Privacy Policy | Oranit Community

oranit.community · Effective: April 2026 · Version 1.2

1. Who We Are

oranit.community (the "Platform") is operated by Sarius, the Osek Morshe (sole proprietorship) of Ziv Cnossen, T.Z. 321583528, registered at Halivne 8b, 4481300 Oranit, Israel (the "Operator", "we", "us", or "our").

We are the data controller (בעל המאגר) responsible for the personal data collected through the Platform under the Israeli Protection of Privacy Law, 5741-1981 (the "PPL"), as amended by Amendment 13 (in force 14 August 2025), and under the Privacy Protection Regulations (Data Security), 5777-2017 (the "Data Security Regulations").

For all privacy-related enquiries, contact us at privacy@oranit.community.

1.1 Privacy Contact

All privacy-related enquiries, rights requests, removal requests, and complaints can be sent to a dedicated email address: privacy@oranit.community. This is a single, monitored channel for privacy matters, separate from general support.

The Operator has a designated privacy contact responsible for handling these enquiries, coordinating responses to data subject rights requests, overseeing the removal-from-directory process described in our Terms of Service §5.2, and acting as the point of contact in the event of a security incident.

This is a privacy-contact role, not a statutory Privacy Protection Officer (PPO) appointment under Amendment 13. Mandatory PPO appointment under Amendment 13 applies to specific categories of organisation, including data brokers, public bodies, organisations engaged in systematic monitoring, and organisations whose main occupation is processing especially sensitive data on a significant scale. The Operator does not currently fall within these categories. If our processing activities or scale change such that statutory PPO appointment becomes required, we will appoint a qualified PPO and update this Policy accordingly.

2. Scope of This Policy

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you:

Visit or browse the Platform
Register an account
Claim a profile that was published from public-domain sources
Submit a Listing or other Content
Purchase a paid service
Contact us for support, including through email or messaging channels

This Policy applies to all users of the Platform, including visitors, registered users, claimed-profile owners, and paying customers, and to data subjects whose information appears in the directory through public-domain sourcing as set out in Section 4.

This Policy works alongside our Terms of Service. Where both apply, the Privacy Policy governs the handling of personal data and the Terms of Service govern other aspects of the Platform.

3. Definitions

In this Privacy Policy, the following terms have the following meanings:

"Personal data" means any information relating to an identified or identifiable individual, including name, ID number, contact details, online identifiers (such as IP address), location data, and any factor specific to that individual.
"Especially sensitive data" (מידע אישי בעל רגישות מיוחדת) means, under Amendment 13, the categories receiving heightened protection, including: Israeli national ID number (ת.ז.), biometric data, genetic data, health data, criminal records, sexual orientation, financial details, and political or religious affiliation.
"Direct mailing" (דיוור ישיר) means contacting an individual based on a profile constructed about them, as defined in the PPL and IPA Guidelines 2/2017.
"Advertisement" has the meaning given in section 30A of the Communications Law, 5742-1982 (the "Anti-Spam Law"): a commercially distributed message intended to encourage the purchase of a product or service or the spending of money.
"Open-Data Listing" means a directory entry the Operator has compiled from publicly accessible sources, as set out in the Terms of Service §5.1.

4. Data We Collect

We collect personal data through three channels: (a) information you submit directly, (b) information collected automatically when you use the Platform, and (c) information aggregated from publicly accessible sources for the directory ("Open-Data sourcing").

4.1 Data You Submit Directly

4.2 Data Collected Automatically

4.3 Data Aggregated from Public Sources (Open-Data Sourcing)

As described in our Terms of Service §5.1, the Platform operates as a community directory built on publicly accessible information. To provide a useful directory from launch, the Operator may publish basic profiles for businesses, professionals, and other entities active in Oranit using information already in the public domain. This sourcing covers the same data points typically published in commercial directories, namely:

Business name and trade name
Public address and area served
Public phone number and email address
Public opening hours
Public business category and description
Logo and imagery published on the entity's own public website or social media

The sources of this data include:

Public business registries and the Israeli Business Database
Public-facing websites and publicly accessible social media profiles of the listed entity
Public directory feeds and aggregators (subject to applicable agreements)
Public press, news coverage, and community publications
Information voluntarily submitted by community members

Open-Data sourcing does not include any especially sensitive data category. Any individual, business, or property owner may request delisting at any time, free of charge, as described in Section 8.7.

