Orygent Privacy Notice
1. Who is responsible
1.1 The controller for the processing described in this notice is SMARTEDTECH SL, B66970831, Carrer Agricultura, 16, 1º, 9ª, 08320 El Masnou, Barcelona, Spain (the Operator). Privacy contact: privacy@orygent.com. Rights form: /legal/dsar.
1.2 The Operator has not appointed a Data Protection Officer. Privacy matters are handled by the Operator's data protection contact at the address above.
2. Data roles
2.1 Platform data. The Operator is the controller of personal data processed to operate the platform: account, identity verification, acceptance records, payments, security, support, communications and analytics.
2.2 Provider supply data. Where a provider supplies services to a customer through the platform, the provider is an independent controller of the data it needs for that supply (booking, order, clinical, educational or professional records), and the Operator is a controller of the platform-level record of the transaction. Each party complies with its own obligations; neither acts for the other. On orygent.com no third-party provider supplies services; this paragraph applies only if such a relationship is later enabled.
2.3 Processor services. Where the Operator processes personal data on behalf of a business customer under the customer's instructions (for example an enterprise tenant's employee data), the Data Processing Agreement (DAT-01) applies and governs; it is signed as part of the order.
2.4 Sharing between SET platforms. Personal data is not shared with any other platform operated by the Operator or its group unless you enable the specific destination in your settings. Enabling one destination does not enable others, and you may disable it at any time.
2.5 International transfers. Personal data is stored in the European Economic Area. Where a processor outside that area is used, the transfer is covered by Standard Contractual Clauses, listed in the subprocessor annex.
2.6 Tenant content. Documents, conversations, approvals and other content that a customer's users place in the customer's Orygent tenant are processed by the Operator as processor for that customer under DAT-01. The customer is the controller of its employees' and users' data inside the tenant. Requests from tenant users concerning tenant content are routed to the customer's tenant administrator.
3. What the Operator processes as controller, why, and for how long
| Data class | Purpose | Legal basis (GDPR Art. 6) | Retention ceiling |
|---|---|---|---|
| Enquiry and contact details (name, business email, company, message) | Answer the enquiry and manage a related proposal | Art. 6(1)(b) pre-contractual steps; Art. 6(1)(f) for corporate contacts | Deleted no later than 12 months after the last interaction unless a contract follows |
| Account and role data (name, work email, tenant, role, authority level, sign-in events) | Authenticate users, enforce tenant and role scope, verify signatory capacity | Art. 6(1)(b) contract; Art. 6(1)(c) for capacity evidence where law requires | Life of the account; deleted or anonymised within 90 days after closure |
| Subscription, order and invoice records | Deliver the ordered service, billing, tax and accounting | Art. 6(1)(b); Art. 6(1)(c) tax and accounting law | 6 years after the end of the financial year |
| Acceptance and consent records (document ID, version, hash, time, method, hashed IP and user agent) | Prove which terms were shown and accepted | Art. 6(1)(f) evidence of compliance; Art. 6(1)(c) | 5 years after the end of the relationship |
| Security, audit and abuse-prevention logs | Protect the platform, detect abuse, investigate incidents | Art. 6(1)(f) | 12 months, longer where a legal hold applies |
| Support tickets and communications | Provide support and handle complaints | Art. 6(1)(b) | 12 months after ticket closure |
| Optional marketing email | Send product news | Art. 6(1)(a) consent (marketing_email, separate unticked checkbox) | Until withdrawn |
| Optional analytics | Measure use of public pages | Art. 6(1)(a) consent (analytics_optional, cookie banner) | Per PUB-03 |
3.1 Fields marked mandatory on a form are required to provide the service; the others are optional.
3.2 The Operator does not use tenant content, conversations or uploads to train models for third parties. Use of your data to improve the Operator's own models happens only with the separate research_contribution permission, which you may withdraw at any time without affecting the service.
4. AI assistance and automated decisions
4.1 Orygent provides AI assistance to users of a customer tenant. AI outputs are recommendations and drafts; decisions with legal, financial or employment effect are executed only after approval by a human with the configured authority (see ACC-02 and SEC-01).
4.2 The Operator does not take decisions based solely on automated processing that produce legal or similarly significant effects on you. Where a customer configures automated workflows inside its tenant, the customer is the controller of those workflows.
5. Recipients
5.1 The Operator uses processors for hosting, authentication, email delivery, payment processing, AI model inference and support tooling. The current list of subprocessors, their function and their location is published in the legal hub at /legal/documents (DAT-01 Annex C) and is supplied on request at privacy@orygent.com.
5.2 Payment data is processed by the payment service provider identified at checkout. The Operator does not store full card numbers.
5.3 Personal data is disclosed to public authorities only where the law requires it.
6. Your rights
6.1 You may request access, rectification, erasure, restriction and portability of your personal data, object to processing based on legitimate interest, and withdraw consent at any time with prospective effect. Send requests to privacy@orygent.com or use the rights form at /legal/dsar.
6.2 The Operator verifies your identity proportionately and answers within one month; where the request is complex the Operator may extend by two further months and will tell you why within the first month.
6.3 Where your data sits inside a customer's tenant, the Operator forwards your request to that customer as controller and assists it under DAT-01.
6.4 You may lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (www.aepd.es), or with the supervisory authority of your habitual residence.
7. Retention and deletion
7.1 Account data is kept for the life of the account and deleted or anonymised within 90 days after closure, except where a longer period is required by law (tax and accounting records: 6 years; acceptance and consent records: 5 years after the end of the relationship, as evidence of compliance; records subject to a legal hold: until the hold ends).
7.2 Conversation logs, recordings and uploads not linked to an active contract are deleted no later than 12 months after the last interaction, and earlier on your request, unless a legal hold applies.
7.3 Backups are rotated on a cycle not exceeding 35 days; data deleted from production is removed from backups at the end of the cycle.
7.4 Where a provider is an independent controller, its own retention rules apply to its records.
7.5 Tenant content is returned or deleted at the end of the customer contract under DAT-01 clause 7 (export window 30 days, deletion within 90 days of termination).
8. Security
8.1 The Operator applies tenant isolation with row-level security, least privilege and multi-factor authentication for privileged access, encryption in transit and at rest, logging of privileged actions, and tested backup restoration. The measures are listed in DAT-01 Annex B.
8.2 Operator staff do not read confidential customer content in a tenant (documents, minutes, reports, attachments, financial or personal content). Support access is limited to operational, log and technical records and is recorded in the audit system.
9. Changes
9.1 The Operator may amend this notice for legitimate reasons: changes in law, in the service, in security or fraud prevention, in the payment provider, or to clarify wording. The Operator notifies you of material changes by email and in-product at least 30 days before they take effect (immediately where required by law or security).
9.2 A later version does not broaden a consent you gave earlier; a new purpose or recipient is notified before it is enabled.
9.3