Privacy Policy
Protecting your personal data is a priority for us. Below, we inform you transparently in accordance with Art. 13 and Art. 14 of the General Data Protection Regulation (GDPR) and the German Telecommunications-Digital Services Data Protection Act (TDDDG) about how your data is processed when you visit our website orbsmart.de and in the context of customer and business relationships.
1. Data Controller
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Capoyo GmbH
Rotwandweg 3, 82024 Taufkirchen, Germany
Represented by the Managing Directors: Oliver Bucher, Lars Geipel
Phone: +49 (0) 89 44 14 11 40
Email: info@orbsmart.de
Rotwandweg 3, 82024 Taufkirchen, Germany
Represented by the Managing Directors: Oliver Bucher, Lars Geipel
Phone: +49 (0) 89 44 14 11 40
Email: info@orbsmart.de
2. Your Rights as a Data Subject
Provided the statutory requirements are met, you have the following rights regarding your personal data:
Right of access (Art. 15 GDPR): You have the right to request confirmation as to whether and which personal data concerning you we process, and to receive a copy of such data.
Right to rectification (Art. 16 GDPR): You may request the immediate correction of inaccurate data or the completion of incomplete data.
Right to erasure (Art. 17 GDPR): You may request the deletion of your personal data, provided no statutory retention obligations or overriding legal grounds conflict with this.
Right to restriction of processing (Art. 18 GDPR): You may request a restriction of processing under the statutory conditions.
Right to data portability (Art. 20 GDPR): You have the right to receive data that you have provided to us based on consent or a contract in a structured, commonly used, and machine-readable format.
Right to object (Art. 21 GDPR): Insofar as we process data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to the processing at any time on grounds relating to your particular situation. Where data is processed for direct marketing purposes, you may object at any time without stating reasons.
Right to withdraw consent (Art. 7(3) GDPR): You may withdraw any consent once given at any time with effect for the future, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for our registered office in Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (www.lda.bayern.de).
3. Hosting, SSL/TLS Encryption & Server Log Files
Managed Hosting in Germany: Our website is hosted by HostPress GmbH (Bahnhofstraße 34, 66571 Eppelborn, Germany). We have concluded a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR with our hosting provider, ensuring that personal data is processed exclusively in accordance with our instructions and in compliance with the GDPR on servers located in Germany.
SSL/TLS Encryption: For security reasons and to protect the transmission of confidential content (such as inquiries submitted via our contact forms), this website uses SSL/TLS encryption (indicated by "https://" and the lock icon in your browser's address bar).
Server Log Files & Local IT Security: Each time you access our website, our web server automatically records technical access data in server log files (browser type and version, operating system used, referrer URL, hostname/IP address of the accessing device in truncated/anonymized form, and date/time of the server request). To defend against automated malicious access (brute-force attacks and spam bots), we also deploy the local server security solution Shield Security (SilentCaptcha).
Processing is based on Art. 6(1)(f) GDPR (legitimate interest in ensuring the technical stability, integrity, and security of our IT systems). This data is not merged with other data sources and is automatically deleted after 7 days at the latest.
4. Contact via Contact Form, Email or Phone
When you contact us via our general contact form, the B2B project form, by email (e.g., to info@orbsmart.de, support@orbsmart.de, or b2b@capoyo.de), or by telephone, the information you provide (name, company/organization if applicable, email address, phone number, inquiry type, and message text) will be processed by us for the purpose of handling your inquiry and any follow-up questions.
Legal Basis: If your inquiry aims at concluding or performing a contract (e.g., pre-sales advice, B2B quote requests, or warranty claims), the legal basis is Art. 6(1)(b) GDPR. In all other cases, processing is based on our legitimate interest in effectively and promptly responding to inquiries addressed to us pursuant to Art. 6(1)(f) GDPR.
Retention Period: Data collected in the context of support and contact inquiries is deleted as soon as your inquiry has been conclusively resolved and provided no statutory retention obligations (see Section 5) conflict with deletion.
5. Data Processing in Business Relationships & B2B Projects
In the context of B2B orders, project contracts, and ongoing business relationships with corporate clients, system integrators, public authorities, and suppliers, we process contact details of the respective contact persons (name, business address, email address, telephone number) as well as contract, order, delivery, and billing data.
Purpose & Legal Basis: Processing takes place for preparing quotes, executing contracts, invoicing, and handling warranty claims (Art. 6(1)(b) GDPR), for fulfilling tax and commercial law obligations (Art. 6(1)(c) GDPR), and for maintaining ongoing business relationships (Art. 6(1)(f) GDPR).
Recipients in Contract Execution: Data is only passed on to third parties insofar as this is necessary to fulfill the contract – in particular to commissioned transport and shipping providers (e.g., DHL, DPD, UPS) for delivering ordered hardware, to payment service providers/banks for payment processing, and to tax advisors and tax authorities within the scope of statutory tax requirements.
Statutory Retention Periods: Contract and tax-relevant documents (commercial correspondence as well as accounting records/invoices) are retained for 6 or 10 years in accordance with Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO) and deleted upon expiry of these periods.
6. Cookies & Local Device Storage (Consent Management)
Our website uses cookies as well as entries in your browser's local storage (
localStorage / sessionStorage). We strictly distinguish between technically necessary storage and optional services:Technically Necessary Cookies & Storage (Sec. 25 (2) No. 2 TDDDG, Art. 6(1)(f) GDPR): These entries are strictly required for the secure operation of the website and for storing your user preferences, and do not contain tracking profiles:
– aviaCookieConsent / aviaPrivacy* (Cookie, duration: 1 year) and aviaCookieRefused (SessionStorage): Stores your privacy choices made in our cookie banner.
