Privacy Policy

DruckOrbit Alexander Krenik An der Kirche 4 35260 Stadtallendorf Email: kontakt@druckorbit.com Phone: +49 157 536 80 777

When you place an order, we collect the following data: name, email address, street, postal code, city and optionally your phone number. Additionally, uploaded PDF files and your selected print options (copies, binding, print mode etc.) are stored.

Purpose: Processing and fulfillment of your order, shipping and customer communication.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

Retention period: Order data and PDF files are stored for the duration of the business relationship and beyond in accordance with statutory retention periods (up to 10 years).

When using the contact form, we collect: name, email address, subject and message.

Purpose: Processing your inquiry and getting in touch.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Retention period: Contact requests are stored until fully processed and beyond in accordance with statutory retention periods.

We keep an account for customers and partners. For this we store your email address, a hash of your password if you set one (never the password itself), the language for our emails and the times of the invitation and of the confirmation of your address. A customer account also includes your customer number as well as the name and, where applicable, the company you provide when signing up or that we record when inviting you.

You sign in with a link sent to your email address or with your password. Each link works only once and only for a short time; we only store a check value (hash), never the link itself. For each sign-in we store a session with the time of sign-in and of the last activity. It ends when you sign out, after 30 days without activity, and at the latest after 90 days. To protect against password guessing, we count failed attempts on your account: after five failed attempts, signing in with a password is blocked for 15 minutes, while the sign-in link keeps working.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures) for the account, Art. 6(1)(f) GDPR (legitimate interest in the security of accounts) for sessions and failed attempts.

Storage period: we automatically delete expired sessions and sign-in links, links no later than seven days after they expire. A self-created account without a confirmed email address is deleted after 7 days. You can delete your account yourself in the account settings once no scan job and no partner settlement is pending. Your customer number then remains without any personal reference so that it is never assigned again. We keep data from orders and invoices for as long as we are legally required to (up to 10 years).

We occasionally inform customers by email about similar services from DruckOrbit (Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Unfair Competition Act, UWG). You can unsubscribe at any time, a short email to kontakt@druckorbit.com is enough.

If you, as a customer, send us documents to scan, we create a scan job for them in your customer account. For this we store the job number, the dates of receipt, processing and return, the tracking number of the return shipment, the scans as files with their file names, and whether you have downloaded them. For invoicing and the return shipment we store your billing address, your VAT ID if applicable, and a different return address if you give one.

Storage period: the scans are kept on our server in Germany and are available for download for 30 days after completion. As long as you have not downloaded all files, we remind you by email beforehand. After that we delete the scans automatically, immediately if you delete your account. We store your addresses until you change them or delete your account. We keep invoices and the related job data for as long as we are legally required to (up to 10 years).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract), and Art. 6(1)(c) GDPR (legal retention obligation) for keeping invoices.

We use Stripe (Stripe Inc., 510 Townsend Street, San Francisco, CA 94103, USA) for payment processing. When placing an order, your email address and order data are transmitted to Stripe. Your payment details (credit card etc.) are entered directly on the Stripe page - we do not receive or store any payment data.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

Stripe processes your data partly in the USA. The transfer is based on EU Standard Contractual Clauses. More information: https://stripe.com/privacy

We ship parcels with DHL (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany). For delivery, we pass your name and delivery address on to DHL.

We also pass your email address on to DHL so that DHL can announce the delivery to you. That way you know when your parcel arrives. If you do not want this, untick the box "DHL parcel notification" when ordering. You can also object at any time later, a short email to kontakt@druckorbit.com is enough.

Legal basis: Art. 6(1)(b) GDPR (contract performance) for name and address, Art. 6(1)(f) GDPR (legitimate interest in a smooth delivery) for the email address.

Our PDF color analysis analyzes uploaded PDFs on the server to detect color and black-and-white pages. PDFs are used exclusively for analysis and deleted immediately afterwards - no permanent storage takes place.

All other PDF tools (merge, delete pages, remove blank pages, image conversion, grayscale conversion) process your files exclusively locally in your browser. No data is transmitted to our server.

