Data Protection Policy
How OMG Center Limited handles personal data
- UK GDPR
- ICO Registered
- Version 2.0 · Last updated: 19 October 2026
1. Overview
This policy explains how OMG Center Limited collects, uses, and protects personal data in connection with the Orca service.
It is important to understand what this policy covers, and what it does not.
What this policy covers
This policy covers the limited personal data that OMG Center Limited handles directly as part of the commercial relationship with Orca clients. This includes data provided when booking a discovery call, entering into a service agreement, or communicating with us about the service.
What this policy does not cover
This policy does not govern the data that Orca processes on your behalf when performing its function as your AI executive assistant: your emails, calendar events, meeting transcripts, contact records, tasks, or any other operational content.
That data is yours, and you are its data controller. Where OMG Center Limited stores or processes it for you, in your dedicated Orca project, through the Claude workspace key we provide, or through Orca Meet transcription, we do so as your data processor under the Data Processing Agreement, not under this policy.
Orca is installed on your device and connects to your Microsoft 365 or Google Workspace account using your own credentials. The managed parts of the service that we run for you are covered by the Data Processing Agreement, and we use your data only to provide the service.
2. Who we are
The data controller for the personal data described in this policy is:
- Company name: OMG Center Limited
- Company number: 14169551
- Registered in: England and Wales
- ICO registration: Registered (number to be completed)
- Contact: chris@simmance.ai
- Website: simmance.ai
OMG Center Limited builds, configures, and maintains the Orca software for each client, and runs the managed parts of the service: a dedicated Orca project per client, the Claude workspace key, and meeting transcription. For the data in those parts we act as processor for the client, as set out in the Data Processing Agreement.
3. What personal data we collect
We collect only the personal data necessary to manage the commercial relationship with Orca clients and prospective clients. This comprises:
| Category | Data collected | Source |
|---|---|---|
| Contact details | Name, email address, job title | Provided by you via booking form or direct communication |
| Organisation details | Company name, approximate size or sector | Provided by you during onboarding or discovery |
| Billing information | Name, billing email, company name for invoicing | Provided by you; payment processing handled by a third-party provider |
| Communication records | Emails, call notes relating to the service relationship | Generated through our correspondence |
We do not collect special category data. We do not collect data from third parties. We do not use any automated profiling or tracking technologies beyond standard website analytics.
4. How we use your data
We use the personal data described above for the following purposes:
- Responding to enquiries and conducting discovery conversations about the Orca service
- Setting up and managing your Orca licence and configuration
- Communicating with you about the service, including updates, maintenance notices, and support
- Processing billing and maintaining financial records
- Complying with legal and regulatory obligations
We do not sell personal data. We do not use personal data for marketing purposes beyond communications directly related to the Orca service and offerings from OMG Center Limited that are directly relevant to your existing engagement with us.
5. Lawful basis for processing
Our processing of personal data is based on the following lawful grounds under UK GDPR:
Contract performance (Article 6(1)(b))
The primary basis for processing is the performance of the contract between OMG Center Limited and the client. This covers the use of contact and company details to deliver, configure, and support the Orca service.
Legal obligation (Article 6(1)(c))
We retain financial and billing records as required under UK company and tax law.
Legitimate interests (Article 6(1)(f))
Where we retain communication records or conduct standard website analytics, we do so on the basis of legitimate interests: specifically, the interest in understanding the effectiveness of our communications and in maintaining accurate records of the service relationship. We have assessed that these interests are not overridden by client rights and freedoms.
6. Your operational data
Orca is designed around a clear principle: your operational data belongs to you, and we use it only to provide the service.
When Orca connects to your Microsoft 365 or Google Workspace account, it authenticates using OAuth tokens issued directly to your account. Those tokens are stored in your own operating system's secure credential store, not on any OMG Center server. Your emails, calendar events, and contact data are retrieved directly by the Orca application running on your device, processed locally, and stored where needed in your dedicated Orca project, which OMG Center runs on your behalf.
