Legal note & Privacy policy

Responsible

orto GmbH
Stargarder Str. 32
10437 Berlin
hallo@orto.space

+49 30 21092012

Dipl.-Ing. Arch. Felix Matschinske
M.A. Alexander Werle

AG Charlottenburg, HRB 266456B

The following information outlines how we handle your data in accordance with Art. 13 of the General Data Protection Regulation (GDPR).

Privacy Policy

Usage Data

When you visit our websites, so-called usage data is temporarily evaluated on our web server as a log for statistical purposes in order to improve the quality of our websites. This dataset consists of:

• the name and address of the requested content,
• the date and time of the request,
• the amount of data transferred,
• the access status (content transferred, content not found),
• a description of the web browser and operating system used,
• the referral link indicating which page you came from,
• the IP address of the requesting computer, which is truncated so that it can no longer be linked to a specific person.

The log data listed above is only evaluated in anonymised form.

Storage of IP Address for Security Purposes

In addition, we store the full IP address transmitted by your web browser for a period of seven days, strictly limited to the purpose of detecting, containing and eliminating attacks on our websites. After this period, we delete or anonymise the IP address. The legal basis is Art. 6(1)(1)(f) GDPR.

Data Security

To protect your data from unauthorised access as comprehensively as possible, we implement technical and organisational measures. We use an encryption process on our websites. Your data is transmitted between your computer and our server via the internet using TLS encryption. You can generally recognise this by the lock symbol being closed in your browser's status bar and the address bar beginning with https://.

Embedded Videos

We embed videos on our websites that are not stored on our servers. To ensure that loading our webpages with embedded videos does not automatically cause third-party content to be retrieved, we initially display only locally stored preview images of the videos. This means the third-party provider receives no information. Only after clicking on the preview image will third-party content be loaded. This informs the third-party provider that you have visited our page, along with the technically necessary usage data. The third-party provider may then also implement tracking technologies. We have no influence over further data processing by the third-party provider. By clicking on the preview image, you give us your consent to load third-party content.

The embedding is carried out on the basis of your consent pursuant to Art. 6(1)(1)(a) GDPR, provided you have given your consent by clicking on the preview image. Please note that embedding many videos may result in your data being processed outside the EU or EEA. In some countries, there is a risk that authorities may access data for security and surveillance purposes without you being informed or having the ability to seek legal remedy. Where we use providers in unsafe third countries and you consent, the transfer to an unsafe third country is carried out on the basis of Art. 49(1)(a) GDPR.

Newsletter Registration and Distribution

You can subscribe to a newsletter on our website. Please note that we require certain data (at minimum your email address) to process your registration. The newsletter will only be sent if you have given us your explicit consent pursuant to Art. 6(1)(1)(a) GDPR. After subscribing on our website, you will receive a confirmation email to the address you provided (known as double opt-in). You may withdraw your consent at any time — a straightforward way to do so is via the unsubscribe link included in every newsletter.

As part of the newsletter registration, we store additional data beyond what has already been mentioned, where necessary to demonstrate that you subscribed to our newsletter. This may include storing the full IP address at the time of subscription or confirmation, as well as a copy of the confirmation email we sent. This data processing is carried out on the basis of Art. 6(1)(1)(f) GDPR, in the interest of being able to demonstrate the lawfulness of newsletter distribution.

For newsletter delivery, we are supported by our service provider Mailchimp (USA). In this context, we transmit your email address to Mailchimp, who acts as a strictly instruction-bound data processor on our behalf. We have concluded a data processing agreement with the service provider in accordance with Art. 28(3) GDPR.

Retention Period

Unless we have already provided specific information on retention periods, we delete personal data once it is no longer required for the aforementioned processing purposes and no statutory retention obligations prevent deletion.

Your Rights as a Data Subject

When processing your personal data, the GDPR grants you the following rights as a data subject:

Right of Access (Art. 15 GDPR) You have the right to request confirmation as to whether personal data concerning you is being processed. If so, you have the right to access that data and to receive the information specified in Art. 15 GDPR.

Right to Rectification (Art. 16 GDPR) You have the right to request the immediate rectification of inaccurate personal data concerning you and, where applicable, the completion of incomplete data.

Right to Erasure (Art. 17 GDPR) You have the right to request the immediate erasure of personal data concerning you, provided one of the grounds specified in Art. 17 GDPR applies.

Right to Restriction of Processing (Art. 18 GDPR) You have the right to request the restriction of processing where one of the conditions set out in Art. 18 GDPR is met — for example, if you have objected to processing, for the duration of the review by the controller.

Right to Data Portability (Art. 20 GDPR) In certain cases specified in Art. 20 GDPR, you have the right to receive personal data concerning you in a structured, commonly used and machine-readable format, or to request that this data be transmitted to a third party.

Right to Withdraw Consent (Art. 7 GDPR) Where data processing is based on your consent, you are entitled under Art. 7(3) GDPR to withdraw your consent to the use of your personal data at any time. Please note that withdrawal only takes effect going forward. Processing carried out prior to withdrawal is not affected.

Right to Object (Art. 21 GDPR) Where data is processed on the basis of Art. 6(1)(1)(f) GDPR (processing for the purposes of legitimate interests) or Art. 6(1)(1)(e) GDPR (processing for the performance of a task in the public interest or in the exercise of official authority), you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR) Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of data concerning you infringes data protection regulations. This right may be exercised in particular with a supervisory authority in the member state of your habitual residence, place of work or place of the alleged infringement.

Exercising Your Rights

Unless otherwise described above, please contact the entity named in the legal notice to exercise your rights as a data subject.

As of: 03/2025