Privacy Policy

This Privacy Policy explains how ORIN Group s.r.o. processes personal data when you visit privatebrand.eu, contact us about our manufacturing services or subscribe to our newsletter. It also explains our use of cookies and similar technologies.

1. Who is responsible for your personal data?

The controller of your personal data is:

ORIN Group s.r.o.
Na Štepnici 1379/1
960 01 Zvolen, Slovakia
VAT ID: SK2023327735
Email: info@privatebrand.eu

You can contact us at this email address with questions about this policy or to exercise your data protection rights.

2. Personal data we process

Depending on your interaction with us, we may process:

Your name, email address and telephone number.
Your company name, professional role and related business information.
Your selected manufacturing service, product requirements and information included in your enquiry or correspondence.
Newsletter subscription information, consent records and unsubscribe requests.
Technical information, including IP addresses, browser and device information, request timestamps and server logs.
Website interaction information, including pages visited, traffic sources, clicks, scrolling and navigation, depending on your consent choices and the services enabled.

We obtain information directly from you, through your interactions with our website or from people communicating with us on behalf of your company.

Please do not include sensitive personal information, such as information about your health, in your website enquiry.

3. Enquiries and business communication

We use information provided through our contact forms, email and other communication channels to respond to enquiries, discuss product requirements, prepare quotations and proposals, and manage related business communication.

Where you contact us on your own behalf to discuss a potential contract, the legal basis is taking steps at your request before entering into a contract, under Article 6(1)(b) GDPR.

Where you communicate on behalf of a company, the legal basis is our legitimate interest in handling business enquiries and communicating with potential customers and their representatives, under Article 6(1)(f) GDPR.

Where applicable, we also process information to comply with legal obligations under Article 6(1)(c) GDPR, or to establish, exercise or defend legal claims under Article 6(1)(f) GDPR.

Fields marked with an asterisk are required to submit the relevant form. Without sufficient contact and enquiry information, we may be unable to respond. Providing optional information is voluntary.

Submitting an enquiry does not automatically subscribe you to our newsletter.

4. Newsletter subscriptions

If you subscribe to the ORIN Labs Insider newsletter, we use your email address and any optional subscription information to send updates about ingredients, formulations, manufacturing and our services.

The legal basis is your consent under Article 6(1)(a) GDPR.

We use SmartEmailing to manage subscriptions, distribute emails and process subscription preferences. Depending on the features enabled, delivery information and interactions with emails, such as opens and link clicks, may also be processed to assess newsletter performance. Tracking that requires consent is subject to the relevant consent.

Subscribing is optional. You can withdraw your consent at any time by clicking the unsubscribe link in a newsletter or contacting info@privatebrand.eu.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Limited consent evidence and suppression records may be retained where necessary to demonstrate compliance and prevent further unwanted marketing.

5. Website hosting, operation and security

Our website is hosted by Websupport.

Technical information may be processed to deliver website content, maintain availability, identify errors and protect the website against misuse or unauthorised access.

This may include IP addresses, request timestamps, browser information and server logs.

The legal basis is our legitimate interest in operating and protecting our website, under Article 6(1)(f) GDPR. Storage of or access to information on your device that is not strictly necessary is subject to the applicable consent requirements.

6. Cookies and similar technologies

Cookies are small files stored on your device. Similar technologies may also be used to recognise a browser, remember preferences or measure interactions.

Our cookie controls distinguish between the following categories:

Necessary

These technologies support essential website functions and remember your cookie choices. They do not require consent where they are strictly necessary to provide a service you request.

Our cookie consent tool is configured to remember your choice for 365 days, unless the relevant cookie is deleted or your choice is updated.

Statistics

These technologies help us understand website usage and identify improvements. This category includes Google Analytics 4 and Hotjar.

Where consent is required, the legal basis is your consent under Article 6(1)(a) GDPR and the applicable rules on cookies and similar technologies.

Experience

This category is intended for optional functionality and external content, where used. The presence of a category in the settings does not mean that a service in that category is currently active.

Marketing

This category covers advertising measurement, conversion tracking and retargeting, including the planned use of the LinkedIn Insight Tag.

Where required, these technologies may be used only with your marketing consent.

Managing your choices

The cookie banner allows you to:

Select Accept all to accept the available optional categories.
Select Refuse all to decline non-essential categories.
Open Settings to make a category-by-category choice.

You can reopen Cookie settings to change or withdraw your choice.

Rejecting optional cookies does not prevent you from submitting an enquiry. Withdrawal of consent does not affect processing lawfully carried out before withdrawal.

You can also delete or block cookies through your browser. Deleting the cookie that stores your preferences may cause the banner to appear again.

7. Analytics and advertising services

Google Analytics 4

We use Google Analytics 4, provided by Google, to understand website traffic and visitor interactions.

Information processed may include pages viewed, traffic sources, device and browser information, identifiers and website events.

Our GA4 property is configured to retain user-level and event-level data for 14 months. This setting does not apply to standard aggregated reports. If the “Reset user data on new activity” option is enabled, new activity renews the retention period for the relevant user identifier.

