How Orkestro Limited uses personal data on orkestro.com and when you get in touch with us. Last updated 29 October 2026.
Orkestro Limited runs orkestro.com and decides how the personal data described here is used, which makes us the controller under UK data protection law (the UK GDPR and the Data Protection Act 2018).
We have not appointed a Data Protection Officer, because the law does not require one at our size. Our Chief Technology Officer is responsible for data protection.
This website has no forms and no advertising trackers. It counts visits with PostHog, set up for anonymous statistics only: which pages are viewed, which links are clicked and roughly which country visits come from. Nobody is identified or profiled, sessions are not recorded, and PostHog keeps the data in its EU cloud. PostHog stores one first-party cookie (ph_..._posthog) on orkestro.com to tell one visit from another. You can switch this off at any time with “Turn off analytics” here or in the footer of every page, and browsers that send Do Not Track are never counted.
Like any website, your browser also sends your IP address and basic device details (browser type, the page requested) to the services that deliver the page:
| Service | Why your browser contacts it | What it receives |
|---|---|---|
| Netlify (hosting) | Serves every page of orkestro.com | IP address, page requested, browser details, kept in server logs |
| Google Fonts | Loads the site's typefaces | IP address, browser details |
| unpkg (content delivery network) | Loads the site's scripts and icons | IP address, browser details |
| Esri ArcGIS Online | Draws the map tiles on the home and Marketplace pages | IP address, browser details, map area viewed |
| OSRM (Project OSRM) | Plots the illustrative delivery route on the home-page map | IP address; the route points are sample locations, not yours |
| PostHog (EU cloud) | Counts page views and clicks for anonymous visitor statistics, unless you turn it off | IP address (used to work out the country), pages viewed, links clicked, browser details, a random visitor ID |
We use this only to deliver the site, keep it secure and understand, in aggregate, how it is used. Our lawful basis is legitimate interests: running a website that works and improving it. The analytics cookie relies on the exception for first-party statistics in the Privacy and Electronic Communications Regulations, which is why you can object with one click rather than being asked first. Links to Calendly, LinkedIn, our status page and our help centre take you to those services, which have their own privacy notices.
When you get in touch, we hold what you send us and our replies.
| Situation | What we hold | Why | Lawful basis |
|---|---|---|---|
| You email info@orkestro.com | Name, email address, company, your message | To answer you and follow up on business enquiries | Legitimate interests |
| You book a demo through Calendly | Name, email address, company, booking answers, meeting time | To hold the call and prepare a rate card for your business | Steps before a contract, or legitimate interests |
| You apply by emailing careers@orkestro.com | CV, contact details, anything you include | To consider you for a role | Steps before a contract |
We keep business contact details in Google Workspace (email), HubSpot (customer relationships) and Calendly (meeting bookings). We may send you follow-up emails about Orkestro as a business contact; every one tells you how to opt out, and we stop when you ask.
If you received a delivery booked through Orkestro, the merchant you ordered from controls your data; we process it on their behalf, under our contract with them. That covers your name, delivery address, phone number and email address, used only to get the order to you. For requests about that data, contact the merchant first; we will help them answer.
We also process the names, phone numbers and email addresses of merchants' store, finance and commercial contacts, to run deliveries, billing and support. The courier fleets that carry out deliveries receive what they need to complete each one. A list of our sub-processors is available from dpo@orkestro.com.
We do not sell personal data. We share it only with the providers that run our website and business, each under a written contract, and with authorities where the law requires it.
Some providers, including Netlify, Google and Calendly, are based in the United States. PostHog keeps website statistics in its EU cloud. Where data leaves the UK, it is protected by UK adequacy regulations or the ICO's International Data Transfer Agreement or Addendum, as each provider's terms set out.
| Data | How long we keep it |
|---|---|
| Website server logs | Under Netlify's own retention policy |
| Website statistics (PostHog) | Up to 7 years, the period PostHog sets for our plan. They hold no names or contact details |
| Enquiries and demo bookings that do not become customers | 24 months after last contact |
| Job applications | 6 months after the role closes |
| Customer and billing records | For the contract, then as long as tax and company law require |
You can ask us to:
Email dpo@orkestro.com. We reply within one month, and there is normally no charge. We make no decisions about you by automated means alone that have legal or similarly significant effects.
To complain about how we handle your data, email dpo@orkestro.com with “Data protection complaint” in the subject. We acknowledge every complaint within 30 days, investigate it without undue delay, keep you informed and tell you the outcome. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
We update this notice when the way we use personal data changes. The date at the top shows the current version.
