Privacy Policy

Last updated: 29 October 2026

1. Who we are and how to contact us

Orbis SMS is a business-to-business SMS platform operated by Orbis Digital Ltd, a private limited company registered in England and Wales (company number 17116737). Our registered office is 66 Paul Street, London, EC2A 4NA. In this policy, "we", "us" and "our" mean Orbis Digital Ltd.

This policy explains how we handle personal data on our website (orbissms.co.uk) and our customer portal (app.orbissms.co.uk). It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (both as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003 (PECR).

If you have any questions about this policy or your personal data, contact us:

• Email: support@orbisdigital.co.uk
• Phone: 0330 223 7919
• Post: Orbis Digital Ltd, 66 Paul Street, London, EC2A 4NA

2. Controller and processor roles

Data protection law treats us differently depending on whose data it is.

Where we are the controller

We decide how and why the following data is used, so we are the controller and this policy applies in full:

• data about our customers' account holders and users;
• billing records;
• support tickets;
• enquiries sent through our website contact form;
• marketing to business contacts.

Where we are a processor

Our customers upload contact lists and send messages through Orbis SMS. For that data (mobile numbers, names, tags, consent status, message text, delivery status and opt-outs), the customer is the controller and we act as their processor. We only use it on the customer's instructions, under the Data Processing Agreement that forms part of our Terms. You can read it on our Data Processing Agreement page.

If you received a text message sent through Orbis SMS, the business that sent it is responsible for your data. Please contact that business first about how it got your number or to use your rights. If you contact us instead, we will pass your request to the sending business promptly and help it respond. You can always stop further messages by replying STOP where the message offers it (see section 11).

3. The personal data we collect

Account holders and portal users

• Identity and contact details: name, business email address and phone number.
• Business details: the name and details of the organisation you represent, and information we use to review and approve accounts and sender ID requests.
• Login and security data: login credentials (passwords are stored in hashed form), API keys you create, IP addresses and audit logs of activity in your account.
• Billing records: credit purchases, orders and payment status.
• Support tickets and any other messages you send us.

Website visitors

• Technical data such as your IP address and browser details, which are processed when pages and fonts load and are recorded in security and access logs.
• Your cookie choice, stored in your browser. See our Cookie Policy.

Contact-form enquirers

The details you enter in our contact form, such as your name, contact details and your message, and any follow-up correspondence.

Message recipients (as processor)

Mobile numbers, names, tags, consent status, message text, delivery status and opt-outs uploaded or generated by our customers. We hold this for our customers as described in section 2. We also keep a suppression list of numbers that have opted out, so that the relevant customer cannot message them again.

Payment data

Card payments are taken through Stripe Checkout. Stripe is the payment processor. We never see or store full card numbers. We receive confirmation from Stripe that a payment has succeeded, together with transaction details, so we can add credits and keep billing records.

4. How we use your data and our lawful bases

UK GDPR requires a lawful basis for each use of personal data. This table covers data for which we are the controller.

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can object to any use based on legitimate interests (see section 11). Where we rely on consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

5. Direct marketing and PECR

We market only to businesses. We may send marketing emails about Orbis SMS to business contacts, including our customers and people who have made enquiries.

• Under PECR, emails to corporate addresses (for example at limited companies) do not need prior consent, but we always identify ourselves and give a simple way to opt out.
• Sole traders and some partnerships are treated as individual subscribers under PECR regulation 22. We only email them marketing if they have consented, or if they are existing customers or have negotiated to buy from us and we offered a chance to opt out when we collected their details (the "soft opt-in").
• Every marketing email includes an unsubscribe link. Under PECR regulation 23 we never hide our identity and always give a valid address for opt-out requests.

You can opt out at any time by using the unsubscribe link or contacting us at support@orbisdigital.co.uk. Your right to object to direct marketing is absolute. Once you object, we will stop. We do not use advertising or tracking pixels.

Service emails, such as receipts, security alerts and important changes to our terms, are not marketing and will still be sent while you have an account.

6. Content screening and anti-fraud checks

SMS is often misused for spam, scams, phishing and impersonation. To protect recipients, networks and our customers, and to help prevent offences such as those under the Fraud Act 2006 and the Computer Misuse Act 1990, we:

• manually review and approve accounts before they can send;
• manually review alphanumeric sender ID requests. Sender names protected on the MEF SMS SenderID Protection Registry may be blocked unless the sender is authorised to use them;
• automatically screen message content against risk rules, such as keywords and patterns linked to spam, scams and phishing. Flagged messages may be held for human review or blocked;
• may apply daily sending limits to new accounts.

