Privacy Choices & GDPR Rights

Orenta generally acts as a business or controller for information collected through our website, sales process, client administration, billing, security and internal operations.

When Orenta builds, configures, hosts or supports an AI system or automation for a client, the client generally determines why information is processed and how the system is deployed. In that context, the client generally acts as controller or business, while Orenta acts as processor or service provider.

If your request concerns a client-operated chatbot, voice agent, application, workflow or automation, we may direct or forward the request to that client and assist as required.

Depending on applicable law, you may be able to:

• reject or withdraw consent for non-essential cookies;
• opt out of sale, sharing or targeted advertising;
• send a Global Privacy Control signal;
• unsubscribe from marketing email;
• stop marketing texts or calls;
• access personal information;
• correct inaccurate information;
• request deletion;
• obtain portable information;
• restrict or object to processing;
• withdraw consent;
• opt out of qualifying profiling or automated decision-making;
• request information about significant automated decisions;
• limit certain uses of sensitive information;
• use an authorized agent;
• appeal a denied request; and
• complain to a regulator or supervisory authority.

Where a cookie banner or preference tool is available, you may:

• accept all cookies;
• reject non-essential cookies;
• select functional, analytics or marketing categories; and
• change or withdraw a previous choice.

Where European or UK cookie rules apply, non-essential cookies remain disabled until consent. Strictly necessary cookies may remain active for operation, security and privacy-preference records.

Review our Cookie Policy for more information.

Orenta does not sell personal information in exchange for money.

Orenta does not sell client-provided AI inputs, prompts, files, system records or Confidential Information.

If website analytics or advertising technology is used in a way legally defined as sale, sharing or targeted advertising, residents of applicable states may opt out. Where required, submit an opt-out by:

• using a Your Privacy Choices link or preference tool;
• enabling a supported Global Privacy Control signal; or
• emailing support@orenta.co with the subject line Privacy Opt-Out.

You can send that opt-out directly to support@orenta.co. The opt-out applies to the browser, device, account or individual we can reasonably identify.

We do not knowingly sell or share personal information belonging to anyone under 16.

Global Privacy Control ("GPC") is a browser or device signal communicating a request to opt out of sale or sharing. Where required and technically supported, Orenta treats GPC as a valid request for the browser or device sending it.

You do not need an account to submit a browser-level opt-out. Where we can reasonably associate the signal with a known account or profile, we may apply the choice more broadly as required.

The absence of GPC does not constitute consent.

Email

Use the unsubscribe link in a marketing email or contact support@orenta.co. We may continue sending non-promotional messages about Services, projects, security, billing, transactions or legal matters.

Text messages

Where supported, reply STOP to a marketing text. A confirmation may be sent. Message and data rates may apply.

Telephone calls

Ask not to receive further marketing calls. Orenta or the relevant client will add the number to an applicable suppression list.

Client systems

If a communication comes from a client-operated AI system, use the method provided in that communication or contact the identified client. You may also contact Orenta and identify the client, system and contact details so we can route or assist with the request.

Where required by applicable law, individuals interacting with an Orenta-supported AI system may have rights or choices concerning:

• notice that they are interacting with AI;
• notice that content is AI-generated or AI-assisted;
• access to information about the system's use;
• correction of inaccurate personal information;
• human review or escalation;
• feedback or complaint channels;
• opting out of qualifying automated decision-making;
• information about the logic and expected consequences of qualifying processing; and
• challenging a decision that produces legal or similarly significant effects.

These rights depend on the system, jurisdiction and whether Orenta or the client is the responsible controller.

Orenta does not ordinarily use automated systems to make significant decisions about individuals for Orenta's own purposes.

If a client uses an Orenta-supported system for employment, lending, housing, insurance, healthcare, education, public services or another significant decision, the client generally determines the decision and is responsible for the applicable notice, assessment, human-review and appeal process. Orenta assists where required by law and contract.

Residents of certain states may have some or all of the following rights:

• Confirmation: confirm whether personal information is processed.
• Access: obtain categories or specific personal information.
• Correction: correct inaccurate information.
• Deletion: request deletion.
• Portability: receive certain information in a portable format.
• Opt-out: opt out of sale, sharing, targeted advertising or qualifying profiling.
• ADMT access or opt-out: receive information about or opt out of certain automated decisionmaking uses where applicable.
• Limit: limit certain sensitive-information uses.
• Authorized agent: use an agent where permitted.
• Appeal: appeal a refusal to act.
• Non-discrimination: exercise rights without unlawful discrimination.

Rights may not apply to exempt business-to-business, employment, regulated or other information under a particular law.

Where the California Consumer Privacy Act, as amended ("CCPA"), applies, California residents may request:

• access to categories and specific information;
• information about sources, purposes and recipients;
• correction;
• deletion;
• opt-out of sale or sharing;
• limitation of certain sensitive-information uses;
• rights relating to covered automated decisionmaking technology; and
• non-discriminatory treatment.

Orenta does not sell personal information for money or sell or share client-provided AI inputs, prompts, files or system data for cross-context behavioral advertising.

If Orenta's website practices constitute sale or sharing, the website will provide a Your Privacy Choices or equivalent mechanism and process supported opt-out signals.

Orenta uses sensitive information only as reasonably necessary for requested Services, security and ordinary operations and does not use it to infer personal characteristics.

Automated decisionmaking technology

Where California automated decisionmaking requirements apply, the responsible business may be required to provide a pre-use notice, access information and an opt-out for covered uses. When a client is the responsible business, the client generally handles these obligations. Orenta will provide agreed technical or contractual assistance.

