Privacy notice

1. Who we are

Triton Safety Limited, trading as Orgma, is responsible for the personal information described in this notice. We are registered in England and Wales under company number 11602941. Questions and data protection requests can be sent to support@getorgma.com.

2. Information we collect

Depending on how you use Orgma, we may collect:

• business contact information, including your name, work email address, organisation and enquiry;
• purchase and subscription information, including your chosen plan, billing contact, Stripe customer and subscription references, payment status and renewal status;
• licence information, including an activation-key hash, organisation name, installation identifier, application version and licence status;
• support communications and any information you choose to include in them; and
• limited technical information generated by our hosting and security providers, such as request times, IP addresses, browser information and error logs.

Stripe handles payment-card details. Orgma does not receive or store your full card number or security code.

3. Workforce information inside Orgma Local

The customer controls the employee, qualification, certificate and evidence information entered into Orgma Local. Under normal operation, this information remains on the customer's chosen Windows computer and storage locations. The customer is responsible for deciding who may use the application, establishing an appropriate lawful basis, keeping suitable backups and responding to the rights of its workers.

If a customer voluntarily sends workforce information to us while requesting support, we will use it only to investigate that request and will ask the customer to remove or redact unnecessary information where practical.

4. Why we use personal information

We use personal information where it is necessary to:

• take steps requested before entering a contract and perform our contract with a customer;
• create, deliver, activate and maintain an Orgma licence;
• provide support, protect the service and prevent fraudulent or unauthorised use;
• maintain accounting, tax and other legally required records;
• respond to an enquiry or waiting-list request that you have submitted; and
• pursue our legitimate interests in operating, securing and improving Orgma, provided those interests do not override your rights.

Where we rely on consent, such as for optional marketing messages, you may withdraw it at any time.

5. Services that help us operate Orgma

We use carefully selected providers for website hosting and database services, payment processing, transactional email and business email. These currently include Netlify, Stripe, Resend and Google Workspace. They receive only the information needed to provide their service. Some providers may process information outside the United Kingdom using contractual and other safeguards required by data protection law.

We may also disclose information where required by law, to professional advisers subject to confidentiality, or in connection with a legitimate sale or restructuring of the business.

6. How long we keep information

• Purchase, subscription and accounting records are normally retained for up to six years after the relevant financial year or contract ends.
• Licence records are kept while the licence is active and afterwards where reasonably required for contract, fraud-prevention and legal-record purposes.
• Waiting-list and enquiry details are reviewed regularly and normally deleted after 24 months if no continuing relationship develops.
• Support records are normally kept for up to three years after the request is closed, unless a longer period is required for a dispute or legal obligation.
• Technical logs are retained for the shorter periods set by our providers and operational needs.

7. Security

We use access controls, secret management, encrypted connections, service-provider security controls and data minimisation to protect information. No internet service can guarantee absolute security. Customers must also secure the Windows computer, user accounts and backups used for Orgma Local.

8. Your rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to our use of your personal information, and to receive certain information in a portable format. You may also complain to the UK Information Commissioner's Office. Contact us first at support@getorgma.com and we will try to resolve the matter.

9. Cookies

Orgma does not currently use optional advertising or behavioural-tracking cookies. Essential technologies may be used for security, checkout and basic operation. Stripe applies its own technologies when you visit its hosted checkout.

10. Changes to this notice

We may update this notice as Orgma develops or legal requirements change. The effective date at the top identifies the current version.