The terms governing business use of the OrcaComply software service.
Last updated: 30 August 2026
These Terms of Service apply to business customers and authorised users of OrcaComply, an information security management and compliance software service operated by Orca360 Ltd. By subscribing to, accessing or using OrcaComply, the customer agrees to these terms.
These terms are intended for business use and do not remove any rights that cannot lawfully be excluded.
OrcaComply provides software for managing an information security management system, including guided ISO 27001 implementation, risk and control management, policy and document governance, evidence capture, audit activity, Statement of Applicability records, reporting, users, permissions and related compliance workflows.
We may improve, update or change the service from time to time, provided that we do not materially remove the core functionality of a paid plan without reasonable notice where practicable.
The customer is responsible for its authorised users, the accuracy of account information and ensuring credentials are kept confidential. Accounts must not be shared in a way that bypasses licensing, security or accountability controls.
OrcaComply may offer a free trial and paid subscription plans. Current plan features, user allowances, storage allowances and prices are those shown in the service, on the website, or in an agreed order or quotation. Prices are exclusive of VAT unless stated otherwise.
We may change published pricing for future subscription periods. Existing customers will receive reasonable notice of material price changes before they take effect unless a change is required immediately by law or tax rules.
Where a paid subscription is purchased, billing and payment arrangements will be those shown at checkout, in the customer's account, or in an agreed order. We may use a specialist payment provider to process payments. Full card details are not intended to be stored within the OrcaComply application itself.
We may suspend paid functionality where payment is overdue after reasonable notice, subject to any contractual grace period agreed with the customer.
Plan storage may include policies, documents, evidence, images, audit records, reports and associated files. Customers are responsible for using storage appropriately and for managing retention of information they no longer require.
OrcaComply supports customer-controlled retention. Where export or download functionality is available, customers should retain copies outside the live system where required by law, certification, regulation or internal policy before clearing data.
Deletion from live systems may not immediately remove information from protected backups, which are overwritten or deleted according to the applicable backup lifecycle.
OrcaComply is hosted on virtual private server infrastructure supplied by Fasthosts Internet Limited. The software is developed and operated by Orca360. Administrative access is restricted to authorised Orca360 personnel, while Fasthosts may have limited infrastructure or administrative access where necessary to provide, secure, maintain or support the hosting service or to comply with law.
The customer acknowledges that internet and hosting services may occasionally be interrupted for maintenance, updates, faults or events outside reasonable control.
As between Orca360 and the customer, the customer retains its rights in content and data entered into OrcaComply. The customer grants Orca360 the rights necessary to host, process, transmit, display, back up and otherwise handle that data solely as required to provide and support the service and comply with law.
Orca360 retains all intellectual property rights in the OrcaComply software, interface, documentation, branding, platform architecture and other materials created by or for Orca360, excluding customer data.
Where Orca360 processes personal data on behalf of a customer, the customer is the controller and Orca360 is the processor for that processing.
The processing concerns personal data contained in or generated through the customer's use of OrcaComply for the duration of the subscription and any limited period required for return, deletion, backup rotation, legal obligations or dispute resolution. Processing may include hosting, storing, organising, displaying, transmitting, backing up, securing and supporting ISMS and compliance information.
Orca360 will process customer personal data only on the customer's documented instructions, including instructions inherent in the customer's use and configuration of OrcaComply, unless UK law requires other processing.
Orca360 will ensure that persons authorised to process customer personal data are subject to appropriate confidentiality obligations and will implement appropriate technical and organisational measures designed to protect that data.
The customer gives general authorisation for Orca360 to use sub-processors necessary to provide OrcaComply. The principal infrastructure provider for hosted customer data is Fasthosts Internet Limited. Where UK GDPR Article 28 applies to a new sub-processor, Orca360 will impose appropriate data-protection obligations and provide notice of material changes where required.
Taking into account the nature of the processing, Orca360 will provide reasonable assistance to help customers respond to data-subject requests and relevant data-protection obligations. Orca360 will notify the customer without undue delay after becoming aware of a personal data breach affecting customer-controlled data.
At the end of the service, Orca360 will, subject to available functionality and applicable law, return or delete customer personal data within a reasonable period. Protected backup copies may remain temporarily until overwritten through normal backup rotation.
If customer personal data is transferred outside the UK, Orca360 will ensure an appropriate UK transfer mechanism is used where required.
Each party will keep the other party's confidential information confidential and use it only for the purposes of the customer relationship, except where disclosure is required by law or to advisers and service providers subject to appropriate confidentiality duties.
We aim to provide a reliable service but do not guarantee uninterrupted or error-free availability. Planned maintenance, emergency maintenance, third-party infrastructure faults, internet failures and events outside reasonable control may affect availability. Unless separately agreed in writing, response or availability targets are service objectives rather than guaranteed service levels.
OrcaComply supports information security and compliance processes but does not itself certify an organisation or guarantee ISO 27001 certification. Customers remain responsible for professional judgement, management decisions, legal obligations, risk acceptance, implementation of controls and the accuracy and completeness of their ISMS.
OrcaComply is provided with reasonable care and skill. Except where the law does not permit exclusion, other warranties, conditions or terms implied by statute, common law or otherwise are excluded to the fullest extent permitted by law.
Nothing in these terms excludes or limits liability where it would be unlawful to do so, including liability for fraud or fraudulent misrepresentation, death or personal injury caused by negligence, or any other liability that cannot legally be limited.
Subject to the paragraph above, neither party will be liable for indirect or consequential loss, or for loss of profit, revenue, anticipated savings, goodwill or business opportunity, except where such exclusion is not permitted by law.
Subject to any separately agreed contract, Orca360's aggregate liability arising out of or in connection with the service in any 12-month period will not exceed the fees paid or payable by the customer for OrcaComply during that 12-month period, except where a higher or unlimited liability is required by law.
We may suspend access where reasonably necessary to protect security, prevent misuse, respond to a legal requirement, address a material breach or deal with overdue payment. Where practicable, we will give notice and an opportunity to remedy the issue.
Cancellation and renewal terms are those shown at purchase, in the customer account or in an agreed order. Termination does not remove payment obligations already accrued.
We may update these terms to reflect changes in law, security, infrastructure, product functionality or commercial arrangements. Material changes affecting existing paid customers will be communicated with reasonable notice where practicable.
These terms are governed by the laws of England and Wales. The courts of England and Wales will have jurisdiction over disputes arising from these terms, subject to any mandatory rights or separately agreed dispute-resolution provisions.
Questions about these terms can be sent through the OrcaComply contact page or through Orca360.