Automated screening only decides whether a particular message is held or blocked. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Decisions about accounts, such as approval or suspension, are made by a person. If you disagree with a decision, contact us and we will review it.

7. Who we share data with

We do not sell personal data. We share it only with the service providers (sub-processors) below, who act on our instructions under written contracts, and where the law requires it, for example with regulators, law enforcement or courts.

We do not name our messaging network providers publicly. Customers can request the list under our Data Processing Agreement.

If our business is sold or restructured, personal data may pass to the new owner, who must continue to protect it in line with this policy.

8. International transfers

Our main data is hosted in France. The UK recognises the European Economic Area (EEA) as providing adequate protection, so transfers there need no extra safeguards.

Some providers process data in the United States. Where that happens, transfers are protected by one or more of the following, as applicable:

• the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), where the recipient is certified;
• the UK International Data Transfer Addendum (IDTA) to the EU standard contractual clauses;
• UK adequacy regulations.

Contact us if you would like more information about the safeguards for a particular provider.

9. How long we keep data

We keep personal data only for as long as we need it. These are our retention periods:

We may keep data for longer if we need it to deal with a legal claim or if the law requires it.

10. How we protect your data

We use technical and organisational measures appropriate to the risk, including:

• encrypted connections (HTTPS) for the website, portal and API;
• hashed passwords and secure, HttpOnly session cookies with CSRF protection;
• access to systems and data limited to people who need it;
• security, audit and access logging;
• access-restricted backups, readable only by system administrators;
• written contracts with all sub-processors.

You also play a part. Keep your login details and API keys secure, and tell us straight away if you think your account has been compromised. If a personal data breach is likely to result in a risk to people's rights, we will notify the ICO where required, and tell affected people without undue delay where the risk is high. Where we act as processor, we will tell the affected customer without undue delay.

11. Your rights

Under UK GDPR you have the right to:

• access your personal data and receive a copy;
• rectification of inaccurate or incomplete data;
• erasure of your data in certain circumstances;
• restriction of how we use your data in certain circumstances;
• data portability, meaning a copy of data you gave us in a structured, machine-readable format, where we rely on contract or consent;
• object to processing based on legitimate interests, and an absolute right to object to direct marketing;
• rights related to automated decision-making, including the right to human review of a significant decision made solely by automated means (we do not make such decisions, see section 6);
• withdraw consent at any time where we rely on consent.

How to use your rights

Contact us at support@orbisdigital.co.uk or 0330 223 7919. There is usually no charge. We may charge a reasonable fee, or refuse, if a request is manifestly unfounded or excessive.

We will respond within one month. If a request is complex, or you make several, we may extend this by up to two further months and will tell you why within the first month. We may need to check your identity before acting. If so, the time limit starts once we have what we need. When responding to access requests we will carry out a reasonable and proportionate search.

If you received a message sent through Orbis SMS

The sending business is the controller, so please send rights requests to it. If you contact us, we will pass your request to that business and help it respond. To stop messages:

• reply STOP where the message offers it. Your number is then added to that sender's suppression list, so no further messages are sent from that account;
• report unwanted or suspicious texts free of charge to your network by forwarding them to 7726;
• tell us about suspected spam or scam messages at support@orbisdigital.co.uk. See our Anti-Spam Policy.

12. Children

Orbis SMS is a business-to-business service. It is not offered to consumers and is not directed at anyone under 18. Customers and users must be 18 or over and act for a business, sole trader business, charity or public body. We do not knowingly collect personal data from children as our own customers. If you believe a child has given us personal data, contact us and we will delete it.

13. Complaints

Complain to us first

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. Email support@orbisdigital.co.uk, call 0330 223 7919, or write to us at our registered office.

As required by the Data (Use and Access) Act 2025, we have a process for handling data protection complaints. We will:

• acknowledge your complaint within 30 days of receiving it;
• take appropriate steps to investigate it without undue delay, including asking you for more information if we need it;
• keep you updated and tell you the outcome without undue delay.

The regulator

If you are not satisfied with our response, you can complain to the UK regulator, the Information Commissioner's Office (ICO), or its successor, the Information Commission:

• Website: ico.org.uk
• Phone: 0303 123 1113

The regulator will usually expect you to have complained to us first.

14. Changes to this policy

We may update this policy to reflect changes in the law, our service or our providers. The date at the top shows when it was last updated. If we make a material change, we will tell customers by email or in the portal before it takes effect. Please check this page from time to time.

Related policies: Cookie Policy, Terms, Acceptable Use Policy, Data Processing Agreement.