Privacy policy
As of 11 November 2026. This is a courtesy translation. The German version is the legally binding one.
1. Controller and overview
The controller responsible for data processing on this website under the General Data Protection Regulation (GDPR) is:
Jaqueline Müllers (Orvima)
Bossestrasse 13
10245 Berlin
Germany
Email: hello@orvima.com
This website is deliberately built to collect as little data as possible. It sets no cookies itself and uses no analytics or tracking tools, no forms and no embedded third-party content such as video platforms, maps or social media plugins. The explainer video and the images are delivered together with the website by its hosting provider (see section 2).
2. Hosting
This website is hosted by Cloudflare (Cloudflare Pages). The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare stores the files of this website and delivers them to your browser through a global server network (content delivery network).
When you visit the website, Cloudflare processes personal data on our behalf, in particular the server log files described in section 3, mainly your IP address and the technical details of your browser. A data processing agreement under Art. 28 GDPR is in place with Cloudflare (Data Processing Addendum). Where Cloudflare processes data for its own purposes, for example to secure its network, Cloudflare is responsible for that itself. You can find more information in Cloudflare's privacy policy.
The legal basis is Art. 6(1)(f) GDPR: we have a legitimate interest in providing this website securely, quickly and reliably.
Cloudflare delivers content through a global network. Your data may therefore also be processed on servers outside the European Union, in particular in the USA. There is no restriction to EU data centres. The transfer to the USA is based on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Cloudflare, Inc. is certified. In addition, the data processing agreement incorporates the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), which apply if that decision or the certification ceases to apply. You can obtain a copy of these safeguards on request at hello@orvima.com.
We do not use any Cloudflare features that analyse visitors (for example Web Analytics). Cloudflare does not set cookies in normal operation. Only if Cloudflare puts a security check in front of suspicious traffic can a technically necessary cookie be set (for example “cf_clearance”). No consent is required for this (Section 25(2) no. 2 TDDDG).
3. Server log files
When you visit this website, your browser automatically sends data to the hosting provider's server (see section 2), which is stored temporarily in log files. This includes in particular: IP address, date and time of the request, the page or file requested, amount of data transferred, status code, browser type and version, operating system and the previously visited page (referrer URL).
The processing serves the technical delivery, stability and security of the website, for example to defend against attacks. The legal basis is Art. 6(1)(f) GDPR. The retention period follows Cloudflare's rules under the data processing agreement; the data is only kept as long as it is needed for these purposes. We do not merge this data with other data sources.
4. Contact by email or phone
If you get in touch by email or phone, the data you provide (for example name, email address, phone number and the content of your enquiry) is processed to handle your request. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR (legitimate interest in handling enquiries). Emails are processed through Google Workspace. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which acts for us as a processor (Cloud Data Processing Addendum). This may involve a transfer to Google LLC and other companies in the USA, which is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR) and on the Standard Contractual Clauses agreed in the contract (Art. 46(2)(c) GDPR).
The data is deleted once your enquiry has been dealt with and no statutory retention duties apply. Please note that unencrypted emails can be read by third parties in transit.
5. Cookies and storage on your device
This website does not set any cookies itself. A consent banner is therefore not required. For the exceptional case of a security check by Cloudflare see section 2.
If you switch between the light and dark design using the sun and moon icon in the header, your browser stores this choice locally on your device (local storage, entry “orvima-theme” with the value “light” or “dark”) so that the site looks the same on your next visit. The entry is only created after you click, is not transmitted to us or to third parties and can be deleted at any time in your browser settings. Without a choice, the design follows your device setting. The legal basis is Section 25(2) no. 2 TDDDG (a function you have expressly requested) in conjunction with Art. 6(1)(f) GDPR.
6. Fonts
The fonts used (Montserrat, Manrope and Indie Flower) are delivered together with the website by the hosting provider (see section 2). No connection is made to Google or any other font provider's servers.
7. Explainer video
The explainer video is delivered together with the website by the hosting provider (see section 2) and played directly in your browser (HTML5 video). No video portal is embedded, no cookies are set and no data is passed to further third parties. Only the server log files described in section 3 are created.
8. Link to Instagram
This website contains a link to our Instagram profile @orvima.studio. It is a simple link, not an embedded plugin. Merely visiting our website does not transfer any data to Instagram.
Only when you click the link do you leave our website and your browser connects to Instagram. Instagram may then process data such as your IP address and device information and, if you are logged in there, associate the visit with your account. The provider of Instagram in the European Economic Area is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Meta is responsible for this processing. You can find more information in the Instagram privacy policy.
9. TLS encryption
For security reasons this website uses TLS encryption. You can recognise it by “https://” in your browser's address bar.
10. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). Simply write to hello@orvima.com.
You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59 to 61, 10555 Berlin, www.datenschutz-berlin.de.
11. Changes
This privacy policy will be updated when the website or the legal requirements change. The version published here applies.