Data privacy policy

M&A Media Services GmbH ("MAMS" / mandaco)
Version: October 2026

M&A Media Services GmbH attaches great importance to the protection of your privacy and your personal data, as well as to the necessary level of data security, and therefore collects, processes and uses your personal data exclusively in accordance with the principles described below and the applicable requirements of the EU General Data Protection Regulation and the German Federal Data Protection Act.

I. Name and address of the controller
II. Your personal data
III. General information on data processing
IV. Provision of the website and creation of log files
V. Communication
V.1 Email communication
V.2 Newsletter and newsletter tracking
VI. Use of cookies and local storage
VII. Plugins, tools and service providers
VII.1 Use of Matomo
VII.2 Use of HubSpot (CRM)
VII.3 Use of ticketareo
VII.4 Use of n8n
VII.5 Use of Short.io
VII.6 Use of Vimeo
VII.7 Social media presences and Buffer
VII.8 Contact capture at events (snapADDY)
VII.9 AI-assisted processing (Anthropic Claude)
VII.10 Other processors
VII.11 Processing of application and course participation documents (Career in M&A)
VII.12 Subscriptions, orders and payment processing
VIII. Rights of the data subject
IX. Automated decision-making and profiling
X. Links to other websites
XI. Security
XII. Availability and changes

I. Name and address of the controller

The controller within the meaning of the EU General Data Protection Regulation ("GDPR") and other national data protection laws of the EU Member States as well as other applicable data protection provisions for the operation of the websites www.manda.co and www.ma-review.de and their subdomains (hereinafter the "Website") is:

M&A Media Services GmbH
Habenschadenstr. 16
82049 Pullach
Germany

Tel.: +49 179 4483063
Email: hello@manda.co

Represented by the Managing Director Stefan Schneider

(hereinafter referred to as the "Company", "MAMS", "mandaco", or "we").

If you wish to object to the collection, processing or use of your data by us in accordance with this privacy policy, either in whole or for individual measures, you may send your objection by email or letter to the contact details listed above. You may also obtain information about your personal data free of charge at any time via the above contact details.

II. Your personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter the "data subject"). It is not necessary for you to provide us with personal data when visiting our Website. Personal data such as your name, telephone number, postal and email address or date of birth will only be collected if you voluntarily provide this data to us or consent to its collection. For technically necessary data, please refer to the explanations under "IV. Provision of the Website and creation of log files" and "VI. Use of cookies and local storage".

III. General information on data processing

1. Scope of the processing of personal data

Via this Website, we process personal data (hereinafter also "data") of data subjects, i.e. website visitors, insofar as this is necessary to provide a functional website as well as our content and services. As a rule, the processing of our users' personal data only takes place if the user has consented to the processing. An exception applies where the processing is permitted by law, required for the performance of a contract, or technically necessary.

2. Legal basis for the processing of personal data

Where we obtain the consent of the data subject, Art. 6(1)(a) GDPR serves as the legal basis. For processing necessary for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis; this also applies to pre-contractual measures. Where processing is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis. Where vital interests of the data subject or another natural person require the processing, Art. 6(1)(d) GDPR serves as the legal basis. If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and such interests are not overridden by the interests, fundamental rights and freedoms of the data subject, Art. 6(1)(f) GDPR serves as the legal basis.

3. Data deletion and storage duration

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Data may also be stored if this has been provided for by European or national legislators in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted when a statutory retention period expires, unless continued storage is necessary for the performance of a contract.

4. Processors

For individual processing operations we use service providers that process data on our behalf and on our instructions (processors, Art. 28 GDPR). We have concluded a data processing agreement with each of these providers. Where a provider processes data outside the EU or the EEA, this is based on an adequacy decision of the European Commission (in particular the EU-US Data Privacy Framework) or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The providers used are listed in Section VII.

IV. Provision of the website and creation of log files

1. Description and scope of data processing

When using the Website for informational purposes only, we collect only the personal data that your browser transmits to our server or provider and that is technically necessary to display our Website and ensure its stability and security. This includes your IP address, information about your browser, operating system and device, referrer, date and time of access, and similar data.

Our Website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. All data processed in connection with the use of this Website is stored on servers located in Germany.

Hetzner acts as a processor pursuant to Art. 28 GDPR. A data processing agreement has been concluded with Hetzner, ensuring that your personal data is processed solely in accordance with our instructions and in compliance with applicable data protection regulations.

