Licence Purchase Privacy Notice
Last updated: 16 October 2026
This short notice explains what we do with personal data when you buy or use a licence from the Orpyxis licence store (Road Guardian (RGS), Road Guardian Fleet, EirRoute licence). For anything not covered here, email [email protected]. Our full privacy notice is available on request at [email protected].
1. Who we are
Eman Curmi, trading as Orpyxis Technologies, 42, Triq it-Tin, Sannat SNT1443, Gozo, Malta, is the controller of the data below. Contact: [email protected]. We have not appointed a Data Protection Officer. Questions go straight to the owner.
2. Data we collect when you buy or use a licence
| Data | Where it comes from |
|---|---|
| Order data: the licensee or company name you enter, your email address, the product, plan, seats, price and date | You, at checkout |
| Payment data: payment status, amount and Stripe reference numbers. We never see your full card number. Stripe collects the card details, and any billing details you give it | Stripe |
| Licence data: licence ID, the licence key, seats, issue and expiry dates, and whether the key was revoked | Created by us when your key is issued |
| Activation data: a random installation ID for each device or installation that uses your key, the date it was activated, when it was last seen, the app version, and the time and result of each key check. Our server also sees the IP address of each request | The product on your device, when it checks the key |
| Portal login data: your email address and the one-time code we email you | You, when you sign in to the licence portal |
| Support data: your emails to us and our replies | You |
We do not need and do not ask for special categories of data (such as health data). Please don't send us any.
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Taking payment, issuing your key, running the licence portal and delivering what you bought | Contract |
| Issuing invoices and receipts and keeping accounting and tax records | Legal obligation, and contract |
| Checking that a key is valid, enforcing seat limits, preventing key sharing, fraud and abuse, keeping the licence server secure | Legitimate interests (protecting our licences and systems) |
| Support, service messages about your licence, and handling refunds, disputes and chargebacks | Contract, and legitimate interests (handling claims) |
| Marketing | Not part of a licence purchase. We don't send marketing emails to licence buyers unless you ask for them |
You can object to processing based on legitimate interests at any time, using the contact above.
4. Who we share it with
- Stripe, to take payment and to prevent fraud. Stripe has its own privacy policy and acts as an independent controller for some of this data.
- Our hosting and infrastructure: our own servers in Ireland (EU), protected by Cloudflare (US).
- Resend (Resend, Inc., USA), our email service, to send your licence key, login code and replies. We use its Ireland (EU) region. Its US-based systems are covered by EU Standard Contractual Clauses.
- Professional advisers (for example an accountant or lawyer), under confidentiality, and authorities, where the law requires.
- Your bank or Stripe, if you dispute a payment, so we can show what happened.
We do not sell your data. We do not make automated decisions that have legal or similarly significant effects on you. The key check is automatic, but it only checks that your key is valid and has seats available.
5. Transfers outside the EEA
Stripe and Cloudflare may process data in the US and elsewhere. We rely on the EU-US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses where it is not. Ask us for details at [email protected].
6. How long we keep it
| Data | Kept for |
|---|---|
| Order, payment and invoice records | 10 years, because of Maltese accounting and tax record rules (to be confirmed with an accountant) |
| Licence and activation records | While the licence is active and up to 12 months after it ends |
| Server and security logs, including IP addresses | Up to 12 months |
| Support emails | Up to 3 years after the last contact |
| Enquiries from our contact form that don't lead to a sale | Up to 12 months |
7. Data that you put into the products
If you use a product to hold your own data (for example job, driver, operator, location or delivery details), you are the controller and we are your processor. This notice does not cover that data. Our Licence Store Terms (section 11) cover how we process it. Please contact the business that uses the product if your data is held in it.
8. Your rights and complaints
You can ask us to access, correct, delete or restrict your data, object to its use, and, where it applies, have it moved to another provider. Email [email protected]. We reply within one month. You can also complain to the data protection authority. For Malta that is the Office of the Information and Data Protection Commissioner (IDPC), and in Ireland the Data Protection Commission (DPC). We would like the chance to put things right first.
9. Cookies
Checkout is hosted by Stripe, which sets its own cookies under its own privacy policy. For cookies and analytics on our own websites, email us and we'll explain.
10. Changes
If we change this notice in a way that matters, we will update the date at the top and, for existing licence holders, tell you by email.
If you contact us or ask about a project
If you use our contact form, request a project or email us, we use your name, email address and what you write to reply and deal with your enquiry. We do this because it is in our legitimate interests to answer people who contact us (or, if you ask for a quote, to take steps you ask for before a contract). We keep enquiries that don't lead to a sale for up to 12 months, then delete them. We don't use them for marketing unless you ask us to. The form and our mail are handled by our hosting and email providers, who act on our instructions. You can ask to see, correct or delete your enquiry at [email protected].