Last updated: 1 November 2026
Contents
- Who we are and how to contact us
- Controller and processor roles
- The personal data we collect
- Data about status page subscribers
- How we use data and our lawful bases
- Direct marketing and PECR
- Who we share data with
- International transfers
- How long we keep data
- How we protect data
- Your rights
- Children
- Complaints
- Changes to this policy
1. Who we are and how to contact us
Orbis Status is a business-to-business hosted status page service operated by Orbis Digital Ltd, a private limited company registered in England and Wales (company number 17116737). Our registered office is 66 Paul Street, London, EC2A 4NA. In this policy, "we", "us" and "our" mean Orbis Digital Ltd.
This policy explains how we handle personal data on our website (orbisstatus.co.uk), in our application, and on the status pages we host for customers. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (both as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003 (PECR).
Contact us about privacy at support@orbisdigital.co.uk.
2. Controller and processor roles
We are the controller for: account holders' and team members' data; billing records; support enquiries; security and audit logs that we use to run the service; and marketing to business contacts.
We are a processor for the subscriber email addresses that customers collect through their status pages. The customer is the controller of that data, and our Data Processing Agreement applies. If you subscribed to a business's status page and have a question about your data, please contact that business first.
3. The personal data we collect
- Account and team data: names, business email addresses, business details, roles, and login and security data, including two-factor login settings.
- Usage and technical data: IP addresses, browser information and the audit log, which records actions taken in an account.
- Customer content: status page content that users add, such as components, incidents, updates, maintenance and templates, and the details they enter in page settings.
- Subscriber data, held for our customers: see section 4.
- Enquiries: what you tell us by email or through our contact form, including your name, email address, any company name, your message and your IP address. Contact form records are deleted from our system after 90 days, though we may keep the email correspondence for longer where we need it to help you.
- Billing records: where you pay us, the records needed to do so, including your subscription status and invoices. Card details are entered directly with Stripe, and we never see or store full card numbers.
4. Data about status page subscribers
When someone subscribes to a customer's status page by email or SMS, we process the following for that customer:
- The subscriber's email address or, for SMS subscribers, mobile phone number, and whether they have confirmed it.
- Records of the status emails and text messages we send them, such as incident and maintenance notices.
- The subscriber's choice to unsubscribe.
New email subscribers confirm their address (double opt-in), and every email has a one-click unsubscribe link. Customers can export their subscribers as a CSV and remove a subscriber. Customers are responsible for telling their subscribers about this, including in their own privacy information.
Customers can also connect Slack or Microsoft Teams channels and outgoing webhooks, so that status updates are sent to addresses the customer chooses. Those webhook addresses belong to the customer, and we send only status update content to them. Public status pages can be read by anyone. Private pages can be read only by viewers the customer invites, who sign in with an emailed link, and we process those viewers' email addresses for that purpose.
5. How we use data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing the service, including accounts, status pages and subscriber emails and text messages | Contract, or legitimate interests where the user is a customer's team member |
| Support and answering enquiries | Contract or legitimate interests |
| Security, fraud prevention and audit logs | Legitimate interests |
| Billing and accounting records | Contract and legal obligation |
| Marketing to business contacts | Legitimate interests, or consent where PECR requires it |
Authorised Orbis Digital staff can open a customer's account to give support, investigate a problem or keep the service secure.
6. Direct marketing and PECR
We may send business contacts information about Orbis Status and related Orbis Digital services where the law allows. You can opt out at any time using the link in the message or by emailing us. You have an absolute right to object to direct marketing.
8. International transfers
Our hosting is in Europe. Some suppliers may process data elsewhere. Where they do, we rely on UK adequacy regulations, including the UK extension to the EU-US Data Privacy Framework, or on the UK International Data Transfer Addendum or Agreement, as applicable.
9. How long we keep data
Customers can export subscribers and remove a subscriber, and can delete their account.
| Data | How long |
|---|---|
| Account and team records | For the life of the account. Deleted when the account is deleted |
| Status page content and subscriber data | According to the customer's instructions. Deleted when the account is deleted |
| Audit logs, including IP addresses | For the life of the account, then deleted with it |
| Billing records | Six years after the financial year they relate to, as UK tax law requires |
10. How we protect data
We use technical and organisational measures appropriate to the risk, including two-factor login, role-based access and audit logging. No system is completely secure, and you should keep your own login details safe.
11. Your rights
You have rights to access, rectify and erase your personal data, to restrict or object to its use, to data portability, and rights related to automated decisions. These rights have limits in some situations. They are normally free to use, and we will respond within one month, or up to two months longer for complex requests. We may need to confirm your identity. To use your rights, email support@orbisdigital.co.uk. If your request concerns data controlled by a customer, such as a subscriber's email address, we may refer you to that customer.
12. Children
Accounts on Orbis Status are for businesses and are not for anyone under 18. We do not knowingly collect children's data for our own purposes.
13. Complaints
Please tell us first if you have a data protection complaint, by emailing support@orbisdigital.co.uk. You can also complain to the ICO (or its successor, the Information Commission) at ico.org.uk or on 0303 123 1113.
14. Changes to this policy
We may update this policy, and we will show the new date at the top. We will tell customers about material changes by email or in the application.