Last updated: 31 October 2026
Contents
- Who we are and how to contact us
- Controller and processor roles
- The personal data we collect
- Data about chat visitors
- AI features
- How we use data and our lawful bases
- Direct marketing and PECR
- Who we share data with
- International transfers
- How long we keep data
- How we protect data
- Your rights
- Children
- Complaints
- Changes to this policy
1. Who we are and how to contact us
Orbis Chat is a business-to-business live chat service operated by Orbis Digital Ltd, a private limited company registered in England and Wales (company number 17116737). Our registered office is 66 Paul Street, London, EC2A 4NA. In this policy, "we", "us" and "our" mean Orbis Digital Ltd.
This policy explains how we handle personal data on our website (orbischat.co.uk), in our application, and in the widgets and hosted pages we provide for customers. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (both as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003 (PECR).
Contact us about privacy at support@orbisdigital.co.uk or on 0330 223 7919.
2. Controller and processor roles
We are the controller for: account holders' and agents' data; billing records; support enquiries; security and audit logs that we use to run the service; and marketing to business contacts.
We are a processor for the content and visitor data that customers handle through Orbis Chat, including chats, tickets, contacts, deals, tasks and knowledge base content. The customer is the controller of that data, and our Data Processing Agreement applies. If you chatted with a business using Orbis Chat and have a question about your data, please contact that business first.
3. The personal data we collect
- Account and agent data: names, business email addresses, business details, roles, and login and security data, including two-factor login settings.
- Usage and technical data: IP addresses, browser information and activity logs, including the audit log.
- Customer content: chats, files, notes, tickets, contacts, deals, tasks, tags, shortcuts and knowledge base articles that users add.
- Chat visitor data, held for our customers: see section 4.
- Enquiries: what you tell us by email or by phone.
- Billing records: where you pay us, the records needed to do so, including your subscription status and invoices. Card details are entered directly with Stripe, and we never see or store full card numbers.
4. Data about chat visitors
When someone visits a website that uses the Orbis Chat widget, or uses a customer's chat page or help centre, we process the following for that customer:
- Visit details: current page, referrer, country, device and visit count.
- What the visitor gives: messages, files, CSAT ratings, and anything entered in a pre-chat or offline message form, such as a name or email address.
- Technical data: IP address and browser details, which also support features such as visitor banning.
- Messages from connected channels: if a customer connects Telegram, WhatsApp Business, Facebook Messenger or SMS via Twilio, the sender's details and messages from that channel. These services handle data under their own terms.
Customers are responsible for telling their visitors about this, including in their own privacy and cookie information.
5. AI features
When a customer uses the AI bot, AI-drafted replies or message translation, we send the relevant content, such as the conversation and knowledge base or shortcut content, to OpenAI, to generate a result. A customer who adds their own OpenAI API key has that content processed under their own arrangement with OpenAI.
AI output can be inaccurate. These features do not make decisions with legal or similarly significant effects on individuals.
6. How we use data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing the service, including accounts, chat, channels and AI features | Contract, or legitimate interests where the user is a customer's team member |
| Support and answering enquiries | Contract or legitimate interests |
| Security, fraud prevention and audit logs | Legitimate interests |
| Billing and accounting records | Contract and legal obligation |
| Marketing to business contacts | Legitimate interests, or consent where PECR requires it |
7. Direct marketing and PECR
We may send business contacts information about Orbis Chat and related Orbis Digital services where the law allows. You can opt out at any time using the link in the message or by emailing us. You have an absolute right to object to direct marketing.
9. International transfers
Our hosting is in Europe. Some suppliers may process data in the United States or elsewhere. Where they do, we rely on UK adequacy regulations, including the UK extension to the EU-US Data Privacy Framework, or on the UK International Data Transfer Addendum or Agreement, as applicable.
10. How long we keep data
Customers can set how long conversation data is kept, using data retention settings, and can export or delete a person's data using the GDPR tools.
| Data | How long |
|---|---|
| Account and agent records | For the life of the account. Deleted straight away when the account is deleted, then gone from backups within 35 days |
| Customer content and visitor data | According to the customer's retention settings or instructions. Deleted straight away when the account is deleted, then gone from backups within 35 days |
| Security, audit and access logs | For the life of the account, then deleted with it |
| Billing records | Six years after the financial year they relate to, as UK tax law requires |
| Backups | Taken nightly and encrypted. Kept for 35 days |
11. How we protect data
We use technical and organisational measures appropriate to the risk, including tenant isolation, two-factor login, role-based access, audit logging and nightly encrypted backups. No system is completely secure, and you should keep your own login details safe.
12. Your rights
You have rights to access, rectify and erase your personal data, to restrict or object to its use, to data portability, and rights related to automated decisions. These rights have limits in some situations. They are normally free to use, and we will respond within one month, or up to two months longer for complex requests. We may need to confirm your identity. To use your rights, email support@orbisdigital.co.uk. If your request concerns data controlled by a customer, we may refer you to that customer.
13. Children
Accounts on Orbis Chat are for businesses and are not for anyone under 18. We do not knowingly collect children's data for our own purposes. Customers are responsible for any data about children in their own chats and content.
14. Complaints
Please tell us first if you have a data protection complaint, by emailing support@orbisdigital.co.uk. You can also complain to the ICO (or its successor, the Information Commission) at ico.org.uk or on 0303 123 1113.
15. Changes to this policy
We may update this policy, and we will show the new date at the top. We will tell customers about material changes by email or in the application.