Effective date: August 2026 Last updated: 2026-05-01

This Privacy Policy explains how ORO LABS (“ORO LABS”, “we”, “us”, “our”) collects, uses, and protects your personal information when you visit orowater.com (the “Site”).

1. Who we are

We are ORO LABS, a company registered in Jordan.

Registered office: 55 Eastern House,Abdelrahman Alhajj St.,Swefieh,Amman 11194,JordanCommercial Registration No: 57245VAT No: 30003490General contact: hello@orowater.com

For visitors located in the United Kingdom or the European Economic Area, ORO LABS acts as the data controller for personal information collected through the Site.

ORO LABS is established in the Hashemite Kingdom of Jordan and processes personal information in accordance with Jordan’s Personal Data Protection Law No. 24 of 2023 (“Jordan PDPL”). Where you are a resident of Jordan, the rights and obligations described in this Policy apply to you under the Jordan PDPL in addition to, or in place of, equivalent rights under UK GDPR and EU GDPR. You may also lodge a complaint with the Personal Data Protection Council of Jordan.

Your rights under Jordan PDPL

If you are a resident of Jordan, Law No. 24 of 2023 gives you the following rights, which you can exercise by emailing hello@orowater.com:

Right of access — ask whether we hold personal data about you and obtain a copy.Right to rectification — ask us to correct personal data that is inaccurate or incomplete.Right to erasure — ask us to delete personal data we no longer have a lawful basis to keep.Right to object — object to processing of your personal data, including for direct marketing.Right to withdraw consent — where we rely on your consent, you can withdraw it at any time.Right to lodge a complaint — complain to the Personal Data Protection Council of Jordan, established under Jordan PDPL Law No. 24 of 2023.

In ORO LABS’ assessment, any processing of EU or UK personal data through the Site is occasional, limited in scope, and not large-scale, and the obligation under GDPR Article 27 / UK GDPR Article 27 to designate a representative does not currently apply. We will designate a representative if and when our processing in those territories ceases to be occasional.

2. Personal information we collect

We collect only the personal information you choose to give us, plus a small amount of technical information needed to keep the Site running. We do not use analytics. We do not run behavioural advertising or cross-site tracking pixels.

2.1 Information you give us

General enquiries via the Site: name, email address, the content of your message, and any other details you choose to include.Newsletter or marketing sign-up (where offered): email address and consent to receive marketing emails. Marketing emails sent via our email service provider may record opens, clicks, and bounces for delivery diagnostics; you can unsubscribe via the link included in every marketing email.Trade enquiries (distributors, hospitality buyers, press): name, company name, role, country, email address, and any other information you choose to provide.

2.2 Technical information collected automatically

When you visit the Site, our hosting provider processes a limited set of technical data needed to deliver pages to you and protect the Site against abuse. This includes:

IP address (handled in line with our hosting provider’s logging configuration)Browser user-agent stringDate, time, method, and URL of the requestHTTP response status

This information sits in short-lived server logs for security, abuse prevention, and basic operational monitoring. It is not joined to any other data we hold about you.

3. How we use your information

We use your personal information for the following purposes and on the following lawful bases (UK GDPR / EU GDPR Article 6):

Replying to enquiries you send us

• Art. 6(1)(b) — steps taken at your request prior to entering a contract; or Art. 6(1)(f) — our legitimate interest in responding to people who contact us
• Sending you marketing emails (newsletters, product updates)
• Art. 6(1)(a) — your consent. You can withdraw consent at any time.

Operating, securing, and protecting the Site

• Art. 6(1)(f) — our legitimate interest in maintaining a working, secure website
• Complying with legal, tax, or regulatory obligations
• Art. 6(1)(c) — compliance with a legal obligation

We do not use your personal information for automated decision-making or profiling.

4. Who we share your information with

We do not sell your personal information. We share it only with the service providers who help us run the Site, and only to the extent they need it for that purpose. Our current providers are:

• Website hosting and content delivery: United States, with global edge
• Transactional and marketing email delivery: United States (with EU region available)
• Content management for site copy and assets: European Union and United States

We can tell you which specific providers we currently use, and share copies of their privacy policies, on request — email hello@orowater.com.

Each of these providers acts as our data processor under a written data processing agreement and may not use your personal information for its own independent purposes.

