1. Introduction
Image Concepts (Yorkshire) Ltd (trading as Ordlo), company number 8161985, whose registered office is at Royal House, 110 Station Parade, Harrogate, North Yorkshire, England, HG1 1EP (“Ordlo”, “we”, “us”, “our”) operates the website at ordlo.io and the associated checkout at checkout.ordlo.io.
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have in relation to it. Please read it alongside our Terms and Conditions of Use, available at ordlo.io/terms.
We are committed to protecting your privacy and processing your personal data lawfully and transparently. We process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. We are the data controller for the personal data described in this policy.
If you have any questions about this policy or how we handle your personal data, please contact us at privacy@ordlo.io.
2. What Personal Data We Collect
2.1 Website visitors
When you browse ordlo.io, we or our analytics service may collect:
- Your IP address (anonymised where possible);
- Browser type and version;
- Pages visited and time spent;
- Referring URL;
- Device type and operating system.
This information is collected through cookies and similar tracking technologies. See Section 8 for more detail on cookies.
2.2 Purchasers and account holders
When you purchase a PRO Software licence through checkout.ordlo.io, or when you create an account, we collect:
- Your name;
- Your email address;
- Your billing address (required for VAT invoice purposes);
- Your VAT registration number (if you are a VAT-registered business);
- Your Licence Key and the details of your purchase (product, tier, amount, date);
- Your payment card details — these are transmitted directly to Stripe and are not stored on our systems (see Section 4).
2.3 Support enquiries
When you contact us for support at support@ordlo.io or through our ticketing system, we collect:
- Your name and email address;
- Your website URL (if relevant to the support request);
- The content of your enquiry and any attachments you provide.
2.4 Licence validation data
When the PRO Software performs licence validation, it contacts our licence server at checkout.ordlo.io and transmits:
- Your Licence Key;
- The URL of the WordPress installation where the Software is activated.
No personal data relating to your website visitors is transmitted to our licence server during this process.
2.5 Data you choose to provide
If you contact us by email, complete a contact form, or otherwise communicate with us, we will collect the personal data you provide in that communication.
3. How We Use Your Personal Data
| Purpose | Legal basis under UK GDPR |
| Processing your order and issuing your Licence Key | Performance of a contract (Article 6(1)(b)) |
| Processing payment via Stripe | Performance of a contract (Article 6(1)(b)) |
| Issuing a VAT invoice and maintaining accounting records | Legal obligation (Article 6(1)(c)) — HMRC requirements |
| Sending your Order confirmation and Licence Key by email | Performance of a contract (Article 6(1)(b)) |
| Sending Subscription renewal reminders | Performance of a contract (Article 6(1)(b)) |
| Providing PRO Software updates via our update server | Performance of a contract (Article 6(1)(b)) |
| Responding to support requests | Performance of a contract and legitimate interests (Article 6(1)(b) and (f)) |
| Validating your licence key when the Software contacts our server | Performance of a contract (Article 6(1)(b)) |
| Analysing website usage to improve ordlo.io | Legitimate interests (Article 6(1)(f)) |
| Complying with legal obligations (tax, fraud prevention, law enforcement requests) | Legal obligation (Article 6(1)(c)) |
| Notifying you of material changes to our Terms or this Privacy Policy | Legitimate interests (Article 6(1)(f)) |
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
We will not send you marketing communications without your prior consent. If you consent and later change your mind, you can withdraw consent at any time by emailing hello@ordlo.io.
4. Who We Share Your Personal Data With
4.1 Stripe — payment processing
Card payments are processed by Stripe Payments Europe Limited. When you complete a purchase, your payment card details and billing information are transmitted directly to Stripe. We do not store your full card number.
Stripe acts as both a data processor on our behalf (processing payment data to execute the transaction at our instruction) and as an independent data controller for its own purposes (fraud prevention, regulatory compliance). Stripe’s processing is governed by its own Privacy Policy and Terms of Service, available at stripe.com.
Stripe is certified to PCI DSS Level 1, the highest level of payment card security certification.
4.2 Easy Digital Downloads — licence management and updates
We operate our own checkout and licence server at checkout.ordlo.io using Easy Digital Downloads software. This software runs on our own infrastructure. It processes your name, email address, purchase record, and licence key to power your account, deliver software updates, and validate your licence. This data is held on our own servers and is not shared with a third-party licence management provider.
4.3 Hosting and infrastructure providers
Our website and checkout server are hosted by third-party infrastructure providers. These providers process personal data on our behalf as data processors under appropriate data processing agreements.
4.4 Analytics
We use analytics software to understand how visitors use ordlo.io. Where analytics involve processing personal data (such as IP addresses), we use tools configured to minimise data collection and, where possible, to anonymise IP addresses before storage. We do not sell analytics data to third parties.
