1. Who We Are
1.1 Primary Privacy Contact
The entity responsible for personal data processed via our Websites is the Orbus Software group entity operating those Websites. For account and service data, the responsible entity is the group entity named in your contract (see Section 1.2).
Privacy contact email: privacy@orbussoftware.comÂ
Postal address: please refer to Annex A
1.2 Multiple Contracting Entities
Because we contract with customers through different legal entities, the controller for Customer and User account data is typically the Orbus Software entity:
- named in the relevant order form or subscription agreement; or
- that otherwise provides the Services to the customer.
How to identify your contracting entity: Please refer to your contract or invoice, or contactÂ
1.3 Group Companies
We may involve the following group companies in operating our Websites and delivering our Services:
1.4 DPO / RepresentativesÂ
Data Protection Officer: No Data Protection Officer required
EU representative: Orbus Software Sp. z.o.o.
UK representative: Seattle Software Ltd
2. How Our Processing Differs: Before vs. After You Become a Customer
We collect and use personal data differently depending on your relationship with us. The table below summarises this distinction.
More detail is provided in Sections 4 (Visitors & Prospects), 5 (Customers & Authorized Users), and 6 (Customer Content).
3. What Personal Data We Collect
Depending on how you interact with us, we may collect the following categories of personal data:
4. Visitors & Prospects (Pre-Customer Processing)
4.1 Purposes
We use Visitor and Prospect personal data to:
- Operate, maintain, and secure our Websites (performance monitoring, troubleshooting, abuse and fraud prevention).
- Respond to your requests (e.g., “Contact us” forms, demo requests, scheduling calls, partner enquiries).
- B2B marketing and sales (newsletters, product updates, event invitations, outbound follow-up, CRM management).
- Analytics and website improvement (understanding how our Websites are used, measuring marketing performance and attribution).
- Compliance and protection (responding to lawful requests, enforcing our terms, protecting rights and safety).
4.2 Legal Bases (UK/EU)
Legitimate interests: We process certain data to operate our business effectively, keep our Websites secure, and communicate with business contacts about our products. You have the right to object to processing based on legitimate interests in certain circumstances — see Section 10.
4.3 Cookies and Similar Technologies (OneTrust)
We use cookies and similar technologies on our Websites. We use OneTrust to provide a cookie consent banner and preference centre. You can review the cookies in use and manage your preferences at any time via our Cookie Preference Centre linked to on www.orbussoftware.com.Â
We use the following categories of cookies:
Vendors whose cookies or tags are present on our Websites include (among others): Google (Analytics, Tag Manager, DoubleClick/Ads, YouTube), LinkedIn, 6sense, Pardot (Salesforce), Wistia, OneTrust, and Cloudflare. You can view the full and current vendor list via the OneTrust Preference Centre.
Targeting cookies and marketing analytics: If you accept targeting cookies, our marketing partners may collect information about your interactions with our Websites (e.g., pages visited, interactions, approximate location derived from IP address) and may combine it with other information they hold. You can withdraw or change your consent at any time via the OneTrust Preference Centre.
4.4 Retention (Visitors & Prospects)
We retain Visitor and Prospect personal data for the purposes described above, consistent with our retention policy and applicable law.
5. Customers & Authorized Users (Post-Contract)
5.1 Purposes
We use Customer and Authorized User personal data to:
- Provide and operate the Services (including hosting, processing transactions, enabling features, and maintaining availability).
- Account administration (user provisioning, access control, role-based permissions, authentication/SSO, audit logs).
- Support and service communications (responding to support tickets, service notifications, incident communications, training).
- Billing and payments (invoicing, collections, tax compliance, payment processing via our payment processor).
- Security and fraud prevention (access monitoring, security logging, vulnerability management, incident response).
- Compliance and legal obligations (recordkeeping, responding to lawful requests, enforcing contracts, audit support).
5.2 Legal Bases (UK/EU)
5.3 Retention (Customers & Authorized Users)
We retain Customer and Authorized User personal data for the duration of the customer relationship and as necessary thereafter, consistent with our retention policy and applicable law. Specific retention periods may also be defined in the customer contract or DPA.
5.4 Data Location — Worldwide Processing
Customer and Authorized User personal data may be processed in multiple countries worldwide, including the locations where we and our service providers operate (UK, Poland, USA, Australia, and others). Where a customer contract specifies data residency or processing restrictions, we will process data in accordance with that agreement.
5.5 Account Deletion / End of Service
On termination of the customer relationship, we will handle personal data as described in the applicable contract and DPA.
