This Privacy Policy describes how Innovation Solutions ApS, Morsøgade 12, 6700 Esbjerg, CVR 41171081, Denmark ("Innovation Solutions", "we") processes personal data in connection with the Orbit platform ("the Service").
1. Our roles: controller and processor
- Innovation Solutions as controller — for account registration, authentication, billing contacts, support communications, platform administration, and technical and security logs. This Privacy Policy covers that processing.
- Innovation Solutions as processor — for personal data that a Customer organization stores or otherwise processes through the Service. In this role, the Customer is the data controller and Innovation Solutions processes personal data on the Customer's documented instructions in accordance with the Data Processing Agreement (DPA). Customer-controlled data may include workforce and HR records, candidate and recruitment information, competence and training records, certificates, project and crew assignments, compliance information, contact information, and other personal data entered into Orbit by or on behalf of the Customer. Questions or requests concerning personal data for which a Customer is the controller should normally be directed to that Customer, for example the relevant employer or organization.
2. Personal data we process as controller
- Account data: name, email address, password hash, profile image, organization memberships and account settings.
- Billing and business contact data: company name, VAT number, billing address, billing contact information and payment status. Payment card details are handled by Stripe and do not pass through our servers.
- Technical and security data: IP address, browser and device information, authentication information, session records, audit information and security logs.
- Support and service communications: information you provide when contacting Innovation Solutions for support, administration or other service-related matters.
3. Purposes and legal bases
- Providing, administering and securing the Service — performance of contract under GDPR Article 6(1)(b), where applicable, and Innovation Solutions's legitimate interests under Article 6(1)(f) in operating and securing the Service.
- Billing, bookkeeping and accounting — compliance with legal obligations under GDPR Article 6(1)(c), including applicable Danish bookkeeping requirements.
- Support and service communications — performance of contract and, where relevant, Innovation Solutions's legitimate interest in providing customer support and administering the Service.
- Security, fraud prevention and misuse detection — Innovation Solutions's legitimate interests in protecting the Service, Customers, users and Innovation Solutions against unauthorized access, misuse and security incidents.
3A. Service analytics and platform improvement
Innovation Solutions may analyse technical usage and diagnostic information for operation, security, reliability and improvement of the Service. Where the information is personal data processed by Innovation Solutions as controller, an appropriate legal basis will be identified for each purpose, including legitimate interests under GDPR Article 6(1)(f) where applicable and after the required balancing assessment. The lawful basis depends on the circumstances and is not created merely by this Privacy Policy. Customer personal data processed on behalf of a Customer will not be repurposed for independent cross-customer analysis without an appropriate lawful arrangement and relevant Customer instructions or other applicable legal basis.
4. Customer personal data processed by Innovation Solutions
Where Innovation Solutions acts as processor, the Customer determines the purposes and means of the processing and is responsible for ensuring that it has an appropriate legal basis and all necessary notices, permissions and other requirements for the personal data it places in or processes through the Service. Innovation Solutions processes such personal data only to provide, host, maintain, secure and support the Service and as otherwise instructed by the Customer and permitted by the DPA and applicable law. Ownership of Customer Data is governed by the Terms of Service. Nothing in this Privacy Policy transfers ownership of Customer Data to Innovation Solutions.
4A. Aggregated and anonymised insights
The Terms of Service distinguish Customer Data from effectively anonymised and aggregated statistical outputs. Where permitted by the agreement, the DPA and applicable law, Innovation Solutions may generate statistical measures and benchmarks for improving the Service and understanding operational patterns. Anonymisation itself may involve processing personal data and must therefore have a lawful basis, defined purpose and suitable safeguards. Removing names or assigning pseudonyms is not, by itself, anonymisation. We will assess risks of singling out, linkage and inference, including where small groups or unique assets or projects may make a Customer or individual recognisable. We do not publish customer-identifiable statistics without separate authorisation.
4B. AI and machine learning
We do not use identifiable Customer Data to train or fine-tune general-purpose, cross-customer or third-party artificial-intelligence models on the basis of this Privacy Policy alone. Such use would require a separate documented arrangement, appropriate lawful basis, transparency information and protections, and any necessary DPA changes. Customer-directed AI features, if introduced, will be assessed under the relevant controller/processor roles and communicated before use.
5. Recipients, subprocessors and international transfers
We use vetted service providers and processors to operate the Service, including cloud hosting (Amazon Web Services, EU region), payment processing (Stripe), and email delivery services. Where Innovation Solutions acts as processor for a Customer, the use of subprocessors is governed by the DPA. Where a service provider processes personal data outside the EU/EEA, transfers are made using an applicable lawful transfer mechanism, such as an adequacy decision of the European Commission or the European Commission's Standard Contractual Clauses, together with supplementary measures where required. Innovation Solutions does not sell personal data.
