PRIVACY POLICY

OrbitExSpace GmbH ("OrbitExSpace", "we", "us", or "our") is committed to protecting the privacy of individuals who visit our website, use our services, or otherwise interact with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

The data controller responsible for your personal data is: OrbitExSpace GmbH Munich, Germany For data protection inquiries, contact our Data Protection Officer at [email protected].

We may collect the following categories of personal data: • Contact information — name, email address, phone number, company name, and job title when you submit inquiries, request proposals, or apply for positions. • Technical data — IP address, browser type and version, operating system, referring URL, pages visited, time and date of access, and session duration. This data is collected automatically through server logs and analytics tools. • Communications data — the content of messages you send to us through our contact forms, email, or other communication channels. • Application data — CV, cover letter, work history, education, and other materials submitted through our careers portal. • Customer data — mission specifications, payload information, contractual and billing data provided in the course of a commercial relationship.

We process your personal data on the following legal bases under Article 6 GDPR: • Consent (Art. 6(1)(a)) — where you have given explicit consent, for example by subscribing to communications. • Contract performance (Art. 6(1)(b)) — where processing is necessary to perform a contract with you or to take pre-contractual steps at your request. • Legitimate interests (Art. 6(1)(f)) — where processing is necessary for our legitimate business interests, such as improving our services, ensuring network security, and preventing fraud, provided these interests are not overridden by your rights. • Legal obligation (Art. 6(1)(c)) — where processing is required to comply with applicable laws and regulations.

We use your personal data for the following purposes: • To respond to your inquiries and provide requested information about our services. • To process and manage launch service contracts, satellite hosting agreements, and data subscriptions. • To evaluate job applications and manage the recruitment process. • To improve our website, services, and user experience through analytics. • To ensure the security and integrity of our systems and infrastructure. • To comply with legal, regulatory, and contractual obligations. • To communicate service updates, mission notifications, and other operational information relevant to our customers.

We do not sell your personal data. We may share your data with: • Service providers — trusted third parties who assist us in operating our website, conducting business, and servicing you, subject to contractual data protection obligations. • Legal and regulatory authorities — where required by law, regulation, or legal process. • Business partners — in the context of joint missions or collaborative programs, only to the extent necessary and with appropriate safeguards. Where personal data is transferred outside the European Economic Area (EEA), we ensure adequate protection through EU Standard Contractual Clauses or other approved transfer mechanisms.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Specific retention periods: • Contact inquiries — 24 months from last interaction. • Customer data — duration of the contractual relationship plus 10 years (statutory retention under German commercial law). • Job applications — 6 months after the conclusion of the recruitment process, unless you consent to longer retention. • Technical logs — 90 days. When retention periods expire, data is securely deleted or anonymized.

Under the GDPR, you have the following rights regarding your personal data: • Right of access — obtain confirmation of whether we process your data and request a copy. • Right to rectification — request correction of inaccurate or incomplete data. • Right to erasure — request deletion of your data where there is no compelling reason for continued processing. • Right to restriction — request limitation of processing under certain circumstances. • Right to data portability — receive your data in a structured, machine-readable format. • Right to object — object to processing based on legitimate interests or for direct marketing purposes. • Right to withdraw consent — withdraw consent at any time without affecting the lawfulness of prior processing. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Our website uses essential cookies required for basic functionality. We do not use third-party advertising cookies. Analytics cookies, if used, are configured to anonymize IP addresses and do not track individual users across websites. You can control cookie preferences through your browser settings. Disabling essential cookies may affect website functionality.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include: • TLS 1.3 encryption for all data in transit. • AES-256 encryption for data at rest. • Access controls and authentication for internal systems. • Regular security assessments and penetration testing. • Employee training on data protection and information security.

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The revised policy will be posted on this page with an updated effective date. We encourage you to review this page periodically.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us: OrbitExSpace GmbH Data Protection Officer Email: [email protected] You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.