Privacy Policy
Last updated: 30 July 2026
1. Controller and scope
The controller responsible for the processing of personal data is:
Bartkowiak, Smiri & Yilma The Orbit GbR
Silbersteinstr. 59
12051 Berlin
Germany
Email: hello@theorbitstudio.com
This Privacy Policy applies to our studio website at www.theorbitstudio.com, our newsletter at www.itstheorbit.com, our official social-media accounts and our digital storefronts.
2. Studio website and hosting
Our studio website is created and hosted using Framer, provided by Framer B.V., Amsterdam, the Netherlands.
When you visit the website, Framer may process technical information required to deliver and protect the website, including your IP address, date and time of access, requested page, referrer URL, browser, operating system, device information and security-related data.
The processing is based on Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of our website. Framer processes this information on our behalf under a data processing agreement.
Further information is available in Framer’s Privacy Statement.
Framer Analytics
We use Framer’s built-in, cookie-free analytics to understand the general use of our website. This may include aggregated information concerning page views, traffic sources, approximate country, device type, browser and operating system.We use this information to assess and improve the performance and content of our website. The legal basis is Article 6(1)(f) GDPR.
We currently do not use Google Analytics or advertising pixels from Meta, TikTok, LinkedIn or Pinterest on our studio website.
3. Contact form and email communication
When you contact us by email or through our contact form, we process the information you provide, including your name, email address, company or project name, message and any other information contained in your enquiry.
Framer processes the form submission and forwards it to the email destination configured by us. We use Google Workspace to receive and manage our business email communications.
The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a potential or existing contract. For other enquiries, the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in responding to messages and managing our business communications.
Providing this information is voluntary. However, the required fields are necessary for us to process and respond to your enquiry.
We generally retain correspondence until the enquiry has been resolved. Information may be retained for longer where necessary for an ongoing business relationship, the establishment or defence of legal claims, or compliance with statutory retention obligations.
Further information is available in Google’s Privacy Policy.
4. The Orbit newsletter and Substack
We publish The Orbit newsletter through Substack at www.itstheorbit.com.
When you subscribe, Substack may process information including your email address, name or profile information, subscription status, confirmation and registration data, communication preferences, payment status and information about how you interact with the newsletter.
New email subscriptions are confirmed through a double opt-in process. This means that you must confirm your email address before your subscription becomes active.
For free subscriptions, the legal basis for sending the newsletter is your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time by using the unsubscribe link included in every newsletter.
For paid subscriptions, the processing necessary to provide and administer the subscription is based on Article 6(1)(b) GDPR. Processing required for accounting, taxation or other legal obligations is based on Article 6(1)(c) GDPR.
Newsletter measurement
Substack provides information about newsletter delivery and engagement, including delivery rates, opens, link clicks, page views and subscription activity. Opens may be detected when images contained in an email are loaded or when a post is opened through the Substack app.
Where you have consented to this measurement during the subscription process, the legal basis is Article 6(1)(a) GDPR. The information is used to understand the performance of the newsletter and improve future content. You may withdraw your consent with effect for the future.
Substack and international transfers
We are the controller of our subscriber list. Substack processes subscriber information on our behalf and may also process certain information as an independent controller for its own platform-related purposes.
Substack Inc. is based in the United States. Transfers to the United States are safeguarded through the EU–US Data Privacy Framework and, where applicable, the European Commission’s Standard Contractual Clauses.
Further information is available in the Substack Privacy Policy and Substack Publisher Agreement.
Paid subscriptions and Stripe
Payments for paid Substack subscriptions are processed through Stripe. Stripe processes payment, billing, fraud-prevention and transaction information. We do not receive or store complete credit-card details.
The legal basis for payment processing is Article 6(1)(b) GDPR. Statutory accounting and tax obligations are based on Article 6(1)(c) GDPR.
Further information is available in Stripe’s Privacy Policy.
5. Social media
We maintain official accounts on:
Instagram and Facebook, operated by Meta
TikTok
LinkedIn
Pinterest
When you visit or interact with one of our accounts, the respective platform may process information such as your profile details, messages, comments, reactions, shared content, usage information, device data and identifiers.
We process information that you provide directly to us to communicate with you, respond to enquiries, share our work and manage our online presence. The legal basis is Article 6(1)(f) GDPR. Where communication concerns a potential or existing contract, the legal basis is Article 6(1)(b) GDPR.
The platforms may provide us with aggregated audience and engagement statistics. Depending on the processing activity, we and the respective platform may act as separate or joint controllers.
We have previously used Pinterest’s advertising services. We do not currently upload customer or subscriber lists to advertising platforms and do not use social-media advertising pixels on our studio website.
The platforms may process information outside the European Economic Area under their respective data-transfer safeguards:
Meta Privacy Policy
TikTok Privacy Policy
LinkedIn Privacy Policy
Pinterest Privacy Policy
You are not required to use social media to contact us. You can contact us directly at hello@theorbitstudio.com.
6. Digital marketplaces
We offer digital products through Etsy, Gumroad and Creative Market.
When you purchase or contact us through one of these platforms, the respective platform may process information including your name, contact details, account information, order details, payment status, transaction data and communications.
We access order and buyer information through the respective platform where necessary to fulfil purchases, provide customer support, administer transactions and comply with legal obligations.
The legal bases are Article 6(1)(b) GDPR for fulfilling the purchase, Article 6(1)(c) GDPR for statutory obligations and Article 6(1)(f) GDPR for fraud prevention and the establishment or defence of legal claims.
We do not currently export buyer lists from these platforms for separate advertising or newsletter marketing.
The platforms also process information under their own responsibility:
Etsy Privacy Policy
Gumroad Privacy Policy
Creative Market Privacy Policy
7. Recipients and international data transfers
We disclose personal data only where necessary to operate our services, fulfil contracts, comply with legal obligations or protect our legitimate interests.
Recipients may include hosting and technology providers, email and newsletter providers, payment processors, marketplace operators, professional advisers, accounting providers and public authorities where legally required.
Some providers process information outside the European Economic Area. Where no adequacy decision applies, transfers are generally protected through Standard Contractual Clauses or another legally recognised transfer mechanism.
8. Retention
We retain personal data only for as long as required for the respective purpose.
Newsletter information is generally retained until you unsubscribe or your subscription ends. Limited information may be retained afterwards where necessary to document consent, process outstanding payments, comply with legal obligations or defend against legal claims.
Order, payment and accounting information may be retained for statutory periods of generally six or eight years and, in certain cases, ten years.
When personal data is no longer required and no statutory obligation or legitimate reason for retention applies, it will be deleted or anonymised.
9. Your rights
Subject to the applicable legal requirements, you have the right to:
request access to your personal data;
request correction of inaccurate data;
request deletion of your personal data;
request restriction of processing;
receive data you provided in a portable format;
withdraw consent at any time with effect for the future; and
object to processing based on Article 6(1)(f) GDPR.
Where personal data is processed for direct-marketing purposes, you may object to that processing at any time.
To exercise your rights, contact hello@theorbitstudio.com.
You also have the right to lodge a complaint with a data-protection supervisory authority. Our competent supervisory authority is:
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Germany
www.datenschutz-berlin.de
10. Security and updates
We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access and disclosure.
We may update this Privacy Policy when our services, providers or legal obligations change. The current version will always be available through our website.
Privacy Policy
Last updated: 30 July 2026
1. Controller and scope
The controller responsible for the processing of personal data is:
Bartkowiak, Smiri & Yilma The Orbit GbR
Silbersteinstr. 59
12051 Berlin
Germany
Email: hello@theorbitstudio.com
This Privacy Policy applies to our studio website at www.theorbitstudio.com, our newsletter at www.itstheorbit.com, our official social-media accounts and our digital storefronts.
2. Studio website and hosting
Our studio website is created and hosted using Framer, provided by Framer B.V., Amsterdam, the Netherlands.
When you visit the website, Framer may process technical information required to deliver and protect the website, including your IP address, date and time of access, requested page, referrer URL, browser, operating system, device information and security-related data.
The processing is based on Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of our website. Framer processes this information on our behalf under a data processing agreement.
Further information is available in Framer’s Privacy Statement.
Framer Analytics
We use Framer’s built-in, cookie-free analytics to understand the general use of our website. This may include aggregated information concerning page views, traffic sources, approximate country, device type, browser and operating system.We use this information to assess and improve the performance and content of our website. The legal basis is Article 6(1)(f) GDPR.
We currently do not use Google Analytics or advertising pixels from Meta, TikTok, LinkedIn or Pinterest on our studio website.
3. Contact form and email communication
When you contact us by email or through our contact form, we process the information you provide, including your name, email address, company or project name, message and any other information contained in your enquiry.
Framer processes the form submission and forwards it to the email destination configured by us. We use Google Workspace to receive and manage our business email communications.
The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a potential or existing contract. For other enquiries, the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in responding to messages and managing our business communications.
Providing this information is voluntary. However, the required fields are necessary for us to process and respond to your enquiry.
We generally retain correspondence until the enquiry has been resolved. Information may be retained for longer where necessary for an ongoing business relationship, the establishment or defence of legal claims, or compliance with statutory retention obligations.
Further information is available in Google’s Privacy Policy.
4. The Orbit newsletter and Substack
We publish The Orbit newsletter through Substack at www.itstheorbit.com.
When you subscribe, Substack may process information including your email address, name or profile information, subscription status, confirmation and registration data, communication preferences, payment status and information about how you interact with the newsletter.
New email subscriptions are confirmed through a double opt-in process. This means that you must confirm your email address before your subscription becomes active.
For free subscriptions, the legal basis for sending the newsletter is your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time by using the unsubscribe link included in every newsletter.
For paid subscriptions, the processing necessary to provide and administer the subscription is based on Article 6(1)(b) GDPR. Processing required for accounting, taxation or other legal obligations is based on Article 6(1)(c) GDPR.
Newsletter measurement
Substack provides information about newsletter delivery and engagement, including delivery rates, opens, link clicks, page views and subscription activity. Opens may be detected when images contained in an email are loaded or when a post is opened through the Substack app.
Where you have consented to this measurement during the subscription process, the legal basis is Article 6(1)(a) GDPR. The information is used to understand the performance of the newsletter and improve future content. You may withdraw your consent with effect for the future.
Substack and international transfers
We are the controller of our subscriber list. Substack processes subscriber information on our behalf and may also process certain information as an independent controller for its own platform-related purposes.
Substack Inc. is based in the United States. Transfers to the United States are safeguarded through the EU–US Data Privacy Framework and, where applicable, the European Commission’s Standard Contractual Clauses.
Further information is available in the Substack Privacy Policy and Substack Publisher Agreement.
Paid subscriptions and Stripe
Payments for paid Substack subscriptions are processed through Stripe. Stripe processes payment, billing, fraud-prevention and transaction information. We do not receive or store complete credit-card details.
The legal basis for payment processing is Article 6(1)(b) GDPR. Statutory accounting and tax obligations are based on Article 6(1)(c) GDPR.
Further information is available in Stripe’s Privacy Policy.
5. Social media
We maintain official accounts on:
Instagram and Facebook, operated by Meta
TikTok
LinkedIn
Pinterest
When you visit or interact with one of our accounts, the respective platform may process information such as your profile details, messages, comments, reactions, shared content, usage information, device data and identifiers.
We process information that you provide directly to us to communicate with you, respond to enquiries, share our work and manage our online presence. The legal basis is Article 6(1)(f) GDPR. Where communication concerns a potential or existing contract, the legal basis is Article 6(1)(b) GDPR.
The platforms may provide us with aggregated audience and engagement statistics. Depending on the processing activity, we and the respective platform may act as separate or joint controllers.
We have previously used Pinterest’s advertising services. We do not currently upload customer or subscriber lists to advertising platforms and do not use social-media advertising pixels on our studio website.
The platforms may process information outside the European Economic Area under their respective data-transfer safeguards:
Meta Privacy Policy
TikTok Privacy Policy
LinkedIn Privacy Policy
Pinterest Privacy Policy
You are not required to use social media to contact us. You can contact us directly at hello@theorbitstudio.com.
6. Digital marketplaces
We offer digital products through Etsy, Gumroad and Creative Market.
When you purchase or contact us through one of these platforms, the respective platform may process information including your name, contact details, account information, order details, payment status, transaction data and communications.
We access order and buyer information through the respective platform where necessary to fulfil purchases, provide customer support, administer transactions and comply with legal obligations.
The legal bases are Article 6(1)(b) GDPR for fulfilling the purchase, Article 6(1)(c) GDPR for statutory obligations and Article 6(1)(f) GDPR for fraud prevention and the establishment or defence of legal claims.
We do not currently export buyer lists from these platforms for separate advertising or newsletter marketing.
The platforms also process information under their own responsibility:
Etsy Privacy Policy
Gumroad Privacy Policy
Creative Market Privacy Policy
7. Recipients and international data transfers
We disclose personal data only where necessary to operate our services, fulfil contracts, comply with legal obligations or protect our legitimate interests.
Recipients may include hosting and technology providers, email and newsletter providers, payment processors, marketplace operators, professional advisers, accounting providers and public authorities where legally required.
Some providers process information outside the European Economic Area. Where no adequacy decision applies, transfers are generally protected through Standard Contractual Clauses or another legally recognised transfer mechanism.
8. Retention
We retain personal data only for as long as required for the respective purpose.
Newsletter information is generally retained until you unsubscribe or your subscription ends. Limited information may be retained afterwards where necessary to document consent, process outstanding payments, comply with legal obligations or defend against legal claims.
Order, payment and accounting information may be retained for statutory periods of generally six or eight years and, in certain cases, ten years.
When personal data is no longer required and no statutory obligation or legitimate reason for retention applies, it will be deleted or anonymised.
9. Your rights
Subject to the applicable legal requirements, you have the right to:
request access to your personal data;
request correction of inaccurate data;
request deletion of your personal data;
request restriction of processing;
receive data you provided in a portable format;
withdraw consent at any time with effect for the future; and
object to processing based on Article 6(1)(f) GDPR.
Where personal data is processed for direct-marketing purposes, you may object to that processing at any time.
To exercise your rights, contact hello@theorbitstudio.com.
You also have the right to lodge a complaint with a data-protection supervisory authority. Our competent supervisory authority is:
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Germany
www.datenschutz-berlin.de
10. Security and updates
We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access and disclosure.
We may update this Privacy Policy when our services, providers or legal obligations change. The current version will always be available through our website.