Introduction and Scope
This Privacy Policy governs all personal information processing activities undertaken by Orno in connection with our sponsorship verification workflows, hydration and wellness product fulfillment programs, communications, and online properties located at orno.io and any linked domains operated by Orno or Luminary Group Holdings LLC. It covers information relating to individual streamers, influencers, esports organizations, sponsorship administrators, enterprise partners, talent management firms, logistics contacts, vendor representatives, and other natural persons who interact with us (collectively, "you"). The Policy applies regardless of whether you access our services via desktop or mobile browsers, interact through embedded forms hosted by authorized third parties, or communicate with Orno representatives by email, telephone, direct message, or videoconference.
We design our privacy program to comply with the European Union General Data Protection Regulation (EU GDPR), the United Kingdom GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), Brazil's Lei Geral de Proteção de Dados (LGPD), Singapore's Personal Data Protection Act (PDPA), Australia's Privacy Act, South Africa's Protection of Personal Information Act (POPIA), and other applicable global privacy frameworks. Where local laws impose stricter requirements than those described here, we honor the higher standard for individuals located in those jurisdictions. Supplemental region-specific disclosures may be provided alongside this Policy when relevant.
Because Orno primarily collects limited categories of personal information necessary for sponsorship verification, communications, and product fulfillment, we strive for minimal data collection by design. Nevertheless, we believe transparency requires providing a comprehensive description of our processing activities, safeguards, and accountability measures. This Privacy Policy therefore details not only what information we collect but also why we collect it, the legal bases we rely on, how long we keep it, who we share it with, what controls you have, and how we protect it. We encourage you to read the entire Policy carefully so you can understand our practices and make informed decisions about your personal data.
By accessing our digital properties, submitting a fulfillment request, participating in sponsorship onboarding, or otherwise providing personal information to Orno, you acknowledge that you have read this Privacy Policy. Where consent is required by law, we will seek your explicit opt-in before processing your information for non-essential purposes. If you do not agree with this Policy or our practices, please refrain from using our services and contact us using the details in the Contact Us section so we can address your concerns or facilitate alternative arrangements.
Information We Collect
We collect personal information in a manner consistent with the principles of data minimization and purpose limitation. The specific data elements we collect depend on how you engage with Orno. We categorize the information we collect as follows:
2.1 Directly Provided Sponsorship and Fulfillment Information
When you complete our sponsorship verification or refill request forms, correspond with us by email, or speak with our fulfillment coordinators, you may provide personal details such as your name, preferred display or gamer tag, contact email address, phone number, professional role, organization or team affiliation, and business mailing address. We also collect shipping addresses, product preferences, sizing information, hydration mix selections, quantity requirements, and special instructions necessary to deliver the requested products. If you are responsible for coordinating product distribution to multiple recipients, we may collect limited information about those recipients (e.g., name and preferred shipping details) solely for the purpose of fulfilling their orders and only after you represent that you have the authority to share such information.
As part of sponsorship verification, we may request documents or links that substantiate your eligibility, such as proof of tournament participation, proof of streaming partnership status, or confirmation of contractual relationships with brands managed by Luminary Group Holdings LLC. These materials may incidentally contain personal identifiers, signatures, or contact details, which we process exclusively to confirm authenticity and maintain accurate records of our partner engagements.
2.2 Communications and Engagement Data
We maintain logs of our communications with you, including emails, instant messages, customer service tickets, phone call summaries, and videoconference transcripts where permitted by law. These records capture the content of your inquiries, feedback, preferences, and any troubleshooting steps we provide. We also maintain an interaction history that may include the dates and times of your requests, the Orno personnel assigned to support you, and the status of your orders or sponsorship programs. For marketing or update emails, we collect engagement metrics such as open rates and link click-throughs using privacy-centric analytics to assess the effectiveness of our communications.
2.3 Technical and Usage Information
When you visit our websites or digital services, we automatically collect certain technical data using cookies, pixels, server logs, and similar technologies. This includes your IP address, approximate geographic location derived from the IP address, browser type and version, device type, operating system, referring URLs, pages viewed, timestamps, time spent on pages, interaction patterns, and error logs. We also generate unique identifiers (such as hashed device IDs) to maintain session continuity and enable core security features. Our cookies are designed to be privacy-friendly and we do not engage in cross-site tracking or targeted advertising.
