Privacy policy
How Orbtio collects and uses personal data on this website and in our work with clients.
Last updated 9 Nov 2026
This policy explains what personal data we collect through orbtio.si, why, and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).
Who is responsible
The controller is [Company legal name, e.g. Orbtio d.o.o.], [Street and number], [Postcode] Ljubljana, Slovenia, registration number [Registration number (matična številka)], VAT ID [VAT ID, e.g. SI12345678]. For anything about your data, write to privacy@orbtio.si.
What we collect
When you use the contact or assessment form. Your name, work email, company, website address, current platform, approximate page count, timeline, and anything you write in the message field.
When you email us. Your email address, name, and whatever the email contains.
When you visit the site. Our hosting provider records technical data in server logs, like IP address, browser type, the page requested, and the time. We don't use these logs to identify you.
We don't use analytics, advertising, or tracking tools on this website, and we don't build profiles of visitors.
Why we use it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to your request and preparing an assessment proposal | Form and email data | Steps before a contract at your request, GDPR Art. 6(1)(b) |
| Keeping your inquiry after it closes without a project, so we have the context if you come back | Form and email data | Legitimate interest in continuing a business conversation, Art. 6(1)(f) |
| Working with you as a client | Contact and project data | Performance of a contract, Art. 6(1)(b) |
| Publishing a case study, quote, photo, or screen recording | Name, job title, photo, quote, recording, company logo | Your consent, Art. 6(1)(a) |
| Running and securing the website | Server logs | Legitimate interest in a working, secure site, Art. 6(1)(f) |
| Keeping invoices and business records | Billing data of clients | Legal obligation, Art. 6(1)(c) |
Only name, email, and website are required in the form. Without them we can't reply or look at your site. Everything else is optional. We don't make decisions about you by automated means, including profiling.
We don't send newsletters or marketing emails unless you ask for them.
Case studies and testimonials
We publish a case study, your name, photo, quote, or a recording of your team only with written consent from you and your company, usually agreed in the project contract. You can withdraw consent at any time. We'll then remove the personal parts from our website within 30 days. Copies already shared by others, for example on social media, may stay online.
When we work on your website
During a project we may handle personal data that belongs to your website, such as form submissions, CMS user accounts, or analytics. For that data, your company is the controller and we act as its processor, under a data processing agreement (GDPR Art. 28) that is part of our contract. This policy doesn't cover that data.
Who we share it with
We don't sell personal data. We share it only with service providers who process it for us under a data processing agreement:
- Website hosting: Cloudflare, Inc. (USA), served from its global network
- Email delivery of form submissions and the confirmation we send you: Cloudflare, Inc. (USA)
- Our email and document tools, used to communicate and work with you
Some providers are based outside the EU. Where data leaves the EU or EEA, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
How long we keep it
- Inquiries that don't lead to a project: 12 months after our last contact, then deleted. You can ask us to delete them sooner
- Client correspondence and project data: for the duration of the work and up to 5 years after it ends
- Invoices and accounting records: as long as Slovenian tax law requires, currently 10 years
- Server logs: kept by the hosting provider for a short period, usually days to weeks
- Case study materials: as long as the case study is published, or until you withdraw consent
Your rights
You can ask us to access, correct, or delete your data, restrict its processing, or hand it over to you in a portable format. Where we rely on consent, you can withdraw it at any time. This doesn't affect processing that happened before. Write to the address above and we'll reply within one month.
You can also complain to the Slovenian supervisory authority, the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si, or to the authority in your own EU country.
Security
The site runs over HTTPS. Access to inquiries and client data is limited to the people who need it.
Changes
If we change how we handle data, for example by adding analytics or a scheduling tool, we'll update this page and the date at the top first.