Hetzner is used in the interest of providing our online offering in a secure, fast and reliable manner. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.

2. Legal basis

The legal basis for the temporary storage of data and log files is Art. 6(1)(f) GDPR.

3. Purpose

The temporary storage of the IP address is necessary to deliver the website to the user's device. For this purpose, the IP address must remain stored for the duration of the session. All of the above information is stored in log files to ensure the functionality and security of the Website. The server-side log files are used only for error analysis and are not evaluated for marketing purposes.

4. Duration of storage

Users' IP addresses are anonymized as soon as they are no longer required, i.e. when the user session ends. Log files are stored for a maximum of 14 days.

5. Possibility of objection and deletion

The collection of data for the provision of the Website and the storage of log files is absolutely necessary for the operation of the Website. Consequently, there is no possibility for the user to object.

V. Communication

V.1 Email communication

1. Description and scope of data processing
Our Website provides the option to contact us via a stated email address. In this case the personal data transmitted will be stored. This includes in particular: (1) your salutation and first and last name; (2) your company; (3) your communication data (email address, telephone number); (4) the resulting correspondence.

Your data and the resulting correspondence are processed exclusively by us and are not passed on to third parties. The data is used solely for the conversation initiated by you. The provision of data is voluntary.

2. Legal basis
Art. 6(1)(a) GDPR; if your contact is aimed at concluding a contract, additionally Art. 6(1)(b) GDPR.

3. Purpose
Contacting you or answering your questions about our activities.

4. Duration of storage
The data will be deleted as soon as the respective conversation with you has ended, i.e. when the circumstances indicate that the matter has been conclusively clarified.

5. Possibility of objection and deletion
You may withdraw your consent and object to the storage of your personal data at any time via the contact details in Section I or by email to hello@manda.co. In such a case, the conversation cannot be continued and all personal data stored in the course of the contact will be deleted.

V.2 Newsletter and newsletter tracking

1. Description and scope of data processing
Our Website offers the opportunity to subscribe to an email newsletter. If you sign up, we use the data you provide to send you our newsletter in accordance with your consent. We send newsletters at regular intervals to share news, offers and information from the field of MAMS.

We may process in particular: (1) your email address, (2) whether you have consented to or objected to receiving such communications, including date and time, (3) company name, (4) first and last name.

We collect, process and use this data exclusively for sending the newsletter and monitoring its success. We generally personalize our newsletters with the name of the recipient.

For the technical implementation of the dispatch, your personal data is transferred to Mailchimp, a service of The Rocket Science Group LLC d/b/a Mailchimp, an Intuit Inc. company, 405 N Angier Ave. NE, Atlanta, GA 30308, USA ("Mailchimp"), which processes the data as a processor pursuant to Art. 28 GDPR. Mailchimp is certified under the EU-US Data Privacy Framework (DPF); in addition, the EU Standard Contractual Clauses have been agreed. Mailchimp uses the data exclusively for sending and evaluating the newsletter. Further information: https://mailchimp.com/ and https://www.intuit.com/privacy/statement/.

Consent wording at sign-up: "I have taken note of the privacy policy of M&A Media Services GmbH and consent to my details being processed for sending the newsletter on offers of M&A Media Services GmbH and being stored in our CRM system (HubSpot, see Section VII.2). This consent is voluntary and can be withdrawn at any time with effect for the future, for example via the unsubscribe link in the newsletter or by email to hello@manda.co."

Subscription takes place via a double opt-in procedure: after entering your data you receive an email with a confirmation link; only after confirmation is your address added to the mailing list. We store: registration data, time of registration, confirmation, unsubscription, IP address and changes to the stored data. This is necessary to trace possible misuse of the email address and to protect the controller.

To improve the newsletter, open and click rates are tracked to evaluate the success of a campaign. Further information: https://mailchimp.com/help/about-open-tracking/. Links in our newsletters may be routed through the link shortener Short.io (see Section VII.5).

2. Legal basis
Art. 6(1)(a) GDPR.

3. Purpose
Handling and sending newsletters and evaluating their success, so that we can tailor our offerings to the interests of our subscribers.

