Automation and Data Transparency

Responsible company

Orchords Operations LLC, a Nevis limited liability company, operates the features described here. It is the responsible organization/controller for direct website and service-operation purposes that it determines. When a customer directs processing in a hosted tenant service, that customer may be the controller or data user and Orchords may act as its processor or service provider, subject to the applicable agreement, instructions, and law.

Operational now

• The public compliance screening accepts only a NACE Rev. 2.1 division selection. It evaluates that selection in the browser against a fixed sector-to-framework map and does not submit the selection to Orchords.
• It does not request a company name, country, work email, or consent record and does not create or email a server-side report. The public lead-capture endpoint is disabled.
• The screening does not collect turnover or provide a penalty estimate. It does not inspect a company’s controls, systems, contracts, evidence, or legal status.
• Authenticated or previously issued reports may record jurisdiction as context, but jurisdiction is not evaluated when selecting candidate frameworks.
• Anonymous self-service opt-out submission is disabled until requester verification and abuse controls are implemented. Authenticated and previously issued report workflows are separate from the public screening.
• Authenticated prospect-management workflows allow authorized tenant users to create and update company records and import authorized CSV data. Authenticated company-registry lookup and protected scheduled ingestion can use OpenCorporates only when that integration is configured; this notice does not claim it is enabled in production.
• Regulatory exposure scanning and rules, segment ranking, generated regulatory-change outputs, automated outreach generation and localization, ROI calculations, and the separate effort-and-cost estimator are disabled. They will remain unavailable until their sources, methodology, versioning, review and approval process, and notices are validated.

In development — not a current capability

Product plans may include additional regulator registers, public job postings, website technology observations, trust-centre information, lead scoring, and outreach workflows. Those items must not be treated as operational merely because they appear on a roadmap or in internal software.

Before any new source or outreach workflow is enabled, Orchords must document its purpose, source, legal ground, recipients, retention, opt-out handling, security controls, and any notice required by the jurisdictions involved.

Data and purpose

• Public screening: the sector selection remains in the browser and is not submitted by the form.
• Authenticated or previously issued reports: may include company, jurisdiction, sector, work email, consent, report, and access-token records where that separate workflow was used.
• Authenticated prospect management: may process company identifiers and profile data supplied by an authorized tenant user or returned by a configured registry lookup or ingestion workflow.
• Verified privacy and opt-out requests: to identify the relevant activity, suppress matching use where required, and document the response.
• Request and security logs: to rate-limit abuse, investigate incidents, and operate the service.

The legal ground depends on the activity and applicable law. An authenticated report requested by a user may rely on a requested pre-contract or service step and consent where consent is required. We do not rely on a generic “legitimate interest” statement as permission for every future data source or outreach use.

Retention and access

An access token for an authenticated or previously issued report expires 30 days after generation. Token expiry is not automatic deletion of every underlying lead, consent, security, or accountability record. Those records follow the criteria in the Privacy Notice. Opt-out records may be retained so suppression remains effective. Anyone holding a valid report link can view it, so do not share the link publicly.

Limitations and human review

Outputs are preliminary, rule-based information. They are not legal advice, a compliance determination, an audit, certification, regulator approval, risk score, or penalty calculation. Verify any output with qualified counsel or an assessor who knows the company’s facts and jurisdiction before taking action.

Object or opt out

Email privacy@orchords.com from the address involved, identify the Orchords feature and requested scope, and do not include unnecessary personal data. We may request proportionate verification before changing a record or suppressing a user-requested service. We will respond within the period required by applicable law.

Contact

Privacy: privacy@orchords.com
Legal: legal@orchords.com