Legal information

Privacy Policy

This Privacy Policy explains how we process personal data when you use our online store, contact us, or place an order.

GDPR & ePrivacy OrbivateEU Fulfillment / DAP internationalLast updated 05.06.2026

1. Controller & Contact

Controller
Orbivate
Address
Germany

If you have any questions about data protection or would like to exercise your rights, please contact us by email.

Postal address for data protection and legal inquiries

For all legal correspondence relating to contracts, orders, consumer rights, withdrawal, warranty, data protection inquiries, or other legal matters, please use the following postal address:

Jens Kerner
c/o COCENTER
Koppoldstr. 1
86551 Aichach

2. Principles & Legal Bases

We process personal data only where a legal basis exists and to the extent necessary for the respective purposes. Depending on the situation, we base the processing in particular on:

  • Art. 6(1)(b) GDPR (contract/pre-contractual measures) – e.g., order, delivery, support.
  • Art. 6(1)(c) GDPR (legal obligation) – e.g., commercial/tax retention requirements.
  • Art. 6(1)(f) GDPR (legitimate interest) – e.g., abuse prevention, IT security, store operation.
  • Art. 6(1)(a) GDPR (consent) – e.g., newsletter, certain cookies/tracking.
Data categories
  • Master data: name, address, contact details.
  • Order data: items, prices, order number, status, returns.
  • Payment data: payment method, transaction/authorization data (payment details are generally processed by the payment service provider).
  • Usage/technical data: IP address, device/browser information, log files, cookie IDs (depending on settings/consent).
  • Communication data: the content of your inquiries, support history.

3. Data Processing in the Store

When you use our online store, we process technical data in order to provide the website, ensure stability and security, and deliver the content correctly.

Purposes: website provision, error analysis, IT security, abuse prevention, fraud detection, performance.
Legal basis: Art. 6(1)(f) GDPR.

Server/log data

When the site is accessed, data such as the IP address, date/time, page accessed, referrer URL, browser/OS, volume of data transferred, and status codes may be processed. This data is necessary for secure operation and is deleted regularly, unless security incidents require longer retention.

4. Orders, Payment, Shipping

When you place an order, we process your data to perform the contract: order acceptance, payment processing, shipping/delivery, returns, warranty, and customer service.
Legal basis: Art. 6(1)(b) GDPR.

EU fulfillment: For warehousing and shipping, we transmit shipping and order data to fulfillment/logistics partners (e.g., name, address, items, tracking).

International (DAP): For deliveries outside the EU, additional data may be required by transport providers/authorities for delivery and, where applicable, customs clearance (e.g., address data, product information, invoice values).

Payment processing

For payment processing, the data required depending on the chosen payment method is transmitted to payment service providers. The processing is carried out to perform the contract (Art. 6(1)(b) GDPR) and for fraud prevention (Art. 6(1)(f) GDPR).

5. Customer Account & Communication

Customer account: If you create an account, we process the data you provide to manage the account and to provide order/status information.
Legal basis: Art. 6(1)(b) GDPR.

Contact/support: When you contact us, we process the information you provide to handle your inquiry and communicate with you.
Legal basis: Art. 6(1)(b) GDPR (contractual/pre-contractual) or Art. 6(1)(f) GDPR.

Documentation & abuse prevention

For abuse prevention and to safeguard transactions, documentation may be required (e.g., communication history, shipping/delivery records). The legal basis is Art. 6(1)(f) GDPR.

6. Cookies, Consent, Tracking

We use cookies and similar technologies. Some are technically required (e.g., shopping cart, checkout security), while others serve optional purposes (e.g., analytics, marketing). Optional tracking—where used—takes place only on the basis of your consent.

Legal bases:
Technically required cookies: Art. 6(1)(f) GDPR or Section 25(2) TTDSG.
Optional cookies/tracking: Art. 6(1)(a) GDPR or Section 25(1) TTDSG.

Manage consent

If a consent tool/cookie banner is used in the store, you can make your selection there and change it later.

7. Marketing (Newsletter/Ads)

Newsletter: When you sign up, we process your email address (and, where applicable, other voluntary information) in order to send you updates about products and promotions.
Legal basis: Art. 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future (e.g., via the unsubscribe link in the newsletter or by email to info@orbivate.com).

Advertising/remarketing

Where we use advertising/analytics tools, this is done—where required—only with your consent.

8. Recipients & Processors

We transmit personal data only where this is necessary to perform the contract, where consent has been given, where a legal obligation exists, or where a legitimate interest justifies the transfer.

Recipient groups
  • Store platform/hosting (store operation, checkout, security).
  • Payment service providers (depending on payment method).
  • Shipping service providers (delivery, tracking).
  • Fulfillment/logistics partners (warehousing, shipping handling).
  • IT/support service providers (maintenance, support tools).
  • Authorities, where legally required.

9. Third-Country Transfers

Depending on the service providers used, processing may also take place outside the EU/EEA. In such cases, we ensure—where necessary—appropriate safeguards, e.g., EU Standard Contractual Clauses (SCCs), adequacy decisions, or comparable protective mechanisms.

10. Retention Period

We store personal data only for as long as it is necessary for the purposes, or for as long as statutory retention obligations exist.

Retention – typical cases
  • Order/billing data: in accordance with statutory requirements.
  • Support communication: as long as necessary; thereafter deletion/anonymization.
  • Newsletter: until unsubscribe/withdrawal.
  • Log/security data: regularly, unless incidents require longer retention.

11. Your Rights

Subject to the statutory requirements, you have the right to access, rectification, erasure, restriction, data portability, and to object to certain processing activities. You can withdraw your consent at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority.

Subject
“Data protection inquiry”

12. Data Security

We use technical and organizational measures to protect data against loss, manipulation, and unauthorized access.

13. Changes

We may update this Privacy Policy if legal requirements, store operations, or the services used change. The version published in the store at any given time applies.