Last updated: 30 August 2026
1. About these terms
These Terms of Service apply to business customers and authorised users of OrcaSure, an assurance and audit management software service operated by Orca360. By subscribing to, accessing or using OrcaSure, the customer agrees to these terms.
These terms are intended for business use. They do not remove any rights that cannot lawfully be excluded.
2. The service
OrcaSure provides software for audit planning, digital inspections, evidence capture, corrective actions, review and verification, reporting, user and permission management, location/zone/area structures, operational checklists, scan tags and related assurance workflows.
We may improve, update or change the service from time to time, provided that we do not materially remove the core functionality of a paid plan without reasonable notice where it is practicable to give notice.
3. Accounts and authorised users
The customer is responsible for its authorised users, the accuracy of account information, and ensuring that credentials are kept confidential. Accounts must not be shared between people where doing so would bypass licensing, security or accountability controls.
Administrators and active auditors are licensed users for pricing purposes. Area managers, action owners and other operational participants may be included without an additional licence where stated in the customer's plan.
4. Customer responsibilities
The customer is responsible for:
- configuring its audits, questions, locations, areas, users, permissions and retention rules appropriately;
- ensuring it has a lawful basis for personal data entered into OrcaSure;
- providing any privacy information required to its own staff, contractors or other individuals;
- ensuring audit content, evidence and corrective actions are lawful, relevant and appropriate;
- maintaining suitable internal controls over who may access the service;
- reviewing exported records before deleting information needed for legal, regulatory, insurance, accreditation or internal-retention purposes; and
- complying with applicable laws and sector-specific requirements.
5. Subscription plans and pricing
Subscription prices, user allowances, storage allowances and plan features are shown on the Pricing page or in an agreed order or quotation. Prices are exclusive of VAT unless stated otherwise.
We may change published pricing for future subscription periods. Existing customers will receive reasonable notice of material price changes before they take effect, unless a change is required immediately by law or tax rules.
6. Billing and Stripe
Subscription billing and payment processing within OrcaSure are provided through Stripe. The public OrcaSure marketing website does not process card payments.
Where card or payment details are required, they are provided to Stripe rather than stored as full card details on the OrcaSure VPS. Stripe's own terms and privacy arrangements also apply to the payment services it provides.
We may suspend paid functionality where payment is overdue after reasonable notice, subject to any contractual grace period shown in the service or agreed with the customer.
7. Storage and evidence
Each plan includes the storage allowance shown on the Pricing page or order. Storage may include audit responses, photographs, evidence, reports and associated files.
OrcaSure is designed to resize and optimise uploaded images to reduce storage consumption while maintaining suitable quality for ordinary audit, review and reporting purposes.
If a customer approaches or exceeds its storage allowance, we may contact the customer to discuss archive, retention, clean-down or additional storage options. We will not deliberately prevent a critical audit from being completed without reasonable warning where an alternative is reasonably available.
8. Retention, export and clear-down
OrcaSure supports customer-controlled retention. Completed audits can be exported or downloaded so customers can retain copies outside the live system where that fits their legal, regulatory or internal policy.
Customers can clear eligible legacy records or evidence from live storage where the information is no longer required. The customer is responsible for deciding what should be retained or deleted and for keeping any exported archive required by its own obligations.
Deletion from live systems may not immediately remove information from protected backups, which are overwritten or deleted according to the applicable backup lifecycle.
9. Hosting and infrastructure
OrcaSure is hosted on a virtual private server supplied by Fasthosts Internet Limited. The software is developed and operated by Orca360. Administrative access to the VPS is restricted to authorised Orca360 personnel, while Fasthosts may have limited infrastructure or administrative access where necessary to provide, secure, maintain or support the hosting service or to comply with law.
The customer acknowledges that internet and hosting services may occasionally be interrupted for maintenance, updates, faults or events outside reasonable control.
10. Customer data ownership
As between Orca360 and the customer, the customer retains its rights in the content and data it enters into OrcaSure. The customer grants Orca360 the rights necessary to host, process, transmit, display, back up and otherwise handle that data solely as required to provide and support the service and comply with law.
Orca360 retains all intellectual property rights in the OrcaSure software, interface, documentation, branding, platform architecture and other materials created by or for Orca360, excluding customer data.
11. Data protection and processor terms
Where Orca360 processes personal data on behalf of the customer, the customer is the controller and Orca360 is the processor for that processing. The following clauses form the data-processing terms between the parties.
11.1 Processing details
Subject matter: personal data contained in or generated through the customer's use of OrcaSure.
Duration: for the term of the subscription and any limited period required for return, deletion, backup rotation, legal obligations or dispute resolution.
Nature and purpose: hosting, storing, organising, displaying, transmitting, backing up, securing and otherwise processing data to provide audit, assurance, corrective-action, review, reporting, authentication, support and related OrcaSure functionality.
Types of personal data: identity, work contact details, account data, audit responses, comments, findings, corrective actions, photographs, evidence, timestamps, responsibility records, technical logs and any other personal data the customer chooses to place in the service.
Categories of data subjects: employees, contractors, auditors, managers, action owners, visitors, suppliers and other individuals whose information is included in the customer's assurance processes.
