Privacy Policy

1. Introduction

Orchard Reach EOOD ("Orchard Reach," "we," "us," or "our"), a single-member limited liability company registered in Bulgaria under UIC 208684883 (VAT BG208684883), with its registered office at 3 Cherni Vrah Street, Yambol, Bulgaria, operates the email outreach platform available at orchardreach.com (the "Platform"). This Privacy Policy explains how we collect, use, store, and protect personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Bulgarian data protection legislation.

For all privacy-related inquiries, please contact us at info@orchardreach.com.

2. Data Controller

Orchard Reach EOOD is the data controller for personal data collected through the Platform in the course of providing our services — that is, for the account data of our customers and their users, described in section 3.1 below.

For prospect data — the business contact details of the people our customers' outreach campaigns are addressed to — Orchard Reach and the customer are joint controllers within the meaning of Article 26 GDPR. We state this plainly because it reflects what the Platform actually does: Orchard Reach itself sources prospect records from third-party B2B data providers and public sources, applies its own selection and enrichment logic to decide which individuals are contacted, and generates the content of the messages. Those are decisions about the purposes and means of processing, and a party that makes them is a controller regardless of what a contract calls it. The customer defines the audience it wants to reach and the commercial offer; we determine how that audience is found, filtered and addressed.

Where a customer instead uploads its own contact list and instructs us only to send to it, Orchard Reach acts as a processor for that list, on the terms of our Data Processing Agreement.

What joint control means for you, if you are a prospect. You may exercise every right described in section 9 against Orchard Reach directly, whether or not you also contact the customer whose campaign reached you — Article 26(3) GDPR gives you that choice, and we will not redirect you to the customer as a condition of acting. Write to info@orchardreach.com. In particular, your right to object to direct marketing under Article 21(2) is absolute: we will stop, with no balancing test and no reason required from you.

3. Personal Data We Collect

3.1 Account Data (Data Controller)

When you register for and use our Platform, we collect the following personal data directly from you:

• Full name and business contact details (email address, phone number)
• Company name, job title, and industry
• Billing information processed through Stripe (we do not store full payment card details)
• Account credentials (managed through our authentication service)
• Communication preferences and account settings
• Usage data, including login history, feature usage, and campaign performance metrics

3.2 Prospect Data (Joint Controller)

Orchard Reach conducts automated research and generates email outreach content on behalf of our customers. In the course of providing this service, we process prospect data which may include:

• Business contact names and email addresses
• Company names, job titles, and professional information
• Publicly available business information used for research and personalisation

If you received an email from a campaign run on this Platform, this section is the notice required by Article 14 GDPR — the notice we owe you because we obtained your data from somewhere other than you.

• Where we got it. From third-party B2B data providers (such as Apollo and People Data Labs) and from publicly available business sources such as company websites and public professional profiles. We do not obtain it from you.
• What we do with it. Identify businesses that may have a use for a customer's product, generate a relevant message, and send it to a business contact address.
• Our lawful basis. Legitimate interests, Article 6(1)(f) GDPR — the interest of a business in offering its products to other businesses. You can ask us for our balancing assessment.
• Who else sees it. The Orchard Reach customer whose campaign contacted you, and the sub-processors listed in section 6.
• How long we keep it. As set out in section 8. If you object, we keep the minimum needed to make sure we do not contact you again — that record is kept indefinitely, because forgetting it would mean emailing you a second time.
• What you can do about it. Every right in section 9, exercisable against us directly. The right to object under Article 21(2) is absolute. Every email we send also carries a one-click unsubscribe link that requires nothing from you but the click.

Orchard Reach and the customer are joint controllers for this data (see section 2). Customers additionally warrant, under our Terms of Service, that their campaigns comply with the marketing laws of the countries they target.

3.3 Website Visitor Data

When you visit orchardreach.com, we collect data through cookies and similar tracking technologies as described in our Cookie Policy. This includes IP addresses, browser type, device information, pages visited, and referral sources.

4. Legal Bases for Processing

We process personal data under the following legal bases as defined by Article 6 of the GDPR:

• Contract performance (Article 6(1)(b)): Processing account data necessary to provide you with our Platform services, manage your subscription, and fulfil our contractual obligations.
• Legitimate interests (Article 6(1)(f)): Processing usage data to improve our Platform, ensure security, prevent fraud, and for internal analytics. Our legitimate interest is balanced against your rights and freedoms.
• Consent (Article 6(1)(a)): Processing website visitor data through non-essential cookies and marketing communications. You may withdraw consent at any time through your cookie preferences or by contacting us.
• Legal obligation (Article 6(1)(c)): Processing data necessary to comply with applicable laws, including tax, accounting, and regulatory requirements.

