Privacy

Who we are

Orkiya is a phygital ecosystem — real stores, online and in store. It connects you with the shops, restaurants and retailers behind the products, and never processes payments: you always pay the store directly.

Orkiya (46-CCA, DHA Phase 4 DD, Lahore 54792, Pakistan) is the controller of your account data and is responsible for your personal information on this platform.

You can reach us at privacy@orkiya.com, +92 313 6662226, or the Lahore address above.

What we collect

Account details: your name, email address, phone number, and a one-way hash of your password.

Sign-in with Google: if you choose “Continue with Google”, we receive your name and email address from your Google profile to create or find your account. We never see your Google password, and we never post to Google on your behalf.

Orders and delivery: the items you buy, the store they come from, and the delivery or pickup address and contact details for each order.

Loyalty and visits: when you check in at a store or earn loyalty, we record the store and — only with the personalization features you’ve turned on — your visit history.

Messages: the conversations you have with a store about an order.

Sign-in security: the passkey you use to sign in, and a record of security events such as logins.

Payments: you pay the store directly. Where a store accepts cards, the payment runs on that store’s own payment provider — Orkiya never processes your payment and never stores your card details.

Why we use it

To run your account, process and fulfil your orders, and keep the platform working. Our basis for this is the contract you have with us when you place an order.

To remember you at the stores you use — your usual store, visits, and loyalty — only when you’ve chosen the personalization features.

To send you transactional messages about your orders. We do not send marketing email unless you ask for it.

To understand how Orkiya is used — through Google Analytics, so we know which pages work and which need fixing.

To prevent fraud and keep the platform secure.

Who sees your information

When you buy from a store, that store receives the order details it needs to serve you — the items, the store, and your delivery or pickup details. The store you buy from is the controller of that order data.

We use a small number of service providers that process data on our behalf under contract: an email provider, cloud file storage, and Google (for account sign-in and analytics). We do not process payments — you pay the store directly. A current list is available on request.

We do not sell your personal information, and we do not share it for cross-context advertising.

Where your data is stored

Your data is stored with our hosting and infrastructure providers, primarily in Finland (European Union), on servers operated by Hetzner Online GmbH.

How long we keep it

We keep your information only as long as we need it for the purposes above. Order records are kept longer where the law requires it (for example, tax records).

When you ask us to delete your account, we erase your personal information and keep only what a legal obligation requires. Our retention schedule is available on request.

Your rights

From the Trust & transparency hub in your account you can: download the data we hold on you, ask us to correct it, ask us to delete it, and switch off personalization or sharing.

If you are a California resident (CCPA/CPRA), you have the right to know, delete, correct, opt out of the sale or sharing of your information, use an authorized agent to make a request, and appeal a decision on your request. We do not discriminate against you for exercising these rights.

If you enable Global Privacy Control in your browser, we treat it as a request to opt out of sharing.

If you are in Canada (PIPEDA, and Quebec’s Law 25), you may access and correct your information, withdraw consent, and complain to your privacy regulator — the OPC, or Quebec’s CAI — if you are not satisfied with our response.

Children

Orkiya is not intended for children under 13 (under 16 where local law requires it), and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will erase it.

Security

We use reasonable safeguards to protect your information: everything travels encrypted in transit (TLS), we use access controls, and we never store your full card number.

If a security incident affects your personal information, we will notify you and the relevant regulators as the law requires.

Cookies

We use the essential cookies needed to keep you signed in, remember your cart, and show the right regional catalogue.

We also use Google Analytics, which sets its own cookies on our behalf, to count visits and understand which pages are used. We do not use it for advertising, and we do not sell analytics data.

If your browser sends a Global Privacy Control signal, we treat it as a request to opt out. If we ever add cookies beyond these, we will ask for your consent first.

Changes to this policy

We may update this policy. When we do, the effective date above changes too. We will note material changes on Orkiya or send them to you where the law requires it.

Contact us

For any privacy question or request, write to privacy@orkiya.com, call or message +92 313 6662226, or write to 46-CCA, DHA Phase 4 DD, Lahore 54792, Pakistan.

You can also submit most requests directly from the Trust & transparency hub in your account.