This Privacy Notice explains how Joshua Roberts trading as HomeOrbit collects, uses, stores, and protects personal data in connection with the HomeOrbit website, enquiries, customer relationships, platform administration, and operation of the HomeOrbit service.
1. Identity and contact details
Controller for this notice: Joshua Roberts trading as HomeOrbit Address: Apartment 414, 35 Greenland Street, Liverpool, L1 0AD, United Kingdom Email: support@homeorbit.co.uk
Where this notice refers to "HomeOrbit", "we", "us", or "our", it means Joshua Roberts trading as HomeOrbit.
2. Scope of this notice
This notice covers personal data we process:
- as controller for website visitors, people who make enquiries, customer contacts, administrators, billing contacts, support contacts, and business relationship contacts;
- for account administration, platform security, audit, support, and service communications; and
- where we process limited operational metadata in our own right for service improvement, fraud prevention, legal compliance, and platform security.
For most personal data that a customer organisation uploads into the HomeOrbit platform for its own operational purposes, the customer organisation is the controller and HomeOrbit acts as the processor. That customer organisation is responsible for its own workforce privacy information and notices to its staff, workers, young people, service users, and other data subjects.
3. Categories of personal data we process as controller
Depending on how you interact with HomeOrbit, we may process:
3.1 Website and enquiry data
- name;
- work email address;
- employer or organisation name;
- phone number if you provide it;
- enquiry message content;
- records of communications with us.
3.2 Customer account and service relationship data
- names and business contact details of customer contacts;
- job title or role;
- account identifiers;
- login-related information;
- correspondence and support history;
- implementation notes and customer relationship history.
3.3 Security and technical data
- IP address;
- approximate geolocation derived from IP where available;
- browser and device information;
- operating system;
- timestamps and access logs;
- diagnostic and error information;
- audit and security events.
3.4 Platform administration and profile data
- user profile data;
- organisational assignment information such as company, home, role, and permissions;
- theme preference or other user preference information;
- profile images where uploaded.
3.5 Data processed within customer environments
When HomeOrbit acts as processor for a customer, the categories of data may include operational and workforce records that the customer chooses to use in the platform, including:
- employee and worker records;
- rota and attendance records;
- training records and certificates;
- payslip and payroll-related records;
- right to work and DBS-related records;
- personnel and HR records;
- policies and internal documents;
- signatures;
- forms and workflow records;
- young person records;
- medication-related information;
- budgets, receipts, and financial supporting documents; and
- other customer-controlled records uploaded to the platform.
Where this data is processed, we usually act only on the customer's instructions.
4. How we collect personal data
We collect personal data:
- directly from you when you contact us, make an enquiry, or use the website;
- from customer organisations that create or administer user accounts;
- from your use of the platform and website;
- from cookies and similar technologies where applicable;
- from infrastructure, security, and monitoring providers; and
- occasionally from public sources or referrals where relevant to legitimate B2B business contact.
5. Purposes and lawful bases
We process personal data for the following purposes and lawful bases:
5.1 Website enquiries and pre-contract communications
We use personal data to respond to enquiries, discuss the service, arrange demonstrations, and assess interest in HomeOrbit.
Lawful basis: legitimate interests, and where appropriate, steps at your request before entering into a contract.
5.2 Customer onboarding, administration, and service delivery
We use personal data to create accounts, manage customer relationships, configure the service, provide support, and communicate about the platform.
Lawful basis: contract, and legitimate interests in running and administering our service.
5.3 Platform security, authentication, fraud prevention, and incident management
We use personal data to secure accounts, detect suspicious activity, investigate incidents, preserve logs, and protect the service.
Lawful basis: legitimate interests, legal obligation where applicable, and contract where security is necessary to provide the service.
5.4 Product support, maintenance, troubleshooting, and service communications
We use personal data to diagnose issues, answer support requests, notify users of service matters, and maintain the platform.
Lawful basis: contract and legitimate interests.
