Privacy Policy

1. Who is responsible for the data?

Until the planned Luxembourg entity is formally incorporated and assumes the relevant processing activities, the transitional controller is Raoul FANKEM, founder of the Purple Orchid Group project, acting in his own name for this initiative.

Public correspondence location: 1160 Auderghem, Brussels, Belgium.
Project office: 14 Rue de la Fonderie, L-1581 Luxembourg.
Privacy contact: contact@purpleorchidgroup.com.

2. What the public website may process, and how

• Information you provide directly: information you voluntarily send by email or another support channel, including your name, contact details, message and attachments you choose to provide.
• Technical delivery and security information: limited network, request, anti-abuse and security information that hosting, DNS, TLS or content-delivery providers may process automatically when your browser connects to the site.
• No advertising profile: the current website source deliberately includes no advertising pixels, behavioural analytics or social-media tracking scripts.

3. What the current iOS pilot may process, and how

The current pilot is designed around local demonstration data and mock flows. Information entered into demo fields is handled locally for the purpose of validating and previewing the simulated flow unless a screen explicitly states otherwise. OrchidPay does not intentionally collect production payment credentials, real card PAN/CVV data, real bank credentials, real transaction settlement data, advertising identifiers, contact books, precise location, health data or cross-app tracking data through its own production backend in this pilot.

The app may rely on Apple operating-system, App Store distribution and update services. Those technical services can process device, network or diagnostic information under their own terms and technical requirements. When Face ID is enabled in a future build, biometric templates remain managed by iOS; OrchidPay is not designed to receive the underlying biometric template.

4. Purposes and legal bases

• Support and correspondence: responding to requests and taking steps requested by you.
• Security and service delivery: protecting the website and pilot, diagnosing faults and preventing abuse on the basis of legitimate interests in operating a secure pilot.
• Compliance and legal claims: retaining or disclosing information where required by applicable law or necessary to establish, exercise or defend legal claims.
• Consent: where future optional processing legally requires consent, it will remain disabled until valid consent is obtained.

5. Recipients, related entities and transfers

Necessary infrastructure or communications providers may process limited information to deliver hosting, DNS, network protection, email, app distribution or update services. During the current transitional phase, Purple Orchid Group is a project rather than a separately incorporated parent company. If a future Purple Orchid Group entity, subsidiary, contractor or other service provider is given access to personal data, access will be limited to what is necessary for the stated purpose and the recipient will be required to protect the data to a standard that is the same as or no less protective than the commitments stated in this policy and applicable law.

OrchidPay does not sell personal data and the current landing does not include advertising or behavioural-tracking partners. If providers process data outside the EEA, applicable transfer mechanisms and safeguards are used where required by law.

6. Retention and deletion

Information is kept only for as long as reasonably necessary for the purpose for which it was received, to maintain security, to manage an ongoing relationship, or to comply with applicable legal obligations and claims. The pilot does not currently maintain a production customer ledger or live payment history.

Where deletion is legally available, you can request it through the Privacy Choices page. Local app data can also be removed by uninstalling the pilot application, subject to normal operating-system behaviour and any system-managed storage.

7. Your rights and consent choices

Subject to the General Data Protection Regulation and applicable law, you may have rights of access, rectification, erasure, restriction, portability and objection. Where processing relies on consent, you may withdraw consent at any time without affecting earlier lawful processing.

You can submit a request through Privacy Choices. You may also lodge a complaint with the Belgian Data Protection Authority (APD/GBA) or another competent EEA supervisory authority.

8. Children

The OrchidPay pilot is not designed as a child-directed service. The current product should not be interpreted as a public financial account for minors.

9. Changes

This policy will be updated before live payment features, production accounts, regulated payment services, material analytics or materially different data processing are introduced.

Politique de confidentialité — résumé opérationnel

OrchidPay est actuellement un pilote privé de Purple Orchid Group. Jusqu’à la constitution formelle de la future entité luxembourgeoise, le responsable transitoire des traitements liés à cette initiative est Raoul FANKEM. Contact : contact@purpleorchidgroup.com.

La version pilote n’active ni paiement réel, ni conservation de fonds clients, ni règlement en production. Les données saisies dans les parcours de démonstration sont traitées localement pour valider et prévisualiser le flux simulé, sauf indication contraire à l’écran. Le site ne déploie volontairement aucun pixel publicitaire, outil analytics comportemental ou traceur social.

Les prestataires techniques indispensables peuvent traiter des données réseau ou de sécurité limitées pour délivrer et protéger le service. Tout futur prestataire, entité liée ou sous-traitant ayant accès à des données personnelles devra assurer un niveau de protection au moins équivalent aux engagements de cette politique et au droit applicable.

Vous pouvez demander l’accès, la rectification, l’effacement, la limitation, la portabilité ou exercer votre droit d’opposition, selon les conditions du RGPD. Lorsque le traitement repose sur le consentement, celui-ci peut être retiré. Les demandes sont centralisées sur la page Vos choix de confidentialité. Une réclamation peut être déposée auprès de l’APD/GBA ou de toute autre autorité compétente de l’EEE.