This Privacy Policy describes how Coborax ApS, c/o Innovation Solutions ApS, Morsøgade 12, 6700 Esbjerg, CVR 41171081, Denmark ("Coborax", "we") processes personal data in connection with the Orbit platform ("the Service").
1. Our roles: controller and processor
- Coborax as controller — for account registration, authentication, billing contacts, support communications, platform administration, and technical and security logs. This Privacy Policy covers that processing.
- Coborax as processor— for personal data that a Customer organization stores or otherwise processes through the Service. In this role, the Customer is the data controller and Coborax processes personal data on the Customer's documented instructions in accordance with the Data Processing Agreement (DPA).
Customer-controlled data may include workforce and HR records, candidate and recruitment information, competence and training records, certificates, project and crew assignments, compliance information, contact information, and other personal data entered into Orbit by or on behalf of the Customer.
Questions or requests concerning personal data for which a Customer is the controller should normally be directed to that Customer, for example the relevant employer or organization.
2. Personal data we process as controller
- Account data: name, email address, password hash, profile image, organization memberships and account settings.
- Billing and business contact data: company name, VAT number, billing address, billing contact information and payment status. Payment card details are handled by Stripe and do not pass through our servers.
- Technical and security data: IP address, browser and device information, authentication information, session records, audit information and security logs.
- Support and service communications: information you provide when contacting Coborax for support, administration or other service-related matters.
3. Purposes and legal bases
- Providing, administering and securing the Service— performance of contract under GDPR Article 6(1)(b), where applicable, and Coborax's legitimate interests under Article 6(1)(f) in operating and securing the Service.
- Billing, bookkeeping and accounting — compliance with legal obligations under GDPR Article 6(1)(c), including applicable Danish bookkeeping requirements.
- Support and service communications— performance of contract and, where relevant, Coborax's legitimate interest in providing customer support and administering the Service.
- Security, fraud prevention and misuse detection— Coborax's legitimate interests in protecting the Service, Customers, users and Coborax against unauthorized access, misuse and security incidents.
4. Customer personal data processed by Coborax
Where Coborax acts as processor, the Customer determines the purposes and means of the processing and is responsible for ensuring that it has an appropriate legal basis and all necessary notices, permissions and other requirements for the personal data it places in or processes through the Service.
Coborax processes such personal data only to provide, host, maintain, secure and support the Service and as otherwise instructed by the Customer and permitted by the DPA and applicable law.
Ownership of Customer Data is governed by the Terms of Service. Nothing in this Privacy Policy transfers ownership of Customer Data to Coborax.
5. Recipients, subprocessors and international transfers
We use vetted service providers and processors to operate the Service, including cloud hosting (Amazon Web Services, EU region), payment processing (Stripe), and email delivery services.
Where Coborax acts as processor for a Customer, the use of subprocessors is governed by the DPA.
Where a service provider processes personal data outside the EU/EEA, transfers are made using an applicable lawful transfer mechanism, such as an adequacy decision of the European Commission or the European Commission's Standard Contractual Clauses, together with supplementary measures where required. Coborax does not sell personal data.
6. Security
Coborax implements appropriate technical and organisational measures designed to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, alteration or disclosure.
Where Coborax processes Customer Data as a processor, applicable security measures and personal data breach obligations are governed by the DPA.
No system or method of electronic storage or transmission can be guaranteed to be completely secure. The security measures described in this Privacy Policy are therefore not a guarantee that a security incident, interruption or data loss can never occur.
7. Backups and recovery
Coborax maintains automated daily backups of the Service and Customer Data for operational resilience and disaster-recovery purposes. Backups are retained for up to seven (7) days and are automatically overwritten or deleted thereafter in accordance with Coborax's backup processes.
Backups are maintained as a technical safeguard for the Service and are not intended to constitute an individual archival or backup service for Customers. Customers remain responsible for maintaining appropriate copies or exports of Customer Data that are operationally, commercially or legally important to them.
Coborax does not guarantee that individual records, files or Customer Data can be restored from backup in every circumstance. Contractual responsibility and limitations relating to availability, backups, data loss and recovery are governed by the Terms of Service and, where applicable, the DPA.
8. Retention
- Account data: while the account exists, then deleted or anonymized within 90 days, unless a longer period is required by law or necessary for the establishment, exercise or defence of legal claims.
- Billing records: 5 years plus the current year, or such other period as required by applicable bookkeeping and tax law.
- Security logs: up to 12 months, unless longer retention is reasonably necessary for investigation, security or legal purposes.
- Customer personal data processed as processor: retained in accordance with the Customer's instructions, the subscription, the DPA and applicable law. Following termination, Customer Data may be available for export for the period specified in the Terms of Service and may thereafter be deleted, subject to the DPA and applicable legal requirements.
- Backup copies: automated daily backups are retained for up to 7 days. Because backups operate on a rolling basis, deleted information may remain in backup copies until the relevant backup is automatically overwritten or deleted.
9. Personal data breaches
Coborax maintains procedures for identifying, assessing and responding to personal data breaches. Where Coborax acts as controller, we will notify the competent supervisory authority and affected individuals where required by applicable data protection law.
Where Coborax acts as processor, Coborax will notify and assist the relevant Customer in accordance with the DPA and applicable data protection law.
10. Your rights
Where Coborax acts as controller, and subject to the conditions and limitations of applicable data protection law, you may request access to your personal data, rectification, erasure, restriction of processing, data portability, and may object to processing based on legitimate interests. Requests concerning personal data processed by Coborax on behalf of a Customer should normally be directed to the relevant Customer, such as your employer or the organization that provided your access to Orbit. Coborax will assist Customers with data-subject requests as required by the DPA and applicable law. To exercise rights concerning processing for which Coborax is controller, contact support@innovationnow.dk. You may also lodge a complaint with Datatilsynet, the Danish Data Protection Agency.
11. Automated decision-making
Unless expressly disclosed otherwise, Coborax does not use personal data for which it acts as controller to make solely automated decisions that produce legal effects or similarly significant effects on individuals. Customers may use functionality within the Service as part of their own HR, recruitment, project, compliance or operational processes. The Customer is responsible for determining whether its use of such functionality involves automated decision-making or profiling and for complying with any applicable legal requirements.
12. Cookies
The Service uses strictly necessary cookies and similar technologies for session authentication, security and interface preferences. No advertising or cross-site tracking cookies are set unless this Privacy Policy and any required consent mechanism are updated accordingly.
13. Changes to this Privacy Policy
We may update this Privacy Policy when our processing activities, the Service or applicable legal requirements change. Material changes will be notified in the Service or by another appropriate means. The current version is always available at /legal/privacy.
14. Contact
Coborax ApS, c/o Innovation Solutions ApS, Morsøgade 12, 6700 Esbjerg, Denmark, CVR 41171081. support@innovationnow.dk or legal@innovationnow.dk.