5.5 Legal compliance, dispute management, and record keeping
We may retain or use personal data where needed to comply with law, respond to lawful requests, enforce rights, maintain business records, or defend legal claims.
Lawful basis: legal obligation and legitimate interests.
5.6 Limited service improvement and operational analytics
We may use technical and usage information to understand faults, improve reliability, refine workflows, and improve the service. We do not use customer operational records for advertising profiling.
Lawful basis: legitimate interests.
5.7 Cookies and similar technologies
Where non-essential cookies are introduced in future, we will rely on consent where required. Strictly necessary cookies are used on the basis that they are necessary to provide the service you request.
6. Special category and criminal offence data
As controller, we generally try to minimise the special category or criminal offence data we collect directly. Please do not send unnecessary sensitive data through public website enquiries.
As processor, HomeOrbit may host or otherwise process special category data and criminal offence data uploaded by customer organisations, including young person information, medication-related information, employment records, DBS-related records, and other sensitive care-sector data. In those cases, the customer organisation is responsible for identifying the relevant lawful basis and condition under applicable law.
7. Recipients and categories of recipient
We may share personal data, where necessary, with:
- hosting and infrastructure providers;
- database and storage providers;
- error monitoring and security providers;
- email and communications providers;
- professional advisers such as lawyers, insurers, accountants, or auditors under duties of confidentiality;
- regulators, courts, law enforcement, or competent authorities where required; and
- other service providers acting on our instructions.
A current subprocessor schedule is provided in the HomeOrbit legal pack and may be updated from time to time.
8. International transfers
HomeOrbit aims to use UK and EEA-friendly hosting arrangements where practical. However, some suppliers, service routes, support systems, or infrastructure components may involve processing outside the UK.
Where personal data is transferred internationally, we will use an appropriate transfer mechanism and appropriate safeguards as required by applicable law, such as:
- adequacy regulations;
- the UK International Data Transfer Agreement or Addendum;
- European Commission standard contractual clauses where relevant; or
- another lawful transfer mechanism.
9. Data retention
We keep controller-side personal data only for as long as reasonably necessary for the purposes described in this notice, including legal, security, support, contractual, and record-keeping needs.
Typical retention periods are described in the HomeOrbit Retention and Deletion Schedule. Customer-controlled data held in the platform is generally retained for the duration of the customer relationship and then handled under the relevant contract and data processing terms.
10. Security
We use reasonable technical and organisational measures designed to protect personal data. These measures may include access controls, role-based permissions, logging, supplier security controls, encryption in transit, managed hosting, secret management, and issue monitoring.
No internet-based system can be guaranteed to be completely secure. You should also keep your credentials secure and use appropriate internal controls.
11. Your rights
Where HomeOrbit acts as controller, and subject to legal limits and exemptions, you may have the right to:
- request access to your personal data;
- request correction of inaccurate data;
- request erasure;
- request restriction of processing;
- object to certain processing based on legitimate interests;
- request portability in certain cases; and
- complain to the Information Commissioner's Office.
If your personal data is primarily held by HomeOrbit on behalf of a customer organisation, you should normally direct your request to that organisation first, because it is usually the controller for that data. We will assist the relevant customer where required.
12. Complaints
You can raise privacy queries by contacting support@homeorbit.co.uk.
You also have the right to complain to the Information Commissioner's Office (ICO) if you believe your personal data has been handled unlawfully or unfairly.
13. Automated decision-making
HomeOrbit does not use personal data for solely automated decisions that produce legal effects or similarly significant effects on individuals as part of the general operation of the service, so far as we are aware at the date of this notice.
14. ICO registration
As at the date of this notice, HomeOrbit does not publish an ICO registration number. This may change as the service deployment and operational model evolve.
15. Changes to this notice
We may update this Privacy Notice from time to time to reflect legal, technical, operational, or service changes. The latest version published by us will apply from the date shown at the top of the notice.