---
title: "Privacy Notice — Orygent"
description: "What personal data the Operator processes, why, for how long, and your rights."
source: https://www.orygent.com/legal/privacy
---

[Legal](https://www.orygent.com/en/legal) · PUB-02

# Orygent Privacy Notice

What personal data the Operator processes, why, for how long, and your rights.

Approved Approved by SMARTEDTECH SL (owner) · Version 2026-11-13 · Effective 13 November 2026

[Legal Notice](https://www.orygent.com/legal/legal-notice)[Website Terms](https://www.orygent.com/legal/terms)[Subscription Terms](https://www.orygent.com/legal/subscription)[Privacy Notice](https://www.orygent.com/legal/privacy)[Cookies Policy](https://www.orygent.com/legal/cookies)[Data Processing Agreement](https://www.orygent.com/legal/dpa)

## 1. Who is responsible

1.1 The controller for the processing described in this notice is SMARTEDTECH SL, B66970831, Carrer Agricultura, 16, 1º, 9ª, 08320 El Masnou, Barcelona, Spain (the Operator). Privacy contact: privacy@orygent.com.

1.2 The Operator has not appointed a Data Protection Officer. Privacy matters are handled by the Operator’s data protection contact at the address above.

## 2. Data roles

2.1 Platform data. The Operator is the controller of personal data processed to operate the platform: account, acceptance records, payments, security, support and communications.

2.2 Processor services. Where the Operator processes personal data on behalf of a business customer under the customer’s instructions, the Data Processing Agreement (DAT-01) applies and governs; it forms part of the subscription.

2.3 Sharing between SET platforms. Personal data is not shared with any other platform operated by the Operator or its group unless you enable the specific destination in your settings. Enabling one destination does not enable others, and you may disable it at any time.

2.4 International transfers. Personal data is stored in the European Economic Area. Where a processor outside that area is used, the transfer is covered by Standard Contractual Clauses, listed in DAT-01 Annex C.

2.5 Workspace content. Work items, documents, notes, approvals, uploads and other content that a customer’s users place in the customer’s Orygent workspace are processed by the Operator as processor for that customer under DAT-01. The customer is the controller of its employees’ and contacts’ data inside the workspace. Requests from workspace users concerning workspace content are routed to the customer’s workspace administrator.

## 3. What the Operator processes as controller, why, and for how long

| Data class | Purpose | Legal basis (GDPR Art. 6) | Retention ceiling |
| --- | --- | --- | --- |
| Enquiry and contact details (name, business email, company, message) | Answer the enquiry and manage a related proposal | Art. 6(1)(b) pre-contractual steps; Art. 6(1)(f) for corporate contacts | Deleted no later than 12 months after the last interaction unless a contract follows |
| Account and role data (name, work email, workspace, role, approval authority, sign-in events) | Authenticate users, enforce workspace and role scope | Art. 6(1)(b) contract | Life of the account; deleted or anonymised within 90 days after closure |
| Subscription, order and invoice records | Deliver the ordered service, billing, tax and accounting | Art. 6(1)(b); Art. 6(1)(c) tax and accounting law | 6 years after the end of the financial year |
| Acceptance and consent records (document code, version, time, method) | Prove which terms were shown and accepted | Art. 6(1)(f) evidence of compliance; Art. 6(1)(c) | 5 years after the end of the relationship |
| Security, audit and abuse-prevention logs | Protect the platform, detect abuse, investigate incidents | Art. 6(1)(f) | 12 months, longer where a legal hold applies |
| Support tickets and communications | Provide support and handle complaints | Art. 6(1)(b) | 12 months after ticket closure |
| Optional marketing email | Send product news | Art. 6(1)(a) consent (separate unticked checkbox) | Until withdrawn |

3.1 Fields marked mandatory on a form are required to provide the service; the others are optional.

3.2 The Operator does not use workspace content or uploads to train models for third parties. Use of your data to improve the Operator’s own models happens only with the separate research_contribution permission, which you may withdraw at any time without affecting the service.

3.3 The public site uses no analytics or marketing technology (see PUB-03).

## 4. AI assistance and automated decisions

4.1 Orygent provides AI assistance to users of a customer workspace. AI outputs are recommendations and drafts; steps with legal, financial or employment effect go ahead only after approval by a person with the configured authority.

4.2 The Operator does not take decisions based solely on automated processing that produce legal or similarly significant effects on you.

## 5. Recipients

5.1 The Operator uses processors for hosting, database and sign-in, email delivery, payment processing and AI model processing. The current list, with function and location, is DAT-01 Annex C, and is supplied on request at privacy@orygent.com.

5.2 Payment data is processed by Stripe, the payment service provider identified at checkout. The Operator does not store full card numbers.

5.3 Personal data is disclosed to public authorities only where the law requires it.

## 6. Your rights

6.1 You may request access, rectification, erasure, restriction and portability of your personal data, object to processing based on legitimate interest, and withdraw consent at any time with prospective effect. Send requests to privacy@orygent.com.

6.2 The Operator verifies your identity proportionately and answers within one month; where the request is complex the Operator may extend by two further months and will tell you why within the first month.

6.3 Where your data sits inside a customer’s workspace, the Operator forwards your request to that customer as controller and assists it under DAT-01.

6.4 You may lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (www.aepd.es), or with the supervisory authority of your habitual residence.

## 7. Retention and deletion

7.1 Account data is kept for the life of the account and deleted or anonymised within 90 days after closure, except where a longer period is required by law (tax and accounting records: 6 years; acceptance and consent records: 5 years after the end of the relationship, as evidence of compliance; records subject to a legal hold: until the hold ends).

7.2 Uploads and messages not linked to an active contract are deleted no later than 12 months after the last interaction, and earlier on your request, unless a legal hold applies.

7.3 Backups are rotated on a cycle not exceeding 35 days; data deleted from production is removed from backups at the end of the cycle.

7.4 Workspace content is returned or deleted at the end of the customer contract under DAT-01 clause 7 (export window 30 days, deletion within 90 days of termination).

## 8. Security

8.1 The Operator applies workspace isolation with row-level security, least privilege and multi-factor authentication for privileged access, encryption in transit and at rest, logging of privileged actions, and tested backup restoration. The measures are listed in DAT-01 Annex B.

8.2 Operator staff do not read confidential customer content in a workspace (documents, notes, attachments, financial or personal content). Support access is limited to operational, log and technical records and is recorded.

## 9. Changes

9.1 The Operator may amend this notice for legitimate reasons: changes in law, in the service, in security or fraud prevention, in the payment provider, or to clarify wording. The Operator notifies you of material changes by email and in-product at least 30 days before they take effect (immediately where required by law or security).

9.2 A later version does not broaden a consent you gave earlier; a new purpose or recipient is notified before it is enabled.

Carries over the Orygent texts approved by SMARTEDTECH SL with effect from 1 November 2026. Service facts (plans, providers and storage) were updated for the current Orygent service; the approved clauses are unchanged. The English text is the binding version. Translations of the site are for convenience only.