Privacy policy

Privacy Policy

Last updated: 12 August 2026

1. ABOUT THIS PRIVACY NOTICE

This Privacy Notice explains how Cave Direct Technology Ltd, trading as OrbitBay, collects, uses, stores and shares your personal data when you:

  • Visit or use the OrbitBay website.
  • Create or use a customer account.
  • Place, amend, cancel or return an order.
  • Contact our customer-service team.
  • Subscribe to marketing communications.
  • Submit a review, enquiry or other information.
  • Otherwise interact with OrbitBay.

Throughout this Privacy Notice, “OrbitBay”, “we”, “us” and “our” refer to Cave Direct Technology Ltd trading as OrbitBay.

This notice should be read alongside our Terms of Service, Shipping Policy, Refund and Returns Policy and any Cookie Policy or cookie settings made available on the OrbitBay website.

2. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

The data controller responsible for your personal data is:

Cave Direct Technology Ltd
Trading as OrbitBay
Registered in England and Wales
Company registration number: 14899593
VAT registration number: GB 462 3341 12

Registered office:

StorageMart - Unit 1618
Vulcan Road North
Norwich
NR6 6AQ
United Kingdom

Email: hello@orbitbay.co.uk
Telephone: 07835 234273

For the purposes of applicable UK data-protection law, Cave Direct Technology Ltd is the data controller unless another organisation is expressly identified as being separately responsible for particular processing.

3. WHAT IS PERSONAL DATA?

Personal data is information relating to an identified or identifiable individual.

This may include information that identifies you directly or information that could identify you when combined with other information.

Personal data does not include information that has been irreversibly anonymised so that an individual can no longer reasonably be identified.

4. PERSONAL DATA WE MAY COLLECT

The personal data we collect depends on how you interact with OrbitBay.

Contact and identity information

  • Your name.
  • Email address.
  • Telephone number.
  • Billing address.
  • Delivery address.
  • Business or organisation name.
  • VAT or company information supplied for a business order.
  • Limited identity or address-verification information where reasonably necessary for fraud prevention, security or transaction verification.

Order and transaction information

  • Products viewed, ordered, returned or cancelled.
  • Order numbers and transaction history.
  • Product condition selected.
  • Delivery method and tracking information.
  • Returns, refunds, repairs and replacements.
  • Warranty or guarantee claims.
  • Product serial numbers and other product-identifying information.
  • VAT invoices and other transaction records.
  • Communications relating to an order.

Payment information

Payments are processed through Shopify and the payment providers presented during checkout.

We may receive information such as:

  • The payment method used.
  • Payment authorisation or failure status.
  • Billing information.
  • Transaction references.
  • Refund and chargeback information.
  • Limited payment-card information such as card type and final digits.

We do not normally receive or store your complete payment-card number or card security code.

Account information

  • Customer-account details.
  • Login and account-security information.
  • Saved addresses.
  • Account preferences.
  • Order history.
  • Communication preferences.

Customer-service information

  • Information contained in emails, telephone calls, forms or other messages.
  • Details of complaints, enquiries and support requests.
  • Photographs, videos or documents supplied in relation to a delivery, product or return.
  • Troubleshooting information.
  • Product serial numbers.
  • Any other information you choose to provide.

Technical and usage information

  • Internet Protocol address.
  • Browser type and version.
  • Device type and operating system.
  • General location inferred from an IP address.
  • Referring website, search engine or advertising source.
  • Pages and products viewed.
  • Basket and checkout activity.
  • Dates and times of website use.
  • Website errors and performance information.
  • Cookie and consent preferences.
  • Interaction information such as clicks, scrolling, navigation and page engagement where permitted.

Marketing and preference information

  • Whether you have agreed to receive marketing.
  • Your marketing preferences.
  • Your response to marketing communications.
  • Products or categories that may be relevant to you.
  • Advertising and cookie-consent preferences.

Reviews and user-submitted content

  • Product or service reviews.
  • Ratings.
  • Photographs or other content submitted by you.
  • The name or display name associated with the submission.