Notice at collection

Our Privacy Policy describes categories of information, sources, purposes, recipients and retention criteria. Where required, forms or collection interfaces will link to an appropriate notice at or before collection.

Authorized agents

An authorized agent may submit a request where permitted. We may require evidence of authorization and verify the individual directly, except where verification is not permitted.

Where applicable, residents of Texas, Colorado, Connecticut, Virginia and other states may have rights to access, correct, delete or obtain portable personal information and opt out of sale, targeted advertising or qualifying profiling.

Texas law also restricts certain intentionally harmful uses of artificial intelligence. Orenta may refuse or suspend any system intended for unlawful discrimination, manipulation, social scoring, biometric misuse or another prohibited purpose.

If we decline a request and applicable law provides an appeal, email support@orenta.co with the subject line Privacy Appeal. We will provide the result and regulator information required by law.

Where EU, EEA or UK data-protection law applies and Orenta acts as controller, you may have the following rights.

Access

Ask whether we process your personal data and request a copy and information about the processing.

Rectification

Request correction of inaccurate data and completion of incomplete data.

Erasure

Request deletion in circumstances provided by law, including where data is no longer required or consent has been withdrawn and no other lawful basis applies.

Restriction

Request restricted processing while accuracy, lawfulness or an objection is assessed, or in other legally provided circumstances.

Portability

Where processing is based on consent or contract and automated, request certain data in a structured, commonly used and machine-readable format and ask for transmission where feasible.

Objection

Object to processing based on legitimate interests, including related profiling. We will stop unless compelling legitimate grounds override your interests, rights and freedoms or the processing is required for legal claims. You may object to direct marketing at any time.

Withdraw consent

Where processing is based on consent, withdraw it at any time. Withdrawal does not affect processing conducted before withdrawal.

Automated decision-making

You may have the right not to be subject to a solely automated decision, including profiling, that produces legal or similarly significant effects, subject to applicable exceptions. Where such processing is permitted, safeguards may include human intervention, an opportunity to express your view and a method to contest the decision.

Complaint

You may complain to a data-protection supervisory authority where you live, work or believe an infringement occurred. We encourage you to contact Orenta first so we can attempt to address the concern.

Where the European Union AI Act applies, providers and deployers of certain AI systems may be required to:

• inform people when they interact directly with AI;
• mark certain AI-generated or manipulated output in machine-readable form;
• disclose certain deepfakes or synthetic content;
• provide information and instructions to deployers; and
• maintain appropriate transparency and human oversight.

Orenta's role may vary by project. Depending on the Services, Orenta may be a provider, deployer, integrator, contractor or processor, while the client may have independent obligations as the organization putting the system into use.

Project-specific AI Act responsibilities should be allocated in the Order Form or a separate AI compliance schedule.

Where GDPR or UK GDPR applies and Orenta acts as controller, we may rely on:

• Contract: processing necessary to enter into or perform a contract.
• Legitimate interests: operating, securing and improving our business, responding to inquiries and appropriate business-to-business marketing.
• Consent: processing for a specific purpose with consent.
• Legal obligation: compliance with law and legal process.
• Legal claims: establishing, exercising or defending rights.

Where required, we obtain consent for non-essential cookies and certain electronic marketing. When relying on legitimate interests, we consider necessity and balance our or a third party's interests against individual rights and reasonable expectations.

Orenta may receive personal data from a client or Client System rather than directly from an individual.

When Orenta acts solely as processor, the client is generally responsible for the privacy notice, lawful basis and rights response, and Orenta provides required assistance.

When Orenta independently acts as controller for indirectly obtained data, we provide information required by applicable law within the relevant period unless an exception applies.

Orenta is based in the United States. Information may be processed in the United States and other countries. Where required, transfer safeguards may include:

• adequacy decisions;
• European Commission Standard Contractual Clauses;
• the UK International Data Transfer Addendum or another approved mechanism;
• contractual, technical and organizational protections; and
• another recognized transfer mechanism.

Contact us for additional information, subject to confidentiality and security limitations.

Email support@orenta.co with the subject line Privacy Request. Include:

• your name;
• associated contact information;
• your relationship with Orenta;
• the right you wish to exercise; and
• if relevant, the client, system or application concerned.

Do not send Social Security numbers, passwords, government identification or full financial information unless Orenta specifically provides a secure verification method.

We may verify identity and authority before completing a request.

Verification may involve matching supplied information with existing information. We request only what is reasonably necessary. The level of verification depends on sensitivity and risk.

Some opt-out requests do not require identity verification. We will not impose verification where prohibited.

We respond within the period required by applicable law. Where permitted, we may extend the period and explain why.

A request may be denied or limited where:

• identity or authority cannot reasonably be verified;
• an exception applies;
• retention is legally required;
• information is required for security, fraud prevention or legal claims;
• deletion would prevent suppression or opt-out compliance;
• another person's rights would be harmed; or
• Orenta processes the information only for a client that must handle the request.

We will provide explanations and appeal information required by law.

Orenta will not unlawfully discriminate or retaliate because an individual exercised a privacy right. Orenta does not currently provide financial incentives in exchange for personal information.

We may update this Policy for changes in law, technology, Services or business practices. The updated Policy will state a new effective date. Where required, we will provide additional notice before materially changing information use.

For privacy choices, GDPR requests, complaints or appeals:

Orenta · 701 Tillery St, Austin, TX 78702, USA
orenta.co · support@orenta.co