Personal-data processing

Who processes the data

ФОП Миронович Андрій Андрійович (trading as ORO Professional), tax number 3276711157. Contact: oro.prof.ua@gmail.com.

Why

• To create your account and recognise you at sign-in.
• To accept, take payment for and deliver an order.
• To answer an enquiry and handle a return or dispute.
• To store your care selection and hair journal if you use them.
• To keep the service secure and to meet obligations set by law.

What data

Order contact and delivery data (name, email, telephone, city and branch), account data and order history, cart and checkout draft, care-selection answers and journal entries, consent records, and technical session data and security logs.

Who receives it

Providers without which the service cannot operate: Supabase (authentication and database), Lovable (hosting), monobank (card payments), Nova Poshta and Ukrposhta (delivery), and the transactional email delivery provider. Also authorised bodies where required by law.

How long we keep it

Active account data — while the account exists. Drafts — 30 days for a care selection and 24 hours for a checkout draft. Data on completed orders, payments and fiscal documents may be kept longer where the law requires it.

What deleting your account does

Deletion removes the account and its active data: profile, cart, drafts, saved care selection and hair journal.

Records of completed orders and payments may still be kept where the law requires it. They are detached from you and are no longer accessible through the website. This means not every record is erased immediately. No automatic purge schedule exists.

Service messages and marketing are different

Service messages are required to run your account and your order: registration confirmation, password recovery, order confirmation, payment status, delivery, returns, and delivery of a fiscal receipt once the relevant integration is active. They are not advertising and are sent without a separate marketing consent.

Marketing news, promotions and personalised offers are sent only with a separate voluntary consent. You may decline it — this does not affect your ability to register, place an order or use your account. You can withdraw the consent at any time. Such messages are currently sent by email only.

Is consent needed for everything

No. Processing for ordering, payment and delivery is needed to perform the contract, and some records are kept to meet obligations set by law. A separate consent is needed for optional things — marketing in particular.

Your rights

You can ask for access to your data, correction, deletion, and restriction of processing or withdrawal of an optional consent where applicable. Write to oro.prof.ua@gmail.com. We may ask you to verify your identity so that we do not disclose another person's data.