This Privacy Policy explains how JS Technology Group Ltd
("we", "us", "our"), a company registered in England and Wales (company
number 16945230), collects and uses personal data through
the Orbit mobile application (the "App").
This policy is written to comply with the UK General Data Protection
Regulation (UK GDPR) and the Data Protection Act 2018.
1. About the App and our role
The App is a "white-label" member application. It lets you connect to an
organisation (for example a club, society, or business
that uses our platform) by entering a customer number that
the organisation provides. Once connected, the App shows you that
organisation's news, events, and updates.
Because of this, there are two roles to be aware of:
Your organisation is the data
controller for the personal data you share through your
membership with them (for example your profile and any content you submit
to them). They decide why and how that data is used.
JS Technology Group Ltd acts as a data
processor on behalf of your organisation for that data, and as a
data controller for the limited operational data we need
to run the App securely (for example sign-in security and crash
diagnostics).
If you have questions about how your organisation uses your data, please
contact your organisation directly. For questions about the App itself,
contact us using the details in Section 11.
2. The personal data we collect
Depending on how you use the App, we may process:
Account and profile data — such as your name, email
address, username, and membership details, used to sign you in and
identify you to your organisation.
Organisation identifier — the customer number you
enter to activate the App and connect to your organisation.
Device and technical data — such as device type,
operating system version, app version, and a push-notification token,
used to deliver notifications and keep the App working correctly.
Usage and diagnostic data — basic information about
how the App is used and any errors it encounters, used to fix problems
and improve reliability.
Equipment custody data: if your organisation uses
Equipment Check Out, its authorised operators may record your name as the
diver or hirer, the box and equipment, why they left, who recorded the
movement, and when and in what condition each item returned. Your
organisation controls these operational records and decides how long it
needs them.
Camera: the camera opens only when you tap a button
that uses it, and it is used for two different things.
Scanning a code. If your organisation uses Assets
or Equipment Check In/Out, you can scan a QR code or barcode to find
equipment or record a checkout or return. No photo is taken,
stored, or sent when you scan. The App receives only the text
the code contains, and sends only that text to your organisation so it
can find the matching item.
Taking a photo as evidence. If your organisation
uses Competitions and the competition you have joined asks for proof,
you can photograph it. That photo is stored and sent,
and is covered under “Competition evidence” below. A copy is
also saved to your own device’s photo library so you keep it. You
can instead choose a file you already have, in which case the camera is
never opened.
You can refuse or withdraw camera access in your device settings at any
time, and the rest of the App carries on working without it.
Competition data: if your organisation uses
Competitions, and you choose to take part in one, we record the figures
you log (or that your device sends), the day each belongs to, any note
you add, and your position. Whether your name appears alongside your
figures on a leaderboard is your choice: by default you
are shown to colleagues as “Anonymous” unless you turn your
name on, and you can change that at any time.
Competition evidence (only if the competition asks for
it): some competitions require proof of an entry, for example a
photograph of a completed walk or a sponsorship form. If yours does, the
photo or document you attach is stored with that entry.
Who can see it. Only you, and the administrators
of your own organisation who review entries. It is not shown to other
members, and it never appears on a leaderboard. Each time an
administrator opens one, that is recorded in your organisation’s
audit log.
How it is stored. Encrypted, using a key
belonging to your organisation alone.
How long. It is deleted when the entry is
deleted, when your account is deleted, and in any case under the
retention periods in section 6.
Your choice. Nothing is uploaded unless you pick
it or photograph it yourself. If you take the photo in the App, a copy
is saved to your own device as well, which is yours to keep or
delete.
Fitness and activity data (optional, and only if you switch
it on): a competition may be able to count your daily steps,
distance or exercise minutes automatically, read from Health Connect on
Android or Apple Health on iOS. This is off unless three separate
things are all true: your organisation has enabled connected
fitness data, the person running that particular competition has asked
for it, and you have agreed to it for that specific
competition. Agreeing to one competition does not agree to any other.
We read only a daily total of the one measure
that competition counts. We do not read your sleep, weight, heart
rate, workouts in detail, or your location, and we do not receive the
individual readings behind the total.
We read it only for days inside that competition's
dates, and never before you joined or after it closes.
Administrators at your organisation see your total and your
position. They do not see your day-by-day figures.
You can disconnect at any time, and when you do
we offer to delete everything your device sent. Anything you typed in
yourself is kept unless you delete it, because you did not ask to
lose that.
Taking part in any competition is voluntary, and choosing not to
connect a device (or not to take part at all) has no consequence for
you.
We do not knowingly collect any more data than we need to provide the
App.
3. How we use your data and our legal bases
Purpose
Legal basis (UK GDPR)
Activate the App and connect you to your organisation
Performance of a contract
Sign you in and keep your account secure
Performance of a contract; Legitimate interests (security)
Provide your organisation's enabled operational services, including equipment custody records
Performance of a contract; Legitimate interests of your organisation
Send you notifications you have enabled
Consent; Performance of a contract
Count your activity towards a competition you joined, where you connected a device
Consent (which you can withdraw at any time)
Diagnose problems and improve the App
Legitimate interests
Comply with legal obligations
Legal obligation
Where we rely on consent (for example push notifications, or connecting
your fitness data to a competition), you can withdraw it at any time
without affecting the lawfulness of processing before withdrawal.
Withdrawing consent for fitness data also offers to delete the figures your
device has already sent.
4. Who we share your data with
We share data only where necessary:
Your organisation — so they can manage your
membership and provide their services to you.
Service providers who help us run the App, including:
Google Firebase / Firebase Cloud Messaging
(Google Ireland Ltd / Google LLC) — to deliver push notifications.
Authorities or third parties where we are required
to by law, or to protect our rights, users, or the public.
We do not sell your personal data, and we do not use it
for third-party advertising.
5. International transfers
Some of our service providers may process data outside the UK. Where
that happens, we ensure appropriate safeguards are in place (such as UK
adequacy regulations or the UK International Data Transfer Agreement /
Addendum to the EU Standard Contractual Clauses), so your data receives an
equivalent level of protection.
6. How long we keep your data
Account and membership data — for as long as your
organisation maintains your membership, and then for a reasonable period
afterwards.
Organisation operational records, including
equipment custody history, for the period set by your organisation as
data controller.
Diagnostic and technical data — for a limited period
to help us maintain and secure the App.
When data is no longer needed, we delete it or anonymise it. Your
organisation sets the retention rules for the membership data they
control.
7. How we protect your data
Encrypted connections (HTTPS/TLS) between the App and our servers.
Secure storage of your sign-in session on your device.
Access controls so that each organisation's data is kept separate
from every other organisation's data.
Encryption of sensitive data at rest on our servers.
No system is completely secure, but we work to protect your data using
industry-standard practices.
8. Your rights
Under UK data protection law you have the right to:
Access the personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Ask us to delete your data ("right to erasure").
Restrict or object to certain processing.
Request a copy of your data in a portable format.
Withdraw consent where we rely on it.
To exercise these rights for membership data, please contact your
organisation, who controls that data. For data we control, contact us using
the details below. We will respond within one month.
9. Children
The App is not directed at children under 13, and we do not knowingly
collect data from children under 13 without appropriate consent. If you
believe a child has provided us with personal data, please contact us and
we will take appropriate steps.
10. Changes to this policy
We may update this Privacy Policy from time to time. When we make
significant changes, we will update the "Last updated" date at the top and,
where appropriate, notify you in the App. Please review it periodically.
11. Contact us
If you have any questions about this Privacy Policy or how we handle your
data, contact us at: