Privacy Notice

Please read this notice carefully.

What's in this notice?

This privacy notice explains how we collect, use, store and protect personal data when you use our website and platform.

Who we are and how to contact us

This website and platform (the "Platform") is operated by Pally Talk Limited ("we", "us", "our").

We operate the Platform under the trading name Orangap, which is a business line of Pally Talk Limited and not a separate legal entity.

If you have any questions about this privacy notice or how we handle your personal data, please contact us at hello@orangap.com.

In most cases, we act as an independent controller of personal data in connection with the operation of the Platform.

What data we collect

We may collect and process the following categories of personal data:

• Identity data — name; date of birth (where required).
• Contact data — email address; telephone number.
• Professional data — job title; company name; professional experience and profile information.
• Account data — login credentials; user preferences; account activity.
• Transaction data — details of Bookings; invoice values; pricing structures and margins; payment-related information.
• Technical data — IP address; browser type and version; device information; usage data.
• Communications data — messages sent via the Platform; correspondence with us.

How we collect your data

We collect personal data:

• directly from you when you create an account or use the Platform;
• when you generate invoices or enter into Bookings;
• when you communicate with other Users;
• automatically through cookies and similar technologies; and
• from third parties (such as payment providers), where applicable.

How we use your data

We use your personal data for the following purposes:

• Providing and operating the Platform — creating and managing user accounts; facilitating Bookings between Users; enabling White Label Invoice functionality.
• Managing transactions — recording transaction details; administering Fees and payments; maintaining records of Bookings.
• Improving and developing our Services — analysing usage patterns; enhancing Platform functionality; developing new features; maintaining platform integrity.
• Detecting fraud, misuse or unauthorised activity — monitoring compliance with our terms.
• Communicating with you — responding to enquiries; sending service-related notifications; providing updates relating to your account.
• Where permitted, for marketing purposes — sending relevant updates and communications (you may opt out at any time).

Lawful basis for processing

We process personal data in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, on the following lawful bases:

• performance of a contract (including providing access to the Platform and facilitating Bookings);
• legitimate interests, including operating, securing and improving the Platform; managing transactions; and preventing fraud and misuse;
• legal obligations, where we are required to comply with applicable laws;
• consent, where required (for example, certain marketing activities).

Who we share your data with

We may share personal data with:

Other Users

Where necessary to facilitate Bookings and transactions.

Where personal data is shared between Users as part of a Booking, each User acts as an independent controller of such data and is responsible for its own compliance with applicable data protection laws.

Service providers

• Supabase (data hosting and database services)
• Stripe (payment processing)
• Resend (email delivery services)
• Cloudflare (security and infrastructure services)

Professional advisers

Including legal, regulatory and accounting advisers.

Authorities

Where required by law or regulatory obligation.

We do not sell your personal data.

International transfers

Your personal data may be transferred to, stored in, or processed in:

• the United Kingdom;
• the European Economic Area; and
• the United Arab Emirates.

Where personal data is transferred outside the UK or EEA, we will ensure appropriate safeguards are in place (such as standard contractual clauses or equivalent mechanisms).

Commercially sensitive information

Certain data processed via the Platform (including pricing, invoices and margins) may be commercially sensitive.

We implement appropriate technical and organisational measures to protect such information and do not disclose it to other Users except where necessary to facilitate a Booking or transaction.

Data retention

We retain personal data only for as long as necessary to:

• provide the Platform and Services;
• comply with legal and regulatory obligations;
• resolve disputes and enforce agreements.

Retention periods will vary depending on the nature of the data and applicable legal requirements.

Your rights

Under applicable data protection laws, you may have rights to:

• access your personal data;
• request correction of inaccurate data;
• request deletion of your data;
• restrict or object to processing;
• request data portability;
• withdraw consent (where processing is based on consent).

You may exercise these rights by contacting us using the details above.

Data security

We implement appropriate technical and organisational measures to protect personal data against:

• unauthorised access;
• loss or destruction;
• misuse or alteration.

However, no system is completely secure and we cannot guarantee absolute security.

Cookies

We use cookies and similar technologies to:

• operate the Platform;
• analyse usage;
• improve user experience.

Further details are set out in our Cookies Policy.

Changes to this privacy notice

We may update this privacy notice from time to time.

You should check this page periodically to ensure you understand how your data is used.

Governing law

This privacy notice and any dispute arising from it shall be governed by the laws of England and Wales.