Skip to main content
Oro logo

Oro

GDPR evidence

oroinc.comCloud and hostingLast verified 2 Nov 2026
Vendor website Are you Oro?
GDPR mark, CertReports state No public evidenceNo public evidence

Oro and GDPR

CertReports found no public GDPR evidence for Oro as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.

Are you the vendor? Add evidence

Evidence

VerifiedActive: EU-US Certification, SW-US Certification, UK Extension Certification
as of 2 Nov 2026 · confidence 100%
Kind
Listing
Issued or listed
29 Oct 2026
Expires or valid through
29 Oct 2027
Scope
For meeting our contractual obligations to our customers, in the provision of procurement orchestration SaaS services For HR data, for meeting our contractual obligations to our employees
SourceCapturedQuoteLinks
Data Privacy Framework list
Official registry · HTTP 200
2 Nov 2026ORO Labs, Inc.: Active: EU-US Certification, SW-US Certification, UK Extension Certification
Live pagesha256 ad7a4f82dc
Data Privacy Framework list
Official registry · HTTP 200
26 Oct 2026ORO Labs, Inc.: Inactive
Live pagesha256 96f4fee6a4
This is wrong
VerifiedActive: UK Extension Certification, EU-US Certification, SW-US Certification
as of 2 Nov 2026 · confidence 100%
Kind
Listing
Issued or listed
4 Dec 2019
Expires or valid through
28 Jul 2027
Scope
Oro Inc. performs the following activities which can involve collecting and processing of private data: - Oro Inc. develops business application platform focusing on CRM and eCommerce (OroCRM, - OroCommerce, and OroPlatform leveraging open source technologies). Oro is a global company and as such has customers in the EU. Oro Inc. provides cloud solutions (OroCloud) allowing customers to host the applications developed by Oro Inc. (OroCRM, OroCommerce, and OroPlatfrom) in the cloud. The detailed purpose of collecting data is described in our Privacy Policy at https://oroinc.com/privacy-policy/The comprehensive and most recent list of the sub-processors of the personal data collected by Oro Inc. sites is provided at https://oroinc.com/subprocessors/   Oro Inc. Data Privacy Framework commitment covers the following types of private data: - Contact data of users registered at oroinc.com, community.oroinc.com and other Oro Inc. corporate sites. - Personal data of OroCRM and OroCommerce customers. - Personal data of users of OroCloud’s customers who decided to deploy their Oro-licensed applications (OroCRM and OroCommerce) in OroCloud. Oro Inc. uses contact information for the news subscription and user authentication at Oro corporate and community sites, and Customer Portal. In the course of providing the SaaS service of OroCRM and OroCommerce solutions for the customers, Oro Inc. may process private information as a part of the data required for customer technical support requests fulfillment, and to provide contracted level of service. Oro Inc. uses Google Cloud Platform (Google LLC) and Oracle Cloud Infrastructure (Oracle Corporation) for hosting, Sendgrid Inc. for email sending, Atlassian Jira Service Desk as the Customer Portal for enterprise customers, QuickBooks (Intuit Inc.) for accounting and Cloudflare for CDN .
SourceCapturedQuoteLinks
Data Privacy Framework list
Official registry · HTTP 200
2 Nov 2026Oro Inc.: Active: UK Extension Certification, EU-US Certification, SW-US Certification
Live pagesha256 0d9b2e41e0
This is wrong
What GDPR means, and what it does not

"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.

Read the GDPR guide and browse all vendors with evidence

Questions buyers ask

Is Oro GDPR compliant?

There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.

How does CertReports verify this?

Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.

Change history

  1. 18 Sep 2026First indexed by CertReports1 evidence row across 1 framework entered the index.

Alternatives with GDPR evidence

Similar vendors (shared product tags or the Cloud and hosting category) whose GDPR row is verified or vendor-stated, ranked by similarity.

No Cloud and hosting vendor has GDPR evidence in the index yet.

Understand GDPR evidence

All articles