Privacy policy.

01Who we are

Orthrus Ltd ("Orthrus", "we", "us" or "our") is the controller of personal data collected through orthrus.xyz (the "site"). Orthrus Ltd is registered in England and Wales with company number 15177133 and registered office at [registered office address].

This policy explains what personal data we collect, how we use it, and your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For any privacy question, contact us at privacy@orthrus.xyz.

02The information we collect

We collect personal data in the following ways:

Information you give us

When you submit an invoice enquiry or otherwise contact us through the site, we collect the details you provide — typically your first and last name, email address, business or trading name, the value of the invoice, your client's name, the payment terms, and any further information you choose to include.

Information we collect automatically

When you visit the site, we may collect limited technical information, such as your IP address, device and browser type, and information about how you use the site, through cookies and similar technologies.

We do not knowingly collect special category data through the site. Please do not send us sensitive personal information unless we specifically ask for it.

03How we use your information, and our lawful bases

We use personal data for the following purposes:

• to respond to your enquiry and assess an invoice you submit — on the basis of taking steps at your request prior to entering into a contract, and our legitimate interests in evaluating and progressing enquiries;
• to provide, operate and improve the site and our services — on the basis of our legitimate interests in running and developing our business;
• to carry out identity, credit, fraud-prevention and anti-money-laundering checks where relevant — on the basis of our legitimate interests in preventing fraud and our compliance with legal obligations;
• to communicate with you about your enquiry or our services — on the basis of our legitimate interests, or your consent where required; and
• to comply with our legal and regulatory obligations, including accounting and record-keeping — on the basis of compliance with a legal obligation.

Where we rely on legitimate interests, we have considered that those interests are not overridden by your own interests, rights and freedoms.

04Who we share your information with

We do not sell your personal data. We may share it with:

• service providers who process data on our behalf — such as website hosting, email, analytics, and providers of identity and fraud-prevention checks — all bound to act only on our instructions;
• our professional advisers, such as legal, accounting and insurance advisers;
• regulators, law-enforcement agencies or other authorities, where we are required to do so by law; and
• a buyer or successor, if Orthrus is involved in a merger, acquisition or transfer of its business.

05International transfers

We aim to keep personal data within the United Kingdom. Where a provider processes data outside the UK, we ensure an appropriate safeguard is in place — such as a UK adequacy decision, the International Data Transfer Agreement, or Standard Contractual Clauses together with the UK Addendum.

06How long we keep your information

We keep personal data only for as long as necessary for the purposes set out in this policy, including to meet any legal, accounting or reporting requirements. Where we decide not to proceed with an enquiry, we retain the related data only for as long as needed to manage that decision and meet our legal obligations, after which it is securely deleted or anonymised.

07How we protect your information

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. No transmission of information over the internet can be guaranteed to be completely secure, so we cannot guarantee the security of data sent to the site.

08Your rights

Under UK data protection law you have the right to: request access to the personal data we hold about you; request correction of inaccurate data; request erasure of your data; object to, or request restriction of, our processing; request the transfer of your data to another party; and, where we rely on consent, withdraw that consent at any time.

To exercise any of these rights, contact us at privacy@orthrus.xyz. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk or on 0303 123 1113. We would, however, appreciate the chance to address your concerns before you approach the ICO.

09Cookies

The site uses a small number of cookies and similar technologies — those necessary for the site to function and, where applicable, analytics cookies that help us understand how the site is used. You can control or delete cookies through your browser settings; restricting cookies may affect how the site works.

10Children

The site and our services are intended for people aged 18 or over. We do not knowingly collect personal data from children.

11Changes to this policy

We may update this policy from time to time. The current version is always the one published on this page, with the date it was last updated shown above.

12Contact us

For any question about this policy or your personal data, contact privacy@orthrus.xyz, or write to Orthrus Ltd, [registered office address].