Last written 26 July 2026 · OrchesPay

1. Who this page is about

OrchesPay publishes this website and supplies the back office described on it. Where this page says we, us or our, it means OrchesPay.

This page has two halves. The first half covers visitors to this website. The second half covers the back office we supply to a merchant, where the merchant decides what happens to the information and we act on their instructions.

The product name and the company details on this page stand as placeholders until launch. A named legal entity, a registered address and a supervisory authority reference will replace them before this site goes live.

2. Visitors to this website

2.1 What we collect when you browse

Reading this site requires no account and no form. Our host records the ordinary technical details every web server records, so pages can be served and the service can be kept healthy and safe.

The address of the page you asked for.
The date and time of the request.
Your browser type and version.
Your network address, held for a short period for security reasons.

The site loads no third party analytics, no advertising pixels and no social widgets. Every asset a page needs comes from the same place the page comes from.

2.2 What we collect when you write to us

The contact form asks for your name, your work email address, your company, a rough monthly payment volume, the subject you would like to cover, and your message. A hidden field sits on the form to catch automated submissions, and a value in that field causes the submission to stop.

We use what you send for a single purpose. Replying to you and arranging a walkthrough.

2.3 How long we keep it

Server records of page requests: up to ninety days.
Messages sent through the contact form: up to twenty four months from your last contact.
Anything that becomes part of a signed agreement: as long as the agreement and the law require.

2.4 Our legal grounds

We rely on our legitimate interest in running a business website, answering the people who write to us, and keeping the service secure. Where you begin a commercial conversation with us, we also rely on the steps taken ahead of a contract.

3. Cookies and local storage

This site keeps one small item in your browser, and it exists to remember that you have seen the cookie note. It carries the value seen and nothing else.

The cookie page describes this in full.

4. The back office

4.1 The roles

A merchant using OrchesPay decides which information enters the back office and what happens to it. In data protection language that merchant is the controller, and we act as the processor on their documented instructions.

A person who paid a merchant and wants to understand how their information is handled should ask that merchant. The merchant holds the relationship and the answers.

4.2 What the back office processes

Payments carry personal information by their nature. The set is agreed with each merchant before an account goes live, and it commonly covers:

The identity of the person paying, to the extent the payment method requires it.
Contact details supplied at checkout.
The amount, the currency, the time and the outcome of each payment.
Refunds, disputes and the evidence attached to them.
Identity checks and screening results where the market requires them.
Where money is paid out, the details of the person receiving it.

4.3 Access to personal data inside the product

Reading the personal details behind a payment is treated as its own action rather than an ordinary page view.

It is available to a limited set of roles.
It asks the person to prove who they are again before it runs.
It asks for a reason, which is stored with the request.
Each access is written to a log kept for that purpose.

4.4 Requests from the people in the data

The product carries a route for handling a request from a person whose data a merchant holds, so a merchant can answer one inside the same system that holds the records.

4.5 Sub processors

We use a small number of suppliers for hosting, platform operations and payment processing. A current list goes to every merchant, and a merchant receives notice ahead of a change so they can raise an objection.

4.6 Security measures

The account a request can reach is decided from the signed session, never from the request.
One layer removes operator only fields from every response before it leaves.
Each area of the product is switched on per merchant.
Sensitive actions ask the person to prove who they are again.
A write that arrives twice happens once.
Changes, sign ins on behalf of somebody, and access to personal data are all recorded.

4.7 A personal data breach

A breach affecting a merchant gets reported to that merchant without undue delay, together with what we know, what we are doing, and what we suggest they do.

5. Sharing

We sell personal information to nobody, and we share it with nobody for advertising. Sharing happens in four cases only: a supplier acting for us under contract, a merchant receiving information that belongs to them, a payment provider that has to receive it to complete a payment, and a lawful request we are obliged to answer.

6. Transfers

Where information travels outside the region it was collected in, we put an approved transfer mechanism in place first, and we describe the arrangement to any merchant who asks.

7. Keeping records

Financial records are kept for as long as the law of the market requires, which is commonly several years. Records of that kind stay in place even where a person asks for erasure, because the obligation to keep them sits above the request.

8. Your rights

Under the law that applies to you, you may hold rights to:

Ask what personal information we hold about you, and receive a copy.
Have something corrected when it is wrong.
Ask for erasure where the grounds for holding it have ended.
Ask us to restrict what we do with it.
Object to processing that rests on a legitimate interest.
Receive what you gave us in a portable form.
Complain to your supervisory authority.

Write to hello@orchespay.com and we will answer inside one month. A request about a payment you made to a business goes faster if you send it to that business, because it decides the outcome.

9. Children

This website is aimed at businesses and their staff. We collect nothing knowingly from anyone under the age of eighteen through this site.

10. Changes to this page

When this page changes, the date at the top changes with it. A change that materially affects a merchant arrives by direct notice as well.

11. Reaching us

Email hello@orchespay.com for anything on this page. A named contact for data protection, and a postal address, will sit here before launch.

12. Review status

This page is written to be read and understood, and it awaits review by a qualified adviser in each market where the product is sold. Payments carry obligations that vary by market, so treat this as a working draft until that review lands.