Privacy Policy (GDPR & CCPA)
Controller. BrandOrbitWorks, 99441 Mellinger Strasse 10 Magdala, Germany, is the data controller for personal data processed through this website. Contact: [email protected].
What we collect. We process contact details you submit (name, email, phone, company, project brief), technical data (IP address, browser type, device identifiers, pages viewed), and payment metadata handled by our PCI-DSS payment provider. We do not collect special-category data under Article 9 GDPR.
Purpose & legal basis. Contact and project data is processed to respond to inquiries and perform pre-contractual measures (Art. 6(1)(b) GDPR). Analytics and marketing cookies run only with consent (Art. 6(1)(a) GDPR). Legitimate interests (Art. 6(1)(f)) cover site security, fraud prevention, and aggregate service improvement.
Retention. Inquiry records are retained for 24 months after the last interaction. Contractual and invoicing records are kept for 10 years as required by German commercial and tax law. Consent withdrawals are honored immediately.
Recipients & transfers. Data is shared with vetted processors (hosting, email delivery, analytics, payment) under Art. 28 GDPR data-processing agreements. Where a processor operates outside the EEA, transfers rely on Standard Contractual Clauses and equivalent safeguards.
Your rights. Under GDPR you may request access, rectification, erasure, restriction, portability, and object to processing. Under the CCPA (California residents) you may request disclosure, deletion, and opt-out of the “sale” or “sharing” of personal information — we do not sell personal data. Exercise rights by emailing [email protected]. You may lodge a complaint with your supervisory authority; ours is the Hessian Commissioner for Data Protection and Freedom of Information.