Privacy Policy
1. Privacy at a Glance
General Information
The following provides a simple overview of what happens to your personal data when you visit our website. Personal data includes any data that can be used to personally identify you. For detailed information on data protection, please refer to our Privacy Policy outlined below.
Data Collection on This Website
Who is responsible for data collection on this website? Data processing on this website is carried out by the website operator. You can find the operator’s contact information in the “Notice on the Responsible Party” section of this Privacy Policy.
How do we collect your data? Some data is collected when you provide it to us. For example, this could be data that you enter into a contact form.
Other data is collected automatically or with your consent when you visit the website. This primarily includes technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you access our website.
What do we use your data for? Some of the data is collected to ensure the website is provided error-free. Other data may be used to analyze your user behavior.
What rights do you have regarding your data? You have the right at any time to request information, free of charge, about the origin, recipients, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent for data processing, you can withdraw this consent at any time for future processing. Additionally, under certain circumstances, you have the right to request the restriction of the processing of your personal data. Furthermore, you have the right to file a complaint with the relevant supervisory authority.
For these or other questions regarding data protection, you may contact us at any time.
3. General Information and Mandatory Disclosures
Data Protection
The operators of this site take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this Privacy Policy.
When you use this website, various personal data is collected. Personal data refers to information that can personally identify you. This Privacy Policy explains which data we collect, how we use it, and the purpose of the collection.
Please note that data transmission over the internet (e.g., when communicating by email) may have security gaps. Complete protection of data from third-party access is not possible.
Information on the Responsible Party
The responsible party for data processing on this website is:
Midcosta GmbH
Sägebühlweg 4
79868 Feldberg
Phone: +49 89262071850
Email: info@midcosta.de
The responsible party is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g., names, email addresses, etc.).
Data Storage Duration
Unless a more specific storage period is mentioned in this Privacy Policy, your personal data will remain with us until the purpose for data processing no longer applies. If you make a valid request for deletion or withdraw your consent for data processing, your data will be deleted unless we have other legally permissible reasons for retaining it (e.g., tax or commercial law retention periods); in such cases, the data will be deleted after these reasons cease to apply.
General Information on Legal Bases for Data Processing on this Website
If you have consented to data processing, we process your personal data based on Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR if special data categories per Art. 9(1) GDPR are processed. In the case of explicit consent to transfer personal data to third countries, processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or access to information on your device (e.g., via device fingerprinting), data processing is additionally based on § 25(1) TDDDG. Consent may be revoked at any time. If your data is required to fulfill a contract or pre-contractual measures, we process it based on Art. 6(1)(b) GDPR. Data is also processed if necessary to fulfill a legal obligation under Art. 6(1)(c) GDPR. Data processing may also be based on our legitimate interests per Art. 6(1)(f) GDPR. Specific legal bases are detailed in the following sections of this Privacy Policy.
Recipients of Personal Data
As part of our business activities, we work with various external parties, which sometimes involves transferring personal data to these parties. Personal data is shared only if required for contract fulfillment, legally mandated (e.g., to tax authorities), based on our legitimate interest under Art. 6(1)(f) GDPR, or if another legal basis permits the sharing. When using data processors, personal data of our customers is shared only under a valid data processing agreement. In cases of joint processing, a joint processing agreement is established.
Withdrawal of Your Consent to Data Processing
Many data processing operations are only possible with your explicit consent. You can revoke previously given consent at any time. The legality of data processing up until the revocation remains unaffected.
Right to Object to Data Collection in Specific Cases and to Direct Advertising (Art. 21 GDPR) IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS FOR PROCESSING IS SPECIFIED IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).
IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING, INCLUDING PROFILING RELATED TO DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION UNDER ART. 21(2) GDPR).
Right to Lodge a Complaint with the Competent Supervisory Authority
In the case of GDPR violations, data subjects have the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, workplace, or the place of the alleged infringement. The right to lodge a complaint is without prejudice to other administrative or judicial remedies.
Right to Data Portability
You have the right to receive data that we process automatically based on your consent or in fulfillment of a contract, in a commonly used, machine-readable format. If you request the direct transfer of data to another responsible party, this will only take place if technically feasible.
Access, Correction, and Deletion
Within the framework of applicable legal provisions, you have the right at any time to receive free information about your stored personal data, its origin, recipients, and the purpose of data processing. You may also have the right to correct or delete this data. For this, and other questions regarding personal data, you may contact us at any time.
Right to Restrict Processing
You have the right to request the restriction of the processing of your personal data. You may contact us at any time regarding this. The right to restrict processing applies in the following cases:
If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of this verification, you have the right to request the restriction of processing of your personal data.
If the processing of your personal data is unlawful, you may request the restriction of data processing instead of deletion.
If we no longer need your personal data but you need it to exercise, defend, or assert legal claims, you have the right to request the restriction of its processing instead of deletion.
