Scope and responsibility
This notice covers website visitors, company representatives, workspace users and people whose employment or recruitment information is entered into ORPECT. Companies supply and manage their source records. ORPECT manages platform access and review workflows. Controller and processor responsibilities depend on the processing activity and applicable agreement. Request operating-entity, address and regional privacy-contact details through Contact before supplying personal records.
Information we process
The categories depend on the features used. Submit only relevant information you are authorized to provide. The interactive demo contains sample records separate from company workspaces.
- Account and company details: name, work email, company website, country, registration details, verification submissions, team roles and optional company LinkedIn profile.
- Employment and recruitment records: employee name, email, phone, government identifier type and issuing country, photograph, optional LinkedIn URL, department, job title, employment dates and non-joining events.
- Feedback and compensation: factor ratings, employer reviews, factual remarks, starting and departure salary, currency, pay period, evidence status and supporting documents.
- Access and operational records: authorization cases, plan and coupon activity, credit transactions, search history, requests, notifications and audit events.
- Security and communication details: session information, request/network information used for protection, email-delivery metadata, inquiry messages and privacy-case correspondence.
Support tickets and conversations
ORPECT processes ticket subjects, categories, messages, requester and company references, timestamps, status, assignments and optional linked privacy-case references to provide support. Administrators may add internal notes to investigate an issue. Conversations are accessible to the requester and authorized platform administrators, not other company users. Internal notes are not displayed to the requester. Replies and status changes can generate in-app notifications. Do not send passwords, authenticator codes, live email links or raw government identifiers in chat.
Where information comes from
Information comes from account holders, authorized company representatives, individuals making requests and platform activity. Records can be contributed by more than one employer. LinkedIn links are supplied by users; ORPECT does not scrape LinkedIn or verify ownership of the linked profile. Employer-provided information must not be treated as independently verified merely because it appears in a record.
Why information is used
Processing supports company verification, secure account access, tenant administration, employment-record management, identifier matching, reviewed background-verification access, evidence moderation, credit accounting, communications, abuse prevention and rights-request handling. The applicable legal basis and required notices depend on the activity and jurisdiction. Sharing consent, an enabled feature or a purchased plan does not by itself establish every applicable legal basis.
Identity linking and automated processing
The system indexes protected identifiers and can link compatible records to a career chain. Government identifiers are considered by country and type, with email and phone as secondary evidence. Conflicts and uncertain matches need review. This automation supports record organization; ORPECT does not automatically decide whether someone should be hired, rejected or promoted. Individuals can request review of an incorrect link through the privacy process.
Who can see records
Workspace data is not a public people directory. Company users see information permitted by their role and tenant. Platform reviewers have administrative access for defined moderation, access and support tasks. Another company can receive only currently eligible, authorized history. Salary, contact details and profile images have their own sharing checks. Shared histories may include eligible non-joining events and approved, undisputed factual remarks.
Providers and other disclosures
Transactional email is configured through Resend when enabled. Company-selected email recipients receive account and workflow communications. Where payment checkout is enabled, Razorpay processes payment details in its hosted checkout. ORPECT stores purchase amounts, currency, order and payment references, status and a snapshot of company billing details for receipts. ORPECT does not store card numbers or CVV codes. Hosting, database and file-service providers depend on the service configuration; request applicable provider and safeguard details through Contact. Required legal disclosures and disclosures to protect rights or investigate abuse must be assessed under the applicable law. The website does not use advertising or cross-site tracking services.
Retention, deletion and legal holds
Retention depends on purpose, record category, contractual and statutory duties, disputes and legal holds. Request the applicable retention schedule for active data, support conversations and internal notes, historical revisions, email metadata and backups through Contact. Closing a support ticket does not delete its conversation. Messages and support action histories are protected against ordinary editing or deletion; personal-data requests follow the privacy review process. Removing an active record may retain an audit or financial entry; a deletion request does not automatically erase every employer record. Requests must be assessed and the outcome explained.
Security and file handling
Server-side authorization, protected sessions, rate limits, validated inputs and generic errors protect access to records. Uploaded images are validated and re-encoded; document access follows quarantine and scan controls. Configured sensitive artifacts and backups are encrypted. Company users must also keep credentials private and handle records appropriately.
Your rights and how to make a request
Use the public Privacy Center to request access, correction, deletion, restriction, objection, withdrawal or review of disputed information, as applicable. The subject portal provides a limited identity-reviewed route to eligible records. Only necessary identity evidence should be supplied; email possession alone does not authorize disclosure. Rights, exceptions, deadlines and appeal or complaint routes vary by jurisdiction.
- Identify the issue and the source company or record if known. Do not include passwords or authenticator secrets.
- Incorrect employment facts, identity links and disputed remarks can be raised for review.
- Withdrawal can stop eligible sharing, subject to the processing basis and any applicable retention duties.
- European privacy rights include access, correction and qualified erasure, restriction, portability and objection rights; individuals can complain to their competent supervisory authority.
Regional employment and privacy rules
ORPECT focuses first on the USA, European markets and India. US background-report processing requires assessment of federal, state and local obligations, including applicable FCRA procedures. European processing requires a documented legal basis, appropriate notices and rights handling. Indian availability accounts for the DPDP framework and applicable commencement dates. Country availability follows the relevant regional policy.
Data locations and international transfers
Storage locations depend on the configured service environment and providers. Email delivery may involve provider processing in another region. Request the storage region, relevant provider locations and applicable transfer safeguards through Contact before submitting information subject to a regional storage or transfer requirement.
Cookies and browser preferences
The signed-in session cookie supports authentication. A separate sidebar cookie and browser preference remember the chosen dashboard layout. Optional Google Analytics and Microsoft Clarity tracking runs only on selected public marketing pages after you select Accept. Reject keeps optional tracking off. Sign-in, signup and private dashboards are excluded; no employee identifiers or account records are supplied as analytics events. Advertising consent remains denied. You can change your choice through Cookie settings in the public footer. See the Cookie Policy for storage durations and controls.
Sensitive data, minors and updates
ORPECT is intended for authorized business employment workflows. Do not submit unrelated medical, genetic, financial-account or other sensitive information. Do not submit children’s information. The service is intended for adult business employment workflows. This notice will be updated when the operator, service configuration or data practices change; material changes need the appropriate notice. Use Contact for general questions and the Privacy Center for a personal-data request.