5. Especially Sensitive Data

Under Amendment 13, the categories of "especially sensitive data" (מידע אישי בעל רגישות מיוחדת) receive heightened protection. The Operator's interaction with these categories is limited and is described here for full transparency:

Israeli national ID number (ת.ז.) and company number (ח.פ.): collected only when required by Israeli tax law for the issuance of a tax invoice. These numbers are stored encrypted, accessible only to authorised personnel for invoicing and tax-reporting purposes.
Financial details: limited to the partial card data (last four digits, card brand) returned to the Platform by the payment processor for transaction reconciliation. Full card data is never stored by the Operator.
Other categories of especially sensitive data, including biometric data, genetic data, health data, criminal records, sexual orientation, and political or religious affiliation, are not collected, processed, or stored by the Platform under any circumstance.

If you submit such information voluntarily (for example, in the body of a support email), we will not use it for any purpose beyond responding to your enquiry, and we will delete it as soon as the enquiry is resolved.

6. How We Use Your Data

We use your personal data for the following purposes only:

6.1 Operating the Platform

To create and manage your account, display your Listing, process your orders, generate tax invoices, deliver service-related notifications, and provide you with access to Platform features.

6.2 Billing and Invoicing

To process payments, generate tax invoices (חשבוניות מס) and credit invoices (חשבוניות זיכוי) through the Morning system, and comply with Israeli tax-reporting requirements. We are legally required to retain billing records for a minimum of 7 years.

6.3 Customer Support

To respond to your enquiries, resolve disputes, action removal requests, and provide assistance with your Listing or account.

6.4 Platform Operation, Improvement, and Quality Assurance

To analyse how the Platform is used in aggregated form, identify technical issues, prevent abuse, and improve the functionality, design, and content of the Platform. Where possible, this analysis is performed on data that has been aggregated or pseudonymised.

6.5 Security and Fraud Prevention

To detect, investigate, and prevent fraudulent activity, unauthorised access, abuse of the Platform, and violations of our Terms of Service.

6.6 Marketing Communications

Marketing communications are governed by the Anti-Spam Law (section 30A of the Communications Law, 5742-1982). We will only send marketing communications where you have given prior explicit consent, or where the limited "existing customer" exception under section 30A(c) applies. Every marketing communication will:

Include the word "advertisement" (פרסומת) in the subject line or body, as required by law
Identify the Operator and contact details
Provide a clear, free-of-charge unsubscribe mechanism
Honour any refusal notice (הודעת סירוב) within a reasonable time and in any case within 3 business days

You may withdraw consent or object to direct mailing at any time by emailing privacy@oranit.community or using the unsubscribe link in any email.

6.7 Legal Compliance

To comply with applicable Israeli law, court orders, regulatory requirements, lawful requests from law enforcement, or other legal process.

6.8 Automated Processing and AI

Amendment 13 explicitly addresses automated decision-making and the use of artificial intelligence in processing personal data. The Platform uses automated processing in two limited ways:

Automated translation of Listing content between Hebrew and English using a third-party AI translation service
Automated content classification and moderation pre-screening to flag potentially prohibited content for human review

No decisions producing legal effects or similarly significant effects on you are made solely by automated means. Final moderation, billing, and account decisions are made by a human.

7. Legal Basis for Processing

Under the PPL (as amended by Amendment 13), we process your personal data on the following legal bases:

Consent: where you have actively given your consent, including for non-essential cookies and for marketing communications
Contract performance: processing necessary to fulfil our obligations to you under our Terms of Service
Legal obligation: processing required to comply with Israeli tax law, invoicing law, consumer protection law, anti-money-laundering rules, and other statutory duties
Legitimate interests: analytics in aggregated form, fraud prevention, Platform security, and the directory function based on public-domain information, where these do not override your rights and freedoms

Where consent is the legal basis, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent for essential processing (for example, basic account function) may mean the Operator is unable to continue providing the Service to you.

