Privacy Policy

1. Who we are

Orbidex ("we", "us", "our") operates the Orbidex IT Help Desk Portal, accessible at orbidex.app and related subdomains (the "Service").

For the purposes of applicable data protection law (including the GDPR where it applies), we act as the data processor on behalf of our customers (who are the data controllers for their employees' data) and as the data controller for data relating to our own customers and their administrators.

2. Data we collect

We collect data in two contexts:

A. Customer account data — data about the companies and administrators who purchase the Service:

• Business name, industry, and contact details
• Billing name and email address
• Communication records (support emails, in-app messages)

B. End-user data — data uploaded or generated by our customers and their employees through use of the Service:

• User profiles: full name, email address, job title, department, phone, employee ID
• IT tickets, comments, and attachments
• Asset records, software licenses, purchase orders
• Knowledge base articles, maintenance logs, on-call schedules
• Audit logs recording who did what and when
• Any other data the customer's organisation chooses to store in the platform

C. Usage data — automatically collected technical information:

• Browser type and operating system
• Page views and feature interactions (not sold or shared)
• API request logs (retained 30 days)
• Error logs (no personal data included)

3. How we use your data

We do not sell personal data. We do not use personal data for advertising or profiling.

4. Who we share data with

We share data only with sub-processors necessary to operate the Service:

We may disclose data if required by law or court order, or to protect the rights and safety of our users. We will notify affected customers where legally permitted to do so.

5. Data retention

We retain customer data for as long as the account is active. Upon termination:

• Customer data is retained for 30 days after account closure to allow for data export
• After 30 days, all customer data is permanently deleted from production systems
• Backup retention follows our infrastructure provider's schedule (up to 30 days)
• Ticket attachments are configurable per company (default: 6 months)
• Audit logs are retained for the duration of the account

You may request immediate deletion at any time by contacting us at the address below.

6. Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security isolating each customer's data
• Role-based access controls
• Full audit logging of administrative actions

For a detailed overview, see our Security Overview.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and in any event within 72 hours of becoming aware of it.

7. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of your personal data
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — request that we limit processing of your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdrawal of consent — where processing is based on consent

End users should direct requests to their employer (our customer), who is the data controller. Customers may exercise their rights by contacting us at the address in Section 11.

You also have the right to lodge a complaint with your local data protection supervisory authority.

8. Cookies

We use minimal cookies necessary to operate the Service:

• Authentication tokens — stored in localStorage to keep you logged in (session-scoped)
• UI preferences — dark mode, sidebar state, last-used company (stored in localStorage)

We do not use advertising cookies, third-party tracking cookies, or analytics cookies that identify individuals.

9. Children

The Service is designed for use by businesses and their employees. It is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify customers of material changes by email at least 14 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Contact us

For privacy-related questions, data subject requests, or to exercise your rights: