Terms, privacy, and data processing

1. Service provider

Orbital is provided by Talterra s.r.o., company ID 0180748, registered at Libochovická 1072/11, Dolní Chabry, 184 00 Prague, Czech Republic ("Talterra", "we", or the "Provider"). For personal data matters, contact[email protected].

2. Terms of service

Orbital is provided exclusively to businesses and organizations for their professional purposes. The service is not intended for consumers. A person acting on behalf of a customer confirms that they are authorized to bind that customer.

Each engagement is governed by an individual written agreement (the "Customer Agreement"), which sets out the scope, price, schedule, term, service levels if applicable, and termination. These terms form part of it only if the Customer Agreement expressly refers to them. In case of conflict, the Customer Agreement prevails.

The customer is responsible for having a lawful basis to provide and use content in Orbital, informing affected people, and ensuring that its instructions to Talterra comply with the law. The customer must not enter special categories of personal data or criminal offense and conviction data, including health, biometric, racial or ethnic origin, religious belief, trade union membership, sex life, or criminal history data.

360° feedback reports may use aggregated or anonymized results according to the project's configuration. Talterra does not promise absolute anonymity in every use. Display rules and minimum group sizes must be set in the Customer Agreement or project documentation.

The Provider's materials, methods, software, and outputs are protected by law. The customer may use them only within the agreed scope for its internal purposes. Confidentiality, liability, damages, and dispute resolution are governed by the Customer Agreement. Unless agreed otherwise, Czech law applies.

3. Privacy policy

Talterra is the controller of personal data collected through visits to this website, business communications, and management of customer relationships. For personal data that a customer enters into Orbital about employees, raters, candidates, or others, the customer is the controller and Talterra is its processor under section 4.

Data, purposes, and legal bases

• Inquiries and business communication: name, work contact details, organization, and message content. Processing is needed for pre-contract steps or our legitimate interest in responding to business communications.
• Customer contacts: name, work role, and contact details. Processing is needed to perform the Customer Agreement and manage the business relationship.
• Accounting and contractual data: data needed to conclude, perform, and protect the Customer Agreement and fulfill legal obligations.
• Marketing: we send product messages only with separate consent. Consent can be withdrawn through the email link or by writing to[email protected].

We keep business communications for up to 12 months after the last contact unless a contract is formed. We keep contractual and accounting data for the legally required period and as needed to protect legal claims.

Personal data used to operate Orbital is stored and processed in the European Economic Area. We may share it with vetted infrastructure, support, and processing providers only as necessary and under appropriate contractual safeguards.

You may request access, correction, erasure, restriction, or portability of personal data; object to processing; and complain to the Czech Data Protection Authority. To exercise your rights, write to[email protected].

4. Data processing agreement

This section is a data processing agreement under Article 28 of the GDPR (the "DPA"). When Talterra processes personal data for a customer, this DPA automatically becomes part of the Customer Agreement unless that agreement expressly replaces it with another DPA.

Subject and scope

The customer is the controller and Talterra is the processor. Talterra processes personal data for the term of the Customer Agreement and 180 days after it ends, solely to operate Orbital, administer 360° feedback, produce individual and team reports, provide technical support and security, and follow the customer's written instructions.

Processing may include identification and work contact details, work roles, assessments, answers, and optional comments. Data subjects may include employees, managers, raters, candidates, and others designated by the customer. The customer must not provide the restricted data described in section 2.

Talterra's obligations

• Process data only on documented customer instructions unless required by law.
• Ensure confidentiality of authorized people and appropriate technical and organizational safeguards.
• Access customer content only as needed for support, maintenance, or security, through authorized people and with access logged.
• Where technically possible, help the customer respond to data subject requests and meet GDPR Articles 32–36 obligations.
• Notify the customer of a confirmed personal data breach without undue delay and no later than 48 hours after confirmation.

Subprocessors and AI

The customer gives general written authorization for subprocessors. Talterra maintains a current subprocessor list, informs the customer of material changes at least 30 days in advance, and allows objections on reasonable data protection grounds. If no reasonable solution is found, the customer may end the affected service before the change takes effect.

For AI analysis, Talterra may use Amazon Bedrock from Amazon Web Services EMEA SARL only in the selected EEA region and without cross-region processing. Inputs and outputs must not be used to train foundation models. Talterra does not send customer content to web analytics or advertising tools.

Return, deletion, and audit

Customer content remains available for export for 180 days after the Customer Agreement ends. Talterra then deletes it from active systems, except data it must retain by law. Once a year, the customer may audit compliance with this DPA during business hours, with at least 30 days' written notice and subject to security and confidentiality requirements.

5. Cookies and web analytics

The website uses essential technical cookies. We use Google Analytics 4 to measure visits only after your prior consent. Analytics does not load without consent.

We use Google Analytics only for traffic measurement. Google Signals, advertising account links, remarketing, User-ID, cross-device tracking, and data imports are disabled. We do not send names, email addresses, customer content, or Orbital account identifiers to Google Analytics. Google Analytics may involve a transfer outside the EEA; recipient and safeguard information is available in cookie settings.

Analytics consent is voluntary, can be withdrawn in cookie settings, and is not required to use the website. We keep a consent record for up to 12 months and do not ask again for at least six months after rejection unless processing materially changes.

6. Changes

We publish the current version on this page. Changes do not apply retroactively or change an individual Customer Agreement without both parties' agreement. Changes to subprocessors follow section 4.