Privacy Policy

Last updated: 10 April 2026

1. Data Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

ORAGO GmbH
Lindleystraße 8A
60314 Frankfurt am Main
Germany

Managing Director: Benjamin Sarges
Commercial Register: HRB 123964, Amtsgericht Frankfurt am Main

Phone: +49 (0)69 / 247 45 99 - 0
Email: datenschutz@orago.de

2. Overview of Data Processing

We take the protection of your personal data seriously. This privacy policy explains what data we collect when you use our website, why we collect it, and what rights you have. We process personal data only in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

3. Hosting and Server Log Files

Our website is hosted on servers provided by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany. All servers are located in Germany. When you visit our website, the hosting server automatically collects and stores technical information in server log files that your browser transmits to us. This includes:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the requested file
  • Referrer URL (the page from which our site was accessed)
  • Browser type and version, operating system
  • HTTP status code and amount of data transferred

This data is processed for the purpose of enabling the delivery of our website, ensuring the security of our information technology systems, and for short-term statistical evaluation.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient operation of our website).

Retention period: Server log files are automatically deleted after 30 days.

4. SSL / TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. form submissions). You can recognise an encrypted connection by the "https://" prefix in your browser's address bar and the lock icon.

5. Contact and Demo Request Forms

Our website provides a contact form and a demo request form. When you submit one of these forms, we collect the following personal data:

5.1 Demo Request Form

  • First name and last name (required)
  • Company name (required)
  • Business email address (required)
  • Phone number (optional)
  • Product interest (optional selection)
  • Manufacturing process (optional selection)
  • Preferred contact time (optional)

5.2 Contact Form

  • First name and last name (required)
  • Company name (required)
  • Email address (required)
  • Phone number (optional)
  • Subject (required selection)
  • Message text (required)

In addition, the following technical metadata is automatically recorded with each form submission: the URL of the page from which the form was submitted, and the date and time of submission. This information is used solely for the purpose of processing your inquiry and is not shared with third parties for any other purpose.

5.3 Purpose and Legal Basis

We process this data exclusively to respond to your inquiry, to schedule and deliver product demonstrations, and to provide the information or services you requested.

Legal basis: Art. 6(1)(b) GDPR (processing necessary for the performance of a contract or pre-contractual measures taken at your request) and Art. 6(1)(a) GDPR (your explicit consent, given by checking the privacy consent checkbox before submission).

5.4 Form Processing

Form submissions are processed entirely on our own web server hosted in Germany (see Section 3). Your data is transmitted via an encrypted HTTPS connection directly to our server, which sends a notification email to our team via SMTP. No third-party form processing services are used. Your form data does not leave our server infrastructure and is not transmitted to any country outside the EU/EEA.

5.5 Retention Period

We retain your form submission data for as long as necessary to process your inquiry and for any subsequent business relationship. If no business relationship results, your data will be deleted within 6 months of your last correspondence with us, unless a longer retention period is required by law (e.g. commercial or tax retention obligations under German law).

6. Contact by Email

If you contact us by email, we will process the personal data contained in your email (e.g. your name, email address, and message content) solely for the purpose of handling your inquiry. The same legal basis, data recipients, and retention periods apply as described in Section 5 above.

7. Web Fonts

This website uses the open-source typefaces Barlow and Barlow Condensed for the uniform display of text. These font files are hosted locally on our own server in Germany and are delivered directly to your browser from our domain. No connection to external font services (such as Google Fonts) is established when you visit our website. No personal data is transmitted to third parties for the purpose of font delivery.

8. Cookies and Local Storage

This website does not set any first-party cookies. No tracking, analytics, advertising, or session cookies are placed on your device when you visit our website.

We use your browser's localStorage to remember your consent preference for external services (see Section 10). localStorage is a browser storage mechanism that stores data only on your device — it is not a cookie and is never transmitted to any server. You can clear this data at any time through your browser settings.