Consequences of refusing to provide data: where data is required by law (such as ת.ז. or ח.פ. for invoicing), we are unable to process the relevant transaction without it. Where data is requested for optional reasons (such as marketing), refusal will not affect your ability to use the Platform's core features.

8. Your Rights

Under the Israeli Protection of Privacy Law, 5741-1981, as amended by Amendment 13, you have the following rights regarding your personal data:

8.1 Right to Be Informed

To receive transparent information about the collection and use of your personal data. This Privacy Policy is the primary instrument by which we provide that information.

8.2 Right of Access (זכות עיון)

To request a copy of the personal data we hold about you. Under section 13 of the PPL, we will provide the data in Hebrew, English, or Arabic at your choice. Access may be exercised directly or through an authorised representative.

8.3 Right to Correction

To request correction of inaccurate, incomplete, or out-of-date personal data we hold about you.

8.4 Right to Deletion

To request deletion of your personal data, subject to legal retention obligations. Some data cannot be deleted where retention is required by law, for example billing records that must be kept for 7 years under Israeli tax law.

8.5 Right to Object to Direct Mailing

To object at any time to the use of your data for direct mailing (דיוור ישיר) and direct marketing services, including profiling-based marketing. Where you object, we will cease direct mailing to you within a reasonable time and in any case within 3 business days.

8.6 Right to Withdraw Consent

To withdraw consent to processing that is based on consent (for example, marketing communications, non-essential cookies). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8.7 Right to Be Delisted from the Directory

Any individual, business, organisation, or property owner whose information appears on the Platform, including in Open-Data Listings, may request removal at any time, for any reason, free of charge. The Operator will action the removal within 7 business days. Full procedure is set out in Terms of Service §5.2.

8.8 Right to Lodge a Complaint

If you are not satisfied with our handling of a privacy matter, you have the right to lodge a complaint with the Israeli Privacy Protection Authority (הרשות להגנת הפרטיות). See Section 16.

8.9 How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@oranit.community. We will:

Acknowledge receipt within 3 business days
Respond substantively within 30 days, extendable by a further 30 days for complex requests with notice to you
Provide our response in Hebrew, English, or Arabic at your choice (rights of access)
Take action free of charge, unless requests are manifestly unfounded or excessive

We may request proof of identity (for example, by replying from the email address on file) before processing requests that involve disclosure or deletion of personal data, in order to protect against unauthorised access. We will not request more identity verification than is reasonably necessary.

9. Who We Share Your Data With

We do not sell your personal data, and we do not share your data with third parties for their own marketing purposes.

We share personal data only with the following categories of service providers, and only to the extent necessary for them to perform their service to us. Each provider is bound by confidentiality and data protection obligations:

We may also disclose your data:

Where required by law, court order, or lawful request from a competent authority
To enforce or apply our Terms of Service or this Privacy Policy
To protect the rights, property, or safety of the Operator, the Platform, its users, or the public
In connection with a sale, merger, or transfer of business assets, in which case the Operator will give 30 days' notice and provide an option to delete your data before transfer

10. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy, applying the data minimisation principle of the PPL. Specific retention periods:

Account data: retained for the duration of your account and for 24 months after closure, unless longer retention is required by law
Billing and invoice records: retained for a minimum of 7 years from the end of the tax year in which the transaction occurred, as required by Israeli tax law (Income Tax Ordinance and VAT Law)
Listing content: retained while the Listing is active; deleted or moved to internal archive upon Listing removal or account closure
Removal request audit log: timestamp, requester identifier, and listing reference are retained for 36 months for compliance and audit purposes
Support communications: retained for 24 months from the date of the last communication on a given matter
Security and access logs: retained for up to 12 months for fraud prevention and incident investigation
Cookies and analytics data in identifiable form: retained for up to 26 months; aggregated and anonymised data may be retained indefinitely

When data is no longer required, we securely delete or anonymise it. "Anonymise" here means transforming the data so that it can no longer be linked back to an identified or identifiable individual.

