Privacy Policy
This Privacy Policy explains how Orbis Digital Ltd (trading as "Orbis Salon") ("Orbis", "we", "us") collects, uses and protects personal data in connection with the Orbis Salon platform (the "Service"). We are committed to protecting personal data in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
1. Salon owners, managers and staff (our customers): when you register and use the Service, we are the controller of your account, billing and usage data. This policy describes that processing.
2. Salon clients (customers of the venues that use our Service): if you are a client of a salon and your details are held in the Service, the salon is the controller of your data and we process it only on the salon's instructions as their processor under our Data Processing Addendum. For questions about how a salon uses your data, or to exercise your rights over it, please contact the salon directly — their own privacy policy applies.
1. Who we are and how to contact us
Orbis Digital Ltd (trading as Orbis Salon), a company registered in England and Wales. You can contact us about data protection at [email protected].
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity & contact data | Name, email address, phone number, business name and address | Provided by you at signup or in your account |
| Business & account data | Venue details, plan and subscription tier, settings, user roles, onboarding progress | Provided by you / generated by your use |
| Financial & transaction data | Billing history, subscription status, payout and fee records. Full card numbers are collected and held by our regulated payment provider, not by us. | Provided by you / our payment provider |
| Usage & technical data | Log-in records, IP address, browser type, pages viewed, actions taken, device information, security logs | Collected automatically |
| Communications data | Support requests, emails, feedback, survey responses | Provided by you |
| Marketing preferences | Your choices about receiving product news and offers | Provided by you |
We do not intentionally collect special category data about our customers. Health-related information collected by a salon from its clients through consultation forms is processed by us only as the salon's processor (see the notice above and the Data Processing Addendum).
3. How we use your personal data and our lawful bases
| Purpose | Lawful basis (Article 6 UK GDPR) |
|---|---|
| Creating and administering your account; providing the Service; support | Performance of a contract |
| Billing, collecting Fees, managing subscriptions and payment onboarding | Performance of a contract; legal obligation (accounting and tax records) |
| Securing the Service: authentication, fraud and abuse prevention, audit and security logging, rate limiting | Legitimate interests (protecting the Service and its users); legal obligation |
| Service communications: important notices about your account, changes to terms, security or billing | Performance of a contract; legitimate interests |
| Product improvement and analytics on how the Service is used | Legitimate interests (improving our Service) |
| Marketing our own similar products and services to business contacts | Legitimate interests; consent where required. You can opt out at any time. |
| Establishing, exercising or defending legal claims | Legitimate interests; legal obligation |
Where we rely on legitimate interests we have balanced those interests against your rights and freedoms. You may request further information about our balancing assessments using the contact details above.
4. Marketing
We may send you information about the Service, new features and offers relevant to your business. Every marketing email includes an unsubscribe option, and you can also manage preferences in your account or by contacting us. Opting out of marketing does not affect service communications (for example invoices, security alerts and changes to terms), which we must still send you.
5. Automated decision-making and AI features
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Where the Service offers AI-assisted drafting, the text you submit for drafting is processed by our AI provider to generate the draft; drafts are always subject to human review by you before use.
6. Who we share personal data with
We share personal data only as needed to run the Service, with appropriate safeguards:
| Recipient | Purpose |
|---|---|
| Hosting and infrastructure providers (UK/EU data centres) | Hosting the Service, databases and backups |
| Payment processing partner (a regulated payment institution) | Subscription billing, online card payments, payouts, onboarding checks |
| Email delivery provider | Sending transactional and (where permitted) marketing emails |
| AI provider | Generating drafts when you use AI-assisted features |
| Professional advisers (lawyers, accountants, auditors, insurers) | Professional services, compliance |
| Authorities, regulators and law enforcement | Where required by law or to protect rights, property or safety |
| A buyer or successor in a business transfer | In connection with a merger, acquisition or sale of assets, subject to this policy |
We do not sell personal data.
