Privacy policy.
Who we are
Orvixo Europe Ltd (“Orvixo”, “we”) runs https://orvixo.ai and is the controller of the personal data described here. We are registered in England and Wales, company no. 17355672, with our registered office at 1 Dannog Y Coed, Barry, CF63 1HF, United Kingdom. ICO registration: [ICO registration number, if registered].
Anything about this policy or your data: write to hello@orvixo.ai. A founder reads it.
What we collect
The site has few moving parts, so it collects little. Here is all of it.
When you email us
Your email address, your name and whatever you choose to tell us, usually your company, your role and the planning problem you have. The thread lives in our email system.
When you book a call
Booking runs on Cal.com. You give Cal.com your name, email address, the time you picked and any notes; Cal.com passes them to us and sends the calendar invitation. Cal.com’s privacy policy also applies to that step. Nothing from Cal.com loads on our pages until you click through.
When you visit the site
- Server logs. Our host, Vercel, records the IP address, browser and time of each request so it can serve pages and protect the site. This happens whether or not you accept cookies, and it stores nothing on your device.
- Analytics, only if you allow it. Vercel Web Analytics and Speed Insights count page views and measure load speed: page URL, referrer, country, device, browser and operating system. They set no cookies. A visit is identified with a hash of the request that Vercel discards after a day, so you cannot be recognised across days.
- Visitor identification, only if you allow it. Apollo.io’s tracker records the pages you view, your IP address and device details, stores an identifier in your browser, and matches the visit against Apollo’s database of companies and business contacts. Outside the United States it identifies the company only; for US visitors it may identify the person. Apollo’s script also loads an identity component from LiveIntent that can set cookies of its own. Everything it stores is listed in the cookie policy.
If you follow or message our LinkedIn page, LinkedIn is the controller for what happens there. We see what LinkedIn shows any page administrator.
Why we use it, and on what basis
UK GDPR requires a lawful basis for each use of personal data. Ours are below. Where we rely on legitimate interests we have weighed them against your rights and interests; ask us if you would like to see that assessment.
| Purpose | Data | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Replying to you and setting up calls | Contact details and what you tell us | Legitimate interests (running our business and answering people who write to us). Where you ask us to, steps before a contract. |
| Keeping the site secure and available | Server logs held by our host | Legitimate interests (protecting the site and its visitors). |
| Understanding how the site is used | Aggregate analytics; no cookies | Consent, given through Cookie settings. Withdraw it there at any time. |
| Seeing which companies and people visit, so we can follow up | Visitor-identification data from Apollo.io | Consent, given through Cookie settings. Withdraw it there at any time. |
| Following up with businesses that show interest in Orvixo | Business contact details you gave us or that the tool above matched | Legitimate interests (business-to-business marketing). You can object at any time and we will stop. |
We do not make automated decisions about you that have legal or similarly significant effects, and we do not use the site to collect special-category data.
Who we share it with
Providers that process personal data for us, under contracts that restrict what they may do with it:
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting, server logs, analytics and speed measurement | United States |
| Cal.com, Inc. | Booking calls with the founders | United States |
| Apollo.io (ZenLeads Inc.) | Identifying visiting companies and people; sales tooling | United States |
| LiveIntent, Inc. | Identity component loaded by Apollo's script | United States |
| Our company page; LinkedIn is its own controller | United States / Ireland |
Beyond that, we share personal data only when the law requires it, with professional advisers under a duty of confidence, or with a buyer if the business changes hands. We do not sell personal data.
International transfers
Several providers above are in the United States, so personal data leaves the UK. When it does, we rely on one of the safeguards UK GDPR allows: the UK’s adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework for providers certified under it, or the ICO’s International Data Transfer Agreement or Addendum to the EU standard contractual clauses, which our providers build into their terms. Write to us if you want to know which safeguard covers a particular provider.
How long we keep it
- Enquiries and call notes: while we are in contact and for [Retention period for enquiries, e.g. 24 months after last contact], so we can pick a conversation up where it stopped.
- Server logs: kept by Vercel for a short period under its own retention policy, then deleted.
- Analytics: aggregate only. The daily hash is discarded after 24 hours and nothing that identifies you is retained.
- Visitor identification: held in our Apollo.io account while we use the service. We delete records on request.
- Your cookie choice: 6 months, after which we ask again.
Your rights
Under UK GDPR you can ask us to:
- Tell you what personal data we hold about you and give you a copy (access).
- Correct anything that is wrong (rectification).
- Delete it (erasure), in many situations.
- Stop or limit what we do with it (restriction and objection), including objecting to direct marketing at any time.
- Give you the data you provided in a machine-readable form (portability).
- Withdraw consent you have given. Withdrawing does not affect what was done before, and you can do it for cookies from Cookie settings without asking us.
Email hello@orvixo.ai. We reply within one month and do not charge. We may ask you to confirm who you are first.
If you are in the EU or the US
If you are in the European Economic Area, the EU GDPR applies to our handling of your data alongside UK law. You have the same rights as above and can complain to the supervisory authority where you live. EU representative: [EU representative under Art. 27 GDPR, if appointed].
If you are in the United States, state privacy laws such as the California Consumer Privacy Act set size thresholds we do not currently meet, so they do not apply to us. Even so: we do not sell personal information, nothing optional runs on this site without your say-so (so a Global Privacy Control signal changes nothing; it is already the default), and if you write to exercise a right your state gives you we will honour it where we can.
Complaints
If you think we have got something wrong, tell us first and we will try to fix it. You also have the right to complain to the UK regulator, the Information Commissioner’s Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Cookies
Every cookie and similar technology on the site is listed in the cookie policy. You can change your choices at any time.
Changes
We will update this policy when what we do changes, and the date at the top shows when we last did. If a change matters to you, for example a new category of data or a new purpose, we will say so on the site rather than change the page quietly.