Privacy Policy

Preamble

With the following privacy policy, we would like to inform you about which types of your personal data (hereinafter also referred to as "data") we process for which purposes and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the course of providing our services and, in particular, on our websites, in mobile applications, as well as within external online presences, such as our social media profiles (hereinafter collectively referred to as the "online offering").

The terms used are not gender-specific.

Last updated: 29 January 2026

Table of contents

• Preamble
• Controller
• Contact data protection officer
• Overview of processing activities
• Relevant legal bases
• Security measures
• Disclosure of personal data
• International data transfers
• General information on storage and deletion
• Rights of data subjects
• Business processes and operations
• Provision of the online offering and web hosting
• Use of cookies
• Contact and enquiry management
• Communication via messaging services
• Video conferences, online meetings, webinars and screen sharing
• Cloud services
• Web analytics, monitoring and optimisation
• Presences on social networks (social media)
• Plug-ins and embedded functions and content
• Management, organisation and support tools
• Processing of data in the context of employment relationships
• Recruitment / application procedure
• Changes and updates

Controller

Contact data protection officer

m.bollmann@mtg-gmbh.de

Overview of processing activities

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects concerned.

Types of data processed

• Inventory data.
• Employee data.
• Payment data.
• Location data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta, communication and procedural data.
• Social data.
• Applicant data.
• Image and/or video recordings.
• Audio recordings.
• Log data.
• Performance and behavioural data.
• Salary data.

Special categories of data

• Health data.
• Religious or philosophical beliefs.
• Trade union membership.

Categories of data subjects

• Service recipients and clients.
• Employees.
• Interested parties.
• Communication partners.
• Users.
• Applicants.
• Business and contractual partners.
• Depicted persons.
• Third parties.
• Customers.

Purposes of processing

• Provision of contractual services and fulfilment of contractual obligations.
• Communication.
• Security measures.
• Direct marketing.
• Reach measurement.
• Office and organisational procedures.
• Organisational and administrative procedures.
• Recruitment/application procedure.
• Feedback.
• Marketing.
• Profiles with user-related information.
• Provision of our online offering and user-friendliness.
• Establishment and execution of employment relationships.
• Information technology infrastructure.
• Finance and payment management.
• Public relations.
• Sales promotion.
• Business processes and economic procedures.

Relevant legal bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the GDPR, national data protection provisions may apply in your and/or our country of residence or establishment. If more specific legal bases are relevant in individual cases, we will inform you of these in this privacy policy.

• Consent (Art. 6(1) sentence 1 lit. a GDPR) – The data subject has given consent to the processing of personal data relating to him or her for one or more specific purposes.
• Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 lit. b GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6(1) sentence 1 lit. c GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
• Recruitment/application procedure as a pre-contractual or contractual relationship (Art. 6(1) sentence 1 lit. b GDPR) – Where special categories of personal data within the meaning of Art. 9(1) GDPR (e.g., health data) are requested from applicants, processing is carried out pursuant to Art. 9(2) lit. b GDPR (employment and social security law), Art. 9(2) lit. c GDPR (vital interests), or Art. 9(2) lit. h GDPR (healthcare purposes). Where such data is provided on the basis of consent, processing is carried out on the basis of Art. 9(2) lit. a GDPR.
• Processing of special categories of personal data in relation to healthcare, profession and social security (Art. 9(2) lit. h GDPR) – Processing is necessary for purposes of preventive or occupational medicine, assessment of working capacity, medical diagnosis, provision of health or social care or treatment, or management of health or social care systems and services.

National data protection provisions in Germany: In addition to the GDPR, national data protection regulations apply in Germany, in particular the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).

Note on applicability of the GDPR and the Swiss FADP: These privacy notices serve to provide information both under the Swiss Federal Act on Data Protection and under the GDPR. For this reason, please note that, due to broader territorial application and comprehensibility, the terms of the GDPR are used.

Security measures

In accordance with legal requirements and taking into account the state of the art, implementation costs, the nature, scope, circumstances and purposes of processing, as well as the different likelihoods and severity of risks to the rights and freedoms of natural persons, we implement suitable technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to data, as well as access, input, disclosure, ensuring availability and separation. Furthermore, we have established procedures that ensure the exercise of data subject rights, deletion of data and responses to data threats.