11.2 Documented instructions
Orca360 will process customer personal data only on the customer's documented instructions, including instructions inherent in the customer's use and configuration of OrcaSure, unless UK law requires other processing.
11.3 Confidentiality
Orca360 will ensure that persons authorised to process customer personal data are subject to appropriate confidentiality obligations.
11.4 Security
Orca360 will implement appropriate technical and organisational measures designed to protect customer personal data, taking into account the nature of the processing, available technology, implementation costs and the risks to individuals.
11.5 Sub-processors
The customer gives general authorisation for Orca360 to use the sub-processors necessary to provide OrcaSure. The current principal sub-processor for hosted customer data is Fasthosts Internet Limited, which supplies the VPS infrastructure. Stripe is used for payment and subscription services and may act as processor or independent controller depending on the activity.
Where UK GDPR Article 28 applies to a new sub-processor handling customer personal data, Orca360 will impose appropriate data-protection obligations and provide notice of material changes where required, giving the customer a reasonable opportunity to object on legitimate data-protection grounds.
11.6 Data subject rights
Taking into account the nature of the processing, Orca360 will provide reasonable assistance through appropriate technical and organisational measures to help the customer respond to requests by individuals exercising their data protection rights.
11.7 Breach, DPIA and regulatory assistance
Orca360 will notify the customer without undue delay after becoming aware of a personal data breach affecting customer-controlled data and will provide reasonable assistance with breach assessment, regulator or data-subject notifications, data protection impact assessments and prior consultation where required and relevant to the OrcaSure processing.
11.8 Return and deletion
At the end of the service, Orca360 will, at the customer's choice and subject to available product functionality and applicable law, return or delete customer personal data within a reasonable period. Protected backup copies may remain temporarily until overwritten through normal backup rotation.
11.9 Compliance information and audits
Orca360 will make available information reasonably necessary to demonstrate compliance with these processor obligations and will permit reasonable audits or inspections where required by Article 28, subject to reasonable notice, confidentiality, security controls and measures to avoid unnecessary disruption or exposure of other customers' information.
12. International transfers
If customer personal data is transferred outside the UK, Orca360 will ensure an appropriate UK transfer mechanism is used where required. Payment processing through Stripe may involve international processing under Stripe's applicable transfer arrangements.
13. Confidentiality
Each party will keep the other party's confidential information confidential and use it only for the purposes of the customer relationship, except where disclosure is required by law or to professional advisers and service providers who are bound by appropriate confidentiality duties.
14. Acceptable use
Customers and users must not:
- use OrcaSure unlawfully or to infringe another person's rights;
- attempt to bypass security, permissions, licensing or access controls;
- introduce malware, malicious code or harmful content;
- probe, scan or test vulnerabilities without written authorisation;
- interfere with the service or another customer's use of it;
- upload content they have no right to process; or
- use the service in a way that creates an unreasonable security or infrastructure risk.
15. Availability, maintenance and support
We aim to provide a reliable service but do not guarantee uninterrupted or error-free availability. Planned maintenance, emergency maintenance, third-party infrastructure faults, internet failures and events outside reasonable control may affect availability.
Unless a separate service-level agreement is agreed in writing, any availability targets or response times are service objectives rather than guaranteed service levels.
16. Warranties
OrcaSure is provided with reasonable care and skill. Except where the law does not permit exclusion, all other warranties, conditions or terms implied by statute, common law or otherwise are excluded to the fullest extent permitted by law.
OrcaSure supports assurance processes but does not replace the customer's professional judgement, statutory responsibilities, competent-person duties, legal advice, regulatory obligations or management responsibility.
17. Liability
Nothing in these terms excludes or limits liability where it would be unlawful to do so, including liability for fraud or fraudulent misrepresentation, death or personal injury caused by negligence, or any other liability that cannot legally be limited.
Subject to the paragraph above, neither party will be liable for indirect or consequential loss, or for loss of profit, revenue, anticipated savings, goodwill or business opportunity, except where such exclusion is not permitted by law.
Subject to any separately agreed contract, Orca360's aggregate liability arising out of or in connection with the service in any 12-month period will not exceed the fees paid or payable by the customer for OrcaSure during that 12-month period. This limit does not apply where a higher or unlimited liability is required by law.
18. Suspension and termination
We may suspend access where reasonably necessary to protect security, prevent misuse, respond to a legal requirement, address a material breach, or deal with overdue payment. Where practicable, we will give notice and an opportunity to remedy the issue.
Subscription cancellation and renewal terms are those shown at purchase, in the customer account or in an agreed order. Termination does not remove payment obligations already accrued.
19. Changes to these terms
We may update these terms to reflect changes in law, security, infrastructure, product functionality or commercial arrangements. Material changes affecting existing paid customers will be communicated with reasonable notice where practicable.
20. Governing law
These terms are governed by the laws of England and Wales. The courts of England and Wales will have jurisdiction over disputes arising from these terms, subject to any mandatory rights or separately agreed dispute-resolution provisions.
21. Contact
Questions about these terms can be sent through the OrcaSure contact page or the Orca360 contact page.