Privacy Policy

01Data controller

Orbecta is responsible for the processing of personal data as described in this privacy policy.

02What data do we process?

Orbecta processes personal data because you use our services and/or because you provide it to us yourself. We process the following categories of data:

2.1 Account data

• First and last name
• Business email address
• Phone number
• Role within the company
• Password (stored encrypted)
• For a team account: the account you belong to and your role (administrator or user)

2.2 Company data

• Company name
• Chamber of Commerce number
• VAT number
• Company address
• PO/reference number (if provided)

2.3 Payment data

• For online payments: processed by our payment provider (we only receive confirmation)
• For invoice payment: bank account number for administration
• Invoice numbers and payment dates

2.4 Usage data

• IP address and browser information
• Date and time of visit to the Platform
• Which pages and features you use
• Content you enter or upload: claims, contracts, Warroom sessions, attachments and questions to the AI chat
• Website statistics via Google Analytics (IP addresses of visitors from the EU are not stored)

2.5 Communication data

• Email correspondence between you and Orbecta
• Content of support questions or feedback

03Why do we process this data?

We process your data for the following purposes:

• Performance of the agreement: Providing Pro and Business access, managing your account and billing;
• Legal obligations: Accounting, tax obligations, GDPR requests;
• Customer communication: Answering questions, sending confirmations and invoices;
• Platform improvement: Anonymised usage data helps us improve the Platform;
• Security: Detection of fraudulent use or abuse.

04Legal basis

We process your personal data on the basis of:

• Performance of the agreement (GDPR art. 6(1)(b)) for providing the subscription;
• Legal obligation (GDPR art. 6(1)(c)) for billing and accounting (7-year retention requirement);
• Legitimate interest (GDPR art. 6(1)(f)) for security and platform improvement;
• Consent (GDPR art. 6(1)(a)) where explicitly requested, for example for optional communication.

05How long do we keep your data?

We do not keep your data longer than strictly necessary:

06Who do we share your data with?

We never sell your data to third parties. We only share data with:

6.1 Sub-processors

Orbecta uses carefully selected sub-processors to provide the Platform:

• Supabase — database, sign-in and file storage (EU, Frankfurt);
• Anthropic — AI analysis of the data you submit for an analysis, such as claims, contracts and Warroom sessions (US, under Standard Contractual Clauses). Anthropic does not use this data to train models and deletes it within 30 days;
• Resend — sending emails (EU, Ireland);
• Stripe — processing online payments (within and outside the EU);
• Google Analytics — website statistics (within and outside the EU);
• FastComet — website and email hosting (United Kingdom).

The current list with the role and location of each sub-processor is in our Trust Center.

6.2 Legal obligations

When we are legally obliged to do so (for example at the request of the tax authorities, police or judiciary).

07Transfers outside the EU

Some of our sub-processors are (partly) established outside the European Economic Area (EEA). Transfers take place on the basis of:

• Standard Contractual Clauses (SCCs) of the European Commission;
• Adequacy decisions where applicable;
• EU-US Data Privacy Framework certification where applicable.

08Your rights (GDPR)

You have the following rights regarding your personal data:

• Right of access — request which data we hold about you;
• Right to rectification — correct inaccurate data;
• Right to erasure — delete your data (within legal limits);
• Right to restriction — restrict processing;
• Right to data portability — transfer data to another service;
• Right to object — object to processing;
• Right to withdraw consent — withdraw previously given consent.

You can submit requests via [email protected]. We respond within 30 days.

09Security

We take the protection of your data seriously and apply appropriate technical and organisational measures:

• Encrypted connections (HTTPS/TLS) across the entire Platform and encrypted storage (AES-256);
• Passwords are stored securely encrypted according to industry standards;
• Access to data only for the user it belongs to, enforced in the database; within a team account the administrator decides what colleagues can see;
• Two-factor authentication, mandatory for administrators and available to every user;
• An audit log of every AI analysis, and audit logs for sensitive actions;
• Regular security updates of software and infrastructure.

All measures are listed in our Trust Center.

10Cookies and analytics

The Platform uses the following cookies and similar techniques:

• Strictly necessary cookies — for login, session management and security. These are needed to make the Platform work and are placed without consent.
• Google Analytics — for website statistics, such as the number of visitors and the pages visited. Google does not store IP addresses of visitors from the EU.

We do not use advertising, social media or profiling cookies. See also our cookie policy.

11Complaints

If you have a complaint about the processing of your personal data, you can first report it to us via [email protected].

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl.

12Data Processing Agreement (DPA)

For the personal data you process in the Platform as a business customer, Orbecta is your processor. The data processing agreement is part of our terms and conditions and applies from the moment an account is created. You can request a signed copy via info@orbecta.com.

13Changes

We may amend this privacy policy. Substantial changes are communicated to active customers by email at least 30 days before they take effect. The most recent version is always available at orbecta.com/privacy_en.html.

14Contact

Questions about this privacy policy or your data?