Privacy policy

1. Who processes the data

The data owner is Sole proprietor Andrii Myronovych (ФОП Миронович Андрій Андрійович), trading as ORO Professional, tax identification number 3276711157, registered at Fontanska Doroha 16/8, Odesa, Ukraine, 65049.

Send personal-data questions to oro.prof.ua@gmail.com. No public telephone number is published.

2. What data we process

• First name and last name.
• Email address.
• Telephone number used for delivery and order communication.
• Delivery city, branch or address.
• Order comment.
• Account data (identifier, interface language, settings).
• Order history.
• Cart and checkout draft.
• Care-selection answers and the saved cosmetic-care recommendation.
• Hair-journal entries.
• Records of consents granted and withdrawn.
• Technical data: session, IP address, browser details and security logs.
• Correspondence history relating to enquiries.
• Your Instagram identifier and username, if you contacted us via Instagram Direct.
• The text of incoming and outgoing Instagram Direct messages.
• The type and service details of a message attachment; we make no promise to store the files themselves permanently.
• The date, time, direction and status of a message.
• The link between a conversation and an order, where a manager manually created an order from selected messages.

Care-selection answers describe hair-care characteristics and preferences. They are not medical records and are not intended for medical purposes.

3. Why we process data

• Account creation and authentication.
• Order processing and payment.
• Delivery.
• Customer support.
• Returns and dispute handling.
• Saved care-selection and hair-journal features.
• Security and abuse prevention.
• Compliance with legal and accounting duties.
• Marketing messages — only with a separate voluntary consent.
• Displaying Instagram Direct enquiries in CRM 2.
• Replying to the customer in the same conversation by a member of staff.
• Customer support.
• Manual creation of an order by a manager after reviewing the selected correspondence.
• Security, duplicate prevention and diagnostics of message delivery.

4. Processing bases

• Contract performance and pre-contract steps — for ordering, payment, delivery, returns and support.
• Compliance with legal obligations — for accounting, tax and other mandatory records.
• Legitimate operational and security needs — for security logs and abuse prevention, where applicable.
• Consent — for optional marketing and for optional features where consent is required.

The exact legal wording of the processing bases requires review by a qualified lawyer and may be refined before publication.

5. Who receives the data

• Supabase — authentication and database infrastructure.
• Lovable — website hosting and deployment.
• monobank — card payment processing (card details are entered on the provider's side).
• Nova Poshta and Ukrposhta — order delivery.
• The email delivery provider used by the platform for transactional messages.
• Meta Platforms, Meta Pixel and the Conversions API — advertising analytics, only where you have consented to marketing cookies.
• Meta Platforms, Instagram Messaging API — receiving and sending messages of the professional Instagram account for customer support and the operation of CRM 2.
• Government, tax and other authorised bodies — where required by law.

These are two distinct purposes. The Meta Pixel advertising tool and the Conversions API operate only after your explicit marketing-cookie consent. Processing of Instagram Direct messages is a separate support service and is not governed by marketing-cookie consent. Meta Platforms, Supabase, Lovable and the hosting infrastructure may be used for technical operation.

5.1. Instagram Direct enquiries

We are preparing an Instagram Direct integration with CRM 2 so that enquiries to the professional ORO Professional Instagram account are handled by staff in a single workplace.

An Instagram message by itself does not create an order. Orders, payment status, fiscal receipts and waybills are never created or changed automatically because of the text of a message: a manager reviews the correspondence and creates the order manually.

Correspondence data is not used for automated mailings and is not sold to third parties. Marketing mailings in messengers are not carried out without a separate legal basis and the required consents.

Correspondence data is kept only to the extent and for the time needed for support, CRM operation, security and compliance with legal duties. Deletion follows the published instruction.

The instruction for deleting Meta and Instagram data is published on the separate “Data deletion” page.

6. International transfers

Part of the infrastructure — hosting, database and email delivery in particular — runs on provider servers outside Ukraine. We therefore do not claim that data never leaves Ukraine.

Transfer conditions are governed by the agreements with the relevant providers. The specific safeguards applying to those transfers must be verified and recorded before this document is published.

7. Retention

• Account — until deletion or closure, subject to records retained under mandatory requirements.
• Profile, saved care selection and hair journal — until account deletion, or earlier user deletion where supported.
• Care-selection draft — 30 days.
• Pending transfer of a care selection to an account — 24 hours.
• Checkout draft — 24 hours.
• Completed orders, payments and fiscal records — for the mandatory accounting, tax, dispute and legal retention periods.
• Security logs — an operational target of 90 days, except where a record is needed for an active incident investigation.
• Email correspondence — while necessary to resolve the enquiry and protect the parties' rights.
• Optional marketing consent — until withdrawal, and after withdrawal a limited suppression record needed to honour the withdrawal.

The exact mandatory retention periods for accounting and tax records are not fixed numerically in this revision and are subject to separate verification and approval.

8. Your rights and requests

Send your request to oro.prof.ua@gmail.com. We may ask you to verify your identity in a way proportionate to the request — this is needed so that we do not disclose another person's data.

• Access to the data we process about you.
• Correction of inaccurate or incomplete data.
• Deletion of data, to the extent this does not conflict with mandatory retention periods.
• Restriction of processing or withdrawal of an optional consent, where applicable.

9. Limits of account deletion

After an account is deleted you lose access to the profile, the saved care selection and the hair journal, and this active data is deleted.

Records of completed orders and payments may be retained independently of the active account for the periods required by law for accounting, taxation and handling possible disputes. We therefore do not claim that every record is erased immediately when an account is deleted.

Such records are detached from the person: the link to the account and any guest order-access credential are revoked, and the order is no longer shown as yours anywhere on the website.

Any further reduction of personal data in retained orders (minimisation) is performed only within an approved retention procedure and only for orders explicitly marked for minimisation. No automatic purge schedule exists, and this revision fixes no retention period.

9a. Marketing messages

Marketing messages are sent only with a separate voluntary consent, which is not granted by default. Declining it does not affect your ability to register, place an order or receive support.

Email is currently the only supported marketing channel. No messenger campaigns are operated.

Consent can be withdrawn at any time in your account or by writing to the support address. After withdrawal we keep a limited record of it, precisely so that the withdrawal is honoured.

10. Cookies and local storage

• Strictly necessary authentication and session data.
• The cart.
• The care-selection draft.
• The saved interface language.
• The checkout draft.
• A guest order access credential, where applicable.
• Your saved cookie choice (categories, date and consent-text version).
• Meta Pixel marketing cookies (_fbp, _fbc) — only after your explicit consent.

The website uses Meta Pixel only after you consent to marketing cookies. Purposes: measuring visits and on-site actions, evaluating advertising performance and building advertising audiences. Data recipient: Meta Platforms. Before consent the Meta script is not loaded and no marketing cookies are set. You can change or withdraw your consent at any time via the “Cookie settings” link in the site footer. Necessary cookies work independently of marketing consent.

11. Security

We apply reasonable organisational and technical measures: row-level access separation in the database, server-side validation of order and payment operations, secure connections, and rate limits on sensitive requests.

No system can guarantee absolute security, so we do not offer such a guarantee. We notify you of an incident materially affecting your data through the means available to us.

12. Children

The shop is not designed for children to place orders or create accounts independently where the involvement of a parent or other legal representative is required.

We do not knowingly collect children's data in that way. If you believe a child has provided us with data independently, contact us and we will review the matter.

This revision does not set a specific minimum age; that requires legal review.

13. Changes to this policy

Every revision of this policy carries a number and a date. A new revision applies prospectively from publication, and the effective date is set at the moment of publication rather than in advance.