Privacy policy for OrbitOne Vault

1. Controller

The controller responsible for providing the “OrbitOne Vault” browser extension is:

Represented by the managing directors: David Wright and David Nacke

Email: support@orbitone.io

Commercial register: Local Court of Braunschweig
Commercial register number: HRB 209111

The company and contact details correspond to the information provided by AdventureKingz GmbH.

2. Purpose of the browser extension

OrbitOne Vault is a browser extension for using the OrbitOne password manager.

In particular, the extension can:

• detect login forms on websites,
• search for matching credentials in OrbitOne Vault,
• fill usernames and passwords into login forms,
• save new credentials after confirmation by the user,
• update existing credentials,
• connect to an OrbitOne instance specified by the user.

An OrbitOne user account with access to the Vault module is required to use the extension.

3. Data processed

Depending on how the extension is used, the following data in particular may be processed:

3.1 Connection and configuration data

This may include:

• the address of the OrbitOne instance configured by the user,
• user or account identifiers,
• technical session information,
• authentication or access tokens,
• browser extension settings.

3.2 Website and form data

To allow the extension to detect and offer matching credentials, the following information may be processed:

• the address or domain of the website currently open,
• properties of detected login forms,
• labels and technical characteristics of input fields,
• usernames entered by the user,
• passwords entered or selected by the user,
• other credentials expressly selected for saving.

The extension uses this information only to the extent required to detect, match, fill or save credentials.

3.3 Data stored in OrbitOne Vault

Information stored in OrbitOne Vault may include:

• entry name,
• website or domain,
• username,
• password,
• additional notes,
• other fields created by the user.

The user determines the specific content.

3.4 Technical log data

Technically necessary log data may be processed when an OrbitOne instance is accessed. This may include:

• IP address,
• date and time of access,
• API endpoint accessed,
• amount of data transferred,
• browser and extension version,
• error messages and technical status information.

The processing of such data is additionally governed by the privacy policy and technical configuration of the OrbitOne instance used.

4. Purposes of processing

Data is processed for the following purposes:

• establishing a secure connection to the OrbitOne instance,
• authenticating the user,
• searching for matching credentials,
• automatically or manually filling login forms,
• saving and updating credentials,
• managing extension settings,
• ensuring security and functionality,
• analysing errors and preventing unauthorised access.

Credentials are not used for advertising, profiling or personalised advertisements.

5. Legal bases

Where AdventureKingz GmbH processes personal data in connection with the extension, this is based in particular on the following provisions:

• Art. 6(1)(b) GDPR where processing is necessary to provide the extension or perform a user agreement,
• Art. 6(1)(f) GDPR where processing is necessary to ensure technical security, troubleshoot errors or prevent misuse,
• Art. 6(1)(a) GDPR where explicit consent is obtained for specific processing,
• Art. 6(1)(c) GDPR where processing is necessary to comply with legal obligations.

The legitimate interest lies in particular in providing the browser extension securely, reliably and without misuse.

6. Transmission to the OrbitOne instance

The extension transmits the data required for its functions to the OrbitOne instance configured by the user.

This may include in particular:

• the domain or address of the website accessed,
• searches for matching Vault entries,
• new or changed credentials,
• authentication and session information.

If OrbitOne is provided by another company, an employer or another operator, that operator may be the controller responsible under data protection law for processing that takes place on the OrbitOne instance.

AdventureKingz GmbH has no influence over the privacy policies of an externally or independently operated OrbitOne instance.

7. Local storage in the browser

The extension may store technically necessary information locally in the browser. This may include:

• the address of the OrbitOne instance,
• extension settings,
• session information,
• access tokens,
• login status information.

Passwords should not be permanently stored in plain text in the browser's local storage.

Locally stored data can be removed by signing out, resetting the extension or uninstalling it. Depending on the browser used, individual settings may also be processed through browser synchronisation if the user has enabled this feature.

8. Autofill and saving

Credentials are filled only on the basis of a matching Vault entry and the settings or actions chosen by the user.

New or changed credentials are saved only if the user initiates or confirms the save operation.

The extension is not intended to create or change passwords without the user's knowledge or transmit them to unrelated third parties.

9. Browser permissions

OrbitOne Vault may require browser permissions in order to provide its features.

