How we handle your data

Overview and our principles

ORZED, LLC ("Orzed", "we", "our") is a Delaware limited liability company (`16192 Coastal Highway PMB 789009, Lewes, DE 19958, United States`) that engineers and operates software, AI systems and digital growth platforms for business clients. We collect only what we need, use it strictly for the purposes described here, and give you direct control over it.

This policy describes the personal data we process as a Data Controller (under EU/EEA and UK GDPR) and as a Business/Controller (under US state privacy laws including the Delaware Personal Data Privacy Act — DPDPA, and the California Consumer Privacy Act / CPRA) for orzed.com and our client console. When we process end-user data on behalf of a client inside a contracted engagement, we act as a Data Processor / Service Provider governed by the applicable Data Processing Agreement (DPA) and Master Services Agreement.

Data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Business contact identifiers: name, work email, phone number, company name and role submitted when you request a quote, an Opportunity Brief, or an engagement.
• Commercial communication records: project briefs, scoping notes and correspondence sent through our intake forms or direct channels.
• Technical and network telemetry: IP address, pages visited, referrer URL, browser type and session timestamps via first-party server logs and consent-gated analytics. No device fingerprinting and no cross-site ad tracking.
• Client Console credentials: Argon2id-hashed password and session tokens for authorized client console users.
• Billing and tax records: company billing address, tax/VAT ID and payment confirmation tokens. Payment card numbers are processed directly by PCI-DSS Level 1 payment processors and never touch Orzed servers.

Legal bases (GDPR, UK GDPR & US State Laws)

For individuals in the European Economic Area (EEA), the United Kingdom and Switzerland, we rely on the following Article 6 GDPR legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR): processing necessary to scope, enter into and deliver a requested project or service agreement.
• Legitimate interests (Art. 6(1)(f) GDPR): securing our infrastructure, preventing fraud or abuse, and responding to B2B inquiries you initiate.
• Legal obligation (Art. 6(1)(c) GDPR): maintaining statutory tax, accounting and compliance records under US Federal, Delaware and applicable international laws.
• Consent (Art. 6(1)(a) GDPR & ePrivacy Directive): strictly required before activating optional analytics or preference cookies. You may withdraw consent at any time.

How we use personal data

We process personal data solely to:

• Respond to project inquiries, prepare Opportunity Briefs and conduct pre-engagement technical scoping.
• Deliver, govern and support contracted software, AI and digital marketing engagements.
• Provide live milestone visibility, approval gates and transactional notices inside the Orzed Console.
• Maintain platform security, audit logs and regulatory tax/accounting compliance.

We do not use personal data for automated decision-making that produces legal or similarly significant effects (Art. 22 GDPR), nor do we sell or share personal data for cross-context behavioral advertising.

Sub-processors and international transfers

We share data only with vetted infrastructure sub-processors bound by written Data Processing Agreements (DPAs):

International data transfers (EEA/UK/Switzerland to US): Where personal data is transferred from the EEA, UK or Switzerland to the United States, we rely on the European Commission’s Standard Contractual Clauses (SCCs, Module Two/Three) and the UK International Data Transfer Addendum, reinforced by TLS 1.3 in transit, AES-256 encryption at rest and strict role-based access controls.

Retention schedules

We retain personal data only as long as necessary for the purposes set out in this policy or as mandated by law:

• Prospective client inquiries: 24 months from the last interaction.
• Contract, invoice and tax records: 7 years to satisfy US IRS and State of Delaware corporate tax/audit requirements.
• Analytics records: 13 months rolling, anonymized at collection.
• Security and access logs: 12 months.
• Encrypted backups: 35-day rolling rotation cycle.

Your rights (EU/UK GDPR & US CCPA/DPDPA)

Depending on your jurisdiction (including the EEA, UK, Switzerland, Delaware, California, Virginia, Colorado, Connecticut and Texas), you have the right to:

• Access & Know: request confirmation and a copy of the personal data we hold about you.
• Correction / Rectification: request correction of inaccurate or incomplete personal data.
• Deletion / Erasure: request deletion of your personal data, subject to statutory tax/legal retention exceptions.
• Portability: receive your data in a structured, machine-readable format (JSON/CSV).
• Restriction & Objection: object to processing based on legitimate interests or restrict processing during a dispute.
• Opt-Out of Sale, Targeted Advertising & Profiling (US State Laws): Orzed does not sell personal data, share it for cross-context behavioral advertising, or use sensitive personal information beyond service delivery.
• Right to Appeal (US State Laws) & Supervisory Complaint (GDPR): if we decline to act on a request, you may appeal directly to our leadership at team@orzed.com, or lodge a complaint with your local EU/UK Data Protection Authority or US State Attorney General.

Submit any privacy request to team@orzed.com. We respond within 30 calendar days (and within statutory windows under GDPR and US state laws) at no charge.

Cookies and Global Privacy Control (GPC)

orzed.com uses a minimal cookie footprint and honors browser-level Global Privacy Control (GPC) and Do Not Track (DNT) signals automatically:

• Strictly necessary: security, session state and regional routing preferences. Always active.
• Analytics (opt-in): off by default; enabled only when you grant consent and GPC is not active.
• Preferences (opt-in): remembers UI and consent choices for 12 months.

You can review or withdraw your cookie preferences at any time: open the cookie preferences panel.

Security and breach notification

We protect personal data and client assets through defense-in-depth engineering controls:

• Encryption in transit & at rest: TLS 1.3 with HSTS in transit; AES-256 encryption at rest across databases, object storage and backups.
• Zero-trust access control: least-privilege RBAC, mandatory hardware-backed MFA for administrative systems, and isolated client repositories.
• Breach notification: in the event of a confirmed personal data breach posing a risk to individuals, we notify the competent supervisory authorities within 72 hours (Art. 33 GDPR and applicable US state breach notification statutes) and notify affected clients without undue delay.

Children's data (COPPA & GDPR)

Our services are strictly B2B and directed at businesses and adult professionals. We do not knowingly collect personal data from children under 13 (US COPPA) or under 16 (EU/UK GDPR). If you believe a minor has submitted data to us, email team@orzed.com for immediate deletion.

Changes to this policy

We update this policy as regulations or our infrastructure evolve. Material changes are communicated to active clients at least 30 days in advance, and the effective date and version at the top of this page are updated accordingly.

Data controller and contact

For all privacy inquiries, GDPR/CCPA/DPDPA rights requests, or DPA documentation:

• Data Controller / Business Entity: ORZED, LLC (Registered in the State of Delaware, USA)
• Privacy & Legal Email: team@orzed.com
• Telephone / WhatsApp: +1 (302) 303 8300 · +1 (302) 450 8030
• Registered Address: ORZED, LLC, 16192 Coastal Highway PMB 789009, Lewes, DE 19958, United States