2.4 Partner, Vendor, and Platform Data
To validate sponsorship eligibility, manage logistics, and comply with contractual obligations, we may receive limited personal information about you from our parent company Luminary Group Holdings LLC, affiliated subsidiaries, payment processors, and trusted third-party vendors. Examples include status updates from streaming platforms confirming membership tiers, delivery confirmations from logistics carriers, or basic contact details shared by event organizers who have obtained your consent to collaborate with Orno. We also collect publicly available information from social media or professional networking sites when necessary to verify identity, prevent fraud, or assess partnership suitability.
2.5 Sensitive or Special Category Data
Orno does not intentionally collect sensitive personal data (such as government-issued identification numbers, financial account details, health information, biometric identifiers, or data revealing racial or ethnic origin) unless you voluntarily provide such information for a specific purpose and we have obtained your explicit consent or another lawful basis under applicable law. If we determine that the information provided falls within a special category under the GDPR or analogous laws, we will apply heightened safeguards, limit access strictly to personnel with a need to know, and delete the information as soon as it is no longer necessary.
If you provide personal information relating to another individual, you are responsible for ensuring that you have the legal authority to do so and for directing them to this Privacy Policy. We rely on the accuracy of the information you provide and request that you keep your details current by notifying us of any changes.
How We Use Information
We use personal information solely for purposes that are compatible with the reasons for which it was collected, and we avoid secondary uses that are incompatible with those original purposes. Our primary uses include:
-
Sponsorship verification and onboarding: Assessing eligibility, confirming identity, managing contracts, and configuring program parameters for creators and partners.
-
Product fulfillment and logistics: Coordinating inventory, processing refill requests, arranging shipments, tracking deliveries, and resolving fulfillment issues.
-
Communications: Responding to inquiries, providing program updates, sending transactional notices, managing support tickets, and sharing operational announcements.
-
Account administration: Creating and maintaining internal records, documenting consent, reconciling invoices, and managing access to restricted resources or portals.
-
Analytics and service improvement: Analyzing aggregate usage trends, measuring campaign performance, testing platform enhancements, and optimizing user experience.
-
Security and fraud prevention: Monitoring for suspicious activity, detecting unauthorized access, investigating fraud, and enforcing our Terms of Service and policies.
-
Legal compliance and risk management: Complying with regulatory obligations, responding to lawful requests from authorities, exercising or defending legal claims.
We do not use personal information for automated decision-making or profiling that produces legal or similarly significant effects. When we rely on analytics, we aggregate or de-identify data whenever possible, and we avoid intrusive tracking practices. If we ever plan to process personal data for a purpose materially different from the purposes described in this Policy, we will provide you with a clear notice and obtain consent where required.
Lawful Bases for Processing
Under the GDPR and other international privacy laws, we must identify lawful grounds for processing personal information. Depending on the context, Orno relies on the following legal bases:
4.1 Performance of a Contract
We process personal information to fulfill our contractual obligations with you or the organization you represent. This includes verifying sponsorship eligibility, delivering products, coordinating logistics, providing support, and honoring service-level commitments. Without this data, we would be unable to deliver the services you request or participate in the sponsorship programs you join.
4.2 Legitimate Interests
We process personal data based on our legitimate interests in operating our business efficiently, maintaining security, preventing fraud, and improving our services, provided that such interests are not overridden by your fundamental rights and freedoms. Before relying on this basis, we conduct a balancing test to ensure that your privacy expectations are respected. Examples include analyzing aggregate usage data to improve platform performance, communicating with you about service updates, and investigating suspicious account activity.
4.3 Legal Obligation
In certain circumstances, we are required by law to process personal information. This includes responding to valid legal requests from regulatory authorities, maintaining records for tax or audit purposes, complying with export control regulations, and fulfilling mandatory data retention requirements imposed by applicable statutes.
