Privacy Policy

Orbio ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our ITSM platform and website.

1. Information We Collect

Account Information. When you register, we collect your email address, name, and company details. This is necessary to provide you access to the platform and manage your tenant.

Usage Data. We collect log data including IP addresses, browser type, pages visited, and timestamps. This helps us maintain security and improve our service.

Content Data. Any data you submit through the platform — tickets, comments, asset records, KB articles — is stored securely in your dedicated database schema. We do not access or process this content except as necessary to provide the service.

2. Voluntary vs Mandatory Supply

Information we collect is categorized as follows:

• Mandatory: Email address, name, and company name are required to create and maintain your account. Without this information, we cannot provision your tenant or provide access to the platform.
• Optional: Profile picture, phone number, and marketing preferences are optional. You may decline to provide these without affecting your ability to use the platform.

3. Consequences of Failure to Provide

If you fail to provide the mandatory personal information described above, we will be unable to create your account, provision your tenant, or provide the platform services. You will not be able to register or use Orbio. Failure to provide optional information will not affect your access to the platform.

4. How We Use Your Data

• To provision and maintain your tenant and user accounts
• To send transactional emails (password resets, magic links, notifications)
• To monitor platform health, detect abuse, and enforce rate limits
• To improve the platform based on aggregated usage patterns

We do not sell your personal data. We do not use your content for training AI models.

5. Lawful Basis for Processing (POPIA)

In compliance with the Protection of Personal Information Act 4 of 2013 (POPIA), Orbio processes personal data only on the following lawful bases:

• Consent: Where you have explicitly opted in (e.g., marketing communications)
• Contractual necessity: To fulfil our obligations under the Terms of Service
• Legal obligation: To comply with applicable laws and regulatory requirements
• Legitimate interest: For platform security, fraud prevention, and service improvement where your rights do not override our interests

6. Data Subject Rights (POPIA Section 5-24)

Under POPIA, data subjects in South Africa have the following rights:

• Right to Access (Section 23): Request confirmation of whether we hold your data and request a copy
• Right to Rectification (Section 24): Correct or update inaccurate or incomplete personal information
• Right to Deletion: Request deletion of your data where retention is no longer justified
• Right to Objection (Section 11(3)): Object to the processing of your personal information for direct marketing purposes
• Data Export (service feature): Receive your data in a structured, machine-readable format. This is offered as a convenience — POPIA does not confer a standalone right to data portability.
• Right to Withdraw Consent: Withdraw your consent at any time without affecting the lawfulness of prior processing

Exercise these rights from your account settings, via the CRM Consent Center, or by contacting us at privacy@orbio.africa. You may also submit a Data Subject Access Request directly via our DSAR Portal. We will respond within 30 days as required by POPIA.

7. Data Storage, Security & Cross-Border Transfers

All data is stored in PostgreSQL databases encrypted at rest (AES-256). Connections are TLS 1.3-encrypted in transit. Passwords are hashed with BCrypt. Each tenant's data is isolated at the database schema level to prevent cross-tenant access.

Where data is transferred across South African borders, Orbio uses third-party infrastructure providers located outside South Africa, including Render.com, whose servers are hosted in Oregon, United States. Orbio ensures appropriate safeguards are in place for such transfers, including Standard Contractual Clauses and Data Processing Agreements with all sub-processors. Our sub-processor register is available to tenants upon request.

8. Data Retention

We retain your account data for as long as your account is active. Upon tenant deletion, all associated data is permanently deleted within 30 days. Retention periods for specific data categories are defined in our Data Processing Register and default to 7 years (the POPIA prescription period) unless a shorter period is justified.

9. Automated Decision-Making

Orbio does not make decisions based solely on automated processing that produce legal effects concerning data subjects. Where automated decision-making is used (e.g., workflow triggers, SLA breach detection), human oversight is always available and data subjects may request manual review.

10. Marketing Consent & Preference Center

Orbio only sends marketing communications to contacts who have explicitly opted in. Every marketing email includes a one-click unsubscribe link. You can manage your marketing preferences at any time through the CRM Compliance → Consent Center. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

11. Third-Party Services & Sub-Processors

Orbio may integrate with third-party services you explicitly configure (Microsoft Entra ID, Google Workspace, Okta, email providers). Data shared with these services is governed by their respective privacy policies. We maintain a register of all sub-processors with details on data categories, transfer safeguards, and contract status. This register is available in the CRM Compliance → Vendor Register.

12. Cookies

We use essential cookies for authentication and session management only. No tracking cookies or third-party analytics cookies are used. Under POPIA, consent is required for the processing of personal information (including via non-essential cookies); our cookie banner provides explicit notice and opt-in for any future non-essential cookie use. You can control cookie preferences through your browser settings.

13. Complaints & Information Regulator

If you believe your personal information has been processed in violation of POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:

Information Regulator (South Africa)
Salu Building, 33 Hoofd Street, Pretoria, 0001
Email: enquiries@inforegulator.org.za
Web: www.inforegulator.org.za
Tel: +27 (0)10 023 5200

14. Information Officer

Orbio's Information Officer is Jody-Lee Sias, responsible for overseeing compliance with POPIA. You may contact our Information Officer at paia@orbio.africa or by raising a DSAR (Data Subject Access Request) through the CRM Compliance module.

15. Contact

For privacy-related inquiries or to exercise your POPIA rights, contact us:

• Email: privacy@orbio.africa
• DSAR Portal: CRM Compliance → DSAR module
• Information Officer: paia@orbio.africa