Please do not provide special-category personal data, criminal-conviction information or other highly sensitive information unless it is genuinely necessary for the matter you are contacting us about and we have requested or agreed to receive it.

Information required to provide our services

Certain personal information is necessary for us to enter into or perform a contract with you. For example, we normally require your name, contact information, delivery address and relevant payment information to process and deliver an order.

If required information is not provided, we may be unable to process an order, deliver a product, administer an account, provide a refund or perform another service you have requested.

5. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

  • Directly from you when you place an order, create an account, contact us, request a return or submit information.
  • Automatically when you use the website, through cookies and similar technologies where permitted.
  • From Shopify, which hosts and operates the ecommerce platform used by OrbitBay.
  • From payment providers when they process, confirm or decline a transaction.
  • From delivery companies and fulfilment partners when they provide tracking or delivery information.
  • From distributors or suppliers involved in fulfilling an order.
  • From fraud-prevention, identity-verification or security providers.
  • From analytics, advertising and marketing providers where permitted.
  • From review platforms where you choose to submit or respond to a review.
  • From social-media platforms when you communicate with us through those services.

6. HOW AND WHY WE USE PERSONAL DATA

We will only process personal data where we have an appropriate lawful basis for doing so.

To process and fulfil your order

We may use personal data to:

  • Confirm and process orders.
  • Take and confirm payment.
  • Arrange delivery.
  • Send order and dispatch updates.
  • Provide tracking information.
  • Issue invoices.
  • Process cancellations, returns and refunds.
  • Arrange repairs or replacements.
  • Provide customer support.
  • Administer applicable warranties and guarantees.

Lawful basis: Performance of a contract with you and taking steps at your request before entering into a contract.

To operate customer accounts

We use account information to create, maintain, secure and administer your OrbitBay customer account.

Lawful basis: Performance of our contract with you and our legitimate interests in providing secure and convenient customer-account services.

To provide customer service

We use personal data to respond to enquiries, investigate problems, handle complaints and maintain appropriate records of our communications.

Lawful basis: Performance of a contract, compliance with legal obligations and our legitimate interests in providing effective customer service and resolving disputes.

To prevent fraud and protect OrbitBay and our customers

We may use personal data to:

  • Verify transactions and delivery information.
  • Detect fraudulent or suspicious activity.
  • Prevent account misuse.
  • Protect customers, staff, systems and business assets.
  • Investigate chargebacks, payment disputes, missing deliveries and suspected return fraud.
  • Enforce applicable terms and policies.

Lawful basis: Our legitimate interests in preventing fraud, protecting our business and customers, securing our systems, and establishing, exercising or defending legal claims.

To comply with legal and regulatory requirements

We may use and retain personal data to:

  • Maintain tax, accounting and transaction records.
  • Comply with consumer-protection requirements.
  • Respond to lawful requests from courts, regulators and public authorities.
  • Meet product-safety, recall and compliance obligations.
  • Establish, exercise or defend legal claims.

Lawful basis: Compliance with a legal obligation and, where applicable, our legitimate interests in protecting our legal rights.

To improve the website and our services

We may analyse website, transaction and service information to:

  • Understand how customers use OrbitBay.
  • Diagnose technical problems.
  • Improve website speed, navigation and usability.
  • Improve product information and search functionality.
  • Measure the effectiveness of promotions.
  • Develop and improve our products, website and services.

Lawful basis: Our legitimate interests in operating, securing and improving OrbitBay. Where non-essential cookies or similar technologies require consent, we rely on your consent for those technologies.

To send marketing communications

Where you have consented, or where applicable electronic-marketing law permits us to do so, we may send information about OrbitBay products, services, promotions and business updates.

Where we rely on the existing-customer or “soft opt-in” rules for electronic marketing, this will only be used where the applicable requirements are met, including where:

  • We obtained your contact details directly from you during a sale or negotiation for a sale.
  • The marketing relates to our own similar products or services.
  • You were given a clear opportunity to opt out when your details were collected.
  • You are given a simple opportunity to opt out in each subsequent marketing communication.

Lawful basis: Consent where required, or our legitimate interests where UK data-protection and electronic-marketing law permits us to contact existing customers about similar OrbitBay products or services.