4. Duration of storage
Your data is stored on Mailchimp servers in the USA. The data will be deleted as soon as it is no longer required, in particular when you withdraw your consent. After unsubscribing, the data stored for dispatch is deleted; proof of the earlier consent and of the withdrawal is retained for up to three years to meet our accountability obligations.

5. Possibility of objection and deletion
You may withdraw your consent at any time by email to hello@manda.co or via the unsubscribe link in the newsletter.

VI. Use of cookies and local storage

1. Description and scope of data processing

We use cookies and your browser's local storage to make your visit more convenient. Cookies are small text files stored on your device that allow us, among other things, to recognize your browser. Some cookies are deleted after the end of your browser session ("session cookies"); others remain on your device for their respective period of validity. A description of the cookies used can be found in the respective sections under "VII. Plugins, tools and service providers". We store only necessary information in local storage, such as language settings.

2. Legal basis

The legal basis for technically necessary cookies and local storage entries is Art. 6(1)(f) GDPR; these are set in accordance with Section 25(2) no. 2 TDDDG. The legal basis for cookies or comparable technologies for analysis or marketing purposes and for loading third-party content (e.g. Vimeo) is your consent given via the cookie banner, Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

3. Purpose

Technically necessary cookies enable you to use our Website; some functions cannot be provided without them. The data collected by technically necessary cookies is not used to create user profiles.

4. Duration of storage, objection and deletion

Cookies are stored on your device and you have full control over their use. You can deactivate or restrict cookies in your browser settings and delete stored cookies at any time. Consent given via the cookie banner can be withdrawn at any time via the cookie settings of the Website. If cookies are deactivated, not all functions of the Website may be available.

VII. Plugins, tools and service providers

VII.1 Use of Matomo

1. Description and scope of data processing
We have integrated the open-source web analytics service Matomo on our Website. Matomo runs on our own server at Hetzner (see Section IV); no data is transmitted to the Matomo manufacturer. We use Matomo without cookies. This enables us to analyze how often pages are accessed or functions are used.

When individual pages are accessed, the integrated script transmits the following data to our web server: (1) IP address of the accessing system (truncated by the last two bytes), (2) the page accessed and the time of access, (3) the referrer, (4) the subpages accessed, (5) the duration of the visit, (6) the frequency of access, (7) country of origin, device, operating system and browser.

The following cookies are set only if you opt out of Matomo tracking: piwik_ignore (opt-out marker) and MATOMO_SESSID (temporary session cookie securing the opt-out process).

2. Purpose and legal basis
Improving the quality of our Website and its content. Legal basis is our legitimate interest in optimizing our offering, Art. 6(1)(f) GDPR.

3. Objection
You may object to data collection by Matomo at any time with future effect via the opt-out field below. [Matomo opt-out iframe] Further information: https://matomo.org/.

VII.2 Use of HubSpot (CRM)

1. Description and scope of data processing
We use the CRM system HubSpot to manage our business contacts, to communicate with prospects, customers, partners, authors, speakers and event participants, and to send invitations to our events. The provider is HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland, together with HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin ("HubSpot").

In HubSpot we process in particular: name, company, position, business contact details (email, telephone, address), assignment to our offerings and events, communication history, consent status for newsletters and invitations and, for sponsors and partners, contract-related information. The data originates from your contact with us, from event registrations (Section VII.3), from contact capture at events (Section VII.8), from newsletter sign-up (Section V.2) or from publicly accessible professional sources.

HubSpot processes the data as a processor pursuant to Art. 28 GDPR on the basis of the HubSpot Data Processing Agreement. Our HubSpot account is hosted in HubSpot's data centre in the European Union. Insofar as HubSpot, Inc. (USA) obtains access for support and maintenance, this is safeguarded by HubSpot, Inc.'s certification under the EU-US Data Privacy Framework and, in addition, by the EU Standard Contractual Clauses. Further information: https://legal.hubspot.com/dpa and https://legal.hubspot.com/privacy-policy.

2. Legal basis and purpose
The processing serves the initiation and performance of contracts (Art. 6(1)(b) GDPR), the maintenance of our business relationships and informing our business contacts about our publications, events and services on the basis of our legitimate interest in business-to-business direct marketing (Art. 6(1)(f) GDPR, Recital 47) and, where you have consented, the sending of newsletters and invitations (Art. 6(1)(a) GDPR).

