Privacy policy

1) Introduction and Contact Information for the Data Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we provide information about how we handle your personal data when you use our website. Personal data refers to any data that can be used to personally identify you.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Versigo GmbH, Am Langholz 10, 88289 Waldburg, Germany, Tel.: +49 75 29 877 39 97, Email: info@origobag.com. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website

2.1 When you use our website for informational purposes only—that is, if you do not register or otherwise provide us with information—we collect only the data that your browser transmits to the website server (so-called “server log files”). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

The website you visited
Date and time of access
Amount of data transmitted in bytes
Source/referrer from which you accessed the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or used for any other purpose. However, we reserve the right to review the server log files retrospectively should there be concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the “https://” prefix and the lock icon in your browser’s address bar.

3) Hosting & Content Delivery Network

Cloudflare

We use the system of the following provider to host our website and display its content: Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA

All data collected on our website is processed on the provider’s servers.
We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

For data transfers to the U.S., the provider has joined the EU-U.S. Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

4) Cookies

To make your visit to our website more engaging and to enable the use of certain features, we use cookies—small text files stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called “session cookies”), while others remain on your device for a longer period and allow page settings to be saved (so-called “persistent cookies”). In the latter case, you can find the storage duration in the overview of your web browser’s cookie settings.

If personal data is also processed by individual cookies we use, the processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of the contract, pursuant to Art. 6(1)(a) GDPR in the event of consent, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a user-friendly and effective design of the site visit.

You can configure your browser to be notified when cookies are set and decide individually whether to accept them, or to exclude the acceptance of cookies in specific cases or generally.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Contact

5.1 LiveChat

This website uses a live chat system provided by the following vendor: LiveChat Software S.A., al. Dębowa 3, 53-134 Wrocław, Poland

The processing of personal data transmitted via the chat takes place either in accordance with Art. 6(1)(b) GDPR, because it is necessary for the initiation or performance of a contract, or in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in effectively supporting our website visitors.
Your data transmitted in this manner will be deleted, subject to any conflicting statutory retention periods, once the matter in question has been conclusively resolved.

Additionally, for the purpose of creating pseudonymized user profiles using cookies, further information may be collected and analyzed; however, this information does not serve to identify you personally and is not merged with other data sets. If this information is personally identifiable, processing is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in the statistical analysis of user behavior for optimization purposes.

The setting of cookies can be prevented by adjusting your browser settings accordingly. However, this may limit the functionality of our website. You may object to the collection and storage of data for the purpose of creating a pseudonymized usage profile at any time with future effect.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

5.2 Zendesk

To process customer inquiries, we use the email ticketing system provided by the following provider: Zendesk International Ltd., 55 Charlemont Place, Saint Kevin’s, Dublin D02 F985, Ireland

If you submit contact requests via email through our website, these are stored and organized in the ticketing system to enable chronological processing and improve the service experience. You can always view the current status of your request using the individually assigned ticket number.

For the organization and processing of inquiries, personal data is collected to the extent provided, but in any case includes your last name, first name, and email address; this data is transmitted to the provider, stored there, and accessed.

The legal basis for processing this data is our legitimate interest in the efficient organization of our customer service, in responding to your inquiry as quickly as possible, and in optimizing our service offerings in accordance with Article 6(1)(f) of the GDPR.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

5.3 When you contact us (e.g., via the contact form or email), personal data is processed—exclusively for the purpose of handling and responding to your inquiry and only to the extent necessary for that purpose.

The legal basis for the processing of this data is our legitimate interest in responding to your inquiry pursuant to Article 6(1)(f) of the GDPR. If your contact is aimed at entering into a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. Your data will be deleted if the circumstances indicate that the matter in question has been conclusively resolved and provided that no statutory retention obligations preclude this.

6) Data Processing When Opening a Customer Account

Pursuant to Article 6(1)(b) of the GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. You can find out which data is required for account opening in the input fields of the corresponding form on our website.

