Privacy policy.

Who we are.

ORBIT-RRI Ltd is a not-for-profit company registered in England and Wales, with its registered office at De Montfort University, Leicester, LE1 9BH. We are the data controller for personal data collected through this website and through delivery of our training, advisory, and tool services.

What we collect.

We collect only what we need to run the service you have asked for. That includes:

• Contact details you give us when you fill in the "Talk to us" form or write to us by email (name, work email, organisation, and the message you send).
• Training and engagement records when you sign up for one of our courses or engagements (name, organisation, billing details where relevant, attendance records, course feedback).
• Tool inputs if and only if you actively choose to save and share results from one of our free tools. The tools work locally in your browser by default and store nothing on our servers unless you opt in.
• Basic server logs generated when your browser requests a page (IP address, requested URL, user agent, timestamp), used for security and to keep the service running.

Why we collect it.

To reply to your enquiry, deliver the training or service you have asked for, send you the certificate or output you have asked for, invoice you, keep our records straight for the people we are accountable to, and protect the service against abuse.

We do not sell personal data and we do not share it with advertisers.

Legal basis.

Under UK GDPR we rely on the following legal bases:

• Consent when you ask us to do something specific, such as add you to a course mailing list.
• Contract when you have engaged us to deliver a service.
• Legal obligation for records we must keep for tax, accounting, or regulatory purposes.
• Legitimate interests for the basic running of the service: security logs, replying to a sensible enquiry, keeping our books straight.

Who we share it with.

A small number of named processors that we use to run the service. These now include our website host, our email provider, our finance and invoicing software, and our cloud document storage. Each is contracted under UK GDPR-compliant terms. We will name our current processors on request.

We do not transfer personal data outside the UK or the European Economic Area without a legal basis for doing so.

How long we keep it.

Enquiry messages are kept for up to 24 months unless they turn into a commercial engagement, in which case they form part of the engagement record. Engagement records are kept for the legally needed minimum, now six full tax years. Training records for paid courses are kept for the same period.

Server logs are rotated and deleted within 30 days unless retained for an active security investigation.

Cookies and analytics.

The public website uses no third-party advertising cookies and no cross-site trackers. We use a single privacy-respecting analytics service that does not set personal cookies and does not record IP addresses or fingerprints. You can use the site without consenting to any non-essential cookies.

Your rights.

You have the right to access the personal data we hold about you, ask us to correct it, ask us to delete it where there is no legal reason to keep it, object to certain processing, and withdraw consent at any time where consent was the basis we relied on. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data, although we would prefer you came to us first.

Contact.