3. Duration of storage
We store contact data as long as an active business relationship or a legitimate interest in maintaining the contact exists. Contacts without interaction are reviewed for deletion at the latest every 24 months. Contract and invoice data is retained in accordance with commercial and tax law retention periods (six or ten years).

4. Objection and deletion
You may object to the processing of your data for direct marketing purposes at any time and withdraw any consent given, by email to hello@manda.co or via the unsubscribe link in our mailings. We will then place your contact on a suppression list so that you are not contacted again.

VII.3 Use of ticketareo

1. Description and scope of data processing
ticketareo is an event management platform provided by ticketareo GmbH, Jakob-Huber-Str. 2, 82110 Germering, Germany ("ticketareo"). We use ticketareo to organize and manage our events, including event websites, registrations, ticket sales and live streaming.

Through ticketareo we collect personal data required for event registration and participation. This typically includes name and contact details (e.g. email address, phone number), company and position, payment information for ticket purchases, and any additional information provided during registration. ticketareo processes the data as a processor pursuant to Art. 28 GDPR on servers in Frankfurt am Main (AWS region eu-central-1). After the event we transfer participant data to our CRM system (Section VII.2). For events we run jointly with partners (e.g. with Bundesverband Mergers & Acquisitions gem. e.V.), we and the partner are joint controllers within the meaning of Art. 26 GDPR; the essence of this arrangement is made available in the event-specific privacy notice. Further information: https://ticketareo.de/datenschutz/.

2. Legal basis and purpose
Event organization, ticket sales and provision of event-related information. Legal basis is the performance of a contract pursuant to Art. 6(1)(b) GDPR and our legitimate interest pursuant to Art. 6(1)(f) GDPR in the efficient organization and execution of events.

3. Duration of storage
Data will be deleted as soon as it is no longer required, as a rule twelve months after the event; invoice data is subject to statutory retention periods. Server logs are deleted after one month.

4. Objection and deletion
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, via the contact details above or by email to hello@manda.co.

VII.4 Use of n8n

1. Description and scope of data processing
We use the automation platform n8n Cloud of n8n GmbH, Novalisstraße 10, 10115 Berlin, Germany ("n8n") to automate workflows between the systems we use, in particular the transfer of event registrations from ticketareo to our CRM system HubSpot, the creation of short links (Section VII.5) and the preparation of social media posts (Section VII.7). The data to be transferred in each case, for example name, company, email address and registration status, is processed briefly by n8n.

n8n processes the data as a processor pursuant to Art. 28 GDPR; a data processing agreement has been concluded. Our n8n instance is operated in data centres within the European Union. Further information: https://n8n.io/legal/.

2. Legal basis and purpose
Our legitimate interest in efficient, low-error handling of our event and communication processes, Art. 6(1)(f) GDPR. The automation does not change the purposes and legal bases of the underlying processing.

3. Duration of storage
Execution logs in n8n that may contain data are deleted after 30 days at the latest.

4. Objection
You may object to the processing on grounds relating to your particular situation at any time by email to hello@manda.co.

VII.5 Use of Short.io

1. Description and scope of data processing
For links in newsletters, social media posts and print media we use the link shortener Short.io of Short.cm Inc., Delaware, USA ("Short.io") under the domains s.manda.co and s.ma-rev.de. When such a short link is opened, Short.io processes the IP address, time of access, referrer, browser, operating system, device type and the country derived from the IP address, and redirects you to the target page. We see aggregated click statistics per link.

Short.io processes the data as a processor pursuant to Art. 28 GDPR. Our links are processed via Short.io's data centre in Frankfurt am Main (AWS). Insofar as data is transferred to the USA, this is based on the EU Standard Contractual Clauses. Further information: https://short.io/privacy.

2. Legal basis and purpose
Our legitimate interest in short, readable links and in measuring the reach of our communication, Art. 6(1)(f) GDPR.

3. Duration of storage
Click data is retained by Short.io for statistics; full IP addresses are not stored permanently.

4. Objection
You can avoid short links by opening the target page named in our mailings directly. You may also object at any time by email to hello@manda.co.

