Privacy Policy

This privacy policy applies to the ORBYX website at www.orbyx-official.com, hosted by STRATO. Last updated: 17 September 2026.

1. Data controller

Email: mail@orbyx-official.com

2. Hosting and server logs

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO processes the data required to operate the website on our behalf. A data processing agreement under Article 28 of the General Data Protection Regulation (GDPR) is in place with STRATO.

When you visit the website, data processed includes your IP address, date and time, requested page or file, response status, volume of data transferred, and information provided by your browser about its type, operating system and, where applicable, referring page.

This processing enables website delivery, troubleshooting and the detection and prevention of attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to operate a secure and reliable website. The website cannot be delivered without the technically necessary connection data.

Under the service specification agreed with STRATO, website visitor logs are retained for no more than seven days. Ordinary processing takes place in the European Union or European Economic Area. For any service-specific transfers to other countries that may be necessary, the agreement requires compliance with Articles 44 et seq. GDPR.

3. Cookies, analytics and locally served content

This website does not use analytics, advertising or tracking services. Outside the contact form, the website code does not set cookies. No visitor identifiers are stored in local storage or session storage. Images, styles and JavaScript are served from our own web hosting space. No external font services, videos or music players are embedded.

The rotating album feature runs directly in your browser. It does not create a user profile or store a persistent identifier.

The contact form uses the strictly necessary session cookie ORBYXCONTACT to securely associate the form with its submission, prevent unauthorised submissions and limit sending frequency. It is a session cookie, normally removed by your browser when the session ends, unless session restoration is used. On subsequent use, the form code discards session state that is more than one hour old. Server-side session files may remain until the hosting provider automatically removes them. The form session stores only security values, timestamps and sending status, not message content.

Access to the cookie is necessary for the form you expressly request, under Section 25(2), point 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The associated personal data processing is based on Article 6(1)(f) GDPR and our legitimate interest in operating a secure contact form.

4. Links to music platforms

Spotify, Apple Music and Amazon Music are included only as external links. Simply visiting our website does not cause its code to load content from these platforms. Following a link takes you away from our website, after which the selected platform processes data under its own responsibility and privacy policy. These links do not send a referring page, and we do not record link clicks.

5. Contact by email or contact form

When you contact us by email or through the form, we process your email address, message and any name or other information you voluntarily provide, in order to handle and answer your enquiry. STRATO provides our email mailbox under the agreed data processing arrangement.

The form requires your email address and message; your name is optional. Your message is sent to our STRATO mailbox. No separate message database is created. A hidden form field and time-based sending limits help prevent automated submissions; no external CAPTCHA providers are used. Your details are not used for newsletters or advertising profiles.

For general enquiries, the legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in answering incoming messages. Where an enquiry concerns entering into or performing a contract, Article 6(1)(b) GDPR applies. Providing information is voluntary, but we cannot reply without a return contact address.

Ordinary email enquiries are deleted no later than six months after they have been fully resolved. Where statutory retention obligations apply, the affected messages are retained until the relevant legal retention period expires.

Under the agreed service specification, STRATO retains technical email service logs for no more than six months. This technical retention period is separate from the retention of message content in our mailbox.

6. Your data protection rights

Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability under Articles 15 to 20 GDPR. Where processing is based on consent, you may withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before it.

7. Right to object

Where we process your data under Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. We will then stop processing the data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is necessary for establishing, exercising or defending legal claims. You may object to processing for direct marketing at any time.

You can exercise your rights by contacting us using the details above.

8. Right to lodge a complaint

Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, particularly in the EU Member State of your habitual residence, workplace or the alleged infringement. In North Rhine-Westphalia, this is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia. Information and contact details are available at www.ldi.nrw.de.

9. Automated decisions

We do not use this website to make decisions based solely on automated processing that produce legal or similarly significant effects, and we do not carry out profiling within the meaning of Article 22 GDPR.