Privacy notice

Who we are and what this covers

This notice covers enterwithorb.com (the “site”) and the Orb visitor management service. Orb is made by Arcan Labs Private Limited, India (“Arcan Labs”, “we”, “us”).

For the site and its two forms, Contact us and the Evidence Pack, we decide why and how your personal data is used. Under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), that makes us the Data Fiduciary for that data.

If you check in at a building that uses Orb, the building decides what is collected at its door. See Checking in at a building that uses Orb.

What we collect on this site

When you fill in Contact us: your name, work email, company, phone number, role, what you look after (one building, a campus, a shared building or several) and what you would like to talk about. If you choose to add them, your visits a month and a message. If you send feedback on the website, we ask only for your name, an email address and your feedback; the other details are optional.

When you ask for the Evidence Pack: your name, work email, company, role, what you look after and how visitors sign in today.

With either form: that you confirmed reading this notice and the Terms of use (and which version), whether you ticked “Send me occasional updates”, the page you sent it from and the time.

To keep the forms safe: the country your request came from, as reported by our host’s network (not your exact location), is saved with your form. Your IP address is turned into a scrambled code (a hash) and kept for up to two hours to stop the forms being misused; it is never saved with your form. To check that a work email can receive our reply, we ask the public internet address book (DNS) whether its domain accepts mail; only the domain is looked up, never the full address.

What we do not collect: the site sets no cookies, runs no analytics or advertising trackers and loads nothing from other companies. It remembers two small choices in your own browser: your pricing view (band, currency, monthly or yearly) and which section of the home page you were on, so the Back button returns you there. Both stay on your device and hold no personal data.

Please do not send sensitive details, such as health, financial or identity document information, through the forms.

Why we use it, and on what basis

• To answer you and follow up. We use your details to reply, set up the demo, trial or call you asked for, send the Evidence Pack, and call or email you about your request and about Orb. Each form says this before you send it. You give us your details for that purpose, which the DPDP Act treats as a legitimate use (section 7(a)) for as long as you have not told us you no longer agree.
• Occasional updates, only if you ask. Newsletters and product updates go only to people who tick “Send me occasional updates”. That is your consent. You can withdraw it at any time, as easily as you gave it: use the unsubscribe link in any update, or write to us.
• To keep the site and forms working and safe, for example to stop automated or abusive requests.
• To meet our legal obligations.

We do not sell personal data, we do not share it for anyone else’s marketing and we do not use it to train AI models.

Who processes it for us

A small number of service providers handle personal data on our instructions, under their own data processing terms:

• Cloudflare, Inc. hosts the site, runs the form service and protects the site and forms against attacks.
• Google LLC (Google Workspace and Apps Script) stores form submissions in a private spreadsheet, and sends the Evidence Pack email and the alert our team receives when you get in touch.
• Microsoft Corporation (Microsoft 365) runs our email at arcanlabs.in and holds the emails we exchange with you.

No one else receives your personal data, unless the law requires us to share it, for example in answer to a court order or a lawful request from a government authority.

Where it is processed

Your data is processed in India and in other countries where these providers operate, including the United States. The DPDP Act allows this, except to countries the Government of India restricts; we will follow any such restriction.

How long we keep it

• Form submissions are deleted automatically 12 months after you send them.
• Emails between us are kept while we are in touch and for up to 12 months after our last contact. If you become a customer, your agreement with us sets how long we keep business records.
• The scrambled IP code used to stop misuse is deleted after two hours.
• Delivery records kept by our email providers are held for a short period under their own terms.

You can ask us to delete your data sooner; see Your rights.

How we protect it

The site is served only over HTTPS. The form service accepts requests from this site alone, limits how often it can be used, and keeps no personal data in its logs. Only the people at Arcan Labs who answer enquiries can see your details, and their accounts use two-step sign-in.

No system can be made perfectly secure, so we also plan for things going wrong; see If something goes wrong.

Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you, and who we have shared it with;
• ask us to correct, complete, update or delete it;
• withdraw any consent you have given;
• name another person to use these rights for you if you die or become unable to;
• have a complaint about how we handle your data answered.

To use any of these rights, write to privacy@arcanlabs.in from the address you used, or tell us which address it was. We may ask you to confirm it is you. We reply within 30 days, free of charge.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

Checking in at a building that uses Orb

When you visit a building that uses Orb, the building (or the company that runs it) decides what is collected when you check in, why, and for how long. The building is the Data Fiduciary for that data. Arcan Labs processes it on the building’s behalf, as its Data Processor, under a written agreement, and uses it only to run Orb for that building.

The notice on the check-in screen, shown before you are asked anything, tells you what is collected, why, how long each part is kept and whom to contact. To ask about your data or use your rights, contact the building. If you write to us instead, we will pass your request to the building promptly.

The visit shown on this site, with Rahul, Priya and Meridian One, is an illustration. It uses no real person’s data.

Children

This site and its forms are for businesses, not for anyone under 18. If we learn that we have received personal data from someone under 18 through the site, we will delete it.

If something goes wrong

If a personal data breach affects your data, we will tell you and the Data Protection Board of India without delay, in the way the law requires: what happened, what it may mean for you, what we are doing about it and what you can do.

Changes to this notice

When we change this notice, we update the version and date at the top of this page. If a change matters to how we use data you have already given us, we will tell you before it applies.

Contact and grievances

Arcan Labs Private Limited, India.

Privacy questions and requests: privacy@arcanlabs.in.

Grievances about how we handle your data: product@arcanlabs.in, with “Grievance” in the subject line. We acknowledge every grievance and answer it within 30 days.