Orbas Agency Privacy Policy

2. Information we collect

We collect information directly from you, automatically when you use our services and from carefully selected third parties who help us deliver those services. We minimise collection by using privacy-by-design principles and conducting regular data audits.

We collect children’s data only when strictly necessary for a specific project and always with parental or guardian consent. All processing undergoes a Data Protection Impact Assessment (DPIA) when high risk is identified.

3. How we use personal data

We use personal information only where we have a lawful basis and a legitimate business purpose. Typical uses include:

• Responding to enquiries, providing proposals, organising discovery workshops and managing ongoing client relationships.
• Planning, delivering and supporting digital products, automation programmes, AI initiatives and consultancy engagements.
• Processing payments, providing invoices, reconciling accounts and meeting audit requirements.
• Monitoring service performance, identifying trends and tailoring your experience on our websites and applications.
• Sending essential service communications and, with your consent, marketing updates, thought leadership or event invitations. You can opt out at any time.
• Protecting against fraud, abuse or misuse of our systems and enforcing contractual terms.
• Meeting legal or regulatory obligations, responding to lawful requests from regulators and handling disputes.

4. Legal bases for processing

We rely on the following lawful bases under UK GDPR. We perform Legitimate Interest Assessments where required to balance our objectives with your rights.

Consent

For marketing communications, optional analytics cookies, participation in user research and storing recruitment details for future opportunities.

Contract

To provide requested services, manage client or supplier accounts, process payments and fulfil service-level obligations.

Legitimate interests

To secure our platforms, improve offerings, personalise content, develop new products and communicate with existing customers about similar services.

Legal obligation

To comply with tax, anti-money laundering, employment, health and safety or other regulatory requirements.

Vital interests

Only in exceptional circumstances where action is required to protect someone’s life or prevent serious harm.

Public interest

Where we are required to support law enforcement or regulatory investigations within statutory powers.

5. Sharing your information

We do not sell personal information. We may share data with trusted processors who support our operations, including hosting providers, analytics platforms, CRM tools, payment partners, subcontractors, background-check providers and professional advisors. Each partner is bound by written agreements, undergoes security reviews and may only process personal data under our documented instructions. If we are involved in a merger, acquisition or corporate restructuring, we may transfer relevant data as part of that transaction, subject to confidentiality safeguards.

6. International transfers

Where personal data is transferred outside the UK or European Economic Area, we use lawful safeguards such as adequacy regulations, International Data Transfer Agreements (IDTAs), EU Standard Contractual Clauses with the UK addendum, binding corporate rules or another recognised transfer mechanism. We assess the legal environment in the destination country and implement additional controls where necessary.

• Transfer impact assessments: Performed before onboarding a non-UK/EEA provider to document risks and mitigations.
• Encryption and minimisation: Data in transit is encrypted and limited to the minimum necessary attributes.
• Audit rights: Contracts include audit provisions and escalation paths for data subject requests.

7. Data retention

We retain personal data only as long as necessary to fulfil the purposes outlined in this policy, comply with legal obligations and resolve disputes. Client project files are typically retained for seven years after the end of the engagement. Marketing information is retained for two years after your last interaction unless you opt out sooner. Recruitment records are deleted twelve months after a vacancy closes unless we obtain your consent to keep them longer. In all cases we will securely delete or anonymise data when retention is no longer required.

8. Your rights & complaints

You have the right to request access, rectification, erasure, restriction of processing, data portability and to object to certain processing activities. You can also withdraw consent for marketing or optional cookies at any time.

We will never discriminate against you for exercising your rights. If your request is manifestly unfounded or excessive we may charge a reasonable fee or refuse to act, in which case we will explain our decision.

9. Cookies & analytics

We use essential cookies to operate the site, maintain session security and remember your preferences. With your consent we also use analytics, advertising and social media cookies to understand performance and tailor content. You can manage cookies through your browser settings or through our consent banner where available. Rejecting non-essential cookies will not affect access to core services.

For more detail about the cookies we use, retention periods and providers, please review our separate Cookie Notice available on our website.

10. Data security

We implement layered security measures including encryption in transit and at rest, access controls, multi-factor authentication, intrusion detection, regular vulnerability assessments, secure development practices and staff training. Our systems are monitored 24/7 and access is restricted to authorised personnel on a need-to-know basis. We maintain incident response plans and will notify you and relevant regulators of any notifiable breach.

11. Automated decision-making

We do not conduct solely automated decision-making that produces legal or similarly significant effects. If this changes, we will update this policy and inform affected individuals, explaining the logic involved and potential consequences. Any automated tools we deploy are subject to human oversight, fairness assessments and bias monitoring.

12. Changes to this policy & contact

We may update this policy to reflect changes in our services, technology or legal requirements. Significant updates will be communicated via our website or direct notification. The “Effective date” at the top of this page indicates when the policy was last revised. Continued use of our services after changes indicates acceptance.