Who is collecting your information
Orbis, Inc. operates these applications and is responsible for the account, support,
and system information described below. Business data loaded into an application by
a client organization belongs to that client; Orbis processes it only on the
client’s instructions. See “Client data” below.
What we collect and why
- Account information — your name,
business email address, and login credentials, provided when your organization
or Orbis creates your account. Used to authenticate you and administer your
access.
- Support information — your name,
contact details, and the content of your request when you contact Orbis for
support. Used to respond to your request.
- System records — IP address, username,
device identifier, session metadata, and authentication events, generated
automatically when you use an application. Used for security monitoring,
incident investigation, and compliance auditing.
Orbis processes this information to perform its agreement with your organization and
to protect the service. It is not used for advertising or marketing and is not sold.
Client data
Information that a client organization enters into or uploads to an application is
that client’s data. Orbis processes it only to deliver the contracted service
and does not use it for any other purpose. If you are an individual whose
information appears in a client’s data, requests about that information are
referred to the client organization for decision.
Cookies
These applications use only the cookies required for authentication, session
management, and security. No analytics or advertising cookies are set.
How we share information
Orbis uses a limited number of service providers to operate and protect these
applications:
- cloud hosting and productivity services;
- managed infrastructure support; and
- security monitoring — managed detection and
response, email security, and endpoint protection.
Each provider processes information only to support the service, under contractual
confidentiality and security terms. Production data is stored in the United States;
security telemetry may be analyzed by Orbis’s security providers outside the
United States for threat detection only. Orbis also discloses information where
required by law.
Retention
Orbis retains information only for as long as it is needed for the purposes
described above:
- Account information — retained while
your account is active. Deactivated accounts are purged or anonymized at
Orbis’s next scheduled data review, held quarterly.
- System records — 90 days in active logs
and 12 months in archive.
- Security and authentication records —
up to 12 months online and 3 years in archive.
- Support correspondence — retained under
Orbis’s email retention policy, for a minimum of one year.
- Backups — copies of information may
persist in encrypted backups for up to 3 years under the backup rotation
schedule.
- Client data — retained as the client
directs and under the applicable agreement.
Security
Information is protected by role-based access controls, encryption in transit and at
rest, and continuous security monitoring. Access to personal information is limited
to personnel who need it to perform their duties.
Your rights
You may:
- ask whether Orbis holds personal information about
you and request a copy;
- request correction of inaccurate or incomplete
information;
- request deletion where the information is no longer
needed, subject to legal and contractual retention;
- request that processing be restricted while a
dispute about the information is resolved;
- request your information in a portable,
machine-readable format; or
- object to processing based on Orbis’s
legitimate interests.
Orbis verifies your identity before responding and responds within 30 days. If a
request cannot be fulfilled in whole or in part, Orbis explains why.
Contact
Privacy inquiries and requests:
[email protected]. Please include the name of the
application you use so that Orbis can locate your account.
Changes to this notice
Orbis updates this notice when its practices change. The effective date at the top
of this page shows when it was last revised.