If you consent to the use of Google Maps (see Section 10), Google may set its own cookies when the map is loaded. These cookies are controlled by Google, not by us. You can prevent this by declining external services when the consent banner is shown.

9. Analytics and Tracking

This website does not use any web analytics, tracking, or advertising tools. We do not use Google Analytics, Facebook Pixel, LinkedIn Insight Tag, or any similar service. No behavioural data is collected, and no user profiles are created.

10. Third-Party Services and Data Recipients

We only share personal data with third parties when this is necessary to operate our website. The following third-party service is used:

  • Mittwald CM Service GmbH & Co. KG (hosting): Königsberger Straße 4–6, 32339 Espelkamp, Germany. Our website is hosted on Mittwald servers located in Germany. Mittwald acts as a data processor and processes server log data in accordance with our instructions and a data processing agreement (Auftragsverarbeitungsvertrag) pursuant to Art. 28 GDPR. Mittwald Privacy Policy.
  • Google Maps (map display, consent-gated): Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Our contact page offers an embedded Google Maps view to show our office location. This map is not loaded by default. It is only loaded after you give explicit consent via our consent banner. When the map is loaded, your browser establishes a connection to Google servers, transmitting your IP address. Google may also set cookies. The data transfer to the USA is safeguarded by Google's adherence to standard contractual clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR (your explicit consent). You can withdraw consent at any time by clearing your browser's localStorage. Google Privacy Policy.

Form submissions are processed on our own server (see Section 5.4). Web fonts are hosted locally on our server (see Section 7). Icon libraries are also hosted locally.

No personal data is sold, rented, or otherwise shared with third parties for marketing or advertising purposes.

11. International Data Transfers

By default, this website does not transfer any personal data to countries outside the European Union or the European Economic Area (EU/EEA). Our hosting provider is located in Germany, form submissions are processed on our own German server, and web fonts and icon libraries are served locally. The only exception is Google Maps, which is loaded only after you give explicit consent (see Section 10). If you consent, your IP address is transmitted to Google LLC (USA). This transfer is safeguarded by standard contractual clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework. If you decline consent, no data leaves the EU/EEA.

12. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us at datenschutz@orago.de.

  • Right of access (Art. 15 GDPR) — You have the right to obtain confirmation as to whether personal data concerning you is being processed and, if so, to access that data and receive further information about the processing.
  • Right to rectification (Art. 16 GDPR) — You have the right to request the correction of inaccurate personal data and the completion of incomplete data.
  • Right to erasure (Art. 17 GDPR) — You have the right to request the deletion of your personal data where one of the grounds set out in Art. 17 GDPR applies, for example if the data is no longer necessary for its original purpose.
  • Right to restriction of processing (Art. 18 GDPR) — You have the right to request that we restrict the processing of your personal data under certain circumstances.
  • Right to data portability (Art. 20 GDPR) — You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
  • Right to object (Art. 21 GDPR) — You have the right to object at any time to the processing of your personal data which is based on Art. 6(1)(f) GDPR (legitimate interest). If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests.
  • Right to withdraw consent (Art. 7(3) GDPR) — Where processing is based on your consent, you have the right to withdraw that consent at any time. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We will respond to your request without undue delay and in any event within one month of receipt.

13. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that our processing of your personal data infringes the GDPR (Art. 77 GDPR). The competent supervisory authority for ORAGO GmbH is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany

Phone: +49 611 1408-0
Website: datenschutz.hessen.de

14. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes to our website, services, or legal requirements. The current version is always available at this URL. The date of the last update is shown at the top of this page.

15. Contact for Privacy Inquiries

If you have questions about this privacy policy or wish to exercise any of your rights, please contact:

ORAGO GmbH
Data Protection
Lindleystraße 8A
60314 Frankfurt am Main
Germany

Email: datenschutz@orago.de
Phone: +49 (0)69 / 247 45 99 - 0