e.g., invoicing records).

Data protection questions: omsit.official@gmail.com. Please mark the subject line “Data Processing Request”.