5. Data Sharing and Sub-Processors

We share personal data with the following categories of third-party service providers ("sub-processors"), each of which is bound by data processing agreements:

• Cloud infrastructure: Cloud hosting and storage providers (primary infrastructure in the EU region eu-central-1, Frankfurt, Germany), including transactional email delivery services.
• Payment processing: Payment processors for subscription billing and payment handling.
• Accounting and tax compliance: Our external accountants receive the invoices and credit notes we issue — which identify you as the recipient — so that they can be filed and reported as Bulgarian tax law requires. They act as an independent controller in doing so, not as our processor: the filing and retention duties they discharge are their own under Bulgarian accounting and tax law, not instructions from us. The document storage they work from is a processor and is named in our Sub-Processor List.
• Email infrastructure: Email sending and deliverability providers, including sending infrastructure, mailbox warm-up, and domain registration services.
• AI processing: Large-language-model providers used to enrich prospect data and generate email content.
• Prospect data sources: Third-party B2B contact-data providers from which prospect business contact data is obtained.
• CRM, analytics, and tracking: Customer relationship management, website analytics, and advertising measurement services, as detailed in our Cookie Policy.
• Content management: Content management services for website content delivery.

The authoritative, complete, and current list of sub-processors — with named vendors, locations, and transfer mechanisms — is maintained on our Sub-Processor List page. Changes to sub-processors are subject to the notification procedures described in our Data Processing Agreement.

6. International Data Transfers

Our primary infrastructure is hosted within the European Union (AWS eu-central-1, Frankfurt). However, certain sub-processors, including Stripe and HubSpot, are based in the United States. For these transfers, we rely on:

• The EU-US Data Privacy Framework, where the sub-processor is a certified participant;
• Standard Contractual Clauses (SCCs) approved by the European Commission, where the Data Privacy Framework does not apply.

We assess each sub-processor's data protection practices and the legal framework of the recipient country to ensure adequate safeguards are in place.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data: Retained for the duration of your active subscription, plus 90 days following account cancellation or deletion, to allow for account recovery and to fulfil legal and accounting obligations.
• Prospect data: Retained for the duration of the customer's active subscription. Deleted within 30 days of account closure, unless the customer requests earlier deletion.
• Campaign analytics and logs: Retained for 12 months from the date of creation for performance analysis and deliverability optimisation. Aggregated, anonymised data may be retained indefinitely. Campaign records and send logs may be retained beyond account closure where necessary as evidence for the defence of payment disputes and other legal claims, on the basis of our legitimate interests (Article 6(1)(f) GDPR).
• Website visitor data (cookies): Retained in accordance with the retention periods specified in our Cookie Policy.
• Billing records: Invoices and credit notes are retained for 10 years, as required by Bulgarian tax and accounting legislation. These documents cannot be pseudonymised or anonymised: Bulgarian VAT law (art. 114 of the VAT Act) requires each invoice to identify its recipient, so the recipient's name, address and, where applicable, registration or VAT number remain legible on the document for the whole period. They are held in a write-once archive that we ourselves cannot alter or delete before the retention period expires — see "Right to erasure" below.

8. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR. To exercise any of these rights, please contact us at info@orchardreach.com. We will respond within 30 days of receiving your request. Account holders can also exercise several of these rights directly within the Platform: a self-serve data export is available under Profile → "Your data" (supporting your access and portability rights), and account erasure can be requested in-product (supporting your right to erasure), alongside contacting us by email.

• Right of access (Article 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Article 16): You may request correction of inaccurate or incomplete personal data.
• Right to erasure (Article 17): You may request deletion of your personal data, subject to legal retention requirements. One limit is absolute and we state it plainly: issued invoices and credit notes cannot be erased on request. Article 17(3)(b) GDPR excepts processing required to comply with a legal obligation, and Bulgarian law requires us to keep these documents unaltered for 10 years. They are stored so that neither we nor anyone acting for us is technically able to change or delete them before that period ends. Erasing your account does not, and cannot, remove an invoice already issued to you.
• Right to restrict processing (Article 18): You may request that we limit our processing of your personal data in certain circumstances.
• Right to data portability (Article 20): You may request your personal data in a structured, commonly used, machine-readable format.
• Right to object (Article 21): You may object to processing based on legitimate interests, including profiling.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with the Commission for Personal Data Protection of Bulgaria (CPDP) at cpdp.bg, or with any other competent EU supervisory authority.

9. Automated Decision-Making

Orchard Reach uses automated processes to research prospects, generate personalised email content, and optimise campaign deliverability. As part of this processing, the Platform uses large-language-model providers (Anthropic and OpenAI) to enrich prospect data and to generate email content. These automated processes do not produce legal effects or similarly significant effects on individuals. No automated decisions are made regarding the approval, rejection, or scoring of individuals that would affect their rights or freedoms.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS 1.2+) and at rest (AES-256 via AWS), access controls through our authentication service, security reviews conducted as the Platform evolves, and employee access limited to the minimum necessary. Further details are available in our Security Policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users and by posting the revised policy on our website with an updated effective date. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.