Privacy Policy
Important Notice: This English version of the Privacy Policy is provided for convenience only. In the event of any discrepancies, inconsistencies, or conflicts, the German version ("Datenschutzerklärung") shall prevail and is legally binding.
1. Information on the Collection of Personal Data and Contact Details of the Controller
2. Data Collection When Visiting Our Website
3. Cookies
4. Data Processing for Order Handling
5. Data Processing When Opening a Customer Account and for Contract Execution
6. Contacting Us
7. Use of Your Data for Direct Marketing
8. Use of Social Media: Video
9. Web Analytics Services
10. Tools and Miscellaneous
11. Data Subject Rights
12. Duration of Storage of Personal Data
1. Information on the Collection of Personal Data and Contact Details of the Controller
1.1 Thank you for visiting our website. Below, we inform you about the handling of your personal data when using our website. Personal data is any data by which you can be personally identified.
1.2 Controller for the processing of data on this website within the meaning of the General Data Protection Regulation (GDPR):
Orafino GmbH
Steigestr. 64
Eberbach, Germany
Phone: +49 62718039672
Email: info@orafino.de
1.3 To protect the security of your data during transmission, we use state-of-the-art encryption procedures (e.g., SSL or TLS) via HTTPS.
2. Data Collection When Visiting Our Website
Each time our website is accessed, our system automatically collects data and information transmitted by your browser to our server (so-called "server log files"). The following technically necessary data is collected:
– Visited website
– Date and time of access
– Amount of data sent in bytes
– Source/reference from which you accessed the page
– Operating system used
– Browser used
– IP address (if applicable, anonymized)
The legal basis for processing is Art. 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. Data is not passed on or used otherwise. Temporary storage of the IP address is necessary to deliver the website to your device and is stored for the duration of the session.
We reserve the right to review server log files retrospectively if there are concrete indications of unlawful use. Data is deleted as soon as it is no longer required for the purpose for which it was collected. For website provision, this is when the session ends.
In the case of storage in log files, deletion occurs after a maximum of seven days. Further storage is possible, in which case IP addresses are deleted or anonymized so that identification of the accessing client is no longer possible. Collection of this data is essential for website operation; therefore, there is no right to object.
3. Cookies
Our website uses cookies.
Cookies are text files stored on your device. Some functions of our website cannot be provided without cookies, requiring the browser to be recognized after a page change. User data collected by technically necessary cookies is not used to create user profiles. The legal basis is Art. 6(1)(f) GDPR.
Additionally, our website uses cookies that enable analysis of user browsing behavior (so-called third-party cookies). Details regarding scope, purpose, legal basis, and opt-out options are provided in the respective sections of this Privacy Policy.
You have full control over the use of cookies. You can disable, restrict, or delete cookies via your browser settings. Disabling cookies may limit the functionality of our website. Flash cookies can be prevented by changing Flash Player settings.
Help with cookie settings can be found in your browser's help menu:
Internet Explorer: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac
Opera: https://help.opera.com/en/latest/web-preferences/#cookies
Some cookies are deleted after closing your browser (session cookies). Others remain on your device and enable us or our partner companies (third-party cookies) to recognize your browser on your next visit (persistent cookies). When cookies are set, they collect certain user information such as browser and location data as well as IP address values. Persistent cookies are automatically deleted after a predetermined period, which may vary by cookie.
4. Data Processing for Order Handling
4.1 To place an order in our webshop, you must provide personal data required for contract execution. We process the data you provide in order to fulfil your order.
We work with external service providers to process orders. This requires us to share the necessary personal data with them.
Where we engage transport companies for delivery, we share the data required for delivery with the respective carrier. For payment processing, we share your data as necessary with the appointed credit institution. Where we use payment service providers, you will also be informed of this below.
Legal basis for data sharing: Art. 6(1)(b) GDPR.