When you upload a file in the ordering process (product configurators, print cost calculator), we keep it on our server in Germany after the analysis so you do not have to upload it again at checkout. This temporary storage ends no later than 24 hours after your last upload; files that are not ordered are then deleted automatically.

Once you place an order, the file becomes part of your order data and the retention periods from the Order Data section apply.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures and performance of contract).

We only use technically necessary cookies:

- Session cookie: set for technical reasons when you visit and used for signing in to the customer account, the partner area and the admin area. After you sign in to an account it is kept for up to 90 days and then contains a random session identifier, never a password. - Colour mode: your choice between light and dark design is stored locally in your browser (localStorage) - Rate limit bypass: optional cookie to bypass the request limit (only after authentication) - Referral code ("do_ref"): only if you arrive through a referral link. It contains the voucher code only, so that your benefit is kept in the cart. Lifetime 30 days, see the next section. - Cart ID ("do_cart"): links your temporarily stored print files to your cart so you do not have to upload them again at checkout. Contains only a random identifier, no personal data. Lifetime 30 days.

We do not use advertising cookies or third-party cookies for advertising purposes. We do not build user profiles and do not pass any data on to advertising networks.

If you arrive through a partner referral link (address containing "?ref="), we store the corresponding voucher code in a cookie named "do_ref". It contains only this code, no personal data, and is deleted automatically after 30 days. The code is applied in the cart so that your benefit is not lost; you can remove it there at any time, which also deletes the cookie.

Independently of that, on your first visit your browser remembers which page you came to us from (referring address and page opened). This is stored locally in your browser (localStorage, key "do_attribution", 30 days) and is only transmitted to us together with an order. We evaluate it purely statistically to see which channels work; we do not link it to you personally for that purpose.

If you register as a partner, we process your name, email address, address, tax status, VAT identification number where applicable, and bank details. We need this data for the partner contract and for settlement by way of self-billing.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in correctly attributing referrals) for the referral code and origin, Art. 6(1)(b) GDPR (performance of a contract) for the partner data.

Storage period: referral code and origin 30 days in the browser, the origin afterwards with the order. Partner data and statements are subject to the statutory retention periods (up to 10 years). A partner account without a confirmed email address is deleted after 7 days. If you delete your account and there are already redemptions or statements, we anonymise your partner profile; the credit notes are kept as records.

When placing an order, you receive an order confirmation by email. When using the contact form, you receive a receipt confirmation. Emails are sent via our own mail server (Plesk/Postfix).

Legal basis: Art. 6(1)(b) GDPR (contract performance) or Art. 6(1)(f) GDPR (legitimate interest).

This website is hosted on a server of IONOS SE in Germany. The connection to the website is SSL/TLS encrypted (HTTPS).

Server log files: When accessing the website, technical access data is automatically recorded (IP address, time, requested page, browser type). This data is used exclusively to ensure operation and detect abuse, and is automatically deleted after 7 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure provision of the website).

To protect against abuse, we temporarily store your IP address in server memory for certain functions (PDF analysis, contact form, sign-in). This data is not permanently stored and is automatically deleted after one hour at most. We additionally count failed sign-in attempts on the account itself, see "Customer account and sign-in".

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protection against abuse).

Fonts: The fonts used (Manrope, Inter) are served locally from our own server. No connection to Google or other external servers takes place.

PDF.js: A library is loaded from Cloudflare's CDN service (cdnjs) for displaying PDFs in the browser. Your IP address is transmitted to Cloudflare.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technically correct display of the website).

You have the right at any time to:

- Access your stored data (Art. 15 GDPR) - Rectification of inaccurate data (Art. 16 GDPR) - Erasure of your data (Art. 17 GDPR) - Restriction of processing (Art. 18 GDPR) - Data portability (Art. 20 GDPR) - Object to processing (Art. 21 GDPR)

To exercise your rights, contact: kontakt@druckorbit.com

You also have the right to lodge a complaint with a data protection supervisory authority.

We reserve the right to update this privacy policy to adapt it to changed legal requirements or changes to the service. The current version applies.