oroshop processes only the data needed to operate the store and communicate about an order: name, phone or Telegram handle, email when an account is used, cart and order contents, customer notes, fulfilment choice, and technical events required for security and diagnostics.
We use this data to receive a reservation request, confirm availability and price, arrange payment and delivery, show order history in an account, answer enquiries, and protect the service from errors and abuse. We do not sell contact details or use them for unrelated marketing without a separate lawful basis.
To fulfil an order, data may be shared only with providers required by the selected process: Telegram for messages and confirmation, hosting and email providers, and an agreed carrier after delivery is arranged. Only the information needed for that task is shared.
Retention depends on the order status, record-keeping duties, and the need to protect the rights of the customer and seller. When the lawful basis ends, data is deleted or anonymised. Backups expire on their own retention cycle.
Technical cookies may be used for sign-in and account security. If analytics is enabled, it is used to assess public pages in aggregate; order contents and message text must not be included in analytics events.
Use the Contacts page to request access, correction, export, or deletion of your data. If information is still required to fulfil an order or meet a record-keeping duty, we will explain the basis and what can be deleted.