Last updated: 30 August 2026
1. Who we are
OrcaSure is an assurance and audit management software product operated by Orca360. In this policy, “OrcaSure”, “Orca360”, “we”, “us” and “our” refer to the organisation operating the OrcaSure website and software service.
For privacy enquiries or to exercise your data protection rights, please contact us through the OrcaSure contact page or the Orca360 contact page.
2. Scope
This policy applies when you visit the OrcaSure website, request a demo, contact us, create or use an OrcaSure account, administer a workspace, carry out audits or inspections, respond to corrective actions, use billing features, receive service communications, or otherwise interact with OrcaSure in a business capacity.
3. Our role as controller and processor
Controller activities. Orca360 generally acts as controller for information used to run its own business and customer relationship, including website enquiries, demo requests, account administration, licensing, billing records, service communications, security records and support correspondence.
Processor activities. Where a customer places personal data into OrcaSure for its own audits, inspections, corrective actions or assurance programme, the customer will normally be the controller and Orca360 will act as processor on that customer's documented instructions.
Customers are responsible for determining the lawful basis for the personal data they collect through OrcaSure and for providing any privacy information required to their employees, contractors, visitors or other individuals.
4. Personal data we may process
- Identity and contact data: name, work email, telephone number, employer, job title and role.
- Account data: user ID, workspace, access level, permissions, account status and authentication-related information.
- Audit and assurance data: audit assignments, responses, comments, findings, corrective actions, review decisions, timestamps and responsibility records.
- Evidence: photographs, files and other evidence uploaded as part of an audit, inspection or corrective-action process.
- Operational data: sites, locations, zones, departments, areas, schedules and scan-tag activity linked to users or workspaces.
- Technical and security data: IP address, browser or device information, logs, security events and information used to protect and operate the service.
- Commercial and billing data: subscription plan, licensed users, billing status, invoices, payment status and transaction references. Full payment card details are processed by Stripe rather than stored on the OrcaSure VPS.
- Communications: messages, support correspondence and records of product or account communications.
Customers should avoid uploading special category data, criminal-offence data or other highly sensitive information unless it is genuinely required for their assurance process and they have identified the lawful basis and any additional legal condition required.
5. How we collect information
We may collect information directly from you, from your employer or organisation, from another authorised OrcaSure user, through the OrcaSure application, through support interactions, through billing activity, or automatically from systems used to provide and secure the service.
6. Why we use personal data
| Purpose | Typical lawful basis where Orca360 is controller |
|---|---|
| Responding to enquiries and arranging demonstrations | Legitimate interests and, where relevant, steps taken at your request before entering into a contract. |
| Creating and administering customer accounts | Performance of a contract and legitimate interests. |
| Providing, maintaining and securing OrcaSure | Performance of a contract and legitimate interests. |
| Billing, subscriptions and payment administration | Performance of a contract and compliance with legal obligations. |
| Service and security communications | Performance of a contract and legitimate interests. |
| Fraud prevention, misuse detection and security monitoring | Legitimate interests and, where applicable, legal obligations. |
| Legal, regulatory, tax and accounting compliance | Compliance with legal obligations and legitimate interests. |
| Improving OrcaSure using aggregated or appropriately de-identified information | Legitimate interests. |
7. Customer-controlled audit data
Where Orca360 processes personal data in a customer's workspace as processor, we use that information only to provide, secure, maintain and support OrcaSure and in accordance with the customer's documented instructions, unless the law requires otherwise.
The customer controls its audit questions, evidence requirements, action assignments, authorised users, retention decisions and deletion/export choices.
8. Hosting and access to the VPS
OrcaSure is hosted on a virtual private server supplied by Fasthosts Internet Limited. Orca360 develops and operates the software itself and restricts administrative access to authorised Orca360 personnel. Fasthosts provides the underlying VPS infrastructure and may have limited administrative or infrastructure access where necessary to provide, secure, maintain or support its hosting service, or where required by law.
Fasthosts acts as a processor or sub-processor in relation to personal data hosted within the VPS to the extent it processes that data on our behalf.
9. Stripe and payment processing
OrcaSure uses Stripe within the OrcaSure application for subscription billing and payment processing. The public marketing website does not process card payments.
