Orange Data Co.
Privacy Policy
Last updated 12 October 2026
This policy explains what personal data Orange Data Co. collects when you use orangedata.co.uk or buy from us, why we use it, who we share it with and the rights you have. We collect as little as we can, and some of our tools are designed so that we never see what you enter.
Who we are
Orange Data Co. is the data controller for the personal data described here. Orange Data Co. is a trading name of Shades of Bee Ltd, a company registered in England and Wales under company number 11803969, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are registered with the Information Commissioner's Office under registration number ZC270674.
For any question about this policy or your data, email hello@orangedata.co.uk.
What we collect and why
| What | Why we use it | Lawful basis |
|---|---|---|
| Orders: your name, email address, billing details, what you bought and the payment reference | To deliver your purchase, send receipts, give you access to your order page and keep business and tax records | Contract, and legal obligation for tax records |
| Customer emails: your name, email address and what you bought | To send your downloads and access links, help you use your purchase, and tell you about our related products. You can unsubscribe from any email at any time | Contract for delivery emails. Legitimate interests for follow-up emails, and for individuals the "soft opt-in" under the Privacy and Electronic Communications Regulations |
| Results Review and Certification submissions: your business details, contact details, form answers, uploaded risk register and any Workbook results you choose to attach | To prepare for your call, review your submission against the published standard and send you the outcome | Contract |
| Certificate register: business name, website, certificate reference, dates, outcome and the contact email for delivery | To issue certificates and let anyone check that a certificate is genuine. The public verification page shows the business name, website, dates and status only | Contract, and our legitimate interest in keeping certification trustworthy |
| Call bookings: your name, email address and chosen time | To arrange and hold your Results Review call | Contract |
| Consultancy enquiries: your name, work email, organisation, role and what you tell us about your needs | To reply to your enquiry and arrange an introductory call | Legitimate interests, and steps you ask us to take before entering into a contract |
| Emails you send us | To answer you | Legitimate interests |
| Website security logs: IP address, pages requested and time | To keep the site secure and investigate misuse | Legitimate interests |
Please do not include other people's personal data in a risk register or submission beyond what is needed, for example names of individual staff or clients.
What we do not collect
- Your Workbook answers. The online Workbook saves your answers in your own browser on your device. They are not sent to us unless you choose to attach them to a Results Review or Certification submission.
- Your Policy Pack builder entries. The builder creates your documents when you press Download and sends them straight back to you. It keeps no copy.
- Your card details. Payments are taken by Stripe on its own secure pages. We never see or store card numbers.
Cookies and browser storage
We do not use analytics, advertising or tracking cookies. The site uses your browser's storage only to save your Workbook answers and builder entries on your device, at your request. You can delete them at any time with Start over in the Workbook, or by clearing your browser data. Stripe sets its own cookies on its checkout pages, as described in Stripe's privacy policy.
Who we share it with
We use a small number of service providers who process data on our behalf, under contracts that require them to protect it:
- Stripe for payments
- MailerLite for customer emails
- Hostinger for website hosting and our email
- Calendly for booking Results Review calls
We do not sell personal data, and we do not share it with anyone else unless the law requires us to.
International transfers
Some of these providers process data outside the UK, for example in the United States or the European Economic Area. Where that happens, the transfer is protected by UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework, or by the ICO's International Data Transfer Agreement or Addendum.
How long we keep it
| Data | Kept for |
|---|---|
| Orders and payment records | 6 years after the end of the financial year, as UK tax law requires |
| Results Review and Certification submissions, including uploaded files | 24 months after the call or decision |
| Consultancy enquiries that do not lead to work | 24 months after the last contact |
| Certificate register | While the certificate is valid, then 6 years |
| Email list | Until you unsubscribe. We then keep your address on a suppression list so we do not email you again |
| Website security logs | Up to 90 days |
Decisions about you
We do not make decisions about people by automated means. Every certification decision is made by Beke Cynthia Ogbaide. The readiness check on the submission form is guidance only.
Your rights
You have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. You can object to marketing emails at any time, and we will stop. Email hello@orangedata.co.uk and we will respond within one month.
Complaints
If you are unhappy with how we have handled your data, please tell us first at hello@orangedata.co.uk. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes
We will update this policy when the way we use data changes, and show the date at the top.