Privacy Policy

Last updated: 10 April 2026

1. Data Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

ORAGO GmbH
Lindleystraße 8A
60314 Frankfurt am Main
Germany

Managing Director: Benjamin Sarges
Commercial Register: HRB 123964, Amtsgericht Frankfurt am Main

Phone: +49 (0)69 / 247 45 99 - 0
Email: datenschutz@orago.de

2. Overview of Data Processing

We take the protection of your personal data seriously. This privacy policy explains what data we collect when you use our website, why we collect it, and what rights you have. We process personal data only in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

3. Hosting and Server Log Files

Our website is hosted on servers provided by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany. All servers are located in Germany. When you visit our website, the hosting server automatically collects and stores technical information in server log files that your browser transmits to us. This includes:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the requested file
  • Referrer URL (the page from which our site was accessed)
  • Browser type and version, operating system
  • HTTP status code and amount of data transferred

This data is processed for the purpose of enabling the delivery of our website, ensuring the security of our information technology systems, and for short-term statistical evaluation.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient operation of our website).

Retention period: Server log files are automatically deleted after 30 days.

4. SSL / TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. form submissions). You can recognise an encrypted connection by the "https://" prefix in your browser's address bar and the lock icon.

5. Contact and Demo Request Forms

Our website provides a contact form and a demo request form. When you submit one of these forms, we collect the following personal data:

5.1 Demo Request Form

  • First name and last name (required)
  • Company name (required)
  • Business email address (required)
  • Phone number (optional)
  • Product interest (optional selection)
  • Manufacturing process (optional selection)
  • Preferred contact time (optional)

5.2 Contact Form

  • First name and last name (required)
  • Company name (required)
  • Email address (required)
  • Phone number (optional)
  • Subject (required selection)
  • Message text (required)

In addition, the following technical metadata is automatically recorded with each form submission: the URL of the page from which the form was submitted, and the date and time of submission. This information is used solely for the purpose of processing your inquiry and is not shared with third parties for any other purpose.

5.3 Purpose and Legal Basis

We process this data exclusively to respond to your inquiry, to schedule and deliver product demonstrations, and to provide the information or services you requested.

Legal basis: Art. 6(1)(b) GDPR (processing necessary for the performance of a contract or pre-contractual measures taken at your request) and Art. 6(1)(a) GDPR (your explicit consent, given by checking the privacy consent checkbox before submission).

5.4 Form Processing

Form submissions are processed entirely on our own web server hosted in Germany (see Section 3). Your data is transmitted via an encrypted HTTPS connection directly to our server, which sends a notification email to our team via SMTP. No third-party form processing services are used. Your form data does not leave our server infrastructure and is not transmitted to any country outside the EU/EEA.

5.5 Retention Period

We retain your form submission data for as long as necessary to process your inquiry and for any subsequent business relationship. If no business relationship results, your data will be deleted within 6 months of your last correspondence with us, unless a longer retention period is required by law (e.g. commercial or tax retention obligations under German law).

6. Contact by Email

If you contact us by email, we will process the personal data contained in your email (e.g. your name, email address, and message content) solely for the purpose of handling your inquiry. The same legal basis, data recipients, and retention periods apply as described in Section 5 above.

7. Web Fonts

This website uses the open-source typefaces Barlow and Barlow Condensed for the uniform display of text. These font files are hosted locally on our own server in Germany and are delivered directly to your browser from our domain. No connection to external font services (such as Google Fonts) is established when you visit our website. No personal data is transmitted to third parties for the purpose of font delivery.

8. Cookies and Local Storage

This website does not set any first-party cookies of its own, and no cookies are placed on your device by default when you visit. Cookies are only set if you give explicit consent to analytics and external services via our consent banner (see Sections 9 and 10). If you decline, no cookies are set.

We use your browser's localStorage to remember your consent preference for analytics and external services (see Sections 9 and 10). localStorage is a browser storage mechanism that stores data only on your device — it is not a cookie and is never transmitted to any server. You can clear this data at any time through your browser settings.

If you consent to Google Analytics or Google Maps (see Sections 9 and 10), Google may set its own cookies once those services are loaded. These cookies are controlled by Google, not by us. You can prevent this by declining when the consent banner is shown.

9. Web Analytics (Google Analytics)

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). We use it to understand how visitors use our website — for example, which pages are visited and how visitors arrive — so that we can improve our content. Google Analytics uses cookies and processes usage data such as your (truncated) IP address, device and browser information, and the pages you view.

We use Google Analytics with Google Consent Mode v2. This means the analytics tag is present on every page, but consent is set to denied by default: until you accept via our consent banner, Google Analytics does not set any cookies or store identifiers on your device and does not build a user profile. In this state, only limited, anonymous, cookieless signals are transmitted to Google. When you accept, consent is updated to “granted” and full, cookie-based analytics is enabled. If you decline (or withdraw consent), analytics returns to the cookieless, denied state and no analytics cookies are set.