– wp-wpml_current_language (Session Cookie): Stores the selected website language (German / English).
– icwp-wpsf-notbot-freshness (LocalStorage): Technical, purely local bot-protection entry of our server firewall without data transmission to third parties.
– aviaCookieConsent / aviaPrivacy* (Cookie, duration: 1 year) and aviaCookieRefused (SessionStorage): Stores your privacy choices made in our cookie banner.
– wp-wpml_current_language (Session Cookie): Stores the selected website language (German / English).
– icwp-wpsf-notbot-freshness (LocalStorage): Technical, purely local bot-protection entry of our server firewall without data transmission to third parties.
Optional Analytics & Third-Party Services (Sec. 25 (1) TDDDG, Art. 6(1)(a) GDPR): All non-essential cookies and external scripts (Google Analytics 4, Google Tag, and Google reCAPTCHA) are blocked by default and are only loaded if you actively grant consent in our cookie banner. You can change or withdraw your preferences at any time via the lock icon in the bottom-right corner of every page.
7. Web Analytics with Google Analytics 4 (GA4) & Google Tag
Provided you have given your explicit consent in our cookie banner, this website uses Google Analytics 4 (Measurement ID:
G-BKVDX3VGZZ) and the associated Google Tag including reach and conversion measurement (AW-1025528176), services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").Legal Basis & Withdrawal: Use is based exclusively on your voluntary consent pursuant to Section 25 (1) TDDDG and Art. 6(1)(a) GDPR. If you decline analytics cookies, the Google Tag script is not loaded on our site. You can withdraw your consent at any time via the cookie settings icon (bottom right) or use the official browser add-on to disable Google Analytics at tools.google.com/dlpage/gaoptout.
Cookies Set & Storage Duration: Following your consent, Google sets the cookies _ga (duration: up to 2 years, to distinguish visitors), _gid (duration: 24 hours), and _gat_* (duration: 1 minute, to throttle request rates). User and event data associated with cookies in GA4 is automatically deleted after 14 months at the latest.
Default IP Anonymization in GA4: In Google Analytics 4, IP addresses are neither logged nor stored. IP addresses of users within the European Union are used solely on EU servers to derive coarse location data (city/region) and are immediately discarded thereafter.
Data Processing & Third-Country Transfer (USA): We have concluded a Data Processing Agreement with Google pursuant to Art. 28 GDPR. For data transfers to the parent company Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), an adequacy decision by the European Commission exists pursuant to Art. 45 GDPR (EU-U.S. Data Privacy Framework), under which Google LLC is actively certified.
8. Protection of Contact Forms via Google reCAPTCHA v3
To protect our contact and B2B forms against automated spam attacks, we integrate – subject to your corresponding consent in our cookie settings – the service Google reCAPTCHA v3 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
reCAPTCHA v3 analyzes technical characteristics (such as IP address, browser and device information, mouse movements, and time spent on the page) to verify whether a form entry is made by a human or by an automated program (bot).
Legal Basis & Alternative: Loading the reCAPTCHA script takes place exclusively on the basis of your consent pursuant to Section 25 (1) TDDDG and Art. 6(1)(a) GDPR. If you have disabled external security services in the cookie settings and are therefore unable to submit the form, you can always reach us directly by email at info@orbsmart.de.
Third-Country Transfer & Further Information: Data transfer to Google LLC in the USA is safeguarded under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). In addition, Google's Privacy Policy and Terms of Service apply.
9. Email Newsletter (Mailchimp)
If you subscribe to our Orbsmart newsletter via the subscription form in the footer of our website, we process your email address exclusively to send you information about new product releases and firmware updates.
Technical Process & Double Opt-In: When you click "Subscribe", your email address is transmitted to our dispatch provider Mailchimp, and you receive a confirmation email (double opt-in procedure). Your address is only activated once you click the confirmation link contained therein. To document your consent in compliance with the GDPR, the time of registration and confirmation as well as your IP address are logged.
Service Provider & Third-Country Transfer: Dispatch is handled via "Mailchimp", a service provided by The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA (a subsidiary of Intuit Inc.). We have concluded a Data Processing Addendum pursuant to Art. 28 GDPR with the provider. Intuit Inc. / The Rocket Science Group LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
Legal Basis & Withdrawal: Processing (including statistical open and click measurement) takes place exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time via the unsubscribe link at the end of every newsletter or by sending an email to info@orbsmart.de.
10. External Links (Online Shop, Download Servers & Social Media)
Our website contains purely static HTML links to our external online store (orbsmart.shop), to authorized retail partners, to external download servers for firmware packages (e.g., MediaFire), and to our company profiles on Facebook and Instagram.
No active social media plugins are embedded on orbsmart.de. Therefore, merely visiting our website does not transmit any data to social networks or external shop systems. Your browser only establishes a connection to the respective target server when you actively click on such a link.
11. Obligation to Provide Data, Profiling & Objection to Unsolicited Marketing
Obligation to Provide Data (Art. 13(2)(e) GDPR): When visiting our website purely for informational purposes, you are neither legally nor contractually required to provide personal data. When using our contact or B2B forms, providing the data marked as mandatory is required in order to process your inquiry or prepare a contract quote.
No Automated Decision-Making (Art. 13(2)(f) GDPR): We do not use automated decision-making including profiling pursuant to Art. 22(1) and (4) GDPR on our website.
Objection to Unsolicited Marketing Emails: We hereby expressly object to the use of contact data published within the scope of our statutory legal notice (Imprint) obligation by third parties for sending unsolicited advertising and information materials.