4.4 Consent
Where required by law, we will obtain your explicit consent before processing your personal information for specific purposes. This applies primarily to marketing communications, the collection of sensitive personal data, or processing that goes beyond what is necessary for contractual performance or legitimate interests. When we rely on consent, you have the right to withdraw it at any time by contacting us or using the unsubscribe mechanisms provided in our communications. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
4.5 Vital Interests
In rare cases involving emergencies, we may process personal information to protect your vital interests or the vital interests of another person. This basis would apply only when processing is necessary to prevent serious harm and no other lawful basis is available.
If you are located in a jurisdiction that requires a different legal basis for processing, we will comply with those requirements and provide additional information as necessary.
Data Sharing and Transfers
We do not sell personal information. We share personal data only with entities that need access to perform services on our behalf or as required by law. Our data sharing practices include:
- Affiliates: We share information with Luminary Group Holdings LLC and its subsidiaries to coordinate sponsorship programs, manage enterprise relationships, and maintain consistent service quality across the group.
- Service providers: We engage third-party vendors to provide hosting, email delivery, customer relationship management, analytics, and logistics services. These providers process personal data only as instructed by us and are contractually bound to maintain appropriate security measures.
- Logistics and fulfillment partners: We share shipping addresses and contact details with carriers and fulfillment centers to deliver products. These partners may operate in various jurisdictions depending on delivery destinations.
- Professional advisors: We may share information with legal counsel, auditors, and insurance providers as necessary to protect our interests and comply with professional obligations.
- Regulatory and law enforcement: We will disclose personal information when required by applicable law, court order, or government request, or when necessary to protect our rights, property, or safety.
- Business transfers: In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of the transaction, subject to the acquiring party agreeing to uphold the protections described in this Policy.
When we transfer personal data outside the European Economic Area, United Kingdom, or other jurisdictions with data transfer restrictions, we implement appropriate safeguards such as Standard Contractual Clauses approved by the European Commission or adequacy decisions recognizing the destination country's data protection standards.
Data Retention
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Our retention periods vary based on the type of information and applicable legal requirements:
- Account and contact information is retained for the duration of your relationship with us plus a reasonable period thereafter to facilitate potential re-engagement or to address follow-up inquiries.
- Transaction and fulfillment records are retained for periods required by tax, accounting, and consumer protection laws, typically ranging from three to seven years depending on jurisdiction.
- Communications logs are retained for a period necessary to address any disputes, provide customer support references, and satisfy legal obligations, generally not exceeding three years from the last interaction.
- Technical logs and analytics data are retained in aggregated or pseudonymized form for service improvement purposes, with raw logs typically deleted within 90 days.
When personal information is no longer needed, we securely delete or anonymize it in accordance with our data destruction procedures.
Your Privacy Rights
Depending on your location and applicable data protection laws, you may have the following rights regarding your personal information:
To exercise these rights, please contact us using the information in the Contact Us section. We will respond to your request within the timeframe required by applicable law. We may need to verify your identity before processing your request to protect your privacy and security.
Security Measures
We implement appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. Our security program includes:
- Encryption of data in transit using TLS 1.2 or higher protocols
- Access controls limiting data access to authorized personnel with a legitimate need
- Regular security assessments and vulnerability management
- Employee training on data protection and security awareness
- Incident response procedures for detecting and responding to security breaches
- Business continuity and disaster recovery planning
While we strive to protect your personal information, no security system is impenetrable. We encourage you to use strong passwords, enable two-factor authentication where available, and promptly report any suspicious activity.
Children's Privacy
Our services are not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal data from a child without appropriate parental consent, we will take steps to delete such information promptly. If you believe we may have collected information from a child, please contact us immediately.
Policy Changes
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will notify you through appropriate channels, such as email notifications or prominent notices on our website. The effective date at the top of this Policy indicates when it was last updated. We encourage you to review this Policy periodically to stay informed about how we protect your information.
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Orno LLC
Data Protection Office
555 Winderley PlaceMaitland, FL 32751
United States of America
Email: privacy@orno.io
We are committed to working with you to resolve any privacy concerns. If you are located in the European Union or European Economic Area and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.