You may delete your customer account at any time by sending a message to the above-mentioned address of the controller. After your customer account is deleted, your data will be deleted provided that all contracts concluded in connection with it have been fully settled, no statutory retention periods preclude this, and we no longer have a legitimate interest in further storage.

7) Use of Customer Data for Direct Marketing

7.1 Subscription to Our Email Newsletter

When you subscribe to our email newsletter, we will regularly send you information about our offers. The only required information for receiving the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive the newsletter once you have expressly confirmed your consent to receive it by clicking on a verification link sent to the email address you provided.

By activating the confirmation link, you grant us your consent to the use of your personal data in accordance with Art. 6(1)(a) GDPR. In doing so, we store your IP address as recorded by your Internet Service Provider (ISP), as well as the date and time of registration, to enable us to trace any potential misuse of your email address at a later date. The data we collect when you subscribe to the newsletter is used strictly for the intended purpose.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a message to the controller named at the beginning. Once you have unsubscribed, your email address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this scope, which is permitted by law and about which we inform you in this statement.

7.2 CleverReach

Our email newsletters and other promotional email communications are sent via this provider: CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede, Germany

Based on our legitimate interest in effective and user-friendly email marketing, we share the data you provided during registration with this provider in accordance with Art. 6(1)(f) GDPR so that they can handle email distribution on our behalf.

Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider also conducts a statistical analysis of the success of email campaigns using web beacons or tracking pixels in the sent emails, which can measure open rates and specific interactions with the newsletter’s content. In doing so, device information (e.g., time of access, IP address, browser type, and operating system) is also collected and analyzed, but not combined with other data sets.

You may revoke your consent to email tracking at any time with future effect.

We have entered into a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

8) Data Processing for Order Processing

8.1 To the extent necessary for contract fulfillment for delivery and payment purposes, the personal data we collect is transferred to the contracted shipping company and the contracted financial institution in accordance with Art. 6(1)(b) GDPR.

If we are obligated to provide you with updates for goods containing digital elements or for digital products based on a corresponding contract, we process the contact information you provided when placing your order to personally inform you in accordance with our legal information obligations under Article 6(1)(c) of the GDPR. Your contact details are used strictly for the specific purpose of communicating updates we are obligated to provide and are processed by us for this purpose only to the extent necessary for the respective information.

To process your order, we also work with the following service provider(s), who assist us in whole or in part with the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

8.2 Use of Payment Service Providers

- PayPal

One or more online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method from this provider that requires advance payment, your payment details provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number), as well as information about the contents of your order, will be transmitted to the provider in accordance with Article 6(1)(b) of the GDPR. In this case, your data is transferred exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

If you select a payment method that requires us to make an advance payment, you will also be asked during the ordering process to provide certain personal information (first and last name, street, house number, ZIP code, city, date of birth, email address, phone number, and, if applicable, details regarding an alternative payment method).

In such cases, to safeguard our legitimate interest in verifying your creditworthiness, we will forward this data to the provider in accordance with Article 6(1)(f) of the GDPR for the purpose of a credit check. Based on the personal data you have provided as well as additional data (such as shopping cart, invoice amount, order history, payment history), the provider assesses whether the payment option you have selected can be granted in light of payment and/or credit default risks.

The credit report may contain probability values (so-called score values). To the extent that score values are included in the credit report, they are based on a scientifically recognized mathematical-statistical method. The calculation of the score values includes, among other things, but not exclusively, address data.

You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.
- PayPal Checkout

This website uses PayPal Checkout, an online payment system from PayPal that consists of PayPal’s own payment methods and local payment methods from third-party providers.

When paying via PayPal, credit card via PayPal, direct debit via PayPal, or—if offered—“Pay Later” via PayPal, we transfer your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”) as part of the payment processing. This transfer is carried out in accordance with Art. 6(1)(b) GDPR and only to the extent necessary for payment processing.

PayPal reserves the right to conduct a credit check for the payment methods credit card via PayPal, direct debit via PayPal, or—if offered—“Pay Later” via PayPal. For this purpose, your payment data may be transferred to credit bureaus in accordance with Art. 6(1)(f) GDPR based on PayPal’s legitimate interest in determining your creditworthiness. PayPal uses the result of the credit check—specifically the statistical probability of payment default—to determine whether to provide the respective payment method. The credit report may contain probability values (so-called score values). To the extent that score values are included in the credit report, they are based on a scientifically recognized mathematical-statistical method. The calculation of the score values includes, among other things, but not exclusively, address data. You may object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

When the PayPal payment method “Purchase on Account” is available and selected, your payment data is first transmitted to PayPal to prepare the payment, after which PayPal forwards this data to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin (“Ratepay”) to execute the payment. The legal basis in each case is Art. 6(1)(b) GDPR. In this case, RatePay conducts an identity and credit check in its own name to determine your ability to pay in accordance with the principle mentioned above and, based on the legitimate interest in determining your ability to pay pursuant to Art. 6(1)(f) GDPR, forwards your payment data to credit bureaus. A list of the credit agencies that Ratepay may use can be found here: https://www.ratepay.com/legal-payment-creditagencies/

When using a local third-party payment method, your payment data is first transferred to PayPal in accordance with Article 6(1)(b) of the GDPR to prepare the payment. Depending on your selection of an available local payment method, PayPal then transfers your payment data to the relevant provider in accordance with Article 6(1)(b) of the GDPR to process the payment:

- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- iDeal (Currence Holding BV, Beethovenstraat 300, Amsterdam, Netherlands)
- Bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- Blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- EPS (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)

For further information regarding data protection, please refer to PayPal’s Privacy Policy: https://www.paypal.com/de/legalhub/paypal/privacy-full
- Shopify Payments

This website offers one or more online payment methods from the following provider: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

If you select a payment method from this provider that requires you to pay in advance (such as credit card payment), your payment details provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number) as well as information about the contents of your order will be transmitted to the provider in accordance with Article 6(1)(b) of the GDPR. In this case, your data is transferred exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

9) Web Analytics Services

Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables an analysis of your use of our website.

By default, when you visit the website, Google Analytics 4 sets cookies, which are small text files stored on your device and collect certain information. This information includes your IP address, although Google truncates the last digits to prevent direct personal identification.

The information is transmitted to Google’s servers and processed there. This may also involve transfers to Google LLC, based in the United States.

Google uses the collected information on our behalf to evaluate your use of the website, compile reports on website activity for us, and provide other services related to website and internet usage. The truncated IP address transmitted by your browser as part of Google Analytics is not combined with other Google data. The data collected through the use of Google Analytics 4 is stored for a period of two months and then deleted.

All processing described above, in particular the setting of cookies on the device you are using, takes place only if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR.
Without your consent, Google Analytics 4 will not be used during your visit to the site. You may revoke your consent at any time with future effect. To exercise your right of revocation, please deactivate this service using the “Cookie Consent Tool” provided on the website.

We have entered into a data processing agreement with Google that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

Further legal information regarding Google Analytics 4 can be found at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy?hl=de&gl=de, and at https://policies.google.com/technologies/partner-sites

Demographic Features
Google Analytics 4 uses the special “demographic characteristics” feature and can generate statistics that provide insights into the age, gender, and interests of website visitors. This is done by analyzing advertising and information from third-party providers. This allows target groups to be identified for marketing activities. However, the collected data cannot be attributed to any specific individual and is deleted after being stored for a period of two months.

Google Signals
As an extension of Google Analytics 4, Google Signals may be used on this website to generate cross-device reports. If you have enabled personalized ads and linked your devices to your Google Account, Google may, subject to your consent to the use of Google Analytics pursuant to Art. 6(1)(a) GDPR, analyze your usage behavior across devices and create database models, including those related to cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop cross-device analysis, you can disable the “Personalized ads” feature in your Google Account settings. To do so, follow the instructions on this page: https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=de
For more information about Google Signals, please visit the following link: https://support.google.com/analytics/answer/7532985?hl=de

UserIDs
As an extension to Google Analytics 4, the “UserIDs” feature can be used on this website. If you have consented to the use of Google Analytics 4 pursuant to Art. 6(1)(a) GDPR, have set up an account on this website, and log in to this account on various devices, your activities—including conversions—can be analyzed across devices.

For data transfers to the U.S., the provider has joined the EU-U.S. Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

10) Site Features

10.1 Google Maps API

To enable real-time verification of certain entries in the address form of our online store’s ordering process for input errors, we use the services of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transferred to: Google LLC, USA

The provider validates the entered address, verifies the spelling, and supplements any missing data if necessary. In the case of ambiguous addresses, correct alternative suggestions are displayed. For this purpose, the address data you enter is transmitted to the provider, stored there, and evaluated.

This processing is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in the proper collection of the customer’s correct address data for the conscientious fulfillment of our contractual delivery obligations and to prevent issues with contract execution.

The provider processes the relevant data separately and does not merge it with other data sets, and deletes it as soon as its status or correctness has been confirmed, but no later than 30 days.

For data transfers to the United States, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

Further information on Google’s privacy policy can be found here: https://business.safety.google/intl/de/privacy/

10.2 Google Web Fonts

This site uses web fonts from the following provider to ensure consistent font display: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

When you visit a page, your browser loads the required web fonts into its cache to display text and fonts correctly and establishes a direct connection to the provider’s servers. In doing so, certain browser information, including your IP address, is transmitted to the provider.

Data may also be transmitted to: Google LLC, USA

The processing of personal data in connection with establishing a connection with the font provider is only carried out if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. You may revoke your consent at any time with future effect by deactivating this service via the “Cookie Consent Tool” provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.

For data transfers to the U.S., the provider has joined the EU-U.S. Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

Further information on Google’s privacy policy can be found here: https://business.safety.google/intl/de/privacy/

11) Tools and Miscellaneous

Cookie Consent Tool

This website uses a so-called “Cookie Consent Tool” to obtain valid user consent for cookies and cookie-based applications that require consent. The “Cookie Consent Tool” is displayed to users when they visit the page in the form of an interactive user interface, where consent for specific cookies and/or cookie-based applications can be granted by checking boxes. When using the tool, all cookies/services requiring consent are loaded only if the respective user grants the corresponding consent by checking the boxes. This ensures that such cookies are set on the user’s respective device only if consent has been granted.

The tool sets technically necessary cookies to save your cookie preferences. Personal user data is generally not processed in this context.

If, in individual cases, the storage, assigning, or logging cookie settings, this is done in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies and, consequently, in the legally compliant design of our website.

Another legal basis for the processing is Art. 6(1)(c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically non-essential cookies contingent upon the user’s consent.

Where necessary, we have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

Further information about the operator and the settings options for the cookie consent tool can be found directly in the corresponding user interface on our website.

12) Rights of the Data Subject

12.1 The applicable data protection law grants you the following rights as a data subject (rights of access and intervention) vis-à-vis the controller regarding the processing of your personal data, whereby reference is made to the cited legal basis for the respective conditions for exercising these rights:

• Right of access pursuant to Art. 15 GDPR;
  
• Right to rectification pursuant to Art. 16 GDPR;
  
• Right to erasure pursuant to Art. 17 GDPR;
  
• Right to restriction of processing pursuant to Art. 18 GDPR;
  
• Right to be informed pursuant to Art. 19 GDPR;
  
• Right to data portability pursuant to Art. 20 GDPR;
  
• Right to withdraw consent pursuant to Art. 7(3) GDPR;
  
• Right to lodge a complaint pursuant to Art. 77 GDPR.

12.2 RIGHT TO OBJECT