VII.6 Use of Vimeo

1. Description and scope of data processing
We embed videos on our Website via Vimeo, a platform of Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA. Videos are loaded only after you have given consent in the cookie banner or by clicking on the preview image (two-click solution). When loaded, a connection to Vimeo's servers is established; servers are located worldwide, partly in the EU. Vimeo receives information about the page you visited as well as technical data of your browser and device. If you are logged in to a Vimeo account, Vimeo can assign this data to your profile. Vimeo processes this data under its own responsibility. Vimeo is certified under the EU-US Data Privacy Framework. Vimeo's privacy policy: https://vimeo.com/privacy.

2. Legal basis and purpose
Your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG. The purpose is to provide video content without burdening our own servers.

3. Duration of storage
Storage at Vimeo is governed by Vimeo's privacy policy.

4. Objection and deletion
You may withdraw your consent at any time via the cookie settings of the Website. Without consent, no Vimeo content is loaded.

VII.7 Social media presences and Buffer

1. Description and scope of data processing
We operate company pages on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). When you visit these pages, LinkedIn processes your data under its own responsibility; for page statistics ("Page Insights") we are joint controllers with LinkedIn pursuant to Art. 26 GDPR. The arrangement is available at https://legal.linkedin.com/pages-joint-controller-addendum, LinkedIn's privacy policy at https://www.linkedin.com/legal/privacy-policy.

To plan and publish our posts we use Buffer of Buffer, Inc., 2443 Fillmore Street #380-7163, San Francisco, CA 94115, USA ("Buffer"). Buffer processes the content of our posts and public interaction data (e.g. reactions and comments with profile names) that LinkedIn makes available to us. Buffer processes this data as a processor pursuant to Art. 28 GDPR and participates in the EU-US Data Privacy Framework. Further information: https://buffer.com/privacy.

2. Legal basis and purpose
Our legitimate interest in effective external communication with the professional public, Art. 6(1)(f) GDPR.

3. Duration of storage
Posts and interaction data remain in Buffer as long as we need the posts for evaluation, at most 24 months.

4. Objection
Data subject rights vis-à-vis LinkedIn are most easily exercised directly with LinkedIn. You may also contact us at any time: hello@manda.co.

VII.8 Contact capture at events (snapADDY)

1. Description and scope of data processing
At events, with your agreement, we capture business cards and conversation notes using the software snapADDY of snapADDY GmbH, Haugerkirchgasse 7, 97070 Würzburg, Germany ("snapADDY"). We process the details on your business card (name, company, position, business contact details) and the conversation topics and interests we note. The data is then transferred to our CRM system HubSpot (Section VII.2).

snapADDY processes the data as a processor pursuant to Art. 28 GDPR exclusively on servers in Frankfurt am Main. Further information: https://www.snapaddy.com/en/privacy.html.

2. Legal basis and purpose
Our legitimate interest in maintaining business contacts who have handed us their business card, Art. 6(1)(f) GDPR, and, for specific enquiries, the initiation of a contract, Art. 6(1)(b) GDPR.

3. Duration of storage
In snapADDY the data is deleted after transfer to the CRM system, at the latest after 90 days. Section VII.2 applies to further storage.

4. Objection
You may object to the processing at any time by email to hello@manda.co.

VII.9 AI-assisted processing (Anthropic Claude)

1. Description and scope of data processing
For internal tasks such as summarizing documents, drafting texts, evaluating event and communication data and supporting our organization, we use the AI assistant Claude of Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland ("Anthropic") under a business agreement (Claude for Work). Personal data contained in the documents, emails or databases being processed may be involved, in particular name, company, position, business contact details and communication content of business contacts, participants, authors and partners.

Anthropic processes the data as a processor pursuant to Art. 28 GDPR on the basis of the Anthropic Data Processing Addendum. Under the contractual terms, our content is not used to train the AI models. Processing takes place on servers in the USA; the transfer is safeguarded by the EU Standard Contractual Clauses. We limit the processing to what is necessary for the respective task and do not process special categories of personal data (Art. 9 GDPR) with the AI assistant. Further information: https://www.anthropic.com/legal/data-processing-addendum.

2. Legal basis and purpose
Our legitimate interest in efficient work organization, Art. 6(1)(f) GDPR. No decisions based solely on automated processing within the meaning of Art. 22 GDPR are taken; all results are reviewed by our staff.

3. Duration of storage
Inputs and outputs are stored and deleted at Anthropic in accordance with the contractual retention rules for business customers; we ourselves store results only in our own systems according to the periods applicable there.

4. Objection
You may object to AI-assisted processing of your data on grounds relating to your particular situation at any time by email to hello@manda.co.