11. Cookies and Tracking Technologies

The Platform uses cookies and similar tracking technologies to operate effectively, remember your preferences, and analyse usage. Categories used:

Essential cookies: required for the Platform to function (login sessions, language preferences, security tokens). These cannot be disabled and do not require consent.
Analytics cookies: to understand how visitors interact with the Platform. Used only with your consent. Where possible, analytics is configured to anonymise IP addresses.
Functional cookies: to remember your preferences and improve your experience. Used only with your consent.

Consent: when you first visit the Platform, you will be presented with a cookie consent notice in line with the Privacy Protection Authority's recommended opt-in model for non-essential cookies. You may withdraw or modify your consent at any time through the cookie settings on the Platform. Withdrawing consent to non-essential cookies will not affect your ability to use the Platform's core features.

We do not use cookies for behavioural advertising, profiling for direct marketing without separate consent, or sharing data with advertising networks.

12. Data Security

We implement technical and organisational measures consistent with the Privacy Protection Regulations (Data Security), 5777-2017, to protect personal data against unauthorised access, loss, disclosure, alteration, or misuse. These include:

Encrypted data transmission using HTTPS / TLS for all Platform traffic
Encryption at rest for especially sensitive data (ת.ז., ח.פ., partial card data)
Strict access controls limiting who can access personal data internally, with role-based permissions
Logging of access to personal data for audit and incident investigation
Hashed and salted password storage
Secure hosting infrastructure with regular patching and updates
Secure backup procedures with restricted access
Documented information security policy reviewed periodically
Incident response procedures for the handling of suspected or confirmed data breaches

12.1 Security Incident and Breach Notification

In the event of a security incident, we follow the breach response procedures of our information security policy. Where the incident constitutes a serious security event under the Data Security Regulations, we will:

Notify the Privacy Protection Authority without undue delay, in accordance with the Regulations
Notify affected data subjects without undue delay where the incident is likely to result in a significant risk to their rights
Provide affected individuals with information about the nature of the incident, the data involved, the steps we have taken in response, and how they can mitigate possible harm

No system can be guaranteed to be completely secure. While we apply commercially reasonable security measures, we cannot guarantee the absolute security of any data transmitted to or stored on the Platform.

13. International Data Transfers

The Platform is operated from Israel. Some of our service providers (such as hosting, analytics, AI translation, and email delivery providers) may process data outside of Israel.

Where data is transferred internationally, we ensure that appropriate safeguards are in place in accordance with the PPL and Amendment 13's transfer requirements, including:

Transfer to jurisdictions assessed as providing an adequate level of protection (including the EEA, the United Kingdom, and other countries on the IPA's adequacy list)
Where adequacy does not apply, contractual safeguards in our agreements with the recipient that provide a comparable level of protection

If you are located within the European Economic Area (EEA) and access the Platform, please note that Israeli data protection law has been assessed as providing an adequate level of protection by the European Commission. The Operator has not conducted a formal GDPR compliance review for EEA-originating data and recommends that EEA-based businesses seek independent advice if required.

14. Children's Privacy

The Platform is not directed at children under the age of 18. Account creation is restricted to individuals aged 18 and over, or to minors acting with the consent and supervision of a parent or legal guardian, as set out in our Terms of Service §4.3.

We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected data from a child under 13, please contact us at privacy@oranit.community and we will take prompt steps to delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Where changes are material, we will notify you by email (where contact information is on file) or by a prominent notice on the Platform at least 14 days before the changes take effect.

The current version of this Policy is always available at oranit.community/privacy. Each version will state its effective date and version number, and prior versions will be retained on request for transparency.

16. Contact and Complaints

For any questions, requests, removal requests, or complaints relating to this Privacy Policy or our data practices, please contact:

If you are not satisfied with our response, you have the right to lodge a complaint with the Israeli Privacy Protection Authority (הרשות להגנת הפרטיות). The Authority's website provides guidance on how to file a complaint:

oranit.community · Privacy Policy · Version 1.2, April 2026