The architecture means that:
- You are the data controller for all operational data processed by Orca
- OMG Center Limited acts as your data processor for data held in your Orca project, sent to Claude under our workspace key, or recorded through Orca Meet
- OMG Center Limited accesses that data only to provide, support and maintain the service, on your instructions
- Data subject requests about your operational data are referred to you as controller, and we help you respond
Claude (Anthropic) usage is provided by OMG Center through a workspace key we supply, with Anthropic acting as our sub-processor. If you choose to connect an AI provider with a key of your own, such as OpenAI, data sent to that provider is governed by your agreement with it, not by this policy.
7. Third-party services your Orca instance connects to
The following services may be connected to your Orca installation. Some are your own accounts; others are provided by OMG Center as part of the service, as shown below.
| Service | Purpose | Your relationship |
|---|---|---|
| Microsoft 365 | Email, calendar, contacts, Teams meetings | Your Microsoft tenant; governed by your Microsoft agreement |
| Google Workspace | Email, calendar, contacts (alternative to M365) | Your Google Workspace account; governed by your Google agreement |
| Supabase | Your Orca project, storing contacts, meeting records, tasks | A dedicated Supabase project, set up and run by OMG Center; your data, with OMG Center as processor |
| Anthropic (Claude) | AI model access for Orca's assistant capabilities | Provided by OMG Center through a Claude workspace key; usage included within fair use |
| OpenAI (optional) | Optional features where you supply your own key | Your own API key; governed by your agreement with OpenAI |
| Orca Meet | Meeting recording and transcription | Provided by OMG Center through our meeting notetaker and transcription providers |
OMG Center Limited uses Calendly to manage discovery call bookings. Calendly's data handling is governed by their own privacy policy. The personal data shared with Calendly (name, email, any information provided in booking notes) is handled by Calendly as data processor, with OMG Center as data controller for that data.
8. Data retention
We retain personal data for the following periods:
| Data type | Retention period | Basis |
|---|---|---|
| Client contact and company details | Duration of licence + 2 years | Service relationship management |
| Billing and financial records | 7 years from transaction date | UK legal requirement (Companies Act, HMRC) |
| Pre-contract enquiries (no contract entered) | 12 months from last contact | Legitimate interests |
| Service correspondence | Duration of licence + 2 years | Service relationship management |
Once the relevant retention period has passed, personal data is securely deleted or anonymised.
9. Your rights under UK GDPR
As a data subject, you have the following rights in relation to the personal data described in this policy:
- Right of access: You may request a copy of the personal data we hold about you.
- Right to rectification: You may request correction of inaccurate or incomplete personal data.
- Right to erasure: You may request deletion of your personal data where there is no lawful basis for continued processing.
- Right to restriction: You may request that we restrict processing in certain circumstances, for example while a rectification request is being assessed.
- Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you may request a machine-readable copy of your data.
- Right to object: You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
- Rights related to automated decision-making: We do not make automated decisions that have legal or similarly significant effects on individuals. This right is not currently applicable.
To exercise any of these rights, contact us at chris@simmance.ai. We will respond within one calendar month. There is no charge for a request unless it is manifestly unfounded or excessive.
If you are not satisfied with how we have handled your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
10. International transfers
Our own data handling operations are based in the UK. The personal data described in this policy is primarily stored and processed within the UK or the European Economic Area.
Where we use third-party tools such as Calendly, data may be transferred to and processed in the United States. In those cases, we rely on the service provider's own transfer mechanisms (such as Standard Contractual Clauses or equivalent frameworks) and their compliance with applicable data protection law.
Microsoft 365 and Google Workspace, and any provider you connect with a key of your own, are governed by your own agreements with those providers, and any international transfers arising from those connections are governed accordingly. Transfers by the sub-processors we use to run the service (including Supabase and Anthropic) are covered in the Data Processing Agreement, and rely on each provider's own transfer mechanisms, such as the UK International Data Transfer Addendum or Standard Contractual Clauses.
11. Changes to this policy
We may update this policy from time to time. When we make material changes, we will notify active clients by email and update the version number and date at the top of this document. Continued use of the Orca service after notification constitutes acceptance of the revised policy.
The current version is always available at simmance.ai/legal/data-protection-policy.
12. Contact
For any queries about this policy, to exercise your rights, or to raise a concern about how your personal data is handled, contact:
- Chris Simmance, OMG Center Limited
- Email: chris@simmance.ai
- Company No. 14169551, registered in England and Wales
We aim to respond to all data protection queries within five working days and to formal rights requests within one calendar month.