We may add or replace processors from time to time. Where the change is material, we will update this Policy at least 30 days before the new processor begins to handle your personal information, so you can object or withdraw your consent before the change takes effect.

We may also disclose personal information where:

we are legally required to do so;it is necessary to enforce our Terms of Use;it is necessary to protect our rights, property, or safety, or those of others; orORO LABS is involved in a merger, acquisition, or asset transfer (in which case we will tell you before your information becomes subject to a different privacy policy).

5. International transfers

ORO LABS is established in Jordan. Our processors handle data in the United States and the European Union. This means your personal information may be transferred outside the country in which you are located.

Where personal information of UK or EEA visitors is transferred to a country that does not have an adequacy decision, we rely on the safeguards published by our processors, including:

the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) for transfers from the EEA;the UK International Data Transfer Agreement, or the UK Addendum to the EU SCCs, for transfers from the UK.

You can request a copy of the relevant safeguards by emailing hello@orowater.com.

6. How long we keep your information

We keep personal information only for as long as we need it for the purpose we collected it for, unless a longer period is required by law:

• General enquiry messages: Up to 24 months after last contact, then deleted
• Trade / distributor enquiries: Up to 36 months after last contact, to support an ongoing commercial relationship
• Newsletter subscribers: Until you unsubscribe; we then delete your email within 30 days
• Server logs: Up to 30 days, then automatically purged
• Records required by tax or company law: The minimum period required by applicable Jordanian law

7. Your rights

If you are located in the UK or EEA, you have the following rights under UK GDPR / EU GDPR. You can exercise any of them by emailing hello@orowater.com:

Right of access — ask for a copy of the personal information we hold about you.Right to rectification — ask us to correct information that is inaccurate or incomplete.Right to erasure — ask us to delete your personal information, where the law allows.Right to restrict processing — ask us to limit how we use your personal information in certain circumstances.Right to data portability — ask for a machine-readable copy of information you provided to us, where the lawful basis is consent or contract.Right to object — object to processing based on our legitimate interests, including direct marketing (which you can opt out of at any time).Right to withdraw consent — where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We will respond to a valid request within one calendar month. We may extend this period by up to two further months for complex or numerous requests, in which case we will tell you within the first month and explain why.

You also have the right to lodge a complaint with a data protection authority:

United Kingdom: Information Commissioner’s Office (ICO), https://ico.org.uk European Economic Area: the data protection authority of the EEA country where you live, work, or where the issue arose. A list is published at https://edpb.europa.euJordan: the Personal Data Protection Council, established under Jordan PDPL Law No. 24 of 2023.

We would, however, appreciate the opportunity to address your concern first.

If you reside in a country whose data-protection law gives you rights similar to those described above (including Saudi Arabia, the United Arab Emirates, Bahrain, Qatar, and other GCC jurisdictions), you can exercise those rights by contacting hello@orowater.com. We will respond within the time required by the applicable law in your country.

8. Children

The Site is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, please email hello@orowater.com and we will delete it.

9. Security

We and our processors apply appropriate technical and organisational measures to protect personal information, including encryption in transit (TLS 1.2 or higher), restricted access on a need-to-know basis, and provider-side platform security. No transmission over the internet is fully secure, however, and we cannot guarantee the security of information you send us.

If we ever discover a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, you, in line with our legal obligations.

10. Cookies and similar technologies

We do not currently set advertising, analytics, or cross-site tracking cookies on the Site. The only cookies that may be set are:

Strictly-necessary cookies that our hosting provider may use for site security, load balancing, or to deliver the page you requested. These cannot be turned off without breaking the Site.

If we ever introduce non-essential cookies (for example, for analytics or for embedded video), we will update this policy and ask for your consent before any such cookie is set, where consent is required by the law in your jurisdiction.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top tells you when. Material changes will be highlighted on the Site for at least 30 days before they take effect, and, where the law requires it, we will ask for fresh consent.

12. Contact

Questions, requests, or complaints about this Privacy Policy or how we handle personal information:

Email: hello@orowater.comPost: ORO LABS, 55 Eastern House, Abdelrahman Alhajj St., Swefieh, Amman 11194, Jordan

For general questions about ORO LABS or our products, write to hello@orowater.com.