You may unsubscribe at any time by using the unsubscribe link in a marketing email or by contacting hello@orbitbay.co.uk.

Unsubscribing from marketing will not prevent us from sending essential communications about your orders, deliveries, account, returns, refunds, security or legal matters.

To personalise content and advertising

Where you have permitted relevant non-essential cookies or similar technologies, we or our service providers may use browsing and purchase information to:

  • Recommend relevant products.
  • Remember your preferences.
  • Measure advertising performance.
  • Understand how advertising contributes to visits or purchases.
  • Display advertising that may be more relevant to you.

Lawful basis: Consent where required by applicable law.

7. OUR LEGITIMATE INTERESTS

Where we rely on legitimate interests, those interests may include:

  • Operating and improving the OrbitBay business.
  • Providing customer service.
  • Preventing fraud and misuse.
  • Protecting our website, customers and systems.
  • Understanding business performance.
  • Maintaining accurate transaction records.
  • Establishing, exercising and defending legal claims.
  • Marketing our own similar products to existing customers where permitted.

Before relying on legitimate interests, we consider whether the processing is reasonably necessary and balance our interests against your rights, freedoms and reasonable expectations.

8. WHO WE SHARE PERSONAL DATA WITH

We may share personal data where reasonably necessary with the following categories of recipient.

Shopify

Our online store is hosted by Shopify. Shopify processes information needed to operate the website, checkout, customer accounts, ecommerce functions and related services.

Shopify may process personal data as a service provider to OrbitBay and, for some platform functions, as an organisation independently responsible for its own processing.

You can read the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal for further information.

Payment providers

We share information with payment providers displayed during checkout where necessary to:

  • Process and authenticate payments.
  • Prevent fraud.
  • Process refunds.
  • Handle disputes and chargebacks.
  • Comply with financial and legal obligations.

Payment providers may process information under their own privacy notices.

Delivery companies

We share information required to deliver an order, including your name, delivery address, relevant contact details and delivery instructions, with postal operators and couriers.

Distributors, suppliers and fulfilment partners

Some products may be dispatched directly by a UK distributor, supplier or fulfilment partner used by OrbitBay.

Where this applies, we may share information reasonably required to fulfil and support your order, including:

  • Your name.
  • Delivery address.
  • Telephone number.
  • Email address where reasonably required for delivery or tracking.
  • Products ordered.
  • Relevant delivery instructions.

We only provide information that is reasonably necessary for the relevant organisation to fulfil or support the order.

Unless expressly stated otherwise, your contract of sale remains with Cave Direct Technology Ltd trading as OrbitBay even where another organisation physically dispatches the product.

Technology, analytics and professional service providers

We may use organisations that provide:

  • Website hosting and ecommerce infrastructure.
  • Cloud storage.
  • IT support and security.
  • Analytics and website-performance services.
  • Website-interaction and diagnostic services where permitted.
  • Customer-support systems.
  • Email and communication services.
  • Fraud-prevention services.
  • Accounting, legal and professional advice.
  • Review and feedback services.
  • Marketing and advertising services where permitted.

Where these organisations act as processors on our behalf, we require them to process personal data in accordance with our instructions and applicable data-protection requirements.

Government bodies, regulators and law enforcement

We may disclose personal data where required or permitted by law, including to:

  • Courts and tribunals.
  • Tax authorities.
  • Law-enforcement agencies.
  • Regulators.
  • Product-safety authorities.
  • Other public authorities with lawful powers.

Business transfers

If Cave Direct Technology Ltd is involved in a sale, merger, restructuring, investment, insolvency or transfer of business or assets, relevant personal data may be disclosed where reasonably necessary to professional advisers, potential purchasers, investors or the organisation acquiring the relevant business or assets.

Any such disclosure remains subject to applicable data-protection law.

We do not sell customer personal data as a standalone commercial product.

9. COOKIES AND SIMILAR TECHNOLOGIES

OrbitBay and its service providers use cookies and similar technologies to operate, secure, analyse and improve the website.

