ORO Collection (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy applies to all personal information collected through our website at myorocollection.com, our mobile applications, and any related services (collectively, the “Services”).

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our Services. We comply with the General Data Protection Regulation (GDPR) for EU residents, the California Consumer Privacy Act (CCPA/CPRA) for California residents, and other applicable privacy laws.

We collect personal information that you voluntarily provide to us, as well as information collected automatically when you use our Services. The categories of personal information we may collect include:

• Identity Information: Name, username, date of birth, and government-issued identification (for high-value transactions and age verification).
• Contact Information: Email address, phone number, billing and shipping addresses.
• Payment Information: Credit card details, bank account information, and transaction history. Full payment card data is processed securely by our PCI-DSS compliant payment processors; we do not store complete card numbers.
• Account Information: Login credentials, purchase history, wishlist items, and saved preferences.
• Device & Usage Information: IP address, browser type, operating system, device identifiers, pages visited, time spent, and referring URLs.
• Location Information: General geographic location derived from your IP address (not precise GPS location).
• Communication Data: Records of your correspondence with our customer service team, including emails, chat transcripts, and call recordings.
• Marketing Preferences: Your preferences regarding promotional communications and newsletter subscriptions.

We use your personal information for the following purposes, each supported by a valid legal basis under applicable privacy laws:

1. To Provide Our Services: Process orders, manage your account, authenticate your identity, and deliver purchased timepieces. Legal basis: Contractual necessity.
2. To Process Payments: Facilitate secure transactions, prevent fraud, and handle refunds. Legal basis: Contractual necessity.
3. To Communicate With You: Send order confirmations, shipping updates, customer service responses, and account-related notifications. Legal basis: Contractual necessity / Legitimate interest.
4. To Improve Our Services: Analyze usage patterns, troubleshoot issues, and enhance website functionality. Legal basis: Legitimate interest.
5. For Marketing & Personalization: Send promotional offers, recommend products, and personalize your browsing experience. Legal basis: Consent (where required) / Legitimate interest.
6. For Legal Compliance: Comply with applicable laws, respond to legal requests, and protect our rights. Legal basis: Legal obligation.
7. For Security: Detect and prevent fraud, unauthorized access, and other security incidents. Legal basis: Legitimate interest.

We will never use your personal information for purposes incompatible with those disclosed in this policy without obtaining your additional consent where required by law.

We use cookies and similar tracking technologies to enhance your experience, analyze traffic, and understand how you interact with our Services. Cookies are small text files stored on your device that help us recognize you and remember your preferences.

• Essential Cookies: Required for the website to function properly, including session management, authentication, and security features. These cannot be disabled.
• Functional Cookies: Remember your preferences, such as language selection, currency, and wishlist items.
• Analytics Cookies: Help us understand how visitors use our website, which pages are popular, and where improvements are needed. We use Google Analytics and similar tools.
• Marketing Cookies: Used to deliver relevant advertisements and measure the effectiveness of our marketing campaigns. These may be set by us or our advertising partners.

You can manage your cookie preferences through our Cookie Consent Banner or your browser settings. Please note that disabling certain cookies may affect the functionality of our Services. For more information, please review our Cookie Policy.

Depending on your location, you may have the following rights regarding your personal information:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal information, subject to certain legal exceptions.
• Right to Restrict Processing: Request that we limit how we use your personal information.
• Right to Data Portability: Receive your personal information in a structured, machine-readable format and transfer it to another service.
• Right to Object: Object to the processing of your personal information for direct marketing or based on legitimate interests.
• Right to Opt-Out of Sale/Sharing: California residents may opt out of the sale or sharing of their personal information. We do not sell personal information for monetary consideration.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

We implement robust technical and organizational security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. Our security practices include:

• Encryption: All data transmitted between your browser and our servers is protected using TLS 1.3 encryption. Sensitive data at rest is encrypted using AES-256.
• Access Controls: Strict role-based access controls ensure that only authorized personnel can access personal information, and only to the extent necessary for their role.
• Secure Infrastructure: Our servers are hosted in SOC 2 Type II certified data centers with 24/7 monitoring, fire suppression, and redundant power systems.
• Regular Audits: We conduct regular security assessments, penetration testing, and vulnerability scans to identify and address potential risks.
• Incident Response: We maintain a comprehensive incident response plan. In the event of a data breach, we will notify affected users and relevant authorities within 72 hours as required by law.
• Employee Training: All employees undergo regular data protection and security awareness training.

While we take every reasonable precaution, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we continuously strive to protect your information to the highest standards.

We do not sell your personal information. We may share your information with trusted third parties only when necessary to provide our Services or as required by law. Categories of third parties we may share data with include:

• Service Providers: Payment processors (Stripe, PayPal), shipping carriers (DHL, FedEx), email service providers, cloud hosting providers, and customer support platforms. These providers are contractually bound to use your data only for the services they provide to us.
• Analytics Partners: Google Analytics, Meta Pixel, and similar tools that help us understand website traffic and user behavior. These partners may use cookies and collect data according to their own privacy policies.
• Marketing Partners: Advertising networks and social media platforms for targeted advertising, but only with your consent where required.
• Legal & Regulatory Authorities: When required by law, court order, or to protect our legal rights, property, or safety, or that of our users or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of the transaction, subject to the same privacy protections.

All third-party service providers are carefully vetted and required to maintain appropriate data protection standards. We do not authorize them to use your personal information for their own independent marketing purposes.

Our Services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected personal information from a child under 16, we will take immediate steps to delete that information from our records.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at privacy@myorocollection.com so that we can take appropriate action.

For California residents: The CCPA requires verifiable parental consent before collecting personal information from children under 13. We fully comply with this requirement.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. When we make material changes, we will notify you by:

• Posting the updated policy on this page with a revised “Last Updated” date.
• Sending an email notification to the address associated with your account.
• Displaying a prominent notice on our website before the changes take effect.

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after any changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you should discontinue using our Services and may request deletion of your account.

We are required by the CCPA to review and update this Privacy Policy at least once every 12 months.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:

For EU residents, you also have the right to lodge a complaint with your local data protection authority if you believe we have not handled your personal data in accordance with applicable law.