Our Regulatory Position
Orion Forge acts as a Data Processor under the UK General Data Protection Regulation (UK GDPR). When we build AI-powered systems for your business, you remain the Data Controller — you own the data and are responsible for how it is used. We are responsible for processing that data securely, within the agreed scope, and in line with your instructions.
Orion Forge is registered with the Information Commissioner's Office (ICO) as a Data Processor. ICO registration is in progress. Our registration number will be published here once confirmed.
Our AI management practices are designed in alignment with ISO/IEC 42001, the international standard for AI management systems.
Data Processing Agreement
Every client engagement that involves personal data is covered by a Data Processing Agreement (DPA). This is a legally binding contract that sets out:
- What data we process on your behalf
- The purpose and lawful basis for processing
- How long data is retained
- Security measures in place
- Your rights as Data Controller
- Our obligations as Data Processor
- How data breaches are handled and reported
A standard DPA is available within 48 hours of first engagement. Contact us at contactus@orionforge.co.uk to request a copy before your project begins.
Sub-Processors We Use
Where we use third-party tools and platforms to deliver your project, those providers become sub-processors. We disclose all sub-processors before a project begins. Current sub-processors may include:
| Tool Name | Purpose | Privacy Policy |
|---|---|---|
| Anthropic (Claude) | AI language model | anthropic.com/privacy |
| OpenAI | AI language model | openai.com/privacy |
| n8n | Workflow automation | n8n.io/privacy |
| Make (formerly Integromat) | Workflow automation | make.com/en/privacy |
| Airtable | Database and knowledge base | airtable.com/privacy |
Sub-processors are reviewed regularly. If a new sub-processor is required for your project, you will be notified and your written agreement obtained before use.
Your Data Is Never Used to Train AI
We operate exclusively under commercial API agreements with AI providers. Under these agreements, your data and any outputs generated during your project are not used to train, improve, or develop any AI model. This applies to all client data, without exception.
Security Measures
We apply appropriate technical and organisational measures to protect data processed on your behalf, including:
- Encrypted data transmission (TLS)
- Access controls limited to project team members
- No permanent retention of client data beyond the agreed project term
- Secure deletion of data upon project completion or contract end
- Incident response procedures with ICO notification within 72 hours of a confirmed breach
Your Rights
As a Data Controller, you have the right to:
- Access a record of what data we hold or process on your behalf
- Correct any inaccurate data
- Request deletion of data we hold
- Restrict or object to processing
- Receive a copy of your data in a portable format
To exercise any of these rights, contact us at contactus@orionforge.co.uk. We will respond within 30 days.
Contact
For all compliance and data protection enquiries:
Email: contactus@orionforge.co.uk
Response time: within 2 business days