Shortening of IP addresses: Where IP addresses are processed by us or by service providers/technologies used and the processing of a full IP address is not required, the IP address is shortened (also referred to as "IP masking").

Securing online connections using TLS/SSL encryption technology (HTTPS): To protect users' data transmitted via our online services against unauthorised access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) encrypt information transmitted between the website/app and the user's browser (or between servers). TLS, as the more advanced version of SSL, ensures that all data transfers meet the highest security standards. A website secured by an SSL/TLS certificate is indicated by "HTTPS" in the URL.

Disclosure of personal data

In the course of processing personal data, it may be transmitted to other bodies, companies, legally independent organisational units or persons, or disclosed to them. Recipients may include, for example, service providers entrusted with IT tasks or providers of services and content integrated into a website. In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts/agreements with recipients that serve to protect your data.

Internal disclosure within the organisation: We may disclose personal data to other departments or units within our organisation or grant them access to it. Where such disclosure is made for administrative purposes, it is based on our legitimate business interests, is necessary to fulfil contractual obligations, or is based on consent or legal permission.

International data transfers

Processing in third countries: Where we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or this occurs in the context of using third-party services or disclosing/transferring data to other persons, bodies or companies, this always takes place in accordance with legal requirements.

For data transfers to the USA, we primarily rely on the EU–US Data Privacy Framework (DPF), which was recognised as an adequate legal framework by an EU Commission adequacy decision of 10 July 2023. In addition, we have concluded Standard Contractual Clauses with the relevant providers.

This twofold safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, while the Standard Contractual Clauses serve as an additional safeguard.

For individual service providers, we inform you whether they are certified under the DPF and whether Standard Contractual Clauses are in place. More information about the DPF and a list of certified companies can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/.

For data transfers to other third countries, corresponding safeguards apply, in particular Standard Contractual Clauses, explicit consent or legally required transfers. Information on third-country transfers and adequacy decisions can be found in the EU Commission's information offering: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=en.

General information on storage and deletion

We delete personal data that we process in accordance with the legal provisions as soon as the underlying consents are revoked or there are no other legal bases for processing. This applies to cases in which the original purpose of processing no longer applies or the data is no longer required. Exceptions apply if legal obligations or special interests require longer retention or archiving.

In particular, data that must be retained for commercial or tax reasons or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that applies specifically to certain processing operations.

If multiple retention periods or deletion deadlines are specified, the longest period always applies.

Retention and deletion of data: The following general periods apply for retention and archiving under German law:

• 10 years – retention period for books and records, annual financial statements, inventories, management reports, opening balance sheet and the work instructions and other organisational documents required to understand them (§ 147(1) no. 1 in conjunction with (3) AO, § 14b(1) UStG, § 257(1) no. 1 in conjunction with (4) HGB).
• 8 years – accounting vouchers such as invoices and expense receipts (§ 147(1) no. 4 and 4a in conjunction with (3) sentence 1 AO as well as § 257(1) no. 4 in conjunction with (4) HGB).
• 6 years – other business documents: received commercial/business letters, copies of sent commercial/business letters, and other documents relevant for taxation (e.g., wage slips, operating accounting sheets, calculation documents, price labels), and payroll documents insofar as they are not accounting vouchers and cash register strips (§ 147(1) nos. 2, 3, 5 in conjunction with (3) AO, § 257(1) nos. 2 and 3 in conjunction with (4) HGB).
• 3 years – data required to consider potential warranty and damages claims or similar contractual claims and rights and to handle related enquiries are stored for the regular statutory limitation period of three years (§§ 195, 199 BGB).

Start of the period at year-end: If a period does not explicitly start on a specific date and is at least one year, it automatically starts at the end of the calendar year in which the triggering event occurred.

