1. Who we are
Orbis Mail is provided by Orbis Digital Ltd ("Orbis Digital", "we", "us"), a company registered in England and Wales (Company No. 17116737), registered office 66 Paul Street, London, EC2A 4NA. Contact us about data matters at hello@orbisdigital.co.uk.
We are the data controller for personal data collected through this website (for example when you request access or contact us) and for the account details of people who use Orbis Mail. For the content of your mailboxes, contacts, calendar entries and other data you process in Orbis Mail, your organisation is the data controller and we act as its data processor.
2. What we collect
- Enquiry details: your name, email address, business name, phone number and message, when you use our forms.
- Account details: your name, email address, role, organisation and sign-in activity.
- Mailbox connection details: the server settings, username and password for mailboxes you connect. Passwords are encrypted before they are stored.
- Data you add in Orbis Mail: contacts, calendar events, signatures, templates, drafts and notes on messages.
- Technical data: IP address, browser type and request logs, used for security and to keep the service running.
Your email messages stay on your email provider's servers. Orbis Mail fetches them when you view them; we do not keep a separate copy of your mailbox, apart from drafts you save in Orbis Mail.
3. How we use it and our lawful bases
- To provide Orbis Mail to you and your organisation (performance of a contract).
- To respond to enquiries and access requests (steps before entering a contract, and legitimate interests).
- To keep the service secure, prevent misuse and investigate problems (legitimate interests).
- To send service emails such as password resets (performance of a contract).
- To meet legal and accounting obligations (legal obligation).
We do not sell personal data, use it for advertising or read your email except where you ask us to for support, or where the law requires it.
4. Who we share it with
- Brevo, which sends our service emails (such as password resets and form notifications) under a data processing agreement.
- Infrastructure providers that host the servers Orbis Mail runs on.
- Your email provider, which Orbis Mail connects to on your instructions.
- Google Fonts, which serves the fonts used on this website and receives your IP address when your browser loads them.
- Professional advisers, and law enforcement or regulators where the law requires it.
Where a provider processes data outside the UK, we rely on the safeguards recognised by UK data protection law, such as adequacy regulations or the international data transfer agreement.
5. How long we keep it
- Enquiries that don't lead to an account: up to 12 months.
- Account and workspace data: while your organisation uses Orbis Mail, then deleted within 90 days unless the law requires us to keep it.
- Security and audit logs: up to 12 months.
- Billing records: 6 years, as required by HMRC.
6. Security
Orbis Mail is served over HTTPS. Mailbox passwords are encrypted with AES-256-GCM, connections to mail servers use TLS with certificate validation, and access is controlled by role. See our security page for more.
7. Your rights
Under UK GDPR you have the right to access, correct, erase, restrict or object to the processing of your personal data, and to data portability. If your data is held in Orbis Mail on behalf of your organisation, contact your organisation first; we will help them respond. To exercise your rights with us, email hello@orbisdigital.co.uk. We reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
8. Cookies
We only use cookies that are strictly necessary for signing in and protecting forms. See our cookie policy.
9. Changes
We may update this policy. The date at the top shows the current version, and we will tell customers about significant changes.