Privacy Policy

1. Introduction and Scope

This Privacy Policy governs all personal information processing activities undertaken by Orno in connection with our sponsorship verification workflows, hydration and wellness product fulfillment programs, communications, and online properties located at orno.io and any linked domains operated by Orno or Luminary Group Holdings LLC. It covers information relating to individual streamers, influencers, esports organizations, sponsorship administrators, enterprise partners, talent management firms, logistics contacts, vendor representatives, and other natural persons who interact with us (collectively, "you"). The Policy applies regardless of whether you access our services via desktop or mobile browsers, interact through embedded forms hosted by authorized third parties, or communicate with Orno representatives by email, telephone, direct message, or videoconference.

We design our privacy program to comply with the European Union General Data Protection Regulation (EU GDPR), the United Kingdom GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), Brazil's Lei Geral de Proteção de Dados (LGPD), Singapore's Personal Data Protection Act (PDPA), Australia’s Privacy Act, South Africa’s Protection of Personal Information Act (POPIA), and other applicable global privacy frameworks. Where local laws impose stricter requirements than those described here, we honor the higher standard for individuals located in those jurisdictions. Supplemental region-specific disclosures may be provided alongside this Policy when relevant.

Because Orno primarily collects limited categories of personal information necessary for sponsorship verification, communications, and product fulfillment, we strive for minimal data collection by design. Nevertheless, we believe transparency requires providing a comprehensive description of our processing activities, safeguards, and accountability measures. This Privacy Policy therefore details not only what information we collect but also why we collect it, the legal bases we rely on, how long we keep it, who we share it with, what controls you have, and how we protect it. We encourage you to read the entire Policy carefully so you can understand our practices and make informed decisions about your personal data.

By accessing our digital properties, submitting a fulfillment request, participating in sponsorship onboarding, or otherwise providing personal information to Orno, you acknowledge that you have read this Privacy Policy. Where consent is required by law, we will seek your explicit opt-in before processing your information for non-essential purposes. If you do not agree with this Policy or our practices, please refrain from using our services and contact us using the details in the Contact Us section so we can address your concerns or facilitate alternative arrangements.

2. Information We Collect

We collect personal information in a manner consistent with the principles of data minimization and purpose limitation. The specific data elements we collect depend on how you engage with Orno. We categorize the information we collect as follows:

If you provide personal information relating to another individual, you are responsible for ensuring that you have the legal authority to do so and for directing them to this Privacy Policy. We rely on the accuracy of the information you provide and request that you keep your details current by notifying us of any changes.

3. How We Use Information

We use personal information solely for purposes that are compatible with the reasons for which it was collected, and we avoid secondary uses that are incompatible with those original purposes. Our primary uses include:

• Sponsorship verification and onboarding: Assessing eligibility, confirming identity, managing contracts, and configuring program parameters for creators and partners.
• Product fulfillment and logistics: Coordinating inventory, processing refill requests, arranging shipments, tracking deliveries, and resolving fulfillment issues.
• Communications: Responding to inquiries, providing program updates, sending transactional notices, managing support tickets, and sharing operational announcements about sponsorship or fulfillment services.
• Account administration: Creating and maintaining internal records, documenting consent, reconciling invoices, and managing access to restricted resources or portals.
• Analytics and service improvement: Analyzing aggregate usage trends, measuring campaign performance, testing platform enhancements, and optimizing user experience while respecting privacy-centric measurement practices.
• Security and fraud prevention: Monitoring for suspicious activity, detecting unauthorized access, investigating fraud, and enforcing our Terms of Service and policies.
• Legal compliance and risk management: Complying with regulatory obligations, responding to lawful requests from authorities, exercising or defending legal claims, and maintaining business continuity documentation.

We do not use personal information for automated decision-making or profiling that produces legal or similarly significant effects. When we rely on analytics, we aggregate or de-identify data whenever possible, and we avoid intrusive tracking practices. If we ever plan to process personal data for a purpose materially different from the purposes described in this Policy, we will provide you with a clear notice and obtain consent where required.

4. Lawful Bases for Processing

Under the GDPR and other international privacy laws, we must identify lawful grounds for processing personal information. Depending on the context, Orno relies on the following legal bases:

Where we rely on different legal bases for separate processing activities, we document these determinations in our data inventory and make them available to supervisory authorities upon request.

5. Data Sharing and Disclosure

Orno carefully selects and oversees third parties who handle personal information on our behalf. We only share data with recipients that maintain robust privacy and security controls and that agree to process the information in accordance with our instructions and applicable laws. We disclose personal information under the following circumstances:

• Internal group sharing: Orno may share personal information with Luminary Group Holdings LLC and its subsidiaries to coordinate sponsorship programs, manage logistics, provide centralized support, perform internal analytics, and comply with corporate governance requirements. Access is restricted to personnel who require the information to perform their duties.
• Service providers and vendors: We engage trusted third-party providers for functions such as shipping and logistics, warehousing, inventory management, CRM hosting, email delivery, IT support, payment processing for optional upgrades, security monitoring, and professional advisory services (legal, compliance, auditing). These providers process personal information only as necessary to deliver their contracted services and are bound by confidentiality obligations.
• Business partners and sponsors: When you participate in a co-branded program or a sponsorship initiative, we may share limited personal information with the associated brand partner to confirm eligibility, fulfill program requirements, or measure engagement. We ensure that these partners use the information solely for the agreed purpose and provide comparable privacy protections.
• Compliance and legal requests: We may disclose personal information to law enforcement agencies, regulators, courts, or other governmental bodies when required by law or when we believe in good faith that disclosure is necessary to protect our rights, safeguard individuals, or comply with judicial proceedings.
• Business transfers: In the event of a merger, acquisition, restructuring, financing, or sale of assets, personal information may be transferred to the acquiring or successor entity as part of the transaction, subject to continued protection consistent with this Policy. You will be notified if such a transfer materially affects your privacy rights.

