Privacy Policy

1. Introduction

Welcome to Orcrist Technologies GmbH ("we", "us", "our"). We are committed to protecting your personal data and respecting your privacy. This privacy policy explains how we collect, use, process, and protect your personal data when you visit our website (orcrist.org) and use our services, in compliance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG).

2. Data Controller

The data controller responsible for processing your personal data is:

Orcrist Technologies GmbH

Westerlandstr. 13

13189 Berlin

Deutschland

Represented by: Michael Heid

Contact Email: hello@orcrist.org

Full legal details can be found in our Imprint.

3. Data We Collect and How We Use It

Website hosting: We host this website on Cloudflare Pages. Requests pass through Cloudflare's network, which processes connection and request information, including IP addresses, requested URLs, timestamps and browser information, to deliver and protect the website. This processing serves our legitimate interest in operating a secure and reliable website (Art. 6(1)(f) GDPR). See Cloudflare's privacy policy for information about its processing of end-user data.

Email contact: If you contact us by email, we process your email address, message and any other information you provide to respond to your inquiry. This processing is based on our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR), or on pre-contractual measures when your inquiry relates to our services (Art. 6(1)(b) GDPR). You can also use our contact form. When you submit it, Cloudflare processes your email address, message, optional first and last name, and page language to send an email to hello@orcrist.org. The email includes a submission timestamp, reference ID and the page URL without query parameters or fragments. We receive the inquiry in our existing email service. The same purposes and legal bases described above apply. The form backend does not keep a separate submission database or queue. Operational logs contain reference IDs, outcomes and error codes, rather than names, email addresses or message contents.

Careers and applications: Our careers pages retrieve public job listings from Greenhouse. When you open a job, your browser loads the job description and application form directly from Greenhouse's EU job board. These requests disclose connection and request information to Greenhouse. Application details and uploaded documents are submitted directly to Greenhouse for processing on our behalf, rather than to this static website. We use the information you provide to assess your application and communicate with you about recruitment. Please read the application-specific privacy information displayed with the form before submitting your application. You can also open the job board directly.

4. Cookies and Local Resources

The website does not use Google Analytics, analytics or marketing cookies, or a cookie-consent banner. Fonts, images and videos are served locally. The static website code does not set cookies or use browser storage. The contact form uses Cloudflare Turnstile to prevent automated abuse. When the security check loads, Cloudflare processes browser and connection information; the backend validates its result and uses the client IP address for rate limiting. This serves our legitimate interest in protecting the form and our inbox (Art. 6(1)(f) GDPR). Turnstile pre-clearance is disabled. See Cloudflare’s privacy policy.

Cloudflare security services and the Greenhouse application form may use technically necessary cookies or storage according to their configuration. These services are distinct from website analytics. See Cloudflare's cookie information and the privacy information provided with the Greenhouse application form.

5. Data Transfer to Third Countries

Cloudflare and Greenhouse are international service providers. Their processing may involve countries outside the European Economic Area, including the United States. Use of an EU service hostname does not by itself mean that all processing takes place exclusively in the EU. Information about Cloudflare’s international processing is available in its linked privacy policy; application-specific information is provided with the Greenhouse form. Please contact us using the details in Section 2 for information about the safeguards applicable to your data.

6. Your Rights Under GDPR

As a data subject, you have the following rights regarding your personal data:

Right of Access (Art. 15 GDPR): Request information about the personal data we process about you.

Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete data.

Right to Erasure ('Right to be Forgotten') (Art. 17 GDPR): Request deletion of your personal data, subject to certain conditions.

Right to Restriction of Processing (Art. 18 GDPR): Request limitation of the processing of your data under certain circumstances.

Right to Data Portability (Art. 20 GDPR): Request to receive your data in a structured, commonly used, machine-readable format or have it transferred to another controller.

Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests (Art. 6(1)(f) GDPR) on grounds relating to your particular situation. You have an unconditional right to object to processing for direct marketing purposes.

Right to Withdraw Consent (Art. 7(3) GDPR): Withdraw your consent at any time for future processing.

Right to Lodge a Complaint (Art. 77 GDPR): Lodge a complaint with a supervisory authority, such as the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

To exercise these rights, please contact us using the details provided in Section 2.

7. Data Security

We implement appropriate technical and organizational measures (TOMs) to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. This includes measures like SSL/TLS encryption for data transmission. However, no internet transmission is completely secure, and we cannot guarantee absolute security.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. Email and contact form inquiries are retained as needed to respond and for necessary follow-up. Recruitment data is retained according to the application-specific privacy information and applicable requirements. Hosting and security data is processed according to the relevant service configuration. Contact us for information about retention applicable to your data.

9. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting the new policy on our website and updating the "Last Updated" date. We encourage you to review this policy periodically.

10. Contact Us

If you have any questions about this privacy policy or our data protection practices, please contact us at: hello@orcrist.org