Privacy Policy

1. general notes and mandatory information

We warmly welcome you to our website and are delighted that you are interested in our company. When you use this website, various personal data (data) is collected. This refers to data with which you can be personally identified. We take the protection of your personal data seriously. We therefore process your data in accordance with the EU General Data Protection Regulation (GDPR). This privacy policy informs you below about the processing of your personal data and the rights to which you are entitled. We would like to point out that data transmission over the Internet (e.g. when communicating by email) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

Responsible person and data protection officer
The controller in accordance with the EU General Data Protection Regulation (GDPR) is

Mosca GmbH
Mosca 1
69429 Waldbrunn
Represented by: Timo Mosca (Managing Director), Simone Mosca (Managing Director), Alfred Kugler (Managing Director)

Phone: +49 6274 932-0
E-mail: info@mosca.com
You can reach our data protection officer at datenschutz@mosca.com.
 

1.1 Rights

You have extensive rights with regard to the processing of your personal data.

Right to information:
You have the right to information about the data stored by us, in particular for what purpose the data is processed and how long the data is stored (Article 15 GDPR).
Right to rectification of inaccurate data:
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you (Article 16 GDPR).
Right to erasure:
You have the right to request that we erase the personal data concerning you. These conditions stipulate that you can request the deletion of your data if, for example, we no longer need the personal data for the purposes for which it was collected or otherwise processed, if we process the data unlawfully or if you have legitimately objected to it or if there is a legal obligation to delete it (Article 17 GDPR).
Right to restriction of processing:
You have the right to request that the processing of your data be restricted. This right exists in particular for the duration of the review if you have disputed the accuracy of the data concerning you and in the event that you request restricted processing instead of erasure in the case of an existing right to erasure. Furthermore, processing will be restricted in the event that the data is no longer required for the purposes pursued by us, but you need the data to assert, exercise or defend legal claims and if the successful exercise of an objection is disputed between us and you (Article 18 GDPR).
Right to data portability:
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format (Article 20 GDPR), unless it has already been erased.
Right of objection:
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you (Article 21 GDPR). We will stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defense of legal claims. If you wish to object to the processing of your personal data, please send us an e-mail or write to the above-mentioned contact address of the controller. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.
Right of withdrawal:
A given consent can be revoked at any time, whereby the revocation does not affect the legality of the processing carried out until then on the basis of the consent.
Right to lodge a complaint with the supervisory authority:
You have the option of contacting the above-mentioned data protection officer or a data protection supervisory authority if you believe that the processing of your personal data violates the General Data Protection Regulation.A list of data protection supervisory authorities can be found here: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html
 

1.2 SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
 

1.3 Links

On our websites we offer you links to websites that may be of interest to you. We have no influence on their content. We assume no liability for this external content. The respective providers or operators of these websites are responsible for their content. The linked pages were checked for possible legal violations at the time the link was created. Such were not recognizable at the time the link was set. However, constant monitoring of the content of the linked pages is not reasonable without concrete evidence of an infringement. As soon as we become aware of any legal infringements on the linked websites, we will remove the relevant links immediately.
 

2. Processing of data

Below we inform you about the processing of your data as a visitor to our website.
 

2.1 Your rights

You have extensive rights with regard to the processing of your personal data.

Right to information:
You have the right to information about the data stored by us, in particular for what purpose the data is processed and how long the data is stored (Article 15 GDPR).
Right to erasure:
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you (Article 16 GDPR).
Right to restriction of processing:
You have the right to request that we erase the personal data concerning you. These conditions stipulate that you can request the deletion of your data if, for example, we no longer need the personal data for the purposes for which it was collected or otherwise processed, if we process the data unlawfully or if you have legitimately objected to it or if there is a legal obligation to delete it (Article 17 GDPR).
Right to data protability:
You have the right to request that the processing of your data be restricted. This right exists in particular for the duration of the review if you have disputed the accuracy of the data concerning you and in the event that you wish to restrict processing instead of deletion in the case of an existing right to deletion. Furthermore, processing will be restricted in the event that the data is no longer required for the purposes pursued by us, but you need the data to assert, exercise or defend legal claims and if the successful exercise of an objection is disputed between us and you (Article 18 GDPR).
Right to object:
 You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you (Article 21 GDPR). We will stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defense of legal claims. If you wish to object to the processing of your personal data, please send us an e-mail or write to the above-mentioned contact address of the controller. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.
RIGHT OF REVOCATION:A given consent can be revoked at any time, whereby the revocation does not affect the legality of the processing carried out until then on the basis of the consent.
Right to lodge a complaint with the supervisory authority:
You have the option of contacting the above-mentioned data protection officer or a data protection supervisory authority. You can find a list of data protection supervisory authorities here: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html
 

2.2 Information for business partners and interested parties

2.2.1 Voluntary nature of the data provided

The provision of your personal data is generally voluntary. However, it is absolutely necessary to process certain data about you in order to conclude and conduct the business relationship.
 