We do not sell personal information for monetary consideration, nor do we share personal information for cross-context behavioral advertising or targeted advertising within the meaning of the CCPA/CPRA. If our practices change, we will update this Policy and provide appropriate notice and opt-out mechanisms.

6. Cookies and Analytics

Cookies are small text files that are stored on your device to help websites operate efficiently and provide certain features. Orno employs a privacy-first approach to cookies and analytics, ensuring that only necessary and proportionate technologies are used.

We do not use cookies or pixels for targeted advertising or social media tracking. If our cookie practices change, we will update our cookie notice and seek consent where required before implementing new technologies.

7. International Transfers

Orno is headquartered in the United States, and many of our data processing activities occur in the U.S. However, due to the global nature of our sponsorship programs and fulfillment logistics, personal information may be transferred to, accessed from, or stored in jurisdictions other than the one in which you reside. These jurisdictions may have data protection laws that differ from those in your home country.

When transferring personal information internationally, we implement appropriate safeguards to ensure an equivalent level of protection as required by applicable laws. These safeguards include reliance on adequacy decisions issued by the European Commission or UK Government; execution of Standard Contractual Clauses (SCCs), International Data Transfer Agreements (IDTAs), or similar contractual instruments approved by regulators; supplemental risk assessments and security measures; binding corporate rules where applicable; and obtaining your explicit consent when other mechanisms are not available.

We monitor regulatory developments and guidance from supervisory authorities to maintain compliance with cross-border transfer requirements. Where a transfer relies on SCCs or analogous agreements, we implement technical and organizational measures such as encryption in transit and at rest, access controls, and data minimization to mitigate potential governmental access risks. You may request additional information about our transfer mechanisms by contacting us.

8. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including satisfying legal, accounting, or reporting obligations. To determine appropriate retention periods, we consider the amount, nature, and sensitivity of the data; the potential risk of harm from unauthorized use or disclosure; the purposes for which we process the data; whether those purposes can be achieved through other means; and applicable legal requirements. Specific retention practices include:

• Sponsorship and fulfillment records: Retained for the duration of the sponsorship or fulfillment program plus a period of up to seven years to support auditing, dispute resolution, and legal compliance. Where local laws require shorter retention, we adhere to the stricter standard.
• Communications and support tickets: Maintained for up to five years following resolution, unless a longer retention period is necessary due to ongoing issues, regulatory inquiries, or documented consent requirements.
• Marketing preferences: Retained until you opt out, at which point we maintain a suppression list record to ensure your preferences are honored.
• Analytics data: Aggregated and anonymized data may be retained indefinitely for statistical purposes, while identifiable technical logs are typically purged within twelve months unless required for security or legal reasons.

When retention periods expire, we securely delete, anonymize, or de-identify personal information in accordance with industry standards. If legal obligations prevent immediate deletion, we segregate the data and restrict access until deletion becomes permissible. We maintain a comprehensive retention schedule and conduct periodic reviews to confirm compliance.

9. Your Rights (GDPR & CCPA)

Depending on your place of residence, you may have specific rights regarding your personal information. Orno is committed to honoring these rights and providing accessible mechanisms to exercise them. We verify each request to protect privacy and respond within the timeframes required by law. Your rights may include:

10. Security

Orno maintains a comprehensive information security program aligned with industry best practices and the Luminary Group Holdings LLC security framework. We implement technical, organizational, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. Our security controls include:

• Access controls: Role-based access management, multi-factor authentication, and least privilege principles ensure that only authorized personnel can access personal information.
• Encryption: Data is encrypted in transit using TLS and encrypted at rest using AES-256 or equivalent standards when stored in our systems or with qualified service providers.
• Network and application security: Firewalls, intrusion detection and prevention systems, endpoint protection, secure coding practices, vulnerability scanning, and penetration testing help safeguard our infrastructure.
• Monitoring and logging: We maintain audit logs and employ continuous monitoring to detect anomalous activities, with incident response procedures to investigate and remediate potential threats.
• Vendor risk management: We conduct due diligence and contractually require vendors to maintain appropriate security measures, including breach notification obligations.
• Employee training: Personnel receive regular privacy and security training, including phishing simulations, data handling guidelines, and confidentiality obligations.

While we strive to protect personal information, no system can guarantee absolute security. In the unlikely event of a data breach, we will follow our incident response plan, notify affected individuals and regulators as required, and take steps to mitigate any potential harm.

11. Children’s Data

Our services are designed for adult professionals, creators, and organizational representatives. We do not knowingly collect personal information from children under the age of 16 (or the equivalent minimum age in relevant jurisdictions). If we discover that a child has provided us with personal information without verifiable parental consent, we will promptly delete the information. Parents or guardians who believe their child has provided personal information to Orno should contact us immediately so we can investigate and take appropriate action.

12. Policy Updates

We may update this Privacy Policy to reflect changes in our practices, technologies, legal obligations, or business requirements. When we make material changes, we will post a prominent notice on our website, update the effective date at the top of the Policy, and, where required by law, obtain your consent or provide you with the opportunity to opt out of the changes. We encourage you to review this Policy periodically to stay informed about how we protect your information. Continued use of our services after any updates constitutes acceptance of the revised Policy unless otherwise required by law.

13. Contact Us

We welcome questions, feedback, and requests relating to this Privacy Policy or our privacy practices. Our Data Protection Officer oversees compliance across Orno and liaises with supervisory authorities worldwide. To exercise your rights, lodge a concern, or seek clarification, please reach out using the details below.