Privacy Policy

1. Who We Are

Orion Supply Group ("Orion", "we", "us", "our") is a global B2B sourcing and logistics company. Our website is located at orionsupplygroup.netlify.app (and, when live, orionsupplygroup.com).

For the purposes of the EU General Data Protection Regulation (GDPR) and other applicable data protection laws, Orion Supply Group is the data controller responsible for your personal data.

If you have any questions about this Privacy Policy or how we handle your data, please contact us at: orionsupplygroup@gmail.com

2. Information We Collect

Information you give us directly

When you fill out the quote request form or contact us, we collect:

• Full name
• Business name / company
• Email address
• Details of your enquiry (product type, quantity, description)
• Any additional information you choose to include in your message

Information collected automatically

When you visit our website, standard web server logs may automatically record:

• Your IP address (anonymised where possible)
• Browser type and version
• Pages visited and time spent on each page
• Referring website (if applicable)
• Date and time of visit

This information is collected by our hosting provider (Netlify) and is used solely for security and performance monitoring. We do not use tracking pixels or third-party analytics tools that profile individual users.

Information from Calendly

If you book a discovery call via our Calendly link, Calendly collects your name, email address, and scheduling preferences in accordance with Calendly's own Privacy Policy. We receive a copy of this information to facilitate the meeting.

3. How We Use Your Information

We use the personal information we collect to:

• Respond to your enquiry — to send you a quote, answer your questions, or confirm a booking
• Provide our services — to fulfil sourcing, procurement, and logistics requests you place with us
• Communicate with you — to send order updates, shipping notifications, and relevant business correspondence
• Improve our website — to understand how visitors use our site so we can make it better
• Comply with legal obligations — to meet applicable laws and regulations in the jurisdictions where we operate

We will never sell your personal data to third parties. We will never send unsolicited marketing emails unless you have explicitly opted in to receive them.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Contractual necessity — processing required to respond to your enquiry, provide a quote, or fulfil a service agreement
• Legitimate interests — improving our website and services, fraud prevention, and business administration, where these interests are not overridden by your rights
• Legal obligation — where we are required by law to process or retain certain data
• Consent — where you have explicitly opted in (e.g. to receive marketing communications). You may withdraw consent at any time

5. Sharing Your Information

We do not sell, rent, or trade your personal data. We may share your information only in the following limited circumstances:

• Service providers: We use Netlify (hosting and form processing) and Calendly (meeting scheduling). These providers process data on our behalf and are bound by their own privacy policies and data processing agreements.
• Suppliers and logistics partners: Where necessary to fulfil an order you have placed, we may share relevant business information (not personal data beyond what is required) with manufacturers, freight forwarders, or customs agents.
• Legal requirements: We may disclose your information if required by law, court order, or government authority, or to protect the rights, property, or safety of Orion Supply Group or others.

6. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy:

• Enquiry / quote data: 2 years from the date of last contact, unless a business relationship develops
• Active client data: For the duration of our business relationship plus 7 years (to meet standard accounting and legal obligations)
• Website logs: Up to 90 days, as managed by our hosting provider

After retention periods expire, data is securely deleted or anonymised.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — ask us to delete your personal data ("right to be forgotten")
• Right to restrict processing — ask us to limit how we use your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at orionsupplygroup@gmail.com. We will respond within 30 days. If you are in the EEA and believe we have not handled your data correctly, you have the right to lodge a complaint with your local data protection authority.

8. Cookies

Our website uses minimal cookies. Specifically:

• Essential cookies: Netlify may set cookies necessary for the website and form functionality to work. These cannot be disabled without breaking the site.
• No tracking or advertising cookies: We do not use Google Analytics, Facebook Pixel, or any other third-party tracking cookies.

Most browsers allow you to refuse or delete cookies through their settings. Note that disabling essential cookies may affect the functionality of our contact form.

9. International Data Transfers

Orion Supply Group operates globally and your data may be processed in countries outside your home country, including countries that may have different data protection laws.

When we transfer data from the EEA or UK to countries without an adequacy decision, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) as approved by the European Commission, or reliance on the legitimate interests of providing and improving our services.

Our primary hosting provider (Netlify) is based in the United States and complies with applicable data transfer frameworks.

10. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. These measures include:

• HTTPS encryption on all pages
• Secure form submission via Netlify's encrypted infrastructure
• Limited access to personal data — only those who need it to perform their role
• Regular review of our data handling practices

No method of transmission over the internet or electronic storage is 100% secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

11. Children's Privacy

Our website and services are directed at businesses and business professionals. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has submitted personal data to us, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this page periodically. Continued use of our website after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact us: