Legal

Privacy Policy

Last updated: 2026  ·  ORCYN OÜ  ·  Tallinn, Estonia

1. Who We Are

ORCYN OÜ is a private limited company incorporated under the laws of the Republic of Estonia, registered at the Estonian Business Registry. Our registered address is Tallinn, Estonia.

ORCYN operates a maritime procurement infrastructure platform that connects ship operators and local suppliers. For the purposes of applicable data protection law, ORCYN OÜ is the data controller for personal data processed through the platform and our website at www.orcyn.com.

You may contact us at any time at info@orcyn.com.

2. Legal Basis and Applicable Law

As an Estonian company operating within the European Union, ORCYN processes personal data in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR)
• The Estonian Personal Data Protection Act (Isikuandmete kaitse seadus)
• Other applicable EU and Estonian legislation

3. What Personal Data We Collect

3.1 Account and registration data

When you register on the ORCYN platform, we collect your name, work email address, company name, job title, country, and phone number. This data is necessary to create and maintain your account.

3.2 Platform usage data

We collect data generated through your use of the platform, including procurement requests submitted, offers received and sent, order history, supplier and operator interactions, and communication logs within the platform.

3.3 Technical and device data

We automatically collect certain technical data when you access our platform or website, including IP address, browser type and version, device type, operating system, pages visited, time and date of access, and referring URLs.

3.4 Communications

If you contact us by email or through the platform, we retain the content of your messages and your contact details for the purpose of responding and maintaining records of our correspondence.

3.5 Demo requests

If you submit a demo request via our website, we collect your name, company name, email address, and any additional information you provide voluntarily.

4. How We Use Your Data

We process personal data for the following purposes and on the following legal bases:

• To provide the platform and our services — performance of a contract (Article 6(1)(b) GDPR)
• To manage your account and verify your identity — performance of a contract
• To process procurement requests and facilitate transactions — performance of a contract
• To send service-related communications — performance of a contract and legitimate interests
• To respond to your enquiries and demo requests — legitimate interests (Article 6(1)(f) GDPR)
• To improve and develop the platform — legitimate interests
• To comply with legal obligations — legal obligation (Article 6(1)(c) GDPR)
• To send marketing communications, where you have opted in — consent (Article 6(1)(a) GDPR)

5. Cookies

Our website uses cookies and similar tracking technologies. We use:

• Strictly necessary cookies — required for the website to function. These cannot be disabled.
• Analytics cookies — help us understand how visitors use our website. We use these only with your consent.
• Functional cookies — enable enhanced features and personalisation.

You can manage your cookie preferences through the cookie consent banner displayed on your first visit to our website. You may also adjust your browser settings to refuse cookies, though this may affect your ability to use certain features.

6. Who We Share Data With

We do not sell, rent, or trade your personal data. We may share data with the following categories of third parties where necessary:

• Technology and infrastructure providers — cloud hosting, database, and software-as-a-service providers who process data on our behalf under data processing agreements
• Analytics providers — services that help us understand platform usage, subject to your cookie consent
• Professional advisors — legal, accounting, or other professional services where required
• Public authorities — where we are required by law to disclose personal data

All third-party processors are bound by contractual obligations to process data only on our instructions and in accordance with GDPR requirements.

7. International Data Transfers

ORCYN is based in Estonia and primarily processes data within the European Economic Area (EEA). Where we use service providers located outside the EEA, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or an adequacy decision.

8. How Long We Keep Your Data

We retain personal data for as long as necessary to provide our services and fulfil the purposes described in this policy. Specifically:

• Account data is retained for the duration of your account and for up to 3 years following termination, unless a longer retention period is required by law.
• Transaction and order records are retained for 7 years for accounting and legal compliance purposes.
• Marketing consent records are retained until consent is withdrawn plus 3 years.
• Technical logs are typically retained for 90 days.

9. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

• Right of access — to obtain a copy of the personal data we hold about you
• Right to rectification — to have inaccurate data corrected
• Right to erasure — to request deletion of your data in certain circumstances
• Right to restriction of processing — to request that we limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at info@orcyn.com. We will respond within 30 days. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at www.aki.ee, or with the supervisory authority in your country of residence.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These include encrypted data transmission, access controls, and regular security assessments. No method of transmission over the internet is completely secure; however, we take the protection of your data seriously and continually work to improve our security practices.

11. Children

The ORCYN platform is intended for business use only. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.