Privacy Policy – ORIVYS
1. Introduction
This Privacy Policy explains how Exoter Technologies Ltd (“Exoter”, “we”, “us”, or “our”) collects, uses, and protects personal data in connection with the ORIVYS platform and related services.
Exoter Technologies Ltd is a company registered in England and Wales (company number: 16683767) with registered office at:
5, Yard 12 Wildman Street, Kendal, Cumbria, LA9 6EN
For any privacy-related queries, please contact:
2. Scope of this Policy
This Privacy Policy applies to:
- users of the ORIVYS platform
- customers (organisations using ORIVYS)
- visitors to our website
- individuals whose data is processed through ORIVYS
3. Roles under Data Protection Law
Depending on the context, Exoter acts as either:
3.1 Data Processor
For most data stored within ORIVYS (e.g. staff, students, residents, members), Exoter acts as a data processor, processing personal data on behalf of the Customer.
The Customer is the data controller and is responsible for determining the purpose and lawful basis of processing.
3.2 Data Controller
Exoter acts as a data controller for:
- account registration data
- billing and payment information
- support communications
- marketing preferences
4. Personal Data We Process
Depending on how ORIVYS is used, we may process:
4.1 Account and Contact Data
- names
- email addresses
- phone numbers
- user roles
4.2 Customer Data (processed on behalf of customers)
This may include:
- organisational data
- staff or member data
- student or service user data
- operational records
In some cases, this may include:
- data relating to minors
- special category data (e.g. health or care-related information)
Such data is processed only under the instructions of the Customer.
4.3 Payment Data
- billing contact details
- transaction records
Payment card details are processed securely by our payment provider and are not stored by us.
4.4 Communications Data
- support emails
- service-related communications
4.5 Technical Data
- IP addresses
- login activity
- device and browser information
5. How We Use Personal Data
We use personal data to:
- provide and operate the ORIVYS platform
- manage subscriptions and payments
- provide customer support
- maintain system security and performance
- communicate service updates
- send marketing communications (where consent has been given)
6. Legal Basis for Processing
Where Exoter acts as a data controller, we rely on the following lawful bases:
- Contract – to provide the Service
- Legitimate interests – to operate, improve, and secure the Service
- Legal obligation – for accounting and regulatory compliance
- Consent – for marketing communications (where applicable)
7. Data Sharing and Sub-processors
We use trusted third-party providers to deliver our services:
- Google Cloud Platform (UK – London region) – hosting infrastructure
- Stripe – payment processing
- MailerSend – transactional email delivery
These providers process data on our behalf under appropriate contractual safeguards.
8. International Data Transfers
Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or equivalent mechanisms.
9. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected.
9.1 Trial Accounts
If a trial account is not converted into a paid subscription, data is retained for up to 3 months, after which it may be deleted or anonymised.
Trial users do not have access to the Service after the trial period unless they subscribe.
9.2 Active Accounts
Personal data is retained for the duration of the subscription.
9.3 Terminated Accounts
Following termination:
- data is typically retained for up to 45 days
- during this period, restoration may be possible subject to payment of outstanding fees
After this period, data may be permanently deleted.
9.4 Backups
Data may remain in secure backups for a limited additional period and is deleted in accordance with backup cycles.
9.5 Legal and Financial Records
We retain certain data (e.g. billing and accounting records) as required by law.
10. Data Security
We implement appropriate technical and organisational measures to protect personal data, including:
- secure cloud infrastructure
- encryption in transit
- access controls and authentication
- monitoring and security testing
11. Your Rights
Where Exoter acts as a data controller, individuals have rights under UK GDPR, including:
- access to personal data
- rectification of inaccurate data
- erasure (in certain circumstances)
- restriction of processing
- data portability
- objection to processing
Requests can be made via:
Where Exoter acts as a processor, requests should be directed to the relevant Customer (data controller).
12. Marketing Communications
We may send marketing communications only where:
- the recipient has given consent, or
- it is otherwise permitted by applicable law
Recipients may unsubscribe at any time using the link provided in communications.
13. Children and Sensitive Data
ORIVYS may be used by organisations that process data relating to:
- children
- individuals receiving care or support
Such data is processed solely on behalf of the Customer and under their responsibility as data controller.
14. Changes to this Policy
We may update this Privacy Policy from time to time. The latest version will always be made available through our website or the Service.
15. Contact
For any questions about this Privacy Policy or data protection matters:
You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).