4.5 Legal and regulatory disclosure
We may disclose personal data to law enforcement, regulators, or courts where required by law, or where necessary to enforce our Terms and Conditions, protect our rights, or prevent fraud.
4.6 Business transfers
If Ordlo or Image Concepts (Yorkshire) Ltd is acquired by or merges with another entity, personal data held by us may be transferred to the new owner as part of the transaction. We will notify you of any such change and describe your options in advance.
4.7 We do not sell your data
We do not sell, rent, or otherwise transfer your personal data to third parties for their own marketing purposes.
5. Data Retention
We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law:
| Data type | Retention period |
| Purchase and account records (name, email, licence, billing address) | Duration of your relationship with us, plus 6 years (HMRC invoice retention requirement) |
| VAT invoices and accounting records | 6 years from the end of the relevant accounting period, as required by HMRC |
| Payment card details | Not retained by Ordlo — held by Stripe under their own retention policies |
| Support correspondence | Duration of the support engagement, plus 12 months |
| Website analytics data | Up to 26 months, then deleted or anonymised |
| Licence validation logs (Licence Key and activating site URL) | 12 months from last validation event, then deleted |
Where we no longer need personal data, we delete or anonymise it securely.
6. International Transfers
We are a UK-based business and our primary data processing takes place within the United Kingdom. Some of our third-party service providers (including Stripe) operate internationally and may process personal data outside the UK.
Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place, such as the UK International Data Transfer Agreement (UK IDTA) or standard contractual clauses approved by the Information Commissioner’s Office (ICO). For further information about safeguards in place for any specific transfer, please contact privacy@ordlo.io.
7. Your Rights Under UK GDPR
Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:
Right of access. You have the right to request a copy of the personal data we hold about you (a subject access request).
Right to rectification. You have the right to ask us to correct personal data that is inaccurate or incomplete.
Right to erasure. You have the right to ask us to delete your personal data where it is no longer necessary, where you withdraw consent, or where we have processed it unlawfully. Note that we may need to retain certain data to comply with legal obligations (e.g. HMRC invoice records).
Right to restriction. You have the right to ask us to restrict processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have disputed.
Right to data portability. Where we process your data on the basis of consent or contract, and by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
Right to object. You have the right to object to processing based on our legitimate interests, including for analytics and product communications.
Right to withdraw consent. Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us at privacy@ordlo.io. We will respond within one calendar month. We may need to verify your identity before processing your request.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
8. Cookies
Our website uses cookies — small text files stored on your device — to help us understand how visitors use the site and to remember your preferences.
| Cookie type | Purpose | Can you opt out? |
| Strictly necessary | Enable core site functions, secure login, and checkout. Cannot be disabled. | No — these are required for the site to function. |
| Analytics | Help us understand which pages are most visited and how visitors navigate the site. | Yes — via your browser settings or our cookie consent tool. |
Most web browsers allow you to control cookies through their settings. For more information on managing cookies, visit allaboutcookies.org.
9. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encrypted transmission between your browser and our website (HTTPS/TLS);
- Use of Stripe for payment processing, which is PCI DSS Level 1 certified — we never receive or store your full card number;
- Access controls limiting who within our organisation can access personal data;
- Regular review of our security practices.
No method of electronic transmission or storage is 100% secure. If you believe your personal data has been compromised, please contact us immediately at privacy@ordlo.io.
10. Children’s Privacy
Our Services are not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without appropriate parental consent, please contact us at privacy@ordlo.io and we will delete it promptly.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting a notice on ordlo.io and, where we hold your email address, by sending you an email.
The date at the top of this page indicates when this policy was last updated. Continued use of our Services after a revised policy is posted constitutes your acceptance of the updated policy. Previous versions are available on request at privacy@ordlo.io.
12. Contact and Complaints
If you have any questions about this Privacy Policy, want to exercise your data protection rights, or wish to make a complaint, please contact us:
| Data controller | Image Concepts (Yorkshire) Ltd (trading as Ordlo) |
| Registered office | Royal House, 110 Station Parade, Harrogate, North Yorkshire, England, HG1 1EP |
| Company number | 8161985 |
| VAT number | GB153340047 |
| Privacy contact | privacy@ordlo.io |
| General enquiries | support@ordlo.io |
| Website | ordlo.io |
If you are not satisfied with our response, you have the right to lodge a complaint with the ICO:
| Supervisory authority | Information Commissioner’s Office (ICO) |
| Website | ico.org.uk |
| Telephone | 0303 123 1113 |
| Address | Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
Ordlo is a trading name of Image Concepts (Yorkshire) Ltd. Registered in England and Wales · Company No. 8161985 · VAT No. GB153340047