5. Data Processing When Opening a Customer Account and for Contract Execution
When you open a customer account, personal data is collected and processed in accordance with Art. 6(1)(b) GDPR. The scope of data is evident from the input form. The data you enter is stored and used by us for contract execution.
You may delete your customer account at any time by contacting the controller or, where available, directly within the customer account. In that case, we will block your data in accordance with tax and commercial law retention obligations and delete it after the expiry of those periods, unless your consent to permanent storage or a legally permitted further use of data on our part prevents this.
6. Contacting Us
When you contact us via a contact form, the data entered in the form is transmitted to us and stored. The data collected is evident from the respective input form. When contacting us by email, only the data you provide is transmitted to us.
Data is used exclusively for processing the conversation and your enquiry. Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interest), and Art. 6(1)(b) GDPR where contact is aimed at concluding a contract.
Data is deleted as soon as it is no longer required for the purpose for which it was collected and no statutory retention obligations apply. This is the case when the respective conversation with the user has ended – i.e., when it can be inferred from the circumstances that the matter in question has been conclusively resolved.
You may withdraw your consent to the processing of personal data at any time. If you contact us by email, you may object to the storage of your personal data at any time. In such a case, the conversation cannot be continued.
7. Use of Your Data for Direct Marketing
7.1 Newsletter
Our website offers the option to subscribe to a free newsletter. When signing up, the data entered in the form is transmitted to us. Only your email address is mandatory. Any voluntary additional information is used solely for personalised addressing.
Legal basis: Art. 6(1)(a) GDPR (consent via double opt-in). After signing up, you will receive a confirmation email containing a confirmation link. By clicking this link, you also provide consent to receive the newsletter.
When submitting the newsletter registration, we store your IP address as well as the date and time of registration. This storage serves to trace any potential misuse of your email address.
We use the data collected during newsletter registration exclusively for the purpose of sending the newsletter.
You may unsubscribe from the newsletter at any time via the unsubscribe link included in every newsletter. This also constitutes a withdrawal of consent to the storage of personal data collected during the registration process.
7.2 Newsletter for Existing Customers
If you purchase goods or services on our website and provide your email address, we may subsequently use it to send a newsletter. In such cases, the newsletter will contain only direct advertising for our own similar goods or services.
Legal basis: § 7(3) UWG and Art. 6(1)(f) GDPR. Data processing is based solely on our legitimate interest in personalised direct advertising.
If you have already objected to the use of your email address for direct marketing purposes, you will not receive this newsletter. You may also object at any time to the use of your email address for the purposes stated here. After receipt of your objection, the use of your email address for advertising purposes will be ceased immediately.
8. Use of Social Media: Video
Use of YouTube Videos
On this website, we use the YouTube embedding function to display and play videos from "YouTube", which is part of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). We use the enhanced privacy mode, which according to the provider only initiates storage of user information when a video is played. When you start playback of an embedded YouTube video, "YouTube" sets cookies to collect information about your user behaviour. According to YouTube, these serve, among other purposes, to record video statistics, improve usability, and prevent abusive behaviour. If you are logged into Google, your data will be linked directly to your account.
If you do not wish your data to be associated with your YouTube profile, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and evaluates them.
Such evaluation occurs pursuant to Art. 6(1)(a) GDPR on the basis of your explicit consent.
You have the right to object to the creation of these user profiles, for which you must contact YouTube directly. Regardless of whether embedded videos are played, a connection to Google's "DoubleClick" network is established each time this website is accessed, which may trigger additional data processing outside our control.
Data may also be transmitted to servers of Google LLC in the USA. Further information on data protection at YouTube is available in the provider's privacy policy at: https://www.google.de/intl/en/policies/privacy
Opt-out available at: https://adssettings.google.com/authenticated
9. Web Analytics Services
9.1 Tracking Pixels / Conversion Tracking (Meta & TikTok)
In addition to the technologies mentioned above, we use so-called pixels from the Meta (Facebook / Instagram) and TikTok platforms on our website, provided you have given your consent. These pixels enable us to detect whether users arrive at our website after clicking on an advertisement placed by us on Meta or TikTok and perform certain actions there (e.g., purchase, registration).