VII.10 Other processors

In addition to the services above, we use the following processors for internal operations that may come into contact with the data you provide:

Our tax advisors, legal advisors, banks and payment service providers process data under their own responsibility; they are not processors.

VII.11 Processing of application and course participation documents (Career in M&A)

Description and scope of data processing
As part of applications for the Career in M&A program (e.g. online curriculum, workshops, recruiting events, conferences), we process the application documents you submit, in particular your CV and further documents (e.g. cover letter, certificates, references). These may contain: personal details (name, date of birth, gender); contact data (email, phone, postal address); education, grades, work experience, internships; qualifications, skills, language and IT competences; certificates and references; photo (if voluntarily attached); further voluntary information (e.g. hobbies, voluntary work); where applicable, special categories of personal data within the meaning of Art. 9(1) GDPR, if you provide them voluntarily.

Purpose
Conducting and managing the application process for the Career in M&A program; assessing your suitability and selecting participants (40 to 50 students per year); organizing and running the program in cooperation with consulting firms and service providers; inclusion in our applicant pool to contact you about future, thematically suitable programs (only with your express consent pursuant to Art. 6(1)(a) GDPR).

Legal bases
Art. 6(1)(b) GDPR (pre-contractual measures in the application process); Art. 6(1)(a) GDPR (consent for the applicant pool); Art. 9(2)(a) GDPR (special categories, if voluntarily provided with express consent).

Recipients
Your data is processed by authorized staff of M&A Media Services GmbH. Where necessary for running the program, your data may be passed on to: partner companies, consulting firms or cooperation partners involved in the selection, support or delivery of the program; our processors pursuant to Section VII (in particular Microsoft 365 for storage, HubSpot for contact management and ticketareo for event management); for online events, providers of video conferencing and streaming services (e.g. Microsoft Teams, Zoom, Vimeo). Transfers to third countries only take place where appropriate safeguards pursuant to Art. 46 GDPR are in place.

Retention
For the respective program: your application documents are retained for up to six months after completion of the course to handle queries or legal claims (e.g. under the AGG). For future programs (applicant pool): with your consent we retain your documents for up to 24 months. After these periods your data is deleted or anonymized unless statutory retention obligations apply.

Withdrawal and objection
You may withdraw your consent at any time with effect for the future and object to the processing on grounds relating to your particular situation: hello@manda.co.

Voluntary provision
Providing your application documents is voluntary; without this data we cannot process your application.

VII.12 Subscriptions, orders and payment processing

1. Description and scope of data processing
If you order a subscription to M&A REVIEW, single issues, special publications or other services via our websites (in particular ma-review.de) or create a user account, we process your order and account data: name, company, billing and delivery address, email address, telephone number, customer number, services ordered, invoice and payment data and access data for digital access. Payment is handled via the payment methods listed at https://ma-review.de/zahlungsarten. For card and wallet payments we use Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland ("Stripe"), and for PayPal payments PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg ("PayPal"). Stripe and PayPal process your payment data (name, payment method, amount, transaction data) under their own responsibility as payment service providers; we do not receive full card data, only confirmation of payment and the details required for invoicing. Privacy notices: https://stripe.com/privacy and https://www.paypal.com/legalhub/privacy-full.

2. Legal basis and purpose
Performance of the contract, Art. 6(1)(b) GDPR, and compliance with commercial and tax law obligations, Art. 6(1)(c) GDPR.

3. Duration of storage
We store contract data for the duration of the contractual relationship and thereafter until expiry of the statutory retention periods (six years for commercial correspondence, ten years for accounting records, Section 257 HGB, Section 147 AO). User accounts are deleted 24 months after the end of the contract unless you request deletion earlier.

VIII. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights vis-à-vis the controller:

1. Right of access

You may request confirmation from the controller as to whether personal data concerning you is being processed by us. If so, you may request the following information: (1) the purposes of processing; (2) the categories of personal data concerned; (3) the recipients or categories of recipients to whom your data has been or will be disclosed; (4) the planned duration of storage or, if specific information is not possible, the criteria used to determine that period; (5) the existence of the right to rectification or erasure, to restriction of processing or to object; (6) the existence of a right to lodge a complaint with a supervisory authority; (7) all available information on the origin of the data if not collected from you; (8) the existence of automated decision-making including profiling.

