Privacy Policy

The controller under the GDPR is MCF Technologie GmbH. You can contact our data protection officer by post at MCF Technologie GmbH, Data Protection Officer, Pforzheimer Str. 122, 76275 Ettlingen, Germany, by telephone at +49 7243 947 56-0 or by email at info@mcf-technologie.de.

We process personal data only where this is necessary to provide a functional website, our content and our services. Processing is based on Article 6(1)(a), (b), (c) or (f) GDPR, as applicable.

Each request may generate a log containing the browser type and version, operating system, IP address, date and time, requested pages or files, transferred volume, status code and referrer. This processing is necessary for secure and reliable delivery and to defend against attacks and is based on Article 6(1)(f) GDPR. Regular access logs are deleted after 14 days. Information relating to a specific security incident may be retained until that incident is fully resolved and for applicable statutory periods.

This website, its databases and the self-hosted audience measurement service run on infrastructure provided by IONOS SE in Germany. Media and encrypted backups are stored in IONOS Object Storage in Frankfurt. The processing supports contractual and pre-contractual activities and our legitimate interest in secure, fast and efficient delivery. An Article 28 GDPR data-processing agreement is concluded with IONOS.

We currently do not use cookies or comparable tracking technologies requiring consent on the public website. The selected language is part of the URL and is not stored in a language or consent cookie. If you add products to the enquiry list, the selection you requested is stored locally in your browser for up to 30 days; an empty list creates no entry. The legal basis is Section 25(2)(2) TDDDG. The protected editorial area uses technically necessary login and security cookies.

We use the open-source Umami software, operated on our own IONOS infrastructure, for statistical audience measurement and to improve our website. Umami runs in cookieless mode and does not set cookies. To create a technically limited session, technical information such as the IP address, user agent, website ID, date and a monthly rotating salt is processed pseudonymously; the IP address is not stored. We collect page views, referrers without URL parameters, technical device data, coarse geographic information and factual events for successful forms, public-document downloads and clicks to the JOIN application page. We do not use distinct IDs or cross-device tracking and do not collect form contents, names, email addresses, customer numbers, search terms, heatmaps or session recordings. URL parameters are limited to utm_source, utm_medium, utm_campaign, utm_content and utm_term, and Do Not Track is respected. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is privacy-conscious, aggregated analysis and improvement of our online services. Data is deleted automatically after 13 months.

On the careers page, we load the JOIN Job Widget directly to provide an up-to-date, user-friendly display of open positions. This sends technically required requests to JOIN and its CDN. Data transferred may include the IP address, time, user agent and browser client hints, origin or referrer, language, widget configuration and the public company and widget identifiers. The provider is JOIN Solutions AG, Eichenstrasse 2, 8808 Pfäffikon SZ, Switzerland; its EU representative is JOIN Solution GmbH, Schönhauser Allee 36, 10435 Berlin, Germany. In the current integration, our technical assessment found that the JOIN Job Widget does not use its own cookies or web-storage technologies to track website visitors. A pre-existing .join.com cookie in the browser may be sent with individual JOIN requests depending on its SameSite settings; the widget itself did not create such a cookie in our assessment. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the current, user-friendly presentation of open positions and provision of the application process. Further information: https://join.com/en/privacy.

If you apply through the linked JOIN careers page, MCF and JOIN process your applicant data within their respective responsibilities to carry out the application process. JOIN is used as a recruiting service provider or processor in accordance with the contractual arrangements. The legal basis is Article 6(1)(b) GDPR in conjunction with Section 26(1) BDSG. If no employment relationship is established, we delete application documents no later than six months after the process ends unless longer retention is required or you have consented to it. JOIN’s additional information is available at https://join.com/en/privacy.

When you use a contact, quick-contact, product-enquiry or training form, we process the contact, company, message, product and participant data you provide in order to handle your request. The website does not create a separate form-submission record in Payload CMS. The information is transferred via Microsoft Graph to the designated Microsoft 365 mailbox and processed there under the company email-retention rules. Recipients are the responsible employees of MCF Technologie GmbH and Microsoft Ireland Operations Limited as processor. The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual communication and otherwise Article 6(1)(f) GDPR. Data is deleted once the request has been fully handled unless statutory retention requirements or legitimate evidentiary interests apply.

Personal data is disclosed only to the internal teams and contracted service providers required for the relevant purpose. These include IONOS for hosting and backups, Microsoft for email delivery and mailbox processing, and JOIN for job listings and applications. Transfers outside the EU or EEA take place only where an adequacy decision or appropriate safeguards under Articles 44 et seq. GDPR are in place. The European Commission has adopted an adequacy decision for Switzerland.

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, you may withdraw that consent at any time with effect for the future. To exercise your rights, send an informal request using the contact details above.

You may lodge a complaint with a data protection supervisory authority. The competent authority for MCF Technologie GmbH is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

We use technical and organisational security measures to protect your data against manipulation, loss, destruction and unauthorised access. We update this policy when legal requirements or processing activities change.