Processing is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You may amend or withdraw this consent at any time via our cookie settings.
We have concluded appropriate data processing agreements with Meta and TikTok or implemented the contractual standard clauses (e.g., EU Standard Contractual Clauses) where required.
Please note that Meta and TikTok may carry out their own analyses beyond the pixel data, over which we have no influence. Further information on data processing is available from Meta at https://www.facebook.com/about/privacy and from TikTok at https://www.tiktok.com/legal/privacy-policy-eea.
Where personal data is transferred to third countries (e.g., the USA), this is done using EU Standard Contractual Clauses or other permissible safeguards.
9.2 Google Universal Analytics
We use the web analytics service Google Analytics (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) on this website.
Google Analytics uses cookies – text files stored on your computer that enable analysis of your use of the website.
The information generated about your use of this website (including the truncated IP address) is transmitted to a Google server and stored there, with transmission to the USA being possible.
We use Google Analytics with the "_anonymizeIp()" extension, which ensures anonymization of the IP address by truncation and excludes direct personal identification. Your IP address is therefore truncated by Google within Member States of the European Union or in other contracting states of the Agreement on the European Economic Area. In exceptional cases, the full IP address is transmitted to a Google server in the USA and truncated there. In these exceptional cases, processing is carried out pursuant to Art. 6(1)(f) GDPR. Our legitimate interest lies in the statistical analysis of user behaviour for optimisation and marketing purposes.
On our behalf, Google uses this information to evaluate your use of the website, to compile reports on website activity, and to provide us with further services related to website and internet use. Your IP address collected in this context is not merged with other Google data.
You can prevent cookies from being stored by adjusting your browser settings accordingly.
You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and its processing by Google by downloading and installing the following browser plugin:
http://tools.google.com/dlpage/gaoptout?hl=de
This website also uses Google Analytics for cross-device analysis of visitor flows, carried out via a User ID. You can disable cross-device analysis of your usage in your customer account under "My Data" / "Personal Data".
Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de
10. Tools and Miscellaneous
10.1 Google reCAPTCHA
We use the reCAPTCHA function of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") pursuant to Art. 6(1)(f) GDPR based on our legitimate interest in preventing misuse and spam.
reCAPTCHA is a function designed to ensure that input is made by a natural person. The service transmits your IP address and, if applicable, further data required by Google for the reCAPTCHA service to Google.
The use of Google reCAPTCHA may also result in the transmission of your personal data to servers of Google LLC in the USA.
Details on Google reCAPTCHA and Google's privacy policy can be found at: https://www.google.com/intl/de/policies/privacy/
10.2 Google Maps
We use "Google Maps" (API) from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").
Google Maps is used for the display of interactive maps and the creation of directions. Through the use of Google Maps, information about your use of this website, including your IP address and the (starting) address entered in the route planner function, may be transmitted to Google. When you access a page on our website that contains Google Maps, your browser establishes a direct connection with Google's servers. The map content is transmitted directly from Google to your browser and embedded in the page. We therefore have no influence over the scope of data collected by Google in this way. To our knowledge, this includes at least the following data:
– Date and time of the visit to the relevant page
– Internet address or URL of the accessed page
– IP address, (starting) address entered in route planning
We have no influence over the further processing and use of data by Google and therefore cannot accept responsibility for this. If you are logged into Google, your data will be linked directly to your Google account. If you do not wish this to occur, you must log out of Google beforehand. Google stores your data (including that of non-logged-in users) as usage profiles and evaluates them. Such evaluation is carried out pursuant to Art. 6(1)(a) GDPR on the basis of your explicit consent.
