Privacy Policy

1. Introduction

Orizon ("we", "us", "our") is committed to protecting the privacy and security of your personal data. As a cybersecurity and compliance advisory firm, data protection is at the core of everything we do.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website (orizon.sh), use our platform services, or engage with our consulting services.

2. Data Controller

Orizon is the data controller responsible for your personal data. For any questions about this policy or your data rights, contact us at privacy@orizon.sh.

3. Data We Collect

We collect the following categories of personal data:

3.1 Information You Provide

• Contact information (name, email address, company name) when you submit our contact form or book a discovery call
• Communication records when you correspond with us via email
• Professional information relevant to our consulting engagements

3.2 Automatically Collected Data

• Technical data: IP address, browser type, operating system, device information
• Usage data: pages visited, time spent on pages, navigation paths
• We use privacy-respecting analytics and do not use invasive tracking cookies

4. How We Use Your Data

We process your personal data for the following purposes:

• To respond to your enquiries and provide consulting services
• To deliver and improve our platform services (Orizon Comply, PolicyForge, FrameworkMapper)
• To send relevant security and compliance communications (only with your consent)
• To comply with legal and regulatory obligations
• To protect the security and integrity of our services

5. Legal Basis for Processing

We process your personal data under the following legal bases as defined by the GDPR:

• Consent — when you submit a contact form or subscribe to communications
• Contractual necessity — to deliver consulting and platform services you have engaged
• Legitimate interest — to improve our services and ensure security
• Legal obligation — to comply with applicable laws and regulations

6. Data Sharing and Third Parties

We do not sell your personal data. We may share data with:

• Cloud infrastructure providers for hosting and service delivery
• Email service providers for transactional communications
• Professional advisors (legal, accounting) where required
• Regulatory authorities when required by law

All third-party processors are bound by data processing agreements and are required to protect your data to the same standards we maintain.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Contact form enquiries are retained for up to 24 months. Client engagement data is retained for the duration of the engagement plus any legally required retention period.

8. Your Rights

Under the GDPR and applicable data protection laws, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Restriction — request restricted processing of your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, without affecting lawfulness of prior processing

To exercise any of these rights, contact us at privacy@orizon.sh. . We will respond within 30 days.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit and at rest, access controls, regular security assessments, and staff training on data protection.

10. International Data Transfers

Where your data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or transfers to countries recognised as providing adequate protection.

11. Cookies

Our website uses only essential cookies required for site functionality. We do not use advertising or tracking cookies. Essential cookies cannot be disabled as they are necessary for the website to function.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• Email: privacy@orizon.sh
• General enquiries: contact@orizon.sh

You also have the right to lodge a complaint with your local data protection supervisory authority.