Access to websites

This access is required to:

• detect login forms,
• determine the domain of the current website,
• match appropriate Vault entries,
• insert selected credentials into form fields,
• offer to save newly entered credentials after confirmation.

Local storage

Local storage is required to store settings, the configured OrbitOne instance and technically necessary session information.

Tabs or active tab

Access may be required to identify the website currently open and run the extension only on that page.

Communication with the OrbitOne instance

Network or host permissions are required so that the extension can communicate with the OrbitOne instance configured by the user.

Permissions are used exclusively for the extension features described here.

10. No advertising and no sale of data

The browser extension does not contain advertising networks.

Personal data, browsing histories and credentials are not:

• sold to advertisers,
• used for personalised advertising,
• shared with data brokers,
• used to create advertising profiles.

11. Analytics, tracking and telemetry services

OrbitOne Vault does not use external analytics, tracking or advertising services.

In particular, there is no cross-provider tracking of the websites visited.

Technical log data may be processed on the OrbitOne instance used where necessary for operation, security and error analysis.

12. Recipients of data

Data may be transmitted to the following recipients or categories of recipients:

• the OrbitOne instance configured by the user,
• the operator of that OrbitOne instance,
• technical hosting and infrastructure providers,
• IT service providers where necessary for operation or troubleshooting,
• public authorities or other bodies where required by law.

Where required, service providers are contractually bound to comply with data protection requirements.

13. Transfers to third countries

Data may be transferred to countries outside the European Union or European Economic Area if:

• the OrbitOne instance selected by the user is operated there,
• a hosting or infrastructure provider used by the operator processes data in a third country,
• the browser or browser provider used processes data outside the European Economic Area.

The respective operator is responsible for selecting and operating an independently configured OrbitOne instance.

Where AdventureKingz GmbH itself arranges a transfer to a third country, this takes place only in accordance with the legal requirements of Art. 44 et seq. GDPR.

14. Retention period

Personal data is retained only for as long as necessary for the relevant purpose or as required by statutory retention obligations.

The following principles apply in particular:

• Vault entries remain stored until they are deleted by the user or an authorised administrator.
• Local settings generally remain stored until the extension is reset or uninstalled.
• Session and access tokens are retained until they expire, the user signs out or they are revoked.
• Technical log data is retained only for as long as necessary for security, operation and error analysis.
• Support requests are deleted once they have been fully resolved and no statutory retention obligations prevent deletion.

The operator of an OrbitOne instance may define the specific retention period within that instance.

15. Data security

AdventureKingz GmbH takes appropriate technical and organisational measures to protect personal data against loss, manipulation and unauthorised access.

These measures may include in particular:

• encrypted transmission via HTTPS or TLS,
• access protection through authentication,
• time-limited or revocable access tokens,
• role- and permission-based access controls,
• limiting browser permissions to necessary functions,
• security-related extension updates.

The user is responsible for using a secure master password, not sharing credentials with third parties and keeping the browser and extension up to date.

16. Rights of data subjects

Subject to the applicable statutory requirements, data subjects have in particular the right:

• to obtain access to their stored data under Art. 15 GDPR,
• to have inaccurate data corrected under Art. 16 GDPR,
• to request deletion of their data under Art. 17 GDPR,
• to request restriction of processing under Art. 18 GDPR,
• to receive their data in a portable format under Art. 20 GDPR,
• to object under Art. 21 GDPR to processing based on legitimate interests,
• to withdraw consent at any time with effect for the future.

To exercise these rights, data subjects may contact AdventureKingz GmbH at support@orbitone.io.

Where data is processed exclusively by an externally operated OrbitOne instance, these rights must be exercised against the operator of that instance.

17. Right to lodge a complaint

Data subjects have the right to lodge a complaint with a data protection supervisory authority.

The authority generally responsible for companies based in Lower Saxony is:

A complaint may also be lodged with another competent data protection supervisory authority.

18. Minors

The browser extension is not specifically directed at children.

If minors use OrbitOne Vault, they should do so only in accordance with legal requirements and, where applicable, with the consent of their parent or legal guardian.

19. Changes to this privacy policy

This privacy policy may be updated if the extension's features, technical processes or legal requirements change.

The current version will be made available on the extension's product or support page.