Rights of data subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, which in particular arise from Articles 15 to 21 GDPR:

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1) lit. e or f GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw consent at any time.
• Right of access: You have the right to request confirmation as to whether data concerning you is being processed and, where that is the case, access to the data and further information as well as a copy of the data in accordance with legal requirements.
• Right to rectification: You have the right to request completion of data concerning you or rectification of inaccurate data in accordance with legal requirements.
• Right to erasure and restriction: You have the right to request immediate deletion of data concerning you or, alternatively, restriction of processing in accordance with legal requirements.
• Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller.
• Right to lodge a complaint: Without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

Business processes and operations

Personal data of service recipients and clients – including customers, clients or, in special cases, business partners and other third parties – is processed in the context of contractual or comparable legal relationships and pre-contractual measures such as initiating business relationships. This processing supports business operations in areas such as customer management, sales, payment transactions, accounting and project management.

The data collected serves to fulfil contractual obligations and to organise operational processes efficiently.

Personal data may be disclosed to third parties if necessary to fulfil the above purposes or legal obligations. After statutory retention periods expire or the purpose no longer applies, the data is deleted.

Provision of the online offering and web hosting

We process users' data in order to provide our online services to them. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or end device.

Use of cookies

The term "cookies" refers to functions that store information on users' end devices and read information from them. Cookies can also be used for various purposes, such as the functionality, security and convenience of online offerings and the creation of visitor flow analyses. We use cookies in accordance with legal requirements. Where necessary, we obtain users' consent in advance. Where consent is not required, we rely on our legitimate interests.

Storage duration: Regarding storage duration, the following types of cookies are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user leaves an online offering and closes their end device (e.g., browser or mobile application).
• Persistent cookies: Persistent cookies remain stored even after the end device is closed. For example, the login status can be saved and preferred content can be displayed directly when the user visits a website again.

Contact and enquiry management

When contacting us (e.g., by post, contact form, email, phone or via social media) and in the context of existing user and business relationships, the information provided by the requesting persons is processed insofar as this is necessary to answer contact enquiries and any requested measures.

Communication via messaging services

We use messaging services for communication purposes and therefore ask you to observe the following information regarding the functionality of the messaging services, encryption, the use of communication metadata and your options to object.

You can also contact us via alternative channels, e.g., phone or email. Please use the contact options communicated to you or those provided within our online offering.

Video conferences, online meetings, webinars and screen sharing

We use platforms and applications from other providers (hereinafter referred to as "conference platforms") for conducting video and audio conferences, webinars and other types of video and audio meetings (collectively referred to as "conference"). When selecting conference platforms and their services, we observe legal requirements.

Cloud services

We use internet-accessible software services executed on their providers' servers ("cloud services", also referred to as "software as a service") for storing and managing content (e.g., document storage and management, exchange of documents, content and information with specific recipients, or publication of content and information).

Web analytics, monitoring and optimisation

Web analytics (also referred to as "reach measurement") is used to evaluate visitor flows of our online offering and can include behaviour, interests or demographic information about visitors, such as age or gender, as pseudonymous values.

Presences on social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with users active there or to offer information about us.

Plug-ins and embedded functions and content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These can be, for example, graphics, videos or maps (collectively referred to as "content").

Management, organisation and support tools

We use services, platforms and software from other providers ("third-party providers") for purposes of organisation, administration, planning and provision of our services. When selecting third-party providers and their services, we observe legal requirements.

Processing of data in the context of employment relationships

In the context of employment relationships, personal data is processed with the aim of effectively organising the establishment, implementation and termination of such relationships. This processing supports various operational and administrative functions required for managing employee relationships.

Recruitment / application procedure

The application procedure requires applicants to provide us with the data necessary for assessment and selection. Which information is required is derived from the job description or, in the case of online forms, from the information provided there.

Deletion of data: Data provided by applicants may be further processed by us in the event of a successful application for the purposes of the employment relationship. Otherwise, if the application is unsuccessful, applicants' data will be deleted. Applicants' data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Deletion takes place, subject to a justified objection by the applicants, at the latest after a period of six months.

Changes and updates

We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g., consent) or other individual notification.

If we provide addresses and contact details of companies and organisations in this privacy policy, please note that addresses may change over time and please verify the information before contacting them.