Where you enter payment details, those details are submitted to Stripe. OrcaSure does not store full payment card numbers on its VPS. We may receive limited billing information from Stripe, such as payment status, customer identifiers, subscription details, invoice information and transaction references.
Depending on the activity, Stripe may act as a processor on our behalf and may also act as an independent controller for activities such as fraud prevention, security and compliance with its own legal and regulatory obligations.
10. Service providers and sub-processors
Based on the current production design, the principal third-party service providers used for OrcaSure are:
| Provider | Purpose | Role |
|---|---|---|
| Fasthosts Internet Limited | VPS hosting and infrastructure used to host the OrcaSure service and customer data. | Processor / sub-processor where it processes personal data on our behalf. |
| Stripe | Subscription billing and payment processing within the OrcaSure application. | Processor for certain services and independent controller for certain Stripe activities. |
If we introduce a new processor or sub-processor for customer-controlled personal data, we will update our documentation and, where required, follow the authorisation and notification requirements applicable to our processor role.
11. International transfers
Where personal data is transferred outside the United Kingdom, we will use a transfer mechanism recognised under UK data protection law where one is required, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any supplementary measures considered appropriate.
Some Stripe processing may involve international data flows as part of Stripe's global payment infrastructure. Stripe is responsible for the transfer arrangements applicable to processing for which it acts as controller, and contractual safeguards apply where Stripe processes data on our behalf.
12. Evidence, images and compression
OrcaSure may store photographs and other evidence uploaded during audits and corrective-action workflows. The service is designed to resize and optimise uploaded images to reduce storage use while maintaining suitable quality for ordinary assurance, review and reporting purposes.
Customers should ensure images are relevant to the audit or assurance purpose and avoid capturing unnecessary personal information.
13. Retention, export and deletion
We keep personal data only for as long as reasonably required for the relevant purpose, to provide the service, meet legal or accounting obligations, resolve disputes and protect legal rights.
For customer-controlled audit and assurance records, the customer determines its retention period. OrcaSure supports retention management by allowing completed audits to be exported or downloaded and by allowing eligible legacy records and evidence to be cleared from live storage in accordance with the customer's retention policy.
Deletion from active systems may not immediately remove data from protected backups. Backup copies are retained only for the applicable backup lifecycle and are then overwritten or deleted through normal backup rotation.
14. Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include access controls, account permissions, secure authentication mechanisms, server administration controls, logging, software maintenance and other security practices appropriate to the service.
No internet-based service can be guaranteed to be completely secure. Customers are responsible for maintaining secure user accounts, appropriate permissions and suitable organisational controls for their own users.
15. Personal data breaches
Where Orca360 acts as processor and becomes aware of a personal data breach affecting customer-controlled data, we will notify the relevant customer without undue delay and provide reasonable information and assistance to support the customer's own breach assessment and notification obligations.
Where Orca360 acts as controller, we will assess any breach and make notifications to affected individuals or the Information Commissioner's Office where required by law.
16. Your data protection rights
Depending on the circumstances, individuals may have rights including access, rectification, erasure, restriction, objection, data portability and rights relating to solely automated decision-making. These rights are subject to legal conditions and exemptions.
If the information is held in an OrcaSure customer workspace and the customer is the controller, we may direct your request to that customer or assist the customer in responding.
17. Complaints
If you have concerns about how personal data is handled, please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.
18. Cookies and similar technologies
The OrcaSure marketing website does not currently use analytics, advertising or behavioural tracking cookies. Please see our Cookie Policy for more information.
The authenticated OrcaSure application may use strictly necessary session or security technologies required to sign users in, maintain a secure session and provide requested application functionality. Stripe may use cookies or similar technologies on Stripe-hosted payment and billing pages in accordance with its own policies.
19. Marketing
We may contact business users about OrcaSure where permitted by applicable law. You can ask us to stop direct marketing at any time. Service, billing, security and account messages are not marketing and may still be sent where necessary to provide the service.
20. Changes to this policy
We may update this policy to reflect changes in law, regulation, our service, our infrastructure or our processing activities. The latest version will be published on this page with an updated date.