Privacy Policy

This Privacy Policy explains how ORRB Limited (“ORRB”, “we”, “us”, or “our”) collects, uses, stores, and protects personal data when you visit www.orrb.com (the “Site”), contact us, or otherwise engage with our services. It also sets out your rights in relation to your personal data and how to exercise them.

We are the controller responsible for your personal data. If you have any questions about this policy, contact us at info@orrb.com.

Who we are

ORRB is the creator of The Portal — a decision-grade physiological baselining instrument. This policy covers personal data processed through our website and our general business communications. Where we provide The Portal or related services to an organisation, additional, service-specific data processing terms may apply and will be provided separately.

What data we collect

We collect only the data we need to operate the Site, respond to enquiries, and improve our services. This may include:

• Information you give us. When you complete a contact or enquiry form, request a demonstration, or email us, we collect the details you provide — typically your name, email address, organisation, and the contents of your message.
• Investor and partnership enquiries. If you request investor or partnership access, we may collect additional details relevant to that request, such as your role and firm.
• Technical and usage data. When you visit the Site, our hosting and analytics providers may automatically collect limited technical information, such as your IP address, browser type and version, device information, referring pages, and interactions with the Site.
• Cookies and similar technologies. We use a small number of cookies and similar technologies to operate the Site and understand how it is used. See Cookies below.

We do not knowingly collect special category data through the Site. Any physiological data generated by The Portal is governed by separate agreements with the relevant organisation and is not collected through this website.

How we use your data

We use personal data to:

• respond to your enquiries and provide information you request;
• arrange and conduct demonstrations of The Portal;
• manage investor, partnership, and institutional relationships;
• operate, maintain, secure, and improve the Site;
• understand how the Site is used so we can make it better;
• comply with our legal and regulatory obligations.

We do not sell your personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects.

Legal bases for processing

Where UK and EU data protection law applies, we rely on the following legal bases:

• Legitimate interests — to respond to enquiries, run and secure our business, and improve our services, where these interests are not overridden by your rights.
• Consent — where you have opted in, for example to non-essential cookies or to receive communications. You may withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law.

Where your data is stored

The Site is hosted on Vercel, and related business data (such as email correspondence) is held with reputable service providers used to run our operations. These providers may store and process data on servers located in the United Kingdom, the European Economic Area, the United States, or other countries.

Where personal data is transferred outside the UK or EEA, we take steps to ensure it receives an adequate level of protection — for example, by relying on an adequacy decision or on standard contractual clauses with the relevant provider.

Sharing your data

We share personal data only where necessary, and only with:

• Service providers who help us run the Site and our business — including hosting (Vercel), email, and analytics providers — acting on our instructions;
• Professional advisers such as legal, accounting, and insurance advisers, where needed;
• Authorities or third parties where required by law, or in connection with a corporate transaction such as a financing, merger, or acquisition.

Cookies

We use essential cookies required for the Site to function, and we may use a limited set of analytics cookies to understand how the Site is used. You can control or delete cookies through your browser settings. Disabling some cookies may affect how parts of the Site work.

Data retention

We keep personal data only for as long as necessary for the purposes set out in this policy, including to meet legal, accounting, or reporting requirements. Enquiry and correspondence data is typically retained for the duration of our relationship and for a reasonable period afterwards, then securely deleted or anonymised.

Your rights

Depending on your location, you may have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data in certain circumstances;
• object to or restrict our processing of your data;
• request portability of data you provided to us;
• withdraw consent where we rely on it.

To exercise any of these rights, contact us at info@orrb.com. If you are in the UK and have an unresolved concern, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond promptly to any incident.

Children

The Site is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16 through the Site.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be made clear on the Site.

Contact us

For any questions about this policy or how we handle your data, please contact: