1. Data Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Orphit – Julian Galm
Owner (sole proprietorship)

E-Mail:
Phone:

Value-Added Tax (VAT) Identification Number: DE365615051

A data protection officer has not been appointed, as the law does not require one. If you have any questions regarding data protection, you can contact us at any time using the contact information provided above.

2. General Information and Hosting

2.1 Data Collection on This Website

When you visit this website, the web server automatically stores information in so-called server log files. The information collected includes, among other things, the IP address, the date and time of access, the page accessed, the browser type and version, and the operating system. The legal basis for this is Article 6(1)(f) of the GDPR; our legitimate interest lies in ensuring secure and stable website operation. The log data is generally deleted after 14 days.

2.2 Hosting and Content Delivery Network

This website is hosted by our hosting provider wint.global (Germany). To protect against attacks and to host the website, we also use the service Cloudflare, Inc. (U.S.) Both providers process data (in particular IP addresses) on our behalf based on Article 6(1)(f) of the GDPR (legitimate interest in secure and high-performance website operation) or within the framework of data processing agreements (Article 28 of the GDPR). Cloudflare is certified under the EU-US Data Privacy Framework. For more information, please see Cloudflare’s Privacy Policy: https://www.cloudflare.com/privacypolicy/.

2.3 SSL or TLS Encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential information.

3. Order Processing in the Online Store

3.1 Contract Execution

To process your order, we process your name, your shipping and billing addresses, your email address, your phone number, the products you ordered, and your payment information. This processing is carried out for the purpose of fulfilling the purchase agreement in accordance with Article 6(1)(b) of the GDPR.

3.2 Payment Processing

We use the following payment service providers to process payments:

• Stripe Payments Europe, Ltd. (Credit card payment): The data required for payment processing is transmitted to Stripe. The legal basis is Article 6(1)(b) of the GDPR; Stripe processes data under a data processing agreement (Article 28 of the GDPR). Information: https://stripe.com/de/privacy.
• PayPal (Europe) S.à r.l. et Cie, S.C.A.: When you pay via PayPal, the information required to process your payment will be transmitted to PayPal. PayPal's privacy policy applies: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

3.3 Shipping

To deliver the ordered items, we will provide your name and shipping address to the shipping company DPD Continue. The legal basis is Article 6(1)(b) of the GDPR; DPD processes the data as a data processor (Article 28 of the GDPR).

3.4 Statutory Retention Requirements

For commercial and tax law reasons, we are required to retain order, invoice, and accounting data for ten years (Section 147 of the German Fiscal Code (AO), Section 14b of the German Value-Added Tax Act (UStG)). The legal basis is Article 6(1)(c) of the GDPR. The data will be deleted once these retention periods have expired.

4. Ear Impression / 3D Ear Geometry (highly confidential data)

To create your custom in-ear monitors, we need a mold or a 3D scan of your ear geometry. This data allows conclusions to be drawn about your health or physical characteristics and is therefore subject to special protection as biometric or health-related data within the meaning of Article 9(1) of the GDPR.

This data is processed solely on the basis of your express consent in accordance with Article 9(2)(a) of the GDPR in conjunction with Article 6(1)(a) of the GDPR, and is used solely for the custom manufacturing of your Orphit in-ear headphones.

Your ear geometry will be deleted once manufacturing is complete and the production process is finished, but no later than the expiration of the warranty and guarantee period (24 months from delivery), provided that no statutory retention requirements prevent this. You may revoke your consent at any time with future effect; this does not affect the lawfulness of the processing carried out prior to the revocation.

5. Making Contact

When you contact us via the contact form, email, phone, WhatsApp, or by other means, we process your information (specifically your name, email address, phone number, and the nature of your inquiry) to handle your request. The legal basis is Article 6(1)(b) of the GDPR if the inquiry relates to the conclusion of a contract; otherwise, it is Article 6(1)(f) of the GDPR (legitimate interest in processing your inquiry). Your data will be deleted as soon as your inquiry has been fully processed and there are no legal retention requirements that prevent this.

6. Newsletter

When you sign up for our newsletter, we use your email address—and, optionally, your name—to send you information about our products and promotions. Subscription is handled via the double opt-in process; data processing is based on your consent in accordance with Article 6(1)(a) of the GDPR.

We use the marketing automation system for email campaigns Mautic, which is operated on our own infrastructure or through our hosting provider. To the extent that Mautic processes personal data on our behalf, this is done on the basis of a data processing agreement (Art. 28 GDPR). With your consent, we analyze whether and when newsletters were opened or links were clicked (email tracking) in order to improve our newsletters.

You can revoke your consent at any time by clicking the unsubscribe link in any newsletter or by sending an email to [email protected]. Once you revoke your consent, your email address will be removed from the mailing list.

7. Cookies and Consent Management

Our website uses cookies and similar technologies. For more information—particularly regarding the cookies we use, their purposes, and their expiration dates—please see our Cookie policy.

Technically necessary cookies are set in accordance with Section 25(2) of the TDDDG or based on our legitimate interest (Article 6(1)(f) of the GDPR). For statistical and marketing-related cookies (e.g., Google Analytics), we obtain your consent via our Consent Manager (Complianz); processing is then carried out on the basis of Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR. You can revoke your consent at any time with future effect by accessing the cookie settings and adjusting your selections.

7.1 Google Analytics (with consent)

With your consent, we use Google Analytics (Google Ireland Ltd., Ireland) to analyze the use of our website and generate reports on website activity. Among other things, this involves processing IP addresses (truncated), usage data, and device information. The legal basis is your consent (Section 25(1) TDDDG, Article 6(1)(a) GDPR). Google may transfer data to the United States; Google is certified under the EU-U.S. Data Privacy Framework. For more information: https://policies.google.com/privacy.

8. Social Media

On our website, we provide links to our profiles on LinkedIn, Instagram, Facebook, TikTok, and YouTube. Simply visiting our website does not result in any data being transmitted to these services. Only when you click on the link do the privacy policies of the respective provider apply.

9. Recipients of the Data / Data Processors

We only disclose personal data to the extent necessary for contract fulfillment, payment processing, shipping, providing the website, or complying with legal obligations, or if you have given your consent. Recipients include, in particular:

• wint.global (Web Hosting)
• Cloudflare, Inc. (CDN and Security)
• Stripe Payments Europe, Ltd. (Payment Processing)
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (payment processing)
• DPD (Shipping)
• Mautic (Newsletter Distribution and Tracking)
• Google Ireland Ltd. / Google LLC (Statistics, only with consent)

To the extent that service providers process personal data on our behalf, we have entered into data processing agreements with them in accordance with Article 28 of the GDPR.

10. Transfer to Third Countries

Personal data will only be transferred to third countries (in particular to the United States) if an adequate level of data protection exists. This is ensured either by the European Commission’s adequacy decision regarding the EU-U.S. Data Privacy Framework or by appropriate safeguards (in particular, EU Standard Contractual Clauses). Data subjects may request a copy of the safeguards from us.

11. Retention Period

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention obligations:

• Order, invoice, and accounting data: 10 years (statutory retention requirement)
• Ear Geometry/Ear Impression: until completion of production, but no later than the expiration of the warranty and guarantee period (24 months)
• Contact Requests: Through Final Processing
• Newsletter data: until you revoke your consent
• Server log data: typically 14 days

12. Your Rights as a Data Subject

You have the following rights regarding your personal data:

• Right of Access (Art. 15 of the GDPR)
• Right to Rectification (Art. 16 of the GDPR)
• Right to Erasure („Right to Be Forgotten,“ Art. 17 of the GDPR)
• Right to Restriction of Processing (Art. 18 GDPR)
• Right to Data Portability (Art. 20 of the GDPR)
• Right to Object to Processing (Art. 21 of the GDPR)
• The right to withdraw consent at any time (Art. 7(3) of the GDPR) without affecting the lawfulness of processing carried out prior to the withdrawal
• Right to File a Complaint with a Data Protection Supervisory Authority (Art. 77 of the GDPR)

The competent supervisory authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

13. Obligation to Provide Data

Providing your personal data is necessary for placing and processing your order. Without this information, we cannot accept or fulfill your order. We do not engage in automated decision-making, including profiling, as defined in Article 22 of the GDPR.

14. Safety

We take technical and organizational measures to protect your data against tampering, loss, destruction, or unauthorized access. Your data is transmitted in encrypted form (SSL/TLS).

As of August 2026