Legal

Privacy Policy.

What we collect when you use this website, why, who sees it, and how long we keep it. Analytics only if you agree to it, no ad trackers, and we never sell your data.

Last updated: November 5, 2026

1. Who we are

This website, www.orbitaltechltd.com, is run by Orbital Technologies LLC ("Orbital", "we", "us"), a company headquartered in Florida, USA, with a delivery team in Pakistan. We decide how the personal information collected through this website is used, which makes us its "controller" under UK and EU data protection law.

Questions about this policy or your data go to support@orbitaltechltd.com.

2. What this policy covers

This policy covers information collected through this website: the contact form, the Spiffy application form, and ordinary visits to the site. It also covers what you send us directly by email, phone or WhatsApp.

It does not cover data that our clients put into our products (such as HRMS or Spiffy) or share with us during a service engagement. We handle that data on our client's behalf, under the agreement we sign with them. If your employer or a business you deal with uses one of our products, their privacy notice applies to that data.

3. What we collect

When you use the contact form

  • Your name, work email address and, if you give them, your company, region, the kind of help you need and your budget range.
  • Your message.
  • Your IP address and your browser's user-agent string, recorded with the enquiry to help us spot spam and abuse.
  • How you reached us during that visit: the site that referred you, the page you landed on, any campaign tags in that page's address (such as utm_source), the pages you viewed on our site with the time of each, and how long you had been on the site. This is kept in your browser's session storage for that tab only (not a cookie, and not shared with any third party) and sent to us only if you submit the form.

We collect these details only to screen enquiries for spam, phishing and fraud, so we can decide whether a message is safe to answer. We also check any links in your message against a list of common warning signs, and may send the link addresses to Google Safe Browsing to see whether they are known to be harmful. We never open or visit the links from our server.

If our spam checks decide a submission was sent by a bot, it is not stored as an enquiry. We record the IP address, the email address given and the reason in our server log, so a genuine message that was blocked by mistake can still be found.

When you apply for Spiffy

  • Contact details: your name, job title, email address and phone number.
  • Business details: company name, registration number, website, address, city and country, business model, monthly volume, number of warehouses and any message you add.
  • Two documents: an identity document for the contact person (passport, national ID card or driving licence) and an official business document (such as a certificate of incorporation, trade licence or tax registration).
  • Your IP address, and a record of what happens to the application (for example, when it was reviewed and when its documents were downloaded or deleted).

When you email, call or message us

Whatever you choose to send us, along with your email address or phone number. If you contact us on WhatsApp, WhatsApp (part of Meta) also processes that conversation under its own privacy policy.

When you simply browse

Like almost every website, our hosting provider's servers record basic technical information for each request: your IP address, the page requested, the time, and your browser's user-agent string. These logs are used to run and protect the site.

We use Google Analytics to understand how visitors use the site: which pages are viewed, how people arrive, roughly where they are (country and city, worked out from the IP address), and what device and browser they use. Analytics cookies are only set if you accept them in the cookie banner (see section 4). If you decline, or haven't chosen yet, Google Analytics receives only basic page-view information without cookies, which can't be used to recognise you across visits.

We also use Ahrefs Web Analytics to count page views and see which sites send us visitors. It sets no cookies and doesn't store anything on your device, so it can't recognise you across visits.

We do not use advertising pixels, session recording or cross-site tracking, and Google Analytics' advertising features are turned off.

4. Cookies

Pages with a form (the contact page, the Spiffy application and our staff admin area) set two cookies that are strictly necessary for the form to work:

  • A session cookie, which keeps your form submission connected to the page you filled it in on and, for our staff, keeps them signed in.
  • XSRF-TOKEN, a security token that stops other websites from submitting forms in your name.

Both expire after a short period of inactivity. Neither is used for tracking or advertising, which is why we don't ask for consent before setting them. You can block cookies in your browser, but the forms won't work without them.

If you accept analytics cookies in the cookie banner, Google Analytics also sets:

  • _ga and _ga_KVTEZ9RFTG, which tell apart separate visitors and visits. They last up to 2 years.

Your choice is saved in your browser's local storage (not a cookie) so we don't ask again on every page. You can change it at any time with the "Cookie Settings" link at the bottom of every page. Declining removes the analytics cookies.