7. International transfers
We store personal data on servers located in the United Kingdom and/or the European Economic Area. Some of our service providers may process limited personal data outside the UK. Where that happens we ensure an adequate level of protection through UK adequacy regulations, the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, or other safeguards permitted by UK GDPR.
8. How long we keep personal data
| Data | Retention period |
|---|---|
| Account and business data | For the life of your account, then deleted or anonymised within a reasonable period after closure (subject to the export window described in our Terms) |
| Billing and tax records | At least 6 years after the end of the relevant financial year, as required by law |
| Security and audit logs | Typically up to 24 months, unless needed for an ongoing investigation |
| Support correspondence | Up to 3 years after closure of the matter |
| Unconverted trial accounts | Deleted following a reasonable period after trial expiry |
| Backups | Deleted data leaves backup cycles as backups rotate |
9. Security
We take appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS/TLS), hashed passwords, optional two-factor authentication, role-based access controls, tenant isolation between venues, security logging, and secure storage of credentials and API keys. No system can be guaranteed 100% secure, but we review and improve our measures on an ongoing basis. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO and, where required, affected individuals without undue delay.
10. Your rights
Under UK GDPR you have the right to:
- Access — request a copy of the personal data we hold about you;
- Rectification — have inaccurate data corrected and incomplete data completed;
- Erasure — ask us to delete your data in certain circumstances;
- Restriction — ask us to restrict processing in certain circumstances;
- Portability — receive data you provided to us in a structured, commonly used, machine-readable format;
- Objection — object to processing based on legitimate interests, and to direct marketing at any time;
- Withdraw consent — where processing is based on consent, withdraw it at any time (without affecting prior processing).
To exercise any of these rights, contact [email protected]. We will respond within one month (extendable by two further months for complex requests). We may need to verify your identity first. Exercising your rights is free of charge except where a request is manifestly unfounded or excessive.
If you are a salon client and wish to exercise rights over data held about you by a salon, please contact the salon directly; we will assist the salon as its processor.
11. Complaints
If you have a concern about how we handle personal data, please contact us first and we will do our best to resolve it. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.
12. Cookies
The Service uses a small number of cookies that are strictly necessary for it to work (such as your login session and security tokens). See our Cookie Policy for details.
13. Children
The Service is a business tool and is not intended for use by anyone under 18. We do not knowingly collect personal data from children in connection with platform accounts.
14. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page and update the "last updated" date; for material changes we will notify you by email or via the dashboard.
15. Contact
Orbis Digital Ltd (trading as Orbis Salon)
Email: [email protected]
Phone: 0191 603 0275
16. Account deletion and data removal
You have the right to request deletion of your Orbis Salon account and the personal data we hold about you, subject to lawful retention requirements.
You can submit a deletion request in two ways:
- In-app (recommended): Sign in and go to Settings > Delete Account. This confirms your identity and allows us to act quickly.
- Web form: Use the public deletion request page at orbissalon.co.uk/delete-account. This page is required for Google Play Store and Apple App Store compliance.
On receiving a request we will review it and contact you if we need to verify your identity or confirm details before carrying out deletion. We aim to process verified requests within 30 days, or within any shorter period required by applicable law.
Data we may retain after account deletion
Even where an account is deleted, we may retain the following categories of data for the periods described:
| Category | Retention after deletion | Reason |
|---|---|---|
| Payment and invoice records | 7 years | HMRC / legal requirement |
| Fraud prevention and security logs | Up to 7 years | Fraud prevention and dispute resolution |
| Chargeback and refund records | Card-scheme mandated period | Dispute resolution |
| Terms acceptance records | Up to 7 years | Legal compliance evidence |
| Audit logs for access and system events | Up to 3 years | Security, regulatory compliance |
All other personal data will be deleted or irreversibly anonymised within a reasonable period following confirmed account deletion.
App store subscriptions
Deleting your Orbis Salon account does not automatically cancel an in-app subscription purchased through Apple App Store or Google Play. If your subscription was purchased through an app store, you must cancel it separately through your device's subscription management settings. Orbis Salon is not responsible for app store charges that continue after account deletion if you have not cancelled the subscription through the relevant app store.