EU and UK visitors

If you visit from the European Union, European Economic Area, or United Kingdom, this section describes how we handle personal data under the EU GDPR and UK GDPR.

Controller. [LEGAL ENTITY NAME PENDING], [POSTAL ADDRESS PENDING]. Privacy contact: hello@oniyore.com.

Lawful bases. Contract — to take steps at your request and perform orders or reply to requests you send. Consent — marketing messages and non-essential cookies/scripts (you may withdraw any time via Cookie settings or by contacting us). Legitimate interests — security, fraud prevention, and keeping the service reliable; we balance those interests against your rights and expectations and you may object. Legal obligation — tax and accounting records where the law requires retention.

Retention. Contact and request records: as needed to reply and for a limited follow-up window (see site-specific periods; many are TBD pending counsel). Consent and request logs: for audit for a limited period. Security logs: short operational windows. Marketing: until you withdraw consent or we suppress the address. We delete or anonymise when the purpose ends, unless a longer legal hold applies.

Recipients / processors. Hosting and edge delivery (including Cloudflare), email or messaging tools used to reply, and operators who handle requests. We do not sell personal information for money.

International transfers. Data is processed in the United States and other countries. Where required, we rely on the European Commission Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum; or the EU-US Data Privacy Framework where a recipient is certified.

Your rights. Access; rectification; erasure; restriction; portability (machine-readable export, typically JSON or CSV); objection (including an absolute right to object to direct marketing); withdraw consent at any time without affecting prior lawful processing; not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not make such decisions on these sites). You may lodge a complaint with your local EU supervisory authority or, in the UK, the Information Commissioner’s Office (ICO).

Response time. We answer within one month (30 days). For complex or numerous requests we may extend by up to two further months and will tell you why.

Age. These services are for adults 18 or older — stricter than the GDPR digital consent age of 16. Under-18 submissions are refused. There is no parental or guardian consent pathway.

Use the privacy request form or email hello@oniyore.com.