Legal basis: Art. 6(1)(a) GDPR (your explicit consent). Consent is optional and can be withdrawn at any time with effect for the future by clearing your browser's localStorage (see Section 8) or by declining when the banner is next shown. Data may be transferred to Google LLC in the USA (see Section 11). You can learn more in the Google Privacy Policy.

10. Third-Party Services and Data Recipients

We only share personal data with third parties when this is necessary to operate our website. The following third-party services are used:

  • Mittwald CM Service GmbH & Co. KG (hosting): Königsberger Straße 4–6, 32339 Espelkamp, Germany. Our website is hosted on Mittwald servers located in Germany. Mittwald acts as a data processor and processes server log data in accordance with our instructions and a data processing agreement (Auftragsverarbeitungsvertrag) pursuant to Art. 28 GDPR. Mittwald Privacy Policy.
  • Google Maps (map display, consent-gated): Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Our contact page offers an embedded Google Maps view to show our office location. This map is not loaded by default. It is only loaded after you give explicit consent via our consent banner. When the map is loaded, your browser establishes a connection to Google servers, transmitting your IP address. Google may also set cookies. The data transfer to the USA is safeguarded by Google's adherence to standard contractual clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR (your explicit consent). You can withdraw consent at any time by clearing your browser's localStorage. Google Privacy Policy.
  • Google Analytics (web analytics, Consent Mode v2): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use Google Analytics 4 to measure how our website is used. The tag runs under Google Consent Mode with consent denied by default: before you accept, it sets no cookies or identifiers and transmits only limited, anonymous, cookieless signals to Google. After you accept, Google processes full usage data (including your truncated IP address, device and browser information, and pages viewed) and may set cookies. In either state, data may be transferred to Google LLC in the USA, safeguarded by standard contractual clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR (your explicit consent) for cookie-based analytics. You can withdraw consent at any time by clearing your browser's localStorage. See Section 9 for details. Google Privacy Policy.

Form submissions are processed on our own server (see Section 5.4). Web fonts are hosted locally on our server (see Section 7). Icon libraries are also hosted locally.

No personal data is sold, rented, or otherwise shared with third parties for marketing or advertising purposes.

11. International Data Transfers

Our hosting provider is located in Germany, form submissions are processed on our own German server, and web fonts and icon libraries are served locally — none of these transfer data outside the European Union or the European Economic Area (EU/EEA). The exceptions are two Google services that may transfer data to Google LLC (USA): Google Analytics (see Section 9) and Google Maps (see Section 10). Because Google Analytics runs under Consent Mode, it transmits limited, anonymous, cookieless signals to Google even before you consent; once you consent, full analytics data (including your IP address) is transmitted. Google Maps is loaded only if you consent. These transfers are safeguarded by standard contractual clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework. If you decline, no cookies are set and Google Maps is not loaded, but the cookieless analytics signals described in Section 9 may still be transmitted.

12. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us at datenschutz@orago.de.

  • Right of access (Art. 15 GDPR) — You have the right to obtain confirmation as to whether personal data concerning you is being processed and, if so, to access that data and receive further information about the processing.
  • Right to rectification (Art. 16 GDPR) — You have the right to request the correction of inaccurate personal data and the completion of incomplete data.
  • Right to erasure (Art. 17 GDPR) — You have the right to request the deletion of your personal data where one of the grounds set out in Art. 17 GDPR applies, for example if the data is no longer necessary for its original purpose.
  • Right to restriction of processing (Art. 18 GDPR) — You have the right to request that we restrict the processing of your personal data under certain circumstances.
  • Right to data portability (Art. 20 GDPR) — You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
  • Right to object (Art. 21 GDPR) — You have the right to object at any time to the processing of your personal data which is based on Art. 6(1)(f) GDPR (legitimate interest). If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests.
  • Right to withdraw consent (Art. 7(3) GDPR) — Where processing is based on your consent, you have the right to withdraw that consent at any time. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We will respond to your request without undue delay and in any event within one month of receipt.

13. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that our processing of your personal data infringes the GDPR (Art. 77 GDPR). The competent supervisory authority for ORAGO GmbH is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany

Phone: +49 611 1408-0
Website: datenschutz.hessen.de

14. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes to our website, services, or legal requirements. The current version is always available at this URL. The date of the last update is shown at the top of this page.

15. Contact for Privacy Inquiries

If you have questions about this privacy policy or wish to exercise any of your rights, please contact:

ORAGO GmbH
Data Protection
Lindleystraße 8A
60314 Frankfurt am Main
Germany

Email: datenschutz@orago.de
Phone: +49 (0)69 / 247 45 99 - 0