5A. External data and content
The Service may incorporate third-party licensed software, integrations or content. Intellectual-property licences and reuse permissions are governed by the relevant providers and the Terms of Service; they are not a legal basis for personal-data processing. We will assess whether integrations involve transfers of personal data and make the disclosures and contractual arrangements required by law.
6. Security
Innovation Solutions implements appropriate technical and organisational measures designed to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, alteration or disclosure. Where Innovation Solutions processes Customer Data as a processor, applicable security measures and personal data breach obligations are governed by the DPA. No system or method of electronic storage or transmission can be guaranteed to be completely secure. The security measures described in this Privacy Policy are therefore not a guarantee that a security incident, interruption or data loss can never occur.
7. Backups and recovery
Innovation Solutions maintains automated daily backups of the Service and Customer Data for operational resilience and disaster-recovery purposes. Backups are retained for up to seven (7) days and are automatically
overwritten or deleted thereafter in accordance with Innovation Solutions's backup processes. Backups are maintained as a technical safeguard for the Service and are not intended to constitute an individual archival or backup service for Customers. Customers remain responsible for maintaining appropriate copies or exports of Customer Data that are operationally, commercially or legally important to them. Innovation Solutions does not guarantee that individual records, files or Customer Data can be restored from backup in every circumstance. Contractual responsibility and limitations relating to availability, backups, data loss and recovery are governed by the Terms of Service and, where applicable, the DPA.
8. Retention
- Account data: while the account exists, then deleted or anonymized within 90 days, unless a longer period is required by law or necessary for the establishment, exercise or defence of legal claims.
- Billing records: 5 years plus the current year, or such other period as required by applicable bookkeeping and tax law.
- Security logs: up to 12 months, unless longer retention is reasonably necessary for investigation, security or legal purposes.
- Customer personal data processed as processor: retained in accordance with the Customer's instructions, the subscription, the DPA and applicable law. Following termination, Customer Data may be available for export for the period specified in the Terms of Service and may thereafter be deleted, subject to the DPA and applicable legal requirements.
- Backup copies: automated daily backups are retained for up to 7 days. Because backups operate on a rolling basis, deleted information may remain in backup copies until the relevant backup is automatically overwritten or deleted.
8A. Retention of aggregated outputs
Lawfully generated, effectively anonymous statistics may be retained for product improvement and benchmarking while they remain anonymous and do not disclose protected Customer information. Source personal data and identifiable intermediate datasets remain subject to the retention, deletion, processing instructions and restrictions applicable to the relevant processing role. Anonymity will be reassessed where emerging data or methods create material re-identification risks.
9. Personal data breaches
Innovation Solutions maintains procedures for identifying, assessing and responding to personal data breaches. Where Innovation Solutions acts as controller, we will notify the competent supervisory authority and affected individuals where required by applicable data protection law. Where Innovation Solutions acts as processor, Innovation Solutions will notify and assist the relevant Customer in accordance with the DPA and applicable data protection law.
10. Your rights
Where Innovation Solutions acts as controller, and subject to the conditions and limitations of applicable data protection law, you may request access to your personal data, rectification, erasure, restriction of processing, data portability, and may object to processing based on legitimate interests. Requests concerning personal data processed by Innovation Solutions on behalf of a Customer should normally be directed to the relevant Customer, such as your employer or the organization that provided your access to Orbit. Innovation Solutions will assist Customers with data-subject requests as required by the DPA and applicable law. To exercise rights concerning processing for which Innovation Solutions is controller, contact support@innovationnow.dk. You may also lodge a complaint with Datatilsynet, the Danish Data Protection Agency.
11. Automated decision-making
Unless expressly disclosed otherwise, Innovation Solutions does not use personal data for which it acts as controller to make solely automated decisions that produce legal effects or similarly significant effects on individuals. Customers may use functionality within the Service as part of their own HR, recruitment, project, compliance or operational processes. The Customer is responsible for determining whether its use of such
functionality involves automated decision-making or profiling and for complying with any applicable legal requirements.
12. Cookies
The Service uses strictly necessary cookies and similar technologies for session authentication, security and interface preferences. No advertising or cross-site tracking cookies are set unless this Privacy Policy and any required consent mechanism are updated accordingly.
13. Changes to this Privacy Policy
We may update this Privacy Policy when our processing activities, the Service or applicable legal requirements change. Material changes will be notified in the Service or by another appropriate means. The current version is always available at /legal/privacy.
14. Contact
Innovation Solutions ApS, Morsøgade 12, 6700 Esbjerg, Denmark, CVR 41171081. support@innovationnow.dk or legal@innovationnow.dk.