Privacy Notice

Last updated: 15 October 2026

This notice explains what personal data OrCore collects, why, and your rights under UK data protection law (UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR)).

Who we are

OrCore Ltd is the controller for the personal data described in this notice (except booking data – see below).

• OrCore Ltd, registered in England and Wales, company number 17520251
• Registered office: 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE
• Sole director: James Jackson
• Email: athena@orcore.org
• ICO registration number ZC275844

Don't want to hear from us? Just say so

Reply STOP to any message from us, or email athena@orcore.org, and we'll never contact you again. Every email, message and letter we send includes a simple way to opt out. We'll delete your details and keep only a minimal do-not-contact record (your name or business name, email and/or postal address) so that we don't contact you by mistake in the future.

What we collect

1. Business contact details from public sources We find UK campsites, kennels and catteries, and tattoo and piercing studios that might want a free website by looking at publicly available sources: the business's own website, Google (for example Google Maps listings), Facebook and Instagram business pages, and public business directories and registers (such as Companies House). We collect: business name, business type and whether it's a limited company, LLP, sole trader or partnership, contact name (if published), business email, phone number, postal address, website and social media page, the date and method of any contact we make, and short notes about your business. We only collect business contact details that the business has made publicly available.

2. Enquiry and contact details If you fill in a form on orcore.org, email or message us, we collect what you send: usually your name, business name, email address, phone number (optional), the type of business, and your message, plus any content (text, photos, logos) you send us for your site.

3. Customer and payment details If you buy a paid extra, we keep your name, business name, contact details, what you bought, invoices and payment history. If payments are processed by Stripe, we don't see or store your full card number.

4. Booking data (we are a processor) When a business uses an OrCore booking system, its customers' booking details (such as name, contact details, dates, pet or appointment details, and for studios any reference photos and an 18+ confirmation) are processed by us on behalf of that business. The business is the controller and decides how that data is used; our terms with them include data processing terms under Article 28 UK GDPR. If you booked with one of our client businesses, please contact them first about your data. We'll help them answer your request.

5. Website usage and cookies orcore.org and the sites we build use essential cookies only – those strictly needed for the site to work (for example, to keep a booking form working or remember a security setting). These don't need consent. We don't currently use analytics cookies, advertising cookies or tracking pixels (including the Meta pixel). If we ever add analytics or pixels, we'll ask for your consent first with a cookie banner and won't set them unless you agree. Our server keeps standard technical logs (such as IP address and pages requested) for security, which roll off within 35 days.

Why we use it and our lawful basis

How we contact businesses (PECR)

• Limited companies and LLPs ("corporate subscribers"): we may email them or send a direct message (for example via Facebook or Instagram) without prior consent, always identifying ourselves as OrCore Ltd and including an easy way to opt out.
• Sole traders and partnerships: we don't send them unsolicited marketing emails, texts or direct messages unless they've given consent. We may write to them by post instead.
• Every message and letter carries an opt-out, and we stop as soon as you ask.

Our legitimate interests assessment (summary)

• Purpose: offering a free website, and optional paid extras, to small UK businesses in the sectors we serve – a relevant B2B offer.
• Necessity: we can only reach businesses that don't know about us by using their business contact details; we use only what we need.
• Balance: the details are business contact details the business has made publicly available; contact is low-intrusion, infrequent, relevant to the business, and easy to opt out of; we don't contact sole traders or partnerships electronically without consent.
• Safeguards: opt-out in every message, a do-not-contact list that's always checked, and deletion of leads who never respond (see below).

You can object at any time and we'll stop.

Who we share it with

We don't sell personal data. We only share it with service providers who help us run OrCore:

• VM6 Networks Ltd – server hosting in the UK
• Google (Google Workspace) – email, documents and storage
• Stripe – card payment processing, if you choose card payments
• Meta (Facebook and Instagram) – our business pages, and messaging businesses through their Facebook or Instagram pages. We don't use the Meta pixel or Meta advertising tracking on our sites.

We may also share data if the law requires it, or with professional advisers (such as an accountant).

International transfers

VM6 Networks Ltd hosts our servers in the UK. Google, Stripe and Meta may process data outside the UK, including in the USA. Where they do, the transfer is protected by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and/or the UK Extension to the EU–US Data Privacy Framework (the "UK–US Data Bridge") where the provider is certified under it. You can ask us for more detail.

How long we keep it

• Prospect (lead) contact details: deleted 24 months after our last contact if you never respond, unless you become a client.
• Do-not-contact record: kept indefinitely, but limited to name, email and/or address, so we keep honouring your opt-out.
• Client and enquiry records, and invoices: kept for 6 years after the end of the financial year in which our relationship ends or the transaction took place, as required by HMRC. Enquiries that don't lead to work are treated like lead details above.
• Booking data: kept as instructed by the business that controls it; by default deleted 12 months after the appointment, and returned or deleted when the business leaves.
• Studio reference photos: deleted after the appointment (the studio sets the period, up to a maximum of 90 days).
• Backups: roll off within 35 days.

Children

Our services are for businesses and aren't aimed at anyone under 18. We don't knowingly collect children's data for our own purposes. Tattoo and piercing studio bookings made through our systems require the customer to confirm they are 18 or over.

Your rights

You have the right to:

• access a copy of your personal data;
• correct inaccurate data;
• erase your data;
• restrict how we use it;
• object to our use based on legitimate interests;
• object to direct marketing at any time – we will always stop;
• data portability for data you gave us under a contract.

To use any of these rights, email athena@orcore.org. It's free, and we'll reply within one month.

Complaints

If you're unhappy, please tell us first at athena@orcore.org and we'll try to put it right. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.

Changes

We'll update this notice if our practices change and show the date at the top.