If you have objected under Art. 21(1) GDPR, there must be a balance of interests between yours and ours. As long as it is not clear whose interests prevail, you have the right to request the restriction of your personal data’s processing.
If processing is restricted, your data may – aside from storage – only be processed with your consent or to assert, exercise, or defend legal claims or to protect the rights of another natural or legal person or for reasons of important public interest in the European Union or a Member State.
SSL or TLS Encryption
This site uses SSL or TLS encryption for security and to protect the transmission of sensitive content, such as orders or inquiries you send to us. You can recognize an encrypted connection by the “https://” in your browser’s address bar and the padlock icon in your browser bar.
When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
Data Collection on this Website
Cookies: Our website uses “cookies.” Cookies are small data packets that do not harm your device. They are either stored temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device. Session cookies are automatically deleted after your visit. Persistent cookies remain stored on your device until you delete them yourself or they are automatically deleted by your web browser.
Cookies can either originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies allow the integration of specific services from third-party companies within websites (e.g., cookies to handle payment services).
Cookies have various functions. Numerous cookies are technically necessary, as certain website functions would not work without them (e.g., the shopping cart function or displaying videos). Other cookies may be used to analyze user behavior or for advertising purposes.
Cookies required to carry out the electronic communication process, to provide certain functions requested by you (e.g., for the shopping cart function), or to optimize the website (e.g., cookies to measure web traffic) are stored based on Art. 6(1)(f) of the GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies for the technically error-free and optimized provision of its services. If consent to store cookies and similar recognition technologies has been requested, processing occurs exclusively based on this consent (Art. 6(1)(a) of the GDPR and § 25(1) of the German Telecommunications and Telemedia Data Protection Act – TTDSG); consent can be revoked at any time.
You can configure your browser to inform you about cookie settings and only allow cookies in individual cases, exclude the acceptance of cookies for specific cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.
You can find out which cookies and services are used on this website in this privacy policy.
Consent with Cookiebot: Our website uses the Cookiebot consent technology to obtain your consent for storing specific cookies on your device or for using certain technologies and to document this in compliance with data protection regulations. This technology is provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (“Cookiebot”).
When you enter our website, a connection to Cookiebot’s servers is established to obtain your consents and other declarations regarding cookie use. Cookiebot then stores a cookie in your browser to be able to assign the consents you have given or revoked. The data collected in this way is stored until you request deletion, delete the Cookiebot cookie yourself, or the purpose for data storage no longer applies. Statutory retention obligations remain unaffected.
The use of Cookiebot is to obtain legally required consents for using cookies. The legal basis for this is Art. 6(1)(c) of the GDPR.
Contact Form: If you send us inquiries via the contact form, your details from the form, including the contact data you provide there, will be stored for processing the request and in case of follow-up questions. We do not share this data without your consent.
The processing of this data is based on Art. 6(1)(b) of the GDPR if your request is related to fulfilling a contract or necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in effectively handling the inquiries directed at us (Art. 6(1)(f) of the GDPR) or on your consent (Art. 6(1)(a) of the GDPR), if requested; consent can be revoked at any time.
The data you provide in the contact form will remain with us until you request its deletion, revoke your consent for storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory statutory provisions, particularly retention periods, remain unaffected.
Inquiries by Email, Phone, or Fax: If you contact us by email, phone, or fax, your inquiry, including all resulting personal data (name, request), will be stored and processed for the purpose of handling your request. We do not share this data without your consent.
The processing of this data is based on Art. 6(1)(b) of the GDPR if your inquiry is related to fulfilling a contract or necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in effectively processing the inquiries directed at us (Art. 6(1)(f) of the GDPR) or on your consent (Art. 6(1)(a) of the GDPR), if requested; consent can be revoked at any time.
The data sent by you in contact inquiries remains with us until you request deletion, revoke your consent for storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory statutory provisions, particularly statutory retention periods, remain unaffected.
HubSpot CRM: This website uses HubSpot CRM provided by HubSpot Inc., 25 Street, Cambridge, MA 02141, USA (“HubSpot CRM”).
HubSpot CRM allows us to manage existing and potential customers and customer contacts. Using HubSpot CRM, we can record, sort, and analyze customer interactions via email, social media, or phone across various channels. The personal data collected can be analyzed and used for communication with potential customers or marketing actions (e.g., newsletter mailings). HubSpot CRM also enables us to track and analyze the behavior of users on our website.
The use of HubSpot CRM is based on Art. 6(1)(f) of the GDPR. The website operator has a legitimate interest in the most efficient customer management and customer communication possible. If consent has been requested, processing occurs exclusively based on Art. 6(1)(a) of the GDPR and § 25(1) TTDSG, as far as the consent includes storing cookies or accessing information on the user’s device (e.g., device fingerprinting) under the TTDSG. Consent can be revoked at any time.
