Data controller and contact
Orbitalis Capital, a French SAS, SIREN 104 335 039, with its registered office at 704 chemin des Marais, 36130 Déols, France, is the controller for the processing described here. For questions or requests about your data, contact [email protected]. The publisher’s details appear in the legal notice.
Orbitalis Capital has not appointed a data protection officer. Contact: [email protected].
Contact form data
The form collects your name, company, professional email address and message. These fields are required to submit a request; without them, the form cannot be sent. Your website address is optional. Please do not include sensitive data or confidential information about third parties in your message.
Your request is emailed to [email protected] via the website’s server. Your email address is used as the reply address. A private copy is also stored in WordPress, accessible to administrators and not published.
Purpose and legal bases
The data in your request is used only to respond to it and follow it up: further messages about the same need and an invitation to discuss it. It is not used for marketing, newsletters or generic sales outreach.
- Handling incoming requests is based on Orbitalis Capital’s legitimate interest (Article 6(1)(f) GDPR), taking into account the minimal data collected and the reasonable expectations of a person who writes to us.
- When you request a quote or service for yourself, pre-contractual steps taken at your request are based on Article 6(1)(b) GDPR. This basis is not automatically extended to people writing on behalf of their company.
Abuse prevention and technical data
Technical protection accompanies this processing: a honeypot field, a minimum completion time, an origin check and submission limits based on an IP address fingerprint. It is based on Orbitalis Capital’s legitimate interest in maintaining the security and availability of the website (Article 6(1)(f) GDPR).
For this rate limiting, the application calculates a cryptographic fingerprint using a secret key and the UTC date, changing daily, rather than storing a plain-text IP address. This fingerprint is pseudonymised data, not a guarantee of anonymity. Hostinger and Cloudflare may process IP addresses and request information needed for connections, operation and service security, under their public terms.
Recipients and service providers
Requests are addressed to Adel Helal. WordPress administrators can access the private copies. Technical providers supply hosting, network and email services:
- Hostinger International Limited, Cyprus (EU): shared hosting, server-side handling of submissions and storage of the WordPress copy. The server is located in France according to our technical checks of 27 October 2026, without a commitment to exclusive data or access locations. See Hostinger’s privacy policy and its data processing addendum.
- Cloudflare, Inc., United States: DNS, proxy, content delivery network (CDN) and security; website traffic passes through this service. See Cloudflare’s privacy policy.
- Google: Google Workspace email service receiving requests at [email protected]. Under the public terms, the contracting entity depends on the billing address and any specific contractual provisions: Google Cloud France for France; Google Cloud EMEA Limited, in Ireland, for other EEA countries except Italy and Poland, which have their own entities. This general rule does not constitute verification of the Orbitalis account’s private contract. See Google’s contracting entities, Google’s privacy policy and the Workspace data processing addendum.
Retention periods
- Private WordPress copy: automatic deletion 12 months after receipt, through a deletion task scheduled daily.
- Emails in Google Workspace and follow-up correspondence: for as long as necessary to handle the request and the relationship arising from it. WordPress deletion does not delete these emails.
- If the request becomes a client relationship, the data becomes part of the client file and is subject to its own retention periods.
- IP fingerprint and rate-limit counters: counters technically expire one hour after the last counted attempt; the fingerprint changes daily at midnight UTC. Expiry makes the counter unusable without guaranteeing immediate physical deletion of expired WordPress entries. A temporary lock linked to the fingerprint is normally deleted at the end of the check; if processing is interrupted, it may remain without a guaranteed automatic expiry, until another attempt using the same fingerprint.
- Technical logs: retention depends on operational and security needs, legal obligations and the provider’s terms. Hostinger provides for retention necessary to supply the service and meet legal obligations; Cloudflare takes into account, in particular, the purpose, nature and sensitivity of data, risks, and legal or contractual requirements. Their policies do not specify a single verified retention period for this website’s logs.
- Hosting backups: residual copies follow the rotation and overwrite cycle of the applicable Hostinger plan, which distinguishes weekly backups and, depending on the plan, daily backups. Deletion in WordPress does not immediately erase these copies. This policy does not attest to the account-specific schedule or restoration procedures. See Hostinger’s hosting agreement.
Locations and transfers outside the European Economic Area
Using international providers, including Cloudflare and Google Workspace, may involve processing or access outside the European Economic Area (EEA), including in the United States. The server’s technical location in France does not guarantee exclusively European locations for email, backups, subprocessors or support access.
- Cloudflare, Inc.: the official EU-US Data Privacy Framework register, consulted on 27 October 2026, shows participation as “Active - Re-certification under Review”. Under its public terms, Cloudflare relies on this framework for covered transfers to the United States, and on standard contractual clauses for other relevant transfers or if certification ceases to be valid. See Cloudflare’s official record and its privacy policy.
- Google LLC: the official EU-US Data Privacy Framework register, consulted on 27 October 2026, shows participation as “Active”. Under Google Workspace’s public terms, the framework is used for covered transfers to the United States and standard contractual clauses apply to other relevant transfers under the addendum. Google LLC’s certification does not identify the European contracting entity. See Google LLC’s official record, the Workspace transfer framework and the data processing addendum.
- Hostinger: its public addendum provides for standard contractual clauses for relevant transfers outside the EEA to countries without an adequacy decision, including onward transfers. See Hostinger’s data processing addendum.
This information describes the frameworks published by providers, not an audit of the Orbitalis account’s data flows or private contracts. To request information about transfers of your data and a copy of the applicable safeguards, email [email protected].
Cookies, storage and external resources
The website includes no advertising trackers or audience measurement tools. Fonts are self-hosted; pages do not embed scripts, fonts or content from third-party domains. Cloudflare nevertheless handles connections to the orbitalis.tech domain; hosting and email services operate server-side.
- orb_form_start: a session cookie set when a page containing the form loads, for the form’s abuse prevention checks, HttpOnly, SameSite=Strict and Secure over HTTPS. It has no persistent expiry date; the server accepts its value for a maximum of 24 hours.
- orb-motion: browser session storage (sessionStorage), used to remember the choice to pause or resume animations during the tab’s session.
- WordPress login cookies and orb_apercu: reserved for administrators for authentication and the private theme preview; orb_apercu is a session cookie.
These cookies and storage are strictly necessary for the functions described and exempt from consent; no consent banner is displayed. No cookie set by Cloudflare was observed on a public page on 27 October 2026. This dated finding does not mean that no connection data is processed.
Your rights
Subject to the conditions of the GDPR, you have rights of access, rectification, erasure and restriction of processing. You may object, on grounds relating to your particular situation, to processing based on legitimate interests. Portability applies to data you have provided where processing is automated and based on a contract or consent. You may also set instructions for the handling of your data after your death, subject to French law.
To exercise your rights, email [email protected] and describe your request. Where there is reasonable doubt about your identity, proportionate additional information may be requested. The GDPR response period is one month from receipt of the request; it may be extended by two months because of the complexity or number of requests, with reasons provided within the first month.
You may lodge a complaint with the French data protection authority, the CNIL, including if you believe your rights have not been respected.