Privacy policy

1. Who processes the data

The data owner is ФОП Миронович Андрій Андрійович (trading as ORO Professional), tax number 3276711157, Fontanska Doroha 16/8, Odesa, Ukraine, 65049.

Send personal-data questions to oro.prof.ua@gmail.com. No public telephone number is published.

2. What data we process

• First name and last name.
• Email address.
• Telephone number used for delivery and order communication.
• Delivery city, branch or address.
• Order comment.
• Account data (identifier, interface language, settings).
• Order history.
• Cart and checkout draft.
• Care-selection answers and the saved cosmetic-care recommendation.
• Hair-journal entries.
• Records of consents granted and withdrawn.
• Technical data: session, IP address, browser details and security logs.
• Correspondence history relating to enquiries.

Care-selection answers describe hair-care characteristics and preferences. They are not medical records and are not intended for medical purposes.

3. Why we process data

• Account creation and authentication.
• Order processing and payment.
• Delivery.
• Customer support.
• Returns and dispute handling.
• Saved care-selection and hair-journal features.
• Security and abuse prevention.
• Compliance with legal and accounting duties.
• Marketing messages — only with a separate voluntary consent.

4. Processing bases

• Contract performance and pre-contract steps — for ordering, payment, delivery, returns and support.
• Compliance with legal obligations — for accounting, tax and other mandatory records.
• Legitimate operational and security needs — for security logs and abuse prevention, where applicable.
• Consent — for optional marketing and for optional features where consent is required.

The exact legal wording of the processing bases requires review by a qualified lawyer and may be refined before publication.

5. Who receives the data

• Supabase — authentication and database infrastructure.
• Lovable — website hosting and deployment.
• monobank — card payment processing (card details are entered on the provider's side).
• Nova Poshta and Ukrposhta — order delivery.
• The email delivery provider used by the platform for transactional messages.
• Government, tax and other authorised bodies — where required by law.

This is the complete list of active recipients as at the date of this revision. No analytics or advertising tools are installed or used on the website.

6. International transfers

Part of the infrastructure — hosting, database and email delivery in particular — runs on provider servers outside Ukraine. We therefore do not claim that data never leaves Ukraine.

Transfer conditions are governed by the agreements with the relevant providers. The specific safeguards applying to those transfers must be verified and recorded before this document is published.

7. Retention

• Account — until deletion or closure, subject to records retained under mandatory requirements.
• Profile, saved care selection and hair journal — until account deletion, or earlier user deletion where supported.
• Care-selection draft — 30 days.
• Pending transfer of a care selection to an account — 24 hours.
• Checkout draft — 24 hours.
• Completed orders, payments and fiscal records — for the mandatory accounting, tax, dispute and legal retention periods.
• Security logs — an operational target of 90 days, except where a record is needed for an active incident investigation.
• Email correspondence — while necessary to resolve the enquiry and protect the parties' rights.
• Optional marketing consent — until withdrawal, and after withdrawal a limited suppression record needed to honour the withdrawal.

The exact mandatory retention periods for accounting and tax records are not fixed numerically in this revision and are subject to separate verification and approval.

8. Your rights and requests

Send your request to oro.prof.ua@gmail.com. We may ask you to verify your identity in a way proportionate to the request — this is needed so that we do not disclose another person's data.

• Access to the data we process about you.
• Correction of inaccurate or incomplete data.
• Deletion of data, to the extent this does not conflict with mandatory retention periods.
• Restriction of processing or withdrawal of an optional consent, where applicable.

9. Limits of account deletion

After an account is deleted you lose access to the profile, the saved care selection and the hair journal, and this active data is deleted.

Records of completed orders and payments may be retained independently of the active account for the periods required by law for accounting, taxation and handling possible disputes. We therefore do not claim that every record is erased immediately when an account is deleted.

Such records are detached from the person: the link to the account and any guest order-access credential are revoked, and the order is no longer shown as yours anywhere on the website.

Any further reduction of personal data in retained orders (minimisation) is performed only within an approved retention procedure and only for orders explicitly marked for minimisation. No automatic purge schedule exists, and this revision fixes no retention period.

9a. Marketing messages

Marketing messages are sent only with a separate voluntary consent, which is not granted by default. Declining it does not affect your ability to register, place an order or receive support.

Email is currently the only supported marketing channel. No messenger campaigns are operated.

Consent can be withdrawn at any time in your account or by writing to the support address. After withdrawal we keep a limited record of it, precisely so that the withdrawal is honoured.

10. Cookies and local storage

• Strictly necessary authentication and session data.
• The cart.
• The care-selection draft.
• The saved interface language.
• The checkout draft.
• A guest order access credential, where applicable.

No analytics or advertising technologies are used, so no non-essential cookie consent banner is shown. One will appear only if such tools are actually enabled.

11. Security

We apply reasonable organisational and technical measures: row-level access separation in the database, server-side validation of order and payment operations, secure connections, and rate limits on sensitive requests.

No system can guarantee absolute security, so we do not offer such a guarantee. We notify you of an incident materially affecting your data through the means available to us.

12. Children

The shop is not designed for children to place orders or create accounts independently where the involvement of a parent or other legal representative is required.

We do not knowingly collect children's data in that way. If you believe a child has provided us with data independently, contact us and we will review the matter.

This revision does not set a specific minimum age; that requires legal review.

13. Changes to this policy

Every revision of this policy carries a number and a date. A new revision applies prospectively from publication, and the effective date is set at the moment of publication rather than in advance.