Privacy Policy
Last updated:
This Privacy Policy explains how OrquidAgents (“we”, “us”) collects and processes personal data when you use our website, request a quote, or work with us. We act as the data controller for the data described here. When we process personal data on a client’s behalf as part of a project, we act as a processor under a separate Data Processing Agreement.
1. Data we collect
- Quote calculator inputs — the workflow details, channels, integrations and options you select when building an estimate.
- Contact details — your name, company and email address when you submit an enquiry, request a quote, or book a call.
- Communications — the content of messages you send us and our correspondence with you.
- Analytics data — aggregate, cookieless usage data collected via Umami (no cross-site tracking, no advertising identifiers). See our Cookie Policy.
2. Why we use it and our lawful basis
- To respond to enquiries and prepare quotes — legitimate interest in answering and serving prospective clients.
- To deliver a project you engage us for — performance of a contract.
- To send marketing — only with your separate, explicit consent, which you can withdraw at any time.
- To improve and secure our site — legitimate interest, using privacy-first, cookieless analytics.
- To meet legal obligations — where the law requires us to retain or disclose data.
3. Marketing consent
Marketing is always separate from providing the service. You can request a quote and work with us without opting into marketing. Where you do opt in, every marketing message includes a one-click way to unsubscribe.
4. Retention
We keep enquiry and quote data only as long as needed to follow up and for our legitimate business records, then delete or anonymise it. Project data is retained for the life of the engagement and the period set out in the relevant contract or DPA, after which it is deleted or returned.
5. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased (“right to be forgotten”);
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time, where processing is based on consent;
- lodge a complaint with your supervisory authority.
To exercise any of these rights, email privacy@orquidagents.com. We respond within the timeframes the GDPR requires.
6. Sub-processors
We use a small set of carefully chosen service providers to run our site and deliver our work. Each processes data only as needed for its stated purpose:
| Sub-processor | Purpose | Region |
|---|---|---|
| Resend | Transactional email (quotes, booking confirmations, notifications) | US / EU |
| Cal.com | Booking and scheduling for intro calls | EU (self-hostable) |
| Umami | Privacy-first, cookieless web analytics | EU (self-hosted) |
| Railway | Application hosting and infrastructure | EU region available |
Additional sub-processors used for a specific client project are named in that project’s Data Processing Agreement before processing begins.
7. International transfers
Our standard infrastructure runs in the EU where an EU region is available, and we offer an EU data-residency option. Where a provider necessarily processes data outside the EU, we rely on appropriate safeguards (such as Standard Contractual Clauses) and tell you in advance.
8. Security
We encrypt data in transit, store credentials in a dedicated secrets manager, scope integrations to least privilege, and do not use your data to train models without your consent. See our Trust & compliance page for detail.
9. Changes to this policy
We may update this policy from time to time. Material changes will be reflected here with a revised “last updated” date.
10. Contact
Questions about this policy or your data? Email privacy@orquidagents.com.