6. Customer Content (Data We Process on Behalf of Customers)
6.1 Our Role
When Customers use our Services, they may upload, create, or process content that contains personal data (“Customer Content”). In this context:
- the Customer is the controller (UK/EU) and determines the purposes and means of processing; and
- we act as a processor (UK/EU), and process Customer Content only on documented instructions, as set out in our agreement and Data Processing Addendum (DPA).
6.2 What We Do With Customer Content
We process Customer Content only to:
- host and provide the Services;
- maintain security, prevent abuse, and troubleshoot;
- provide support at the Customer’s request; and
- comply with applicable law.
6.3 Data Location — Worldwide Processing (Unless Agreed Otherwise)
Customer Content may be processed in multiple countries worldwide (including the USA and Australia) depending on which infrastructure and subprocessors are used. Where a customer contract specifies data residency or restricts processing locations, we will comply with those restrictions.
6.4 End Users and Data Subjects
If your personal data is contained in Customer Content (e.g., you are an end user of a customer’s deployment of our Services), please contact the relevant Customer to exercise your data rights. We will assist our Customers as required by the DPA.
7. Who We Share Personal Data With
We may share personal data with:
See Appendix B for further information.
8. International Data Transfers
Because we operate across the UK, Poland (EU), USA, and Australia, personal data may be transferred to and processed in countries other than where you are located. Where UK/EEA personal data is transferred outside the UK/EEA, we use appropriate safeguards, which may include:
- EU Standard Contractual Clauses (SCCs);
- the UK International Data Transfer Addendum (UK Addendum to the EU SCCs) or UK IDTA; and/or
- adequacy decisions where applicable.
We also implement additional measures where appropriate (e.g., encryption and access controls) consistent with applicable guidance.
Transfer mechanism details: Standard Contractual Clauses
9. Security
We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure, including:
- access controls and least-privilege principles;
- encryption in transit and at rest;
- logging and monitoring;
- vulnerability management; and
- incident response procedures.
10. Your Rights and Choices
10.1 UK / EEA (Including Poland)
Subject to conditions and applicable exceptions, you may have the right to:
- access your personal data;
- rectify inaccurate personal data;
- erasure of personal data (“right to be forgotten”);
- restrict certain processing;
- object to processing based on legitimate interests or for direct marketing;
- data portability (where applicable); and
- withdraw consent (where processing is based on consent) — without affecting the lawfulness of processing before withdrawal.
You also have the right to lodge a complaint with your supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO). In Poland, this is the Urząd Ochrony Danych Osobowych (UODO).
10.2 USA (State Privacy Laws)
Depending on the applicable US state privacy law and whether thresholds are met, individuals may have rights to access, delete, correct, or opt out of certain processing (such as targeted advertising or “sale” of personal data as defined by applicable law). We will respond to verifiable requests as required.
US rights request method: privacy@orbussoftware.com
10.3 Australia
Under the Australian Privacy Act 1988, individuals may request access to or correction of personal information held about them, subject to applicable exceptions. We will respond to requests within a reasonable timeframe.
10.4 How to Exercise Your Rights
Submit a request: email privacy@orbussoftware.comÂ
We may need to verify your identity before responding. We will respond within the timeframe required by applicable law.
11. Marketing Communications
We may send marketing emails to business contacts where permitted by applicable law (typically on the basis of legitimate interests for B2B contacts, or consent where required).
You can opt out of marketing emails at any time by:
- using the unsubscribe link in any marketing email; or
- contacting us at privacy@orbussoftware.comÂ
Opting out of marketing will not affect service communications we are required to send you as a customer.
12. Do We “Sell” Personal Data?
We do not sell personal data in exchange for money.
We may allow certain advertising and marketing partners to collect information via cookies for purposes such as measuring campaign effectiveness and delivering advertising, subject to your cookie choices made via the OneTrust Preference Centre and applicable law.
13. Children
Our Websites and Services are directed at business professionals and are not intended for use by children. We do not knowingly collect personal data from children.
‍
14. Changes to This Notice
We may update this Privacy Notice from time to time. When we do, we will post the updated notice on this page and revise the “Last updated” date at the top. If changes are material, we may provide additional notice (e.g., on our Websites or by email to affected customers).
15. Contact Us
If you have any questions about this Privacy Notice or how we handle your personal data, please contact us:
Email: privacy@orbussoftware.comÂ
Postal address: Orbus Software, 11th Floor, 123 Victoria Street, London SW1E 6DE
EU representative: Orbus Software, Ul. Zabrska 20, 4th Floor, 40‑083 Katowice, Śląskie, Poland
Appendix A — Group Companies
Fill in the table below with all group companies involved in processing personal data covered by this notice.