Privacy Policy

Malakit Group operates Odlu and determines the purposes and means of the personal-data processing described here. This policy applies to the Odlu storefront, partner and administration portals, account services, marketplace transactions, support and Product AI.

A seller or other marketplace participant may separately be responsible for data it receives and processes for its own purposes. Its own privacy terms may also apply.

We process only data reasonably needed to operate, secure and improve Odlu.

• Account and identity data, including name, email, authentication identifiers, language and account roles.
• Seller and marketplace data, including market membership, listings, product media, orders, addresses, reviews and support messages.
• Payment and subscription records. Full card credentials are handled by the relevant payment provider and are not intended to be stored by Odlu.
• Technical and security data, including device, browser, IP address, timestamps, audit records, fraud signals and service logs.
• Product AI data only when you explicitly consent, as described in the separate Product AI Privacy Notice.

We use personal data for specific, stated and lawful purposes and do not process more data than those purposes require.

• To create and administer accounts, provide requested marketplace services and perform our agreements with users.
• To process orders, seller operations, subscriptions, support and service communications.
• To meet legal, accounting, security and fraud-prevention obligations and protect the rights of users and Malakit Group.
• To maintain and improve service reliability using proportionate, aggregated or de-identified analytics where possible.
• Where Azerbaijani law requires consent, including Product AI processing and its cross-border transfer, we rely on freely given, specific and informed consent that can be withdrawn.

We may disclose data to another marketplace participant when needed to complete a transaction, and to vetted providers that host, secure, authenticate, communicate, process payments or support Odlu. Providers may process data only for documented service purposes and under confidentiality and security obligations.

We may also disclose data when required by Azerbaijani law, a valid authority request, or to establish, exercise or defend legal claims. We do not sell personal data.

Some infrastructure and specialist providers may process data outside Azerbaijan. Before such a transfer we assess the destination, provider and safeguards and use contractual, organisational and technical protections.

Where the receiving jurisdiction does not provide protection equivalent to Azerbaijani law, we transfer personal data only where another lawful exception applies. For Product AI, we request explicit consent before transfer to OpenAI and its approved subprocessors.

We keep personal data only for the period needed for the stated purpose, contractual and legal obligations, security, dispute handling and enforceable limitation periods. Retention differs by record type.

When data is no longer needed, we delete or irreversibly de-identify it, unless law requires archival preservation. Product AI draft and provider retention periods are stated in the Product AI Privacy Notice.

We use role-based access, authentication, encryption in transit and at rest where applicable, least-privilege service accounts, secrets management, logging, backups, monitoring and incident-response controls. Access is limited to authorised people with confidentiality duties.

No online system can eliminate all risk. We continuously review threats and protections and will provide legally required incident notices.

Subject to Azerbaijani law, you may ask whether we process your data and obtain information about the purpose, legal basis, categories, recipients, methods, retention and source. You may request access, correction, restriction, deletion or destruction, object where applicable, withdraw consent, and complain or seek compensation through the competent authority or court.

Withdrawal does not make earlier lawful processing unlawful. We may request proportionate identity verification and may retain limited evidence required to prove consent, withdrawal, security or legal compliance.

Odlu is not intended for children who cannot lawfully enter the relevant agreement or provide valid consent. Do not submit another person's sensitive or identifying data unless you have lawful authority and the disclosure is necessary.

Product AI must not be used with photos of people, body parts, identity documents, contact or payment details, credentials or vehicle registration plates.

We may update this policy when services, providers or law change. Material changes will receive an updated version and effective date, and we will request new consent where the processing requires it.

Send personal-data requests to the privacy contact below. We will record, verify and answer the request within the period required by applicable law.