Orca Technical Ltd (collectively referred to as “we”, “us”, or “our”) is a company registered in England and Wales with company number 16870931. Our registered office address is Suite A, 82 James Carter Road, Mildenhall, England, IP28 7DE.
Orca Technical Ltd is the data controller responsible for your personal data. If you have any questions about this privacy policy, or the way we handle your personal data, please contact us at privacy@orcatechnical.co.uk
When you contact us, we may collect personal details such as your name, email address, phone number, and any other details you choose to share with us. We use this information to respond to your enquiry and maintain our relationship with you.
Lawful Basis Legitimate Interests - it is in both our and your interests to communicate effectively about the services you are enquiring about.
When Orca Technical provides a service for you, we collect necessary information to deliver that service. This may include your name, company name, billing address, shipping address, contact details, and project-specific information.
Lawful Basis Contract - processing is necessary to perform the contract we have with you.
When you make a payment, we collect the information necessary to process that payment. Payments are processed via Stripe, Square, or bank transfer.
Where payments are processed through Stripe or Square, your payment card data is handled directly by those third-party providers and is not stored by us.
Where payments are made by bank transfer, we collect your bank account name and sort code from the transaction record. No card or banking credentials are stored by us at any point.
Lawful Basis Contract - processing is necessary to fulfil our payment obligations to you.
If you have opted in to receive updates from us, we may send you marketing emails about our services or products. You can unsubscribe at any time by contacting us directly at marketing@orcatechnical.co.uk
Lawful Basis Consent - we will only send marketing emails where you have given us clear prior consent to do so.
We are required by law to retain certain financial and transactional records. This includes records of invoices, payments received, and correspondence related to those transactions.
Lawful Basis Legal Obligation - we are required by law to retain financial records for a minimum of six years, under HMRC rules.
Our website uses Swetrix to provide analytics displaying how users interact with our website. Swetrix is a privacy-focused, cookieless analytics tool - it does not use cookies, does not collect any personally identifiable information, and does not store IP addresses. The data collected (such as pages visited and general device type) is fully anonymised. No cookie consent is required for this tool.
Lawful Basis Legitimate Interests - understanding how our website is used helps us improve it for new visitors.
We only retain personal data for as long as necessary for the purpose it was collected, or as required by law. The table below sets out our retention periods by data type.
| Data Type | Retention Period | Reason |
|---|---|---|
| Client Contact & Communication Records | Duration of the relationship, plus 6 years | Limitation Act 1980 - potential contract disputes |
| Financial Records (invoices, payments, transactions) | 6 years from the end of the relevant tax year | HMRC legal requirement |
| Project Records & Correspondence | 6 years after project completion | Limitation Act 1980 |
| Marketing Contact List | Until you unsubscribe | Consent-based |
| Website Analytics Data | Aggregated and anonymised - no personal data is stored | Swetrix does not retain personally identifiable information |
At the end of each retention period, data is securely deleted or anonymised. If you would like to request early deletion of your data, please see Section 4 (Your Rights).
Under UK GDPR, you have the following rights regarding your personal data. To exercise any of these rights, please contact us at privacy@orcatechnical.co.uk. We will respond within one calendar month of receiving your request, free of charge.
Right to Be Informed You have the right to be told how and why we use your personal data - this privacy policy fulfils that obligation.
Right of Access You can request a copy of the personal data we hold about you (known as a Subject Access Request).
Right to Rectification You can ask us to correct any personal data we hold about you that is inaccurate or incomplete.
Right to Erasure You can ask us to delete your personal data. This is not an absolute right - we may need to retain certain data to comply with legal obligations.
Right to Restrict Processing You can ask us to limit how we use your personal data while a dispute about its accuracy or use is resolved.
Right to Data Portability You can request a copy of your personal data, in a structured, machine-readable format, where the processing is based on consent or contract.
Right to Object You have the right to object to processing based on legitimate interests, or to direct marketing at any time. We will stop processing your data for marketing purposes immediately upon receiving such a request.
Right Related to Automated Decision-Making You have the right not to be subject to decisions made solely by automated means that have a legal or significant effect on you. We do not currently carry out any automated decision-making.
If you are unhappy with how we have handled your request, you have the right to complain to the Information Commissioner’s Office (ICO). See Section 10 for details.
We do not sell your personal data to any third party. We may share your data with the following categories of third party:
Some of the third-party services we use store or process data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place to protect your personal data in accordance with UK GDPR.
In most cases, transfers are made under Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum (IDTA), which are legally approved mechanisms that require recipients to protect personal data to a standard equivalent to that required in the UK.
Where possible, we prefer services that store data within the UK, or EU. Our own infrastructure is hosted on servers located in Germany (EU), meaning data processed on our own platform does not leave the European Economic Area.
If you would like details of the specific safeguards in place for any particular transfer, please contact us at privacy@orcatechnical.co.uk
Our website uses Swetrix for analytics. Swetrix is a cookieless analytics tool - it does not use cookies or any other client-side tracking technologies, and does not collect any personally identifiable information. As a result, we do not use any tracking or analytics cookies on our website.
We may use strictly necessary cookies to ensure the website functions correctly, such as remembering your preferences or maintaining a session. These cookies do not track you and do not require your consent.
We do not use any advertising, marketing, or third-party tracking cookies.
We take the security of your personal data seriously, and have implemented a range of technical and organisational measures to protect it against unauthorised access, loss or disclosure.
Technical Measures
Organisational Measures
In the Event of a Data Breach
In the unlikely event of a personal data breach that poses a risk to individuals, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it, as required by UK GDPR. Where the break is likely to result in a high risk to your rights and freedoms, we will also notify you directly, without delay.
If you have any concerns about the security of your data, please contact us at privacy@orcatechnical.co.uk
We will only send you marketing communications if you have given us your explicit prior consent to do so. You will never be added to a marketing list without your knowledge.
You can unsubscribe to marketing emails at any time, by contacting marketing@orcatechnical.co.uk
We will never sell, rent or share your contact details with third parties for marketing purposes.
If you have any concerns about how we handle your personal data, please contact us in the first instance at privacy@orcatechnical.co.uk and we will do our best to resolve the matter promptly.
If you are not satisfied with our response, you have the right to lodge a complaint with the UK’s Information Commissioner’s Office (ICO).
We may update this privacy policy to reflect changes in our business or legal obligations. The date at the top of this policy indicates when it was last revised.
If we make any material changes that significantly affect how we handle your personal data, we will notify you by email where we hold your contact details.
The up-to-date version of this policy is always available on our website.