Privacy Policy | Orchify

Data controller

Controller: Orchify L.L.C.
Address: Përmet Vula 46, 50000 Gjakovë, Kosovo
Privacy contact: dpo@orchify.io

Personal data we process

Business inquiries

When you contact us by email or through the contact form on our homepage, we may process your name, business contact details, employer, role, message content, correspondence, and any information you choose to provide.

The contact form does not send data to our servers. It prepares an email in your own email application, which you then send to us. Until you send it, the information stays on your device.

Technical and security data

When you visit the website, our hosting provider processes connection data on our behalf in server logs: your IP address, the date and time of the request, the requested resource, the referring page, browser and operating system information, and security events. We use this data to deliver the website, to detect and investigate abuse, and to keep the site secure.

Theme preference

The website stores your selected light or dark theme in your browser. This preference is not sent to Orchify by the website code. See our Storage and Cookie Policy.

Purposes and legal bases

Purpose	Legal basis
Responding to inquiries and discussing potential engagements	Steps taken at your request before entering a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to business inquiries (Art. 6(1)(f) GDPR)
Managing business relationships and correspondence	Performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in managing business relationships (Art. 6(1)(f) GDPR)
Protecting the website and infrastructure	Our legitimate interest in maintaining a secure and reliable website (Art. 6(1)(f) GDPR)
Meeting accounting, regulatory, and legal requirements	Compliance with legal obligations (Art. 6(1)(c) GDPR)

Where we rely on legitimate interests, you can object to the processing as described under Right to object.

Orchify does not currently use this website for behavioral advertising, marketing profiling, or automated decision-making.

Service providers and recipients

Personal data is processed on our behalf by providers that support our website hosting (Namecheap) and our business email (Microsoft 365). They act only on our instructions. We may also disclose data where required by law or when necessary to establish, exercise, or defend legal claims.

These providers may process data outside the European Economic Area and outside Kosovo, including in the United States. Where that happens, transfers rely on an adequacy decision such as the EU-US Data Privacy Framework or on the European Commission's Standard Contractual Clauses. You can request a copy of the relevant safeguards through the privacy contact.

Retention

We keep personal data only for as long as needed for the purpose for which it was collected. The period depends on the nature of the inquiry or business relationship, applicable legal requirements, and whether the data is needed to establish, exercise, or defend legal claims. Technical logs are retained according to the hosting provider's operational and security settings.

Right to object

Where we process your personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves to establish, exercise, or defend legal claims.

To object, contact dpo@orchify.io. No particular form is required.

Your data protection rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict, or object to processing of your personal data. You may also have a right to data portability and to withdraw consent where processing is based on consent.

To exercise a right, contact dpo@orchify.io. We may need enough information to confirm your identity and understand the request.

You may lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR), or with the Information and Privacy Agency of Kosovo.

Policy changes

We may update this policy when our services, providers, or legal obligations change. The current version will be published on this page with its effective date.