For further information, see Google’s Privacy Policy.

Hotjar

We use Hotjar to understand how visitors interact with our website and identify opportunities to improve its usability.

Depending on the features enabled, Hotjar processes information about clicks, scrolling, navigation, visited pages, device and browser characteristics, and technical identifiers. Heatmaps and session recordings help us identify usability issues.

The information captured depends on our configuration and the service’s suppression settings. Please avoid entering sensitive personal information into website forms.

Where consent is required, Hotjar is enabled only after acceptance of the relevant statistics category.

For further information, see Hotjar’s privacy information.

LinkedIn Insight Tag — planned use

We plan to use the LinkedIn Insight Tag for advertising measurement, conversion tracking, aggregate audience insights and website retargeting.

When enabled, it may collect information including the page URL, referring page, IP address, device and browser characteristics, timestamps and identifiers. LinkedIn may associate website activity with a LinkedIn member account and process information according to its policies and the member’s settings.

Where required, the tag is enabled only after consent to marketing tracking. The legal basis for our consent-based marketing tracking is Article 6(1)(a) GDPR.

For further information, see LinkedIn’s Privacy Policy and Cookie Policy.

8. Who may receive your personal data?

Personal data may be accessible to authorised members of our team and providers supporting the purposes described in this policy.

Service	Purpose
Websupport	Website hosting and associated technical infrastructure
SmartEmailing	Newsletter subscriptions, email distribution and subscription management
Make	Automation and transfer of information between connected business systems
ClickUp	Organisation and management of enquiries, tasks and business communication
Google Analytics 4	Website usage analytics
Hotjar	Behavioural analytics, heatmaps and session recordings
LinkedIn Insight Tag — planned	Advertising measurement, conversion tracking and retargeting

Email, IT support and website maintenance providers may also process information where necessary to deliver their services.

Providers processing personal data on our behalf are subject to applicable data processing terms. Some providers may also process information as independent controllers for purposes described in their own privacy notices.

Information may be disclosed to professional advisers or competent authorities where necessary to comply with legal obligations or establish, exercise or defend legal claims.

9. International transfers

Some providers operate internationally. Their services may involve transferring personal data outside the European Economic Area (EEA), including to the United States, or allowing access from outside the EEA.

This may apply to Make, ClickUp, Google Analytics, Hotjar and, when enabled, LinkedIn, depending on the contracting entity, service configuration and subprocessors involved.

The applicable transfer arrangements may include:

A European Commission adequacy decision, including the EU–US Data Privacy Framework where the relevant US recipient holds an applicable active certification.
European Commission Standard Contractual Clauses, together with supplementary safeguards where required.

The applicable mechanism depends on the recipient and transfer. Hosting data in the EEA does not necessarily exclude international access by support personnel or subprocessors.

Further information is available in the providers’ documentation, including:

Contact info@privatebrand.eu to request information about transfers relevant to your data and the applicable safeguards, including how to obtain a copy.

10. How long we retain personal data

We retain personal data for as long as necessary for the relevant purpose. We consider the nature of the information, the duration of our communication or business relationship, legal obligations and the need to address legal claims.

Enquiries: Information is retained while handling your enquiry and related negotiations. Further retention depends on continuing business needs, applicable legal requirements and related claims.
Business relationship records: Information is retained during the relationship and subsequently where required by law or necessary for related legal claims.
Newsletter subscriptions: Subscription information is retained while the subscription remains active. After withdrawal or unsubscribe, limited consent evidence and suppression records may be retained where necessary to demonstrate compliance and prevent further unwanted marketing.
Google Analytics 4: Relevant user-level and event-level data is subject to the 14-month setting described above.
Hotjar: Analytics information and session recordings are retained according to the applicable service retention rules and project configuration.
LinkedIn: When enabled, retention depends on the identifiers, advertising features and audience settings used, together with LinkedIn’s applicable retention rules.
Technical logs and automation records: Retention depends on operational, troubleshooting and security needs and the applicable service settings.
Backups: Data scheduled for deletion may remain in restricted backups until the relevant backup cycle expires.

Information no longer needed is deleted or anonymised. You may contact us for information about the retention period applicable to your data.

11. Your data protection rights

Depending on the circumstances and applicable legal conditions, you may have the right to:

Access your personal data and obtain a copy.
Have inaccurate or incomplete data corrected.
Request erasure of your personal data.
Request restriction of processing.
Receive certain data in a portable format.
Object to processing based on legitimate interests.
Withdraw consent where processing is based on consent.

You have the right to object at any time to processing for direct marketing purposes, including related profiling.

To exercise your rights, contact info@privatebrand.eu. We may request information reasonably necessary to verify your identity.

We normally respond within one month. Where legally permitted, this period may be extended, and we will inform you of the extension and reasons.

You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic at www.dataprotection.gov.sk, or with another competent supervisory authority.

12. Changes to this policy

We may update this Privacy Policy when our processing activities, services or applicable requirements change.

The latest version will be published on this page with its updated date.

Last updated: 19 February 2026