5. How we use your information

  • To reply to your enquiry and, if you want to work with us, to prepare a proposal and deliver the work.
  • To review a Spiffy application: to confirm that the business is real and that the person applying is who they say they are, to decide whether to approve it, and to set up the account if we do.
  • To keep the website and our forms secure, and to detect and block spam, fraud and abuse.
  • To meet our legal obligations and to establish or defend legal claims.
  • To understand how the site is used, using Google Analytics, so we can improve it.

We do not sell your personal information, share it for advertising, or add you to a marketing mailing list because you used one of our forms.

6. Our legal bases (UK and EEA)

If UK or EU data protection law applies to you, we rely on these legal bases:

  • Taking steps at your request before entering a contract, when you ask us about our services or apply for Spiffy.
  • Our legitimate interests in running our business, answering enquiries, verifying the businesses we work with, and keeping our site secure. We only rely on this where those interests are not outweighed by your rights.
  • Legal obligation, where the law requires us to keep or disclose information.
  • Your consent, for analytics cookies. You can withdraw it at any time with the "Cookie Settings" link.

7. Who we share it with

Your information is seen by the Orbital team members who need it to do their job, in the USA and in Pakistan. Outside Orbital, we share it only with:

  • Service providers who host this website and deliver our email (currently Namecheap for hosting, email and our content delivery network). They process data only on our instructions.
  • Google, which provides Google Analytics and processes analytics data for us. You can read how Google uses this data, or install the Google Analytics opt-out browser add-on.
  • Google Safe Browsing, which receives only the addresses of links written in a contact form message, to tell us whether they are known to be harmful.
  • Ahrefs, which provides Ahrefs Web Analytics and processes cookieless page-view data for us.
  • Professional advisers, such as lawyers and accountants, where needed.
  • Authorities, where the law requires it, or to protect our rights, our clients or the public.
  • A buyer or successor, if Orbital is ever involved in a merger, acquisition or sale of assets. They would be bound by this policy.

8. International transfers

Our team works from the USA and Pakistan, and our hosting and email providers may store data in other countries. Your information may therefore be processed outside the country where you live, including in countries whose data protection laws differ from yours. Where UK or EU law requires it, we use appropriate safeguards for these transfers, such as the standard contractual clauses approved for that purpose.

9. How long we keep it

  • Spiffy identity and business documents are deleted automatically 30 days after we approve or reject the application, and sooner if the application is withdrawn or deleted.
  • The other details in a Spiffy application are kept for as long as the business uses Spiffy, or as long as we need them to answer questions about the decision, and are then deleted.
  • Contact form enquiries and emails are kept for as long as we need them to reply, to work with you, and to keep reasonable business records. After that they are deleted.
  • Server and security logs are kept for a limited period and then deleted or overwritten.
  • Google Analytics data is kept for 14 months and then deleted automatically.

You can ask us to delete your information sooner at any time (see section 11).

10. How we protect it

The site is served only over HTTPS. Enquiries and applications are stored in databases outside the public part of the web server. Spiffy documents are checked for file type, stored privately under random names that the web server never serves, and can only be opened by signed-in Orbital staff, with every download recorded. No system is perfectly secure, but we limit access to the people who need it and delete sensitive documents as soon as we no longer need them.

11. Your rights

Depending on where you live, you may have the right to:

  • ask for a copy of the personal information we hold about you;
  • ask us to correct it, or to delete it;
  • object to or ask us to restrict how we use it;
  • ask for it in a portable format;
  • not be treated differently for using any of these rights.

To use any of them, email support@orbitaltechltd.com. We may need to confirm your identity first, and we will reply within one month. We don't charge for this.

If you are in the UK, you can also complain to the Information Commissioner's Office. If you are in the EU, you can complain to your local data protection authority. We'd appreciate the chance to sort it out with you first.

12. Children

This website is for businesses. It is not aimed at children, and we do not knowingly collect information from anyone under 16. If you think a child has sent us personal information, email us and we will delete it.

13. Changes to this policy

If we change how we handle personal information, we will update this page and the "last updated" date at the top. If a change materially affects information you have already given us, we will tell you by email where we can.

14. Contact

Orbital Technologies LLC
Headquarters: Florida, USA
Email: support@orbitaltechltd.com
Phone: (516) 410-9988

See also our Terms of Use.