GDPR and UK Data Protection Statement

1. Our Approach

Orbis Corporate Solutions Private Limited (“Orbis”, “we”, “us” or “our”) recognises the importance of protecting personal information when providing professional services.

We are incorporated in India and serve clients across the USA, UK, UAE and India. Our services may involve handling personal information contained in accounting, bookkeeping, taxation, payroll, corporate and advisory records.

Where the European Union General Data Protection Regulation (“EU GDPR”), the UK GDPR or other applicable UK data-protection legislation applies to a particular activity, we will address the relevant requirements according to our role, the nature of the processing and the agreed engagement arrangements.

This Statement should be read alongside our Privacy Statement, Data Protection and Confidentiality Statement and relevant engagement terms.

2. Scope and Applicability

GDPR requirements do not apply automatically to every Orbis activity solely because we serve international clients.

Their application depends on factors including the parties involved, the individuals concerned, the nature of the activity and the territorial scope of the relevant law.

Where an engagement involves personal information subject to EU or UK data-protection requirements, the applicable responsibilities, processing instructions and safeguards should be identified before processing begins.

This Statement does not represent a claim of GDPR certification, registration or approval by a supervisory authority.

3. Our Role in Processing Personal Information

Orbis’s role depends on the particular processing activity.

For our own enquiries, proposals, billing and business administration, we may act as a data controller, determining the purposes and means of processing relevant personal information.

When delivering services using personal information supplied by a client, we may act as a data processor, handling that information on the client’s documented instructions.

Some activities may involve separate responsibilities arising from applicable legal or professional obligations. The relevant engagement arrangements should identify these responsibilities where necessary.

4. Client Data-Processing Arrangements

Where Orbis acts as a processor and applicable law requires a data-processing agreement, processing will be governed by written terms addressing:

• The subject matter, duration, nature and purpose of processing.
• The types of personal information and categories of individuals concerned.
• The client’s documented instructions.
• Confidentiality and security obligations.
• The use of additional processors.
• Assistance with individuals’ rights and relevant compliance obligations.
• Personal data breach notification and cooperation.
• International access and transfer arrangements.
• Return or deletion of information at the end of services.
• Information and audit arrangements necessary to demonstrate compliance.

We will notify the client if we believe a processing instruction infringes applicable data-protection requirements.

5. Purpose Limitation and Data Minimisation

Personal information should be processed for specified, authorised purposes and limited to what is necessary for the relevant activity.

When acting as a processor, we will not use client personal information for unrelated purposes, including our own marketing.

We will follow agreed instructions concerning the accuracy, correction and updating of client information. Clients remain responsible for providing appropriate instructions and ensuring that information is lawfully made available to us.

6. Confidentiality and Security

We use reasonable technical and organisational measures appropriate to the nature of the information and the risks involved.

Relevant measures include restricting access according to responsibilities, protecting credentials, using authorised systems and following agreed client security requirements.

Individuals authorised to process client personal information must be subject to appropriate confidentiality obligations.

Where services are delivered through client-controlled platforms, we follow the agreed access permissions and processing instructions. Full client-record copies should not be downloaded to personal or unapproved devices.

Specific security requirements should be documented where an engagement requires additional controls. No electronic system can be guaranteed to be completely secure.

7. Service Providers and Subprocessors

Where another provider processes personal information on our behalf in connection with a client engagement, their involvement must follow the applicable contractual and legal requirements.

Where required, we will obtain the client’s prior specific or general written authorisation before appointing a subprocessor. Arrangements for notifying changes and raising objections should be documented in the relevant agreement.

Subprocessors must be subject to appropriate written data-protection obligations. Their appointment does not remove Orbis’s responsibilities under applicable law or the engagement terms.

8. International Access and Transfers

An engagement may involve personal information being accessed from India or another country outside the UK or European Economic Area.

Keeping information in a client’s UK or European cloud platform does not necessarily prevent an international transfer from occurring. Remote access from another country may also require assessment.

Before undertaking processing involving a restricted international transfer, the relevant parties must establish the transfer arrangement and safeguards required by applicable law. Depending on the circumstances, this may involve recognised contractual mechanisms, the required transfer assessment and supplementary protections.

Client permission to access information does not, by itself, replace a legally required transfer mechanism.

Orbis does not claim to hold approved Binding Corporate Rules or to benefit automatically from an adequacy decision covering processing in India.

9. Individuals’ Rights

Where applicable, individuals may have rights relating to access, correction, deletion, restriction, objection, portability and withdrawal of consent. These rights are subject to the conditions and exceptions in the relevant law.

Where Orbis acts as a controller, requests may be directed to reachus@orbiscorpsol.com.

Where Orbis acts as a processor, we will notify the relevant client of requests concerning their information and provide appropriate assistance under the engagement arrangements. We will not independently decide such requests unless authorised or legally required to do so.

10. Personal Data Breaches

If Orbis becomes aware of a personal data breach involving information processed on behalf of a client, we will notify the client without undue delay and in accordance with applicable law and the agreed incident-notification arrangements.

We will provide available information relevant to the incident and cooperate with the client’s investigation, containment, remediation and assessment of notification obligations.

Where Orbis acts as a controller, we will assess and fulfil any applicable obligations to notify a supervisory authority or affected individuals.

A client’s regulatory reporting deadline should not be treated as permission for Orbis to delay notifying that client.

11. Retention, Return and Deletion

Personal information should not be retained longer than necessary for its authorised purpose, subject to applicable legal requirements.

Where Orbis acts as a processor, we will return or delete personal information at the client’s choice when the relevant services end, in accordance with the agreed arrangements, unless applicable law requires retention.

The arrangements should address existing copies, backups, archival records and any legally required retention. Information retained after an engagement remains subject to appropriate confidentiality and access restrictions.

12. Accountability and Client Cooperation

Where required, we will maintain records of processing activities within our responsibility and provide information reasonably necessary to demonstrate compliance with applicable processor obligations.

We will cooperate with relevant assessments, audits and inspections as required by law and the engagement terms, while protecting other clients’ information and maintaining appropriate security.

Where applicable, we will assist clients with security assessments, data-protection impact assessments and related regulatory consultation obligations, taking account of the nature of processing and the information available to us.

Any requirement to appoint a data protection officer or an overseas representative will be assessed separately. This Statement does not imply that such an appointment has been made.

13. Relationship with Other Documents

This Statement is a general description of Orbis’s approach. It does not replace:

• A client’s own privacy notices or lawful processing responsibilities.
• An engagement letter or confidentiality agreement.
• A data-processing agreement.
• A legally required international-transfer arrangement.
• Applicable statutory obligations.

Changes to this website Statement do not, by themselves, amend existing contractual commitments.

14. Contact Us

For questions about this Statement or an engagement involving EU or UK personal information, please contact:

• Orbis Corporate Solutions Private Limited
• 308, International Finance Center, Vesu, Surat 395007, India
• Email: reachus@orbiscorpsol.com
• Telephone: +91 9023816799

Please do not include passwords, identification documents or unnecessary sensitive records in your initial communication.