These technologies may be used for:

  • Essential website and checkout functions.
  • Security and fraud prevention.
  • Remembering basket contents and preferences.
  • Customer-account functions.
  • Website analytics and performance measurement.
  • Advertising and marketing measurement where permitted.
  • Understanding website interaction such as clicks, scrolling and navigation where enabled.

Some cookies and similar technologies are necessary for the website or communications service to operate and may not require consent where an applicable legal exemption applies.

Where consent is required for non-essential analytics, advertising, personalisation or similar technologies, those technologies will only be used in accordance with the choices you make through our cookie or privacy controls.

You can manage available cookie choices through the cookie banner or privacy settings displayed on the OrbitBay website.

You can also control cookies through your browser, although blocking certain essential technologies may affect website functionality.

10. AUTOMATED PROCESSING

We and our payment, fraud-prevention, security and ecommerce providers may use automated systems to assess transactions, identify suspicious activity, support fraud-prevention checks, recommend products or improve website services.

Not all automated processing constitutes automated decision-making with legal or similarly significant effects.

Where applicable law gives you rights in relation to a decision based solely on automated processing that produces legal effects or similarly significantly affects you, you may contact us to request further information and, where applicable, human intervention or review.

11. INTERNATIONAL TRANSFERS

Some organisations that process personal data for OrbitBay, including ecommerce, technology, analytics, payment or other service providers, may operate, process or store information outside the United Kingdom.

Where our use of a service involves a restricted transfer of personal data outside the United Kingdom, we take steps to ensure that the transfer complies with applicable UK data-protection law.

Depending on the circumstances, this may include:

  • Transferring personal data to a country, territory or organisation covered by applicable UK adequacy regulations.
  • Using an approved International Data Transfer Agreement (IDTA).
  • Using the UK International Data Transfer Addendum to relevant standard contractual clauses.
  • Using another legally recognised safeguard or exception where appropriate.
  • Carrying out any transfer-risk assessment required for the relevant safeguard.

Where appropriate, additional contractual, technical or organisational protections may also be used.

If you would like further information about the safeguards relevant to personal data that we transfer outside the United Kingdom, please contact hello@orbitbay.co.uk.

12. HOW LONG WE KEEP PERSONAL DATA

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, tax, warranty, fraud-prevention, security and dispute-resolution requirements.

Retention periods depend on factors including:

  • Whether you have an active customer account.
  • Whether the information relates to an order or transaction.
  • The length of any applicable product guarantee or warranty.
  • Whether a return, complaint, chargeback or legal claim is ongoing.
  • Applicable tax, accounting and regulatory requirements.
  • The sensitivity of the personal data.
  • The security and fraud risk associated with the information.

Order, invoice, payment, tax and accounting records are generally retained for the periods required by applicable UK tax and accounting law. Relevant company tax records may need to be retained for approximately six years from the end of the financial period to which they relate and for longer in certain circumstances.

Customer-service, returns and warranty records may be retained for as long as reasonably necessary to deal with the enquiry, support the product, resolve a dispute, comply with legal obligations or establish, exercise or defend a legal claim.

Marketing preferences are retained while relevant. Where you unsubscribe, we may retain a minimal suppression record so that we can honour your request and avoid sending further marketing to that address.

When personal data is no longer required, we will delete, anonymise or securely dispose of it where reasonably practicable and appropriate.

13. HOW WE PROTECT PERSONAL DATA

We use reasonable technical and organisational measures designed to protect personal data against:

  • Unauthorised access.
  • Accidental loss.
  • Misuse or unauthorised disclosure.
  • Alteration.
  • Destruction.

Measures may include appropriate access controls, secure ecommerce systems, encryption provided by relevant service providers, account-security controls, staff access restrictions and monitoring for suspicious activity.

No internet transmission or electronic storage system can be guaranteed to be completely secure.

You should therefore keep your account credentials confidential and avoid sending unnecessarily sensitive information through insecure communication channels.

14. CHILDREN'S PERSONAL DATA

OrbitBay is intended for adult customers. Customers must be at least 18 years old to place an order directly with us.

