Privacy Notice

The controller for the processing described here is Kaldro Limited, Anthypolochagou Georgiou M. Savva 26, Shop 1-2, 8201 Paphos, Cyprus, company registration number HE489052. VORLAR is a brand operated by Kaldro Limited.

For any privacy question or to exercise your rights, contact us at contact@vorlar.com.

This notice explains what personal data the VORLAR website actually processes, why, and for how long. It applies to www.vorlar.com and its language versions.

When you open the website, your browser automatically sends technical information to the servers that deliver it: your IP address, the date and time of the request, the page requested, the referring page, and your browser and operating system. This is necessary to deliver the pages, to keep the service secure and to detect abuse.

The website is built and hosted with the Lovable platform. Pages are delivered through Cloudflare's global network, and the website's database runs on Supabase infrastructure provided through Lovable. These providers process the data on our behalf. Server and security logs are kept by these providers for limited periods according to their own operational retention schedules.

Legal basis: our legitimate interest in operating a secure, functioning website (Article 6(1)(f) GDPR).

The website loads its typefaces (Inter, Inter Tight and IBM Plex Mono) from Google Fonts, a service of Google. When a page loads, your browser connects to Google's servers, which receive your IP address and the technical request data. We use this to display the website consistently.

Legal basis: our legitimate interest in a consistent presentation of the website (Article 6(1)(f) GDPR).

When you submit the request form, we process the information you provide:

• full name, corporate email address, company name and website, job title and department;
• organisation type, number of brands, operating regions;
• the materials you request, your confidentiality preference and any additional information you write;
• the submission time and a reference number.

To protect the form against spam and abuse, we also store a one-way cryptographic hash of your IP address alongside the request. The IP address itself is not stored with your request. The hash is used only to limit how many requests can be sent from one connection.

Requests are stored in a private database that only authorised personnel of Kaldro Limited can access after signing in. We use the information to review your request, to contact you about the materials you requested and to prepare any confidentiality arrangement.

Where email notification is enabled, the content of your request is also sent by email to our company mailbox (contact@vorlar.com) through the email delivery service provided by the Lovable platform, with your email address set as the reply address.

Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Article 6(1)(f) GDPR). Providing the information is voluntary, but we cannot process a request without the required fields.

Retention: we keep request records for as long as needed to handle the enquiry and any resulting business relationship. If no business relationship follows, we delete them no later than 24 months after our last contact, unless a legal obligation requires longer retention.

The public website does not use advertising, tracking or analytics cookies, and it does not create user profiles. For this reason no cookie banner is shown.

The restricted administration area used by our personnel stores a sign-in session in the browser's local storage. This is strictly necessary to provide that area and is not used for visitors of the public website.

Your data is accessible only to authorised personnel of Kaldro Limited and to the service providers named above, who act on our instructions as processors:

• Lovable (website platform, hosting, database and email delivery);
• Cloudflare (content delivery and network security);
• Supabase (database infrastructure provided through Lovable);
• Google (delivery of web fonts).

We do not sell personal data and do not share request information with other third parties unless we are legally required to do so.

Some of these providers are based in, or use infrastructure located in, countries outside the European Economic Area, including the United States. Where personal data is transferred outside the EEA, the transfer relies on an adequacy decision of the European Commission (such as the EU–U.S. Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses offered by the provider. You can contact us for further information about the safeguards used.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased or its processing restricted;
• receive data you provided in a portable format;
• object at any time to processing based on our legitimate interests, on grounds relating to your particular situation.

To exercise these rights, write to contact@vorlar.com.

You also have the right to lodge a complaint with a supervisory authority. In Cyprus this is the Office of the Commissioner for Personal Data Protection. You may also contact the authority in your EU country of residence or work.

The website is served only over encrypted HTTPS connections. Request records are protected by access controls so that they cannot be read through the public website. Submissions are validated on the server and limited in size and frequency.

We will update this notice when the website or our processing changes. The date at the top shows the latest version.