The distinction that matters. For your account we decide what is collected, so we answer for it — that is the privacy policy. For the file you upload, you decide what is in it. We only do what your use of the product asks us to do with it. This page is the standing description of that second relationship. A signed agreement on these terms is available on request from support@orkestar.eu.
Subject matter and duration
We process the data you load into Orkestar so that the product can do what you are using it for: parse your file, hold the resulting figures, and compute the analyses and plans you ask for. That runs for as long as your account is open, and ends when the account is closed or you delete the data — whichever comes first.
We act only on your instructions
We process your uploaded data only to provide the service to you, to keep it secure, and where a law we are subject to requires otherwise — in which case we tell you first, unless that law forbids it. We do not use it for our own purposes. Concretely, and stated because the audience is right to assume otherwise: your figures are not used to train models, to build benchmarks, to produce aggregate statistics we publish, or for anything any other customer sees.
What is processed
Types of data
Whatever your export contains. In the shape the product reads, that is: period, product, brand, category, customer, market, channel, promotion flag, volume, gross sales, discounts, off-invoice trade spend, net sales, cost of goods and pack size — plus the same for cost, expense, general-ledger and production files. Most of this is commercial rather than personal data. Personal data appears where a field names an individual: a customer who is a sole trader, a named account contact, a sales representative, a cost-centre owner.
Categories of people
Your employees who use the product; and any individuals named in the files you upload — typically customer contacts, sole traders, and staff identified in cost or workforce data.
Special categories
Orkestar is not designed for special-category data — health, biometrics, trade union membership, and the rest — and nothing in the product asks for it. Please do not upload it.
Who can see it
Access is limited to the people in your own workspace, and to our personnel where that is necessary to run or support the service. Those personnel are bound by confidentiality that survives the end of their engagement.
Security measures
The measures below exist in the running system. Measures that belong to the hosting providers — encryption at rest, backup regimes, physical security — are theirs, and are described in their own terms rather than restated here as if they were ours.
| Measure | What it means |
|---|---|
| Separation between customers | Every signup gets its own workspace, and records carry the workspace they belong to. Queries are scoped to the signed-in user’s workspace by default rather than by each screen remembering to filter. |
| Password storage | Salted PBKDF2-SHA256 hashes. Passwords are checked against a minimum length, similarity to your own details, a list of common passwords, and being all-numeric. |
| Session and form protection | Session cookies are HttpOnly; over HTTPS both cookies are Secure. Every state-changing request carries a CSRF token. |
| Rate limiting | Signup, password reset, waitlist submission and file upload are rate-limited. Password reset is additionally limited per target address, so varying a source address does not lift the ceiling on any one inbox. |
| Password reset | Links are single-use and time-limited: spending one changes the password, which invalidates the link that produced it. |
| Audit trail | Significant actions are recorded with actor, target, timestamp and IP. |
Sub-processors
You give a general authorisation for us to engage the suppliers listed on the sub-processors page. Each is bound by written terms no less protective than these. We remain responsible to you for what they do. Before adding one we give at least 30 days' notice and you may object on reasonable data protection grounds.
International transfers
The service is hosted in Paris, France (EU). Where a transfer outside that region is unavoidable, it happens only under a lawful transfer mechanism, and the sub-processors page names where each supplier operates.
Help when you need it
If one of your people exercises a right — access, correction, deletion, portability — and the data is in Orkestar, we help you answer. The product does most of it directly: you can read, correct, export and delete your own data from the application. Where you need something the product does not do, write to support@orkestar.eu.
We also assist with your security obligations, breach notifications, and impact assessments, in proportion to what we know and what we do.
If something goes wrong
If we become aware of a breach affecting your data we tell you without undue delay, with what we know at the time: what happened, which data and roughly how many people are affected, the likely consequences, and what we are doing about it. We will not wait until the picture is complete to make the first contact.
Return and deletion
At the end of the engagement you can export your data from the product, and on request we delete it. Deletion covers:
- Every dataset in your workspace, the parsed figures built from them, and the stored copies of the files you uploaded.
- Every export artifact generated for your workspace.
- The workspace record itself, including the plan and trial history attached to it.
- Every user account bound to that workspace, and the sessions and notifications belonging to them.
- Your entry on the waitlist, if the same address is on it.
Three things sit outside that, stated in the privacy policy in the same words: the audit trail, which is retained where there is a legal or accountability reason to keep it; restorable backups, which can hold a copy until the backup rolls off its own cycle; and records a law requires us to keep, for as long as that law requires.
Demonstrating compliance
We make available the information needed to show these obligations are met, and will respond to a reasonable audit request — including a security questionnaire — with the caveat that this is a small operation: expect documented answers and evidence, not a third-party certification we do not hold.
The parties
Processor: Beehive Reporting d.o.o., Savski gaj III. 15, Zagreb, Croatia. Controller: you, the customer, as identified by the account. Governing law: Croatia.