ORBAISE
This English version is provided for convenience. In case of discrepancies, the German version shall prevail.
Privacy Policy
As of October 2026
We are pleased that you are visiting our online shop. The protection of your personal data is important to us. Below we inform you, in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR), about the processing of personal data when you use our online shop.
1. Controller
The controller within the meaning of the GDPR is:
ORBAISE GmbH
Auf der Eierwiese 3a, 82031 Grünwald, Germany
Represented by the managing directors: Antonia Jacobs, Lena Werner
Commercial register: Amtsgericht München, HRB 310773
Email: hello@orbaise.com
Phone: +49 152 53231298
2. General information on data processing
We process personal data of our users only to the extent necessary to provide a functioning online shop and our content and services. The legal bases are in particular Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interest).
Your data will be deleted or blocked as soon as the purpose of storage no longer applies, unless statutory retention obligations (in particular under commercial and tax law, §§ 147 AO, 257 HGB: six or eight/ten years) prevent deletion.
3. Shop system and hosting (Shopify)
Our online shop is operated via the shop system of Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). Shopify provides the technical platform, hosting, and functions for processing orders, payments and shipping.
Personal data that you enter in our shop (e.g. name, address, email address, phone number, order and payment data) is processed on Shopify’s servers. Shopify acts for us as a processor within the meaning of Art. 28 GDPR; we have concluded a corresponding data processing agreement (Data Processing Addendum) with Shopify.
As part of the processing by Shopify, data may be transferred to Shopify Inc. in Canada and to affiliated companies in the USA. For Canada, an adequacy decision of the EU Commission exists (Art. 45 GDPR). Transfers to the USA are based on the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses (Art. 46 GDPR).
The legal basis for the use of Shopify is Art. 6(1)(b) GDPR (contract processing) and Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient operation of our online shop). Further information: https://www.shopify.com/de/legal/datenschutz.
4. Server log files
Each time our online shop is accessed, data transmitted by your browser is automatically collected: IP address, date and time of the request, page accessed, browser type and version, operating system, referrer URL. This data is not merged with other data sources and serves to ensure trouble-free operation, system security and the prevention of misuse. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after 14 days.
5. Cookies and consent management
Our online shop uses cookies and similar technologies. Where these are technically strictly necessary for the operation of the shop (e.g. shopping cart function, login, security and language settings), they are stored on the basis of § 25(2) no. 2 TDDDG; the processing of related personal data is based on Art. 6(1)(f) GDPR.
All cookies that are not technically necessary (e.g. for statistics or marketing) are only set if you have expressly consented to them via our consent banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw or adjust your consent at any time with effect for the future via the cookie settings in the shop.
6. Order processing and customer account
To process your order, we process the data you provide during the order process (name, delivery and billing address, email address, phone number if applicable, order data, payment data). The legal basis is Art. 6(1)(b) GDPR. Providing this data is necessary to conclude the contract.
To deliver the goods, we pass on your name, your delivery address and – where necessary for delivery – your email address or phone number to the shipping company commissioned with the delivery (DHL). The legal basis is Art. 6(1)(b) GDPR.
Storage, picking and shipping of the goods are handled by a logistics service provider commissioned by us. For this purpose we transmit your name, your delivery and, if applicable, billing address, your email address and phone number as well as the order data to the service provider, who processes the data on our behalf. The legal basis is Art. 6(1)(b) GDPR.
For deliveries to countries outside the European Union, your data is transmitted to the shipping service provider and, in the course of customs clearance, where applicable to the competent customs authorities of the destination country. The legal basis is Art. 6(1)(b) GDPR or Art. 49(1)(b) GDPR.
Gift cards: When you purchase a gift card, we process your order and payment data as well as the recipient’s email address and, if applicable, their name, your message and the desired delivery date in order to send the gift card by email. This is done via Shopify. If you give a gift card as a present, you provide us with personal data of the recipient; please do so only if you are authorised to. When the gift card is redeemed, we process the gift card code, the balance and the redemption data. The legal basis is Art. 6(1)(b) GDPR. The data is stored for the period of validity of the gift card and beyond that only in accordance with statutory retention obligations.
Withdrawal function: To exercise your right of withdrawal, we provide an electronic withdrawal function. The application “EU Widerruf Button” of 401layers UG is used. When you use it, we process the data you enter (name, email address, order number, content of the withdrawal declaration) in order to handle and document your withdrawal. The legal basis is Art. 6(1)(b) and (c) GDPR.
If you create a customer account, we process the data stored there for the performance of the contract (Art. 6(1)(b) GDPR) until you delete the account; statutory retention obligations remain unaffected.
7. Payment service providers
Shopify Payments: We offer payment via Shopify Payments (including credit card, Apple Pay, Google Pay). The provider is Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; payment processing is technically carried out via Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Your payment data (e.g. cardholder, card number, amount) is transmitted directly to the payment service provider and processed exclusively for payment processing. The legal basis is Art. 6(1)(b) GDPR.
PayPal: When paying via PayPal, payment processing is carried out by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The data required for payment processing is transmitted to PayPal. The legal basis is Art. 6(1)(b) GDPR. PayPal’s privacy notices additionally apply: https://www.paypal.com/de/legalhub/privacy-full.
8. Newsletter and email marketing
When you subscribe to our newsletter, we use your email address to send you information about products, offers and promotions. Subscription takes place using the double opt-in procedure: after signing up, you receive an email with a confirmation link; your address is only added to the mailing list after confirmation. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by contacting us. We send our newsletter via Shopify (Shopify International Limited, see section 3); Shopify processes your email address and your consent on our behalf.
To existing customers whose email address we received in connection with the sale of goods, we may send direct advertising for our own similar goods pursuant to § 7(3) UWG (legal basis: Art. 6(1)(f) GDPR). You may object to this use at any time without incurring any costs other than the transmission costs at basic rates.
9. Contact
When you contact us by email, phone or contact form, we process your details to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR. The data is deleted as soon as it is no longer required to handle the enquiry and no retention obligations apply.
10. Your rights as a data subject
You have the following rights against us regarding your personal data:
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
11. Data security
Our online shop uses SSL/TLS encryption. As a result, data you transmit to us cannot be read by third parties. We also take appropriate technical and organisational measures in accordance with Art. 32 GDPR.
12. Changes to this privacy policy
We reserve the right to adapt this privacy policy to reflect changes in the legal situation or in our services. The version currently published in the shop applies.
This English version is provided for convenience. In case of discrepancies, the German version shall prevail.
Legal Notice
Information pursuant to § 5 of the German Digital Services Act (Digitale-Dienste-Gesetz, DDG):
ORBAISE GmbH
Auf der Eierwiese 3a, 82031 Grünwald, Germany
Represented by the managing directors: Antonia Jacobs, Lena Werner
Contact
Phone: +49 152 53231298
Email: hello@orbaise.com
Commercial register
Entered in the commercial register.
Registry court: Amtsgericht München (Munich Local Court)
Registration number: HRB 310773
VAT identification number
VAT identification number pursuant to § 27a of the German VAT Act: DE461557825
Consumer dispute resolution
We are neither obliged nor willing to participate in dispute resolution proceedings before a consumer arbitration board (§ 36 VSBG).
As of October 2026