If you do not wish Google to collect, process, or use data about you via our website, you can disable JavaScript in your browser settings. In that case, however, you will not be able to use the map display. For details on the purpose and scope of data collection and further processing and use by Google, as well as your rights and settings options to protect your privacy, please refer to Google's privacy notices: https://policies.google.com/privacy?hl=de
Google's terms of use: http://www.google.de/intl/de/policies/terms/regional.html
Google Maps terms of use: https://www.google.com/intl/de_US/help/terms_maps.html
Further information on data protection: http://www.google.de/intl/de/policies/privacy/
10.3 Google Web Fonts
We use web fonts provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") for the uniform display of typefaces.
When you access our website, your browser loads the required web fonts into the browser cache.
For this purpose, your browser must establish a connection to Google's servers, which transmits your IP address to Google. This may also result in the transmission of your personal data to servers of Google LLC in the USA.
Legal basis: Art. 6(1)(a) GDPR, namely your explicit consent.
If your browser does not support web fonts or you decline their use, a default font from your computer will be used.
Details on Google Web Fonts: https://developers.google.com/fonts/faq
Google's privacy policy: https://www.google.com/policies/privacy/
11. Data Subject Rights
11.1 Applicable data protection law grants you comprehensive rights as a data subject (rights of access and intervention) with regard to the processing of your personal data by the controller, of which we inform you below:
– Right of access pursuant to Art. 15 GDPR:
You may request confirmation from the controller as to whether personal data concerning you is being processed. You also have the right to information about the purpose, the categories of personal data, the recipients, the planned storage duration, and the existence of further rights such as rectification or the right to lodge a complaint with a supervisory authority, the origin of your data if not collected by us, the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved and the significance and intended effects of such processing, as well as your right to be informed of the guarantees pursuant to Art. 46 GDPR when your data is transferred to third countries.
– Right to rectification pursuant to Art. 16 GDPR:
You have the right to immediate rectification of inaccurate data concerning you and/or completion of incomplete data stored by us; rectification or completion must be carried out without delay.
– Right to restriction of processing pursuant to Art. 18 GDPR:
You have the right to request restriction of the processing of your personal data while the accuracy of your data is being verified; if you object to deletion of your data due to unlawful processing and instead request restriction of processing; if you require your data for the establishment, exercise, or defence of legal claims after we no longer need the data for the purposes; or if you have lodged an objection on grounds of your particular situation, pending verification of whether our legitimate grounds override yours.
Where processing of your personal data has been restricted, such data may – apart from storage – only be processed with your consent or for the establishment, exercise, or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. You will be informed by the controller before the restriction is lifted.
– Right to erasure pursuant to Art. 17 GDPR:
You have the right to request the immediate deletion of your personal data where the conditions of Art. 17(1) GDPR are met. This right to erasure does not apply in particular – without limitation – where processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defence of legal claims.
– Right to notification pursuant to Art. 19 GDPR:
Where you have exercised your right to rectification, erasure, or restriction of processing, the controller is obliged to communicate such rectification, erasure, or restriction to all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You also have the right to be informed of those recipients.
– Right to data portability pursuant to Art. 20 GDPR:
You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request its transmission to another controller, insofar as this is technically feasible.
– Right to withdraw consent pursuant to Art. 7(3) GDPR:
You have the right to object at any time to the processing of personal data concerning you carried out on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions.
You also have the right to withdraw your data protection consent declaration at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal.
– Right to lodge a complaint pursuant to Art. 77 GDPR:
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.
11.2 Right to Object
You have the right to object at any time, with effect for the future, to the processing of your data where we process your data on the basis of our overriding legitimate interest following a balancing of interests.
If you exercise this right to object, we will cease processing your data unless demonstrably compelling legitimate grounds for continued processing exist that override your interests, or the further processing serves the establishment, exercise, or defence of legal claims.
12. Duration of Storage of Personal Data
The duration of storage of personal data depends in each case on the applicable statutory retention periods. After their expiry, we routinely delete the data where it is no longer required for the fulfilment or initiation of a contract and/or where we have no legitimate interest in further storage.