How Orkestro Limited uses personal data on orkestro.com and when you get in touch with us. Last updated 29 October 2026.
Orkestro Limited runs orkestro.com and decides how the personal data described here is used, which makes us the controller under UK data protection law (the UK GDPR and the Data Protection Act 2018).
We have not appointed a Data Protection Officer, because the law does not require one at our size. Our Chief Technology Officer is responsible for data protection.
This website has no forms and no advertising trackers. It counts visits with PostHog, set up for anonymous statistics only: which pages are viewed, which links are clicked and roughly which country visits come from. Nobody is identified or profiled, sessions are not recorded, and PostHog keeps the data in its EU cloud. PostHog stores one first-party cookie (ph_..._posthog) on orkestro.com to tell one visit from another. You can switch this off at any time with “Turn off analytics” here or in the footer of every page, and browsers that send Do Not Track are never counted.
Like any website, your browser also sends your IP address and basic device details (browser type, the page requested) to the services that deliver the page:
| Service | Why your browser contacts it | What it receives |
|---|---|---|
| Netlify (hosting) | Serves every page of orkestro.com | IP address, page requested, browser details, kept in server logs |
| Google Fonts | Loads the site's typefaces | IP address, browser details |
| unpkg (content delivery network) | Loads the site's scripts and icons | IP address, browser details |
| Esri ArcGIS Online | Draws the map tiles on the home and Marketplace pages | IP address, browser details, map area viewed |
| OSRM (Project OSRM) | Plots the illustrative delivery route on the home-page map | IP address; the route points are sample locations, not yours |
| PostHog (EU cloud) | Counts page views and clicks for anonymous visitor statistics, unless you turn it off | IP address (used to work out the country), pages viewed, links clicked, browser details, a random visitor ID |
We use this only to deliver the site, keep it secure and understand, in aggregate, how it is used. Our lawful basis is legitimate interests: running a website that works and improving it. The analytics cookie relies on the exception for first-party statistics in the Privacy and Electronic Communications Regulations, which is why you can object with one click rather than being asked first. Links to Calendly, LinkedIn, our status page and our help centre take you to those services, which have their own privacy notices.
When you get in touch, we hold what you send us and our replies.
| Situation | What we hold | Why | Lawful basis |
|---|---|---|---|
| You email info@orkestro.com | Name, email address, company, your message | To answer you and follow up on business enquiries | Legitimate interests |
| You book a demo through Calendly | Name, email address, company, booking answers, meeting time | To hold the call and prepare a rate card for your business | Steps before a contract, or legitimate interests |
| You apply by emailing careers@orkestro.com | CV, contact details, anything you include | To consider you for a role | Steps before a contract |
We keep business contact details in Google Workspace (email), HubSpot (customer relationships) and Calendly (meeting bookings). We may send you follow-up emails about Orkestro as a business contact; every one tells you how to opt out, and we stop when you ask.
If you received a delivery booked through Orkestro, the merchant you ordered from controls your data; we process it on their behalf, under our contract with them. That covers your name, delivery address, phone number and email address, used only to get the order to you. For requests about that data, contact the merchant first; we will help them answer.
We also process the names, phone numbers and email addresses of merchants' store, finance and commercial contacts, to run deliveries, billing and support. The courier fleets that carry out deliveries receive what they need to complete each one. A list of our sub-processors is available from dpo@orkestro.com.
We do not sell personal data. We share it only with the providers that run our website and business, each under a written contract, and with authorities where the law requires it.
Some providers, including Netlify, Google and Calendly, are based in the United States. PostHog keeps website statistics in its EU cloud. Where data leaves the UK, it is protected by UK adequacy regulations or the ICO's International Data Transfer Agreement or Addendum, as each provider's terms set out.
| Data | How long we keep it |
|---|---|
| Website server logs | Under Netlify's own retention policy |
| Website statistics (PostHog) | Up to 7 years, the period PostHog sets for our plan. They hold no names or contact details |
| Enquiries and demo bookings that do not become customers | 24 months after last contact |
| Job applications | 6 months after the role closes |
| Customer and billing records | For the contract, then as long as tax and company law require |
You can ask us to:
Email dpo@orkestro.com. We reply within one month, and there is normally no charge. We make no decisions about you by automated means alone that have legal or similarly significant effects.
To complain about how we handle your data, email dpo@orkestro.com with “Data protection complaint” in the subject. We acknowledge every complaint within 30 days, investigate it without undue delay, keep you informed and tell you the outcome. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
We update this notice when the way we use personal data changes. The date at the top shows the current version.