Who we are and when this policy applies
Data controller: ORTO. ORTO is the controller when it decides why and how personal information is used to operate this website, respond to enquiries, provide reviews and manage its own customer relationships.
This policy applies to information collected through the ORTO website, forms, email, telephone, SMS and ORTO's own CRM records.
When ORTO handles a client's customer information solely under that client's instructions as part of CRM or automation services, the client remains the controller, ORTO acts as its processor and GoHighLevel and relevant communications providers act as sub-processors. In that situation, the client's privacy notice governs the use of the information and rights requests should normally be directed to that client.
Contact: www.orto.live, support@orto.live or +44 7378 856367.
Personal information we collect
Depending on how you interact with ORTO, we may collect:
- your name, business name, job title and contact details;
- your business type or industry, website, staffing and approximate enquiry volume;
- the content of enquiries, review requests and information about the administrative tasks or services you discuss with us;
- email, telephone and SMS content, delivery records, dates, times and communication history;
- customer and service records such as quotations, appointments, invoices and relevant correspondence;
- marketing preferences, consent records, opt-outs and suppression records;
- technical and security information such as IP address, browser information, form-session data and server logs; and
- personal information supplied by a client for ORTO to process on the client's behalf.
Please do not provide special-category information, criminal-offence information or information about another person unless it is necessary, lawful and you are authorised to do so.
How we obtain information
We collect information directly when you complete a form, request a review, email, telephone or text us, enter into a customer relationship or otherwise communicate with ORTO. We may also receive information from an ORTO client when providing CRM and automation services, from service providers that operate the website and communications systems, and from public business sources where lawful.
Fields marked as required are needed to deal with the relevant request. If they are not provided, ORTO may be unable to respond, assess a review request or provide the requested service.
Purposes and lawful bases
ORTO uses personal information only where there is a lawful basis under UK data-protection law:
- Enquiries and requested reviews: to respond, collect relevant details and take steps requested before entering a contract.
- Providing and managing services: to deliver agreed services, manage appointments and communications, administer the customer relationship and perform a contract.
- Operations and security: to run, protect and improve the website and systems, prevent misuse, maintain records and establish or defend legal claims. This is based on ORTO's legitimate interests where those interests are not overridden by individual rights.
- Legal and regulatory requirements: to maintain accounting records, respond to lawful requests and comply with obligations imposed by law.
- Marketing: to send marketing only where valid consent has been given or another lawful route is available under UK GDPR and the Privacy and Electronic Communications Regulations. Consent may be withdrawn at any time.
- Client instructions: to process a client's customer information as necessary to provide contracted CRM and automation services, where the client determines the lawful basis.
CRM, email and SMS handling
In this local V5 development copy, contact-form submissions cannot be delivered: private SMTP settings are absent, and the handler returns a mailbox-unavailable response. Before launch, ORTO must configure authenticated SMTP and confirm the recipient mailbox. The Free Time-Saving Review survey is hosted by GoHighLevel and loads after a visitor action; its destination, routing and provider storage have not been verified in V5. If GoHighLevel is configured for an agreed service, contact details, enquiries, communication history, consent status and follow-up activity may also be stored and managed there.
ORTO may use approved CRM workflows to acknowledge enquiries, request information, send appointment or service reminders, follow up quotations and route a request to a person. These workflows support communication and administration; ORTO does not use them to make solely automated decisions that produce legal or similarly significant effects.
Service messages and replies requested by an individual are not treated as marketing merely because they are sent by email or SMS. Submitting an enquiry does not by itself opt someone into marketing. Marketing emails or texts will be sent only where permitted by law, will identify the sender and will provide a clear way to opt out. Email recipients may use the unsubscribe route provided or contact ORTO, and SMS recipients may reply STOP. ORTO will record opt-outs so that the preference continues to be respected.
Where communications are sent for an ORTO client, ORTO uses the contact information only under the client's documented instructions. The client is responsible for ensuring it has an appropriate lawful basis, providing its own privacy information and honouring communication preferences.
Processors and other recipients
ORTO uses carefully selected providers to operate its services:
- 1&1 IONOS Limited (IONOS): website hosting, server logs, mailboxes and SMTP email delivery. IONOS processes relevant information to provide those services under its UK data-processing agreement.
- HighLevel, Inc. (GoHighLevel): CRM, workflow automation, contact management and email/SMS communication services. HighLevel acts as processor for ORTO's controller data and as sub-processor where ORTO acts for a client, as described in HighLevel's data-processing agreement.
- HighLevel sub-processors: cloud-hosting and communications providers used to store data or deliver email and SMS. HighLevel maintains a current sub-processor list.
Information may also be disclosed to professional advisers, insurers, payment or accounting providers, regulators, courts, law-enforcement bodies or another party where reasonably necessary for a legal obligation, claim, business transfer or protection of rights. ORTO does not sell personal information.
International transfers
GoHighLevel is operated by HighLevel, Inc. in the United States and some of its sub-processors process information in the United States, India or other countries. Where UK-protected information is transferred outside the UK, ORTO relies on an applicable adequacy regulation or contractual safeguards. HighLevel's data-processing agreement incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum for relevant restricted transfers.
You may contact ORTO for more information about the safeguards relevant to your information.
Retention
ORTO will only retain personal information for as long as it is reasonably necessary for the purpose for which it was collected and to meet any legal, accounting or regulatory obligations.
As a general rule, information relating to enquiries that do not result in a customer relationship will be retained for up to 24 months from the last interaction, while records relating to customers, services provided, quotations, invoices, appointments and relevant communications may be retained for up to six years following the end of the customer relationship or completion of the service.
Where an individual has opted out of marketing communications, ORTO may retain limited information on a suppression record for as long as necessary to ensure their preference continues to be respected.
Where ORTO processes personal information on behalf of a client through its CRM and automation services, the client remains responsible for determining the appropriate retention period for their customer data, and ORTO will process and retain that information in accordance with the client's instructions and applicable data protection requirements.
Security
ORTO uses proportionate technical and organisational measures designed to protect personal information, including access controls, HTTPS and encrypted SMTP connections, form-security controls, restricted configuration files and provider security measures. No internet or storage system is completely secure, so absolute security cannot be guaranteed.
Your rights
Depending on the circumstances, UK data-protection law may give you the right to:
- request access to and a copy of your personal information;
- ask for inaccurate or incomplete information to be corrected;
- ask for information to be erased or processing to be restricted;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive certain information in a portable format;
- withdraw consent at any time, without affecting earlier lawful processing; and
- complain to the Information Commissioner's Office.
These rights are not absolute and legal exceptions may apply. ORTO may need to verify your identity before acting on a request. Where ORTO acts only as a processor for a client, the request will be referred to the relevant client or ORTO will assist that client as required.
Cookies and browser storage
The contact form uses a first-party session cookie for form security. V5 does not currently present a cookie preference panel or run separate analytics or advertising scripts. The GoHighLevel survey on the Free Review page may use cookies or other browser storage after a visitor chooses to load it or opens it in a new tab. The provider's settings and any consent requirements have not been verified; they must be confirmed before publication. Current details are in the Cookie Policy.
Changes to this policy
ORTO may update this policy when its services, providers or legal obligations change. The date shown at the top identifies the latest version.
Contact and complaints
For privacy questions, rights requests or marketing opt-outs, email support@orto.live or telephone +44 7378 856367. Please provide enough information for ORTO to identify the relevant records and understand the request.
You may also complain to the Information Commissioner's Office. ORTO would appreciate the opportunity to address the concern first, but contacting ORTO is not a condition of complaining to the ICO.