You also have the right to request information as to whether your personal data is transferred to a third country or an international organization and to be informed about the appropriate safeguards pursuant to Art. 46 GDPR. To exercise your right of access free of charge, please contact us using the contact details in Section I.

2. Right to rectification

You have the right to obtain from the controller without undue delay the rectification and/or completion of inaccurate or incomplete personal data concerning you.

3. Right to restriction of processing

You may request the restriction of processing where: (1) you contest the accuracy of the data, for a period enabling the controller to verify it; (2) the processing is unlawful and you oppose erasure and request restriction instead; (3) the controller no longer needs the data but you require it for the establishment, exercise or defence of legal claims; or (4) you have objected pursuant to Art. 21(1) GDPR and it has not yet been determined whether the controller's legitimate grounds override yours.

Where processing has been restricted, such data may, apart from storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State. If the restriction is lifted, you will be informed beforehand.

4. Right to erasure

a) Obligation to erase
You have the right to obtain the erasure of personal data concerning you without undue delay, and the controller is obliged to erase it where: (1) the data is no longer necessary for the purposes for which it was collected or otherwise processed; (2) you withdraw the consent on which the processing is based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR and there is no other legal ground; (3) you object pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds, or you object pursuant to Art. 21(2) GDPR; (4) the data has been unlawfully processed; (5) erasure is required for compliance with a legal obligation under Union or Member State law to which the controller is subject; (6) the data was collected in relation to the offer of information society services pursuant to Art. 8(1) GDPR.

b) Information to third parties
Where the controller has made the data public and is obliged pursuant to Art. 17(1) GDPR to erase it, the controller shall take reasonable steps, including technical measures, to inform other controllers processing the data that you have requested the erasure of any links to, or copies or replications of, that data.

c) Exceptions
The right to erasure does not apply where processing is necessary (1) for exercising the right of freedom of expression and information; (2) for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority; (3) for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) GDPR; (4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to under a) is likely to render impossible or seriously impair the achievement of those objectives; or (5) for the establishment, exercise or defence of legal claims.

5. Right to notification

If you have exercised your right to rectification, erasure or restriction, the controller is obliged to communicate this to all recipients to whom your data has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about those recipients.

6. Right to data portability

You have the right to receive the personal data you have provided to the controller in a structured, commonly used and machine-readable format and to transmit it to another controller without hindrance, where (1) the processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and (2) the processing is carried out by automated means. You also have the right to have the data transmitted directly from one controller to another where technically feasible. This must not adversely affect the rights and freedoms of others and does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

7. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions. The controller shall no longer process the data unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. Where data is processed for direct marketing purposes, you have the right to object at any time to such processing, including related profiling; the data will then no longer be processed for these purposes. In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Right to withdraw consent

You have the right to withdraw your consent under data protection law at any time. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision (1) is necessary for entering into or performing a contract between you and the controller, (2) is authorized by Union or Member State law to which the controller is subject and which lays down suitable measures to safeguard your rights, freedoms and legitimate interests, or (3) is based on your explicit consent. Such decisions shall not be based on special categories of personal data pursuant to Art. 9(1) GDPR unless Art. 9(2)(a) or (g) applies and suitable safeguards are in place. In the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard your rights, freedoms and legitimate interests, at least the right to obtain human intervention, to express your point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. The supervisory authority will inform you of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

IX. Automated decision-making and profiling

We do not use your data for profiling or automated decision-making within the meaning of Art. 22 GDPR. The AI assistance described in Section VII.9 supports our staff; decisions affecting you are taken exclusively by humans.

X. Links to other websites

This privacy policy applies only to the websites of MAMS. Our websites may contain links to third-party websites; the respective providers are responsible for their content and data protection practices.

XI. Security

We implement appropriate technical and organizational measures pursuant to Art. 32 GDPR to protect your data against loss, misuse and unauthorized access. These include encrypted data transmission (TLS), multi-factor authentication for all company accounts, a tiered authorization concept, regular backups and the commitment of our staff to confidentiality. Our processors are contractually bound to equivalent measures.

XII. Availability and changes

This privacy policy is currently valid as of October 2026. The further development of our websites and offerings, or changed legal or regulatory requirements, may make it necessary to amend this privacy policy. The current version is available at https://manda.co/privacy-policy.