For details, refer to HubSpot’s privacy policy: https://legal.hubspot.com/privacy-policy.
Data transfer to the USA is based on the EU Commission’s standard contractual clauses. For details, visit: https://www.hubspot.com/data-privacy/privacy-shield.
The company is certified under the “EU-US Data Privacy Framework” (DPF), an agreement between the European Union and the USA to ensure compliance with European data protection standards in the USA. Each company certified under the DPF is committed to these data protection standards. For more information, visit: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000TN8pAAG&status=Active.
Data Processing Agreement: We have entered into a data processing agreement (DPA) for using the service mentioned above. This is a data protection contract required by law, ensuring that HubSpot only processes our website visitors’ personal data following our instructions and in compliance with the GDPR.
Social Media
LinkedIn: This website uses elements from the LinkedIn network, provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
Each time a page on this website containing LinkedIn elements is accessed, a connection to LinkedIn’s servers is established. LinkedIn is informed that you have visited this website with your IP address. If you click on LinkedIn’s “Recommend Button” and are logged into your LinkedIn account, LinkedIn can associate your visit to this website with you and your user account. Please note that we, as the website provider, have no knowledge of the content of the transmitted data or LinkedIn’s use of it.
The use of this service is based on your consent under Art. 6(1)(a) of the GDPR and § 25(1) of the German Telecommunications and Telemedia Data Protection Act (TTDSG). Consent can be withdrawn at any time.
Data transfer to the USA is based on the EU Commission’s standard contractual clauses. For details, see: https://www.linkedin.com/help/linkedin/answer/a1343190/datenubertragung-aus-der-eu-dem-ewr-und-der-schweiz?lang=de.
For further information, please see LinkedIn’s Privacy Policy: https://www.linkedin.com/legal/privacy-policy.
The company is certified under the “EU-US Data Privacy Framework” (DPF), an agreement between the European Union and the USA that aims to ensure compliance with European data protection standards for data processing in the USA. Each company certified under the DPF is obligated to adhere to these data protection standards. More information is available at: https://www.dataprivacyframework.gov/participant/5448.
6. Newsletter
Newsletter Data
If you would like to receive the newsletter offered on the website, we need your email address as well as information that allows us to verify that you are the owner of the specified email address and that you agree to receive the newsletter. No further data will be collected, or only on a voluntary basis. We use this data exclusively for the purpose of sending the requested information and do not share it with third parties.
The processing of the data entered in the newsletter registration form is carried out solely on the basis of your consent (Art. 6 (1) (a) GDPR). You can withdraw your consent for the storage of the data, the email address, and their use for sending the newsletter at any time, for example, via the “unsubscribe” link in the newsletter. The legality of the data processing operations already carried out remains unaffected by the withdrawal.
The data you provided for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter or until the newsletter service provider deletes it after the purpose has been fulfilled. We reserve the right to delete or block email addresses from our newsletter distribution list at our discretion within the scope of our legitimate interests according to Art. 6 (1) (f) GDPR.
Data that has been stored for other purposes remains unaffected by this.
After you unsubscribe from the newsletter distribution list, your email address may be stored by us or the newsletter service provider on a blacklist if this is necessary to prevent future mailings. The data from the blacklist will be used solely for this purpose and will not be combined with other data. This serves both your interest and our interest in complying with the legal requirements for sending newsletters (legitimate interest in the sense of Art. 6 (1) (f) GDPR). The storage in the blacklist is not time-limited. You can object to the storage if your interests outweigh our legitimate interest.
7. Plugins and Tools
YouTube with Enhanced Privacy
This website integrates videos from the YouTube website. The operator of the site is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
When you visit one of the websites where YouTube is embedded, a connection is established to YouTube’s servers. In this process, the YouTube server is informed about which of our pages you have visited. If you are logged into your YouTube account, YouTube can directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your YouTube account.
We use YouTube in enhanced privacy mode. According to YouTube, videos played in enhanced privacy mode are not used for personalizing your browsing on YouTube. Ads displayed in enhanced privacy mode are also not personalized. No cookies are set in enhanced privacy mode. Instead, so-called Local Storage elements are stored in the user’s browser, which contain personal data similar to cookies and can be used for recognition. You can find details about enhanced privacy mode here: https://support.google.com/youtube/answer/171780.
After activating a YouTube video, further data processing operations may be triggered, over which we have no influence.
The use of YouTube is in the interest of presenting our online offerings attractively. This represents a legitimate interest in the sense of Art. 6 (1) (f) GDPR. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 (1) TDDG, provided that the consent includes the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) as defined by the TDDG. Consent can be revoked at any time.
For more information about data protection on YouTube, please refer to their privacy policy at: https://policies.google.com/privacy?hl=en.
The company has certification under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that aims to ensure compliance with European data protection standards in data processing in the USA. Each company certified under the DPF commits to uphold these data protection standards. More information can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.