We do not knowingly collect personal data directly from children for the purpose of allowing them to purchase products from OrbitBay.

If you are a parent or guardian and believe that a child has provided personal data to us without appropriate authority, please contact hello@orbitbay.co.uk.

15. YOUR DATA-PROTECTION RIGHTS

Subject to applicable conditions, restrictions and exemptions, you may have the following rights in relation to your personal data.

Right of access

You may request confirmation of whether we process your personal data and obtain a copy of personal data we hold about you together with applicable supplementary information.

Right to rectification

You may ask us to correct inaccurate personal data or complete information that is incomplete.

Right to erasure

You may ask us to delete personal data in circumstances where applicable data-protection law gives you that right.

This right does not always apply, including where information must be retained to comply with a legal obligation or to establish, exercise or defend legal claims.

Right to restrict processing

You may ask us to restrict how we use your personal data in certain circumstances.

Right to object

You may object to processing based on our legitimate interests in certain circumstances.

You have the right to object at any time to the use of your personal data for direct marketing.

Right to data portability

In certain circumstances, you may request personal data that you provided to us in a structured, commonly used and machine-readable format or ask for it to be transferred to another controller where technically feasible.

Right to withdraw consent

Where we rely on your consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.

Rights relating to automated decision-making

Where applicable, you may have rights relating to certain decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

16. HOW TO EXERCISE YOUR RIGHTS

To make a privacy or data-protection request, contact:

Email: hello@orbitbay.co.uk
Telephone: 07835 234273

Please describe the right you wish to exercise and provide enough information for us to locate the relevant records.

We may ask for reasonable information to confirm your identity before disclosing, deleting or changing personal data where this is necessary to protect you and other individuals.

You may authorise another person to make a request on your behalf. We may require reasonable evidence that the person has authority to act for you.

We will respond to valid requests without undue delay and normally within one month of receipt, subject to any permitted pause or extension under applicable data-protection law.

Where the law permits an extension because a request is complex or because you have made a number of requests, we will inform you within the initial response period and explain the reason for the extension.

You will not normally be charged for exercising your data-protection rights. A reasonable fee may only be charged, or a request refused, where permitted by applicable law.

17. MARKETING PREFERENCES

You can stop receiving marketing communications at any time by:

  • Selecting the unsubscribe link in a marketing email.
  • Updating available account or marketing preferences.
  • Contacting hello@orbitbay.co.uk.

It may take a short period for an unsubscribe request to be fully applied across relevant systems.

Even after opting out of marketing, you may still receive essential service communications about orders, deliveries, returns, refunds, account security or other non-marketing matters.

18. THIRD-PARTY WEBSITES AND SERVICES

Our website may contain links to websites or services operated by manufacturers, payment providers, review services, social-media platforms or other independent third parties.

We are not responsible for the privacy practices or content of independent third-party websites.

You should review the privacy information provided by an external service before supplying personal data directly to that service.

19. COMPLAINTS

If you are concerned about how we have used your personal data, please contact us first so that we have an opportunity to investigate and respond.

Email: hello@orbitbay.co.uk
Telephone: 07835 234273

You also have the right to complain to the UK's independent data-protection regulator:

Information Commissioner's Office
Telephone: 0303 123 1113
Website: Make a complaint to the ICO

You may also be entitled to complain to another relevant data-protection authority where applicable.

20. CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice to reflect changes to:

  • Our business operations.
  • The services and technology we use.
  • Our legal or regulatory obligations.
  • The ways in which we process personal data.

When we update this notice, we will publish the revised version on this page and change the “Last updated” date.

Where required by law, we will provide additional notice of material changes.

21. CONTACT ORBITBAY

For questions about this Privacy Notice, our use of personal data or your data-protection rights, please contact:

OrbitBay
A trading name of Cave Direct Technology Ltd

Email: hello@orbitbay.co.uk
Telephone: 07835 234273

Registered office:

Cave Direct Technology Ltd
StorageMart - Unit 1618
Vulcan Road North
Norwich
NR6 6AQ
United Kingdom

Company registration number: 14899593
Registered in England and Wales
VAT registration number: GB 462 3341 12