Privacy Policy

In order to provide our services, ensure server security and deliver your orders, the following data may be collected:

• Minecraft username and UUID: to verify your in-game identity and carry out store deliveries.

• IP address and connection logs: for network security, cheat and bot protection, and in accordance with legal log-keeping obligations.

• Order and transaction information: purchased packages, transaction date, amount and the order reference numbers generated.

• Contact information: the information you share through Discord support channels and our official contact addresses.

The personal data collected is used only for the following legitimate purposes:

• Delivering the orders you place through the store to your in-game account without error,

• Preventing cheating, unauthorised access, fraud and account theft,

• Responding to your support and help requests and ensuring player satisfaction,

• Fulfilling the legal log-keeping obligations under Law No. 5651 on the Regulation of Publications Made on the Internet.

Your personal data is never sold to third parties for commercial purposes or rented out for marketing purposes.

Your data may only be shared with:

• Payment infrastructure providers (for payment confirmation and invoicing),

• Hosting and server infrastructure providers (as required by technical operations),

• Authorised judicial and administrative authorities where duly requested under the applicable legislation, as a legal obligation.

Orinium applies industry-standard TLS/SSL encryption, firewalls, password hashing (bcrypt) and role-based access authorisation measures to protect your data against unauthorised access, loss and disclosure.

Payment is collected through the Tebex Checkout infrastructure. Tebex Limited (United Kingdom), as the seller, processes card and billing data under its own controllership; that data never reaches Orinium. See Tebex's own privacy policy for details.

The site and its database are held on our hosting provider's servers. Where those servers are outside the European Economic Area (EEA), transfers take place with appropriate safeguards under GDPR Art. 46.

You may ask us for the countries of transfer and the safeguards used at the contact address below.

If you are in the European Union (or the EEA), you have the following rights under the General Data Protection Regulation (EU) 2016/679 ('GDPR'):

• Right of access (Art. 15): you may request a copy of the personal data we process about you.

• Right to rectification (Art. 16): you may have inaccurate or incomplete data corrected.

• Right to erasure — 'right to be forgotten' (Art. 17): in certain circumstances you may have your data deleted.

• Right to restriction of processing (Art. 18): you may ask that your data be stored but not otherwise used.

• Right to data portability (Art. 20): you may receive the data you provided in a structured, machine-readable format.

• Right to object (Art. 21): you may object to processing based on legitimate interests.

• Rights regarding automated decisions (Art. 22): you may object to decisions taken solely by automated means that significantly affect you. No such decision-making exists on this site.

• Right to withdraw consent (Art. 7/3): where processing relies on your consent, you may withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal.

Requests relating to these rights are answered free of charge within thirty (30) days at the latest.

• Performance of a contract (Art. 6/1-b): creating the order, confirming payment and delivering the content to the in-game account.

• Legal obligation (Art. 6/1-c): keeping access logs under Turkish Law No. 5651 and retaining commercial records.

• Legitimate interests (Art. 6/1-f): preventing cheating, fraud and account takeover, and protecting the service and site security.

• Consent (Art. 6/1-a): only for processing that is not strictly necessary and that we base on your consent; you may withdraw it at any time.

• Session records: the session cookie is valid for seven (7) days; expired records are deleted seven days later. An idle session becomes invalid after two days.

• Failed login attempts: deleted after twenty-four (24) hours.

• Orders, payments and credit movements: retained for the maximum period required for commercial records by applicable law.

• Application logs: kept under a size limit (2 MB with a single rotated copy); once the limit is reached the oldest entries are rotated out.

• Support correspondence: kept for at most two (2) years after the request is closed.

For requests under the KVKK you may apply to the Turkish Personal Data Protection Board.

If the GDPR applies to you, we recommend contacting us first — but you are not obliged to. Your right to lodge a complaint with the supervisory authority in your country of residence, place of work or place of the alleged infringement remains unaffected.

The data controller is Orinium. For all questions about privacy, KVKK and GDPR, and for requests relating to the rights above, contact us at support@orinium.net or via the #support channel on our official Discord server.