2.2.2 General data from the business relationship

We process the data that you provide to us as part of our business relationship. This includes the following data in particular: Contact details of the business partner's contact persons, in particular title, name, business address, telephone number and e-mail address; bank and billing data; master data changes made by you, e.g. address changes.
 

2.2.3 Data from other sources

We only process personal data from publicly accessible sources (e.g. commercial register, authorities, Internet) to the extent permitted by law, for example because this is necessary for the provision of our services. This includes the following data in particular: Name and business address of the managing directors and shareholders, as far as available from public sources and the commercial registers.
 

2.2.4 Purpose and legal basis of the processing

We collect and process your personal data described in more detail above in the context of entering into and fulfilling our contractual obligations towards you (Article 6(1)(b) GDPR). For example, we process your contact data when you contact us to conclude a contract. By entering into a business relationship as an interested party, supplier or customer (business partner), we will store or otherwise process your contact details and information about business processes and communication with you. In addition, we process your personal data insofar as this is necessary to protect our legitimate interests or those of a third party or to assert legal claims and defend ourselves in legal disputes (Article 6 (1) (f) GDPR). We have a legitimate interest in processing the data in order to process the contractual relationship, e.g. to carry out credit checks or sanction list checks and to be able to collect receivables, also in the context of commissioning debt collection companies. In addition, we process your data insofar as this is necessary and required to fulfill legal obligations (Art. 6 para. 1 c) GDPR).
 

2.2.5 Will my data be passed on?

The processing and forwarding of data takes place exclusively for the fulfillment of contractual, business or legal obligations. We use processors to provide special services. Your data is passed on to them in strict compliance with the obligation of confidentiality and the requirements of the GDPR. As a globally active group, personal data is also passed on to subsidiaries and other recipients outside the EU as part of our business relationships, in accordance with the legally permissible regulations. Possible categories of recipients are Shipping service providers, debt collection service providers, financial and tax authorities, police and investigating authorities (with existing legal basis), official bodies (if transmission is required by law), insurance companies, banks and credit institutions (payment processing, auditors, printing service providers.
 

2.2.6 How long will my data be stored?

We only process and store your personal data for as long as we need it to fulfill contractual, legal or internal process obligations. If there is no longer a legal basis for storage, we will delete the data. This includes the statutory retention obligations of 6 and 10 years for accounting and tax reasons.
 

2.3 Information for applicants

We use your data exclusively for the purpose of your application. During the application process, there are clear rights of access: only the person responsible and the decision-makers regarding recruitment will see your application documents. Your application will only be passed on, e.g. for other vacancies in our company, with your prior consent for inclusion in our applicant pool. If you are not hired, we will delete your data after six months from the date of rejection. If you are hired, we will transfer the relevant data to your personnel file.
 

2.3.1 Data protection of applicant data at the controller

According to Art. 4 No. 1 GDPR, your personal data includes all information that relates or can be related to your person, in particular by means of assignment to an identifier such as a name or an applicant number with which your person can be identified within the company.
 

2.3.2 Where does my data come from and what data is processed?

Through your application, the person responsible receives information (either in paper format and/or in digital form). This is data that you provide to us yourself as part of your application. This includes the following data in particular: Image data, name, address, date of birth, place of birth, details of school and vocational education, further education and training and qualifications, certificates, ...)
 

2.3.3 Purpose and legal basis of the processing

Your data is required for the implementation of the decision on the establishment of an employment relationship (§26 para. 1 BDSG). This means that we need and therefore process your data for the purpose of a possible recruitment. In individual cases, we may obtain your consent (Art. 6 para. 1 a GDPR) to the processing or transfer of your data. This may be the case, for example, if your application is kept for a longer period of time or if your application is considered for another position within our company or another Group company. In these cases, your consent is voluntary and can be revoked by you at any time in the future. In addition, we process your data insofar as this is necessary for the assertion of legal claims and defense in legal disputes and this is necessary for the fulfillment of legal obligations (Art. 6 para. 1 c) GDPR).

Will my data be passed on?
As a globally operating group/group of companies, we may also be interested in passing on your applicant data to other group companies/group companies. In these cases, we will obtain your consent to the processing and transfer of your data before transferring it. The recipients of personal data are providers of our online applicant portal, personnel service providers and tax consultants.

Where and for how long will my data be stored?
Applicant data is stored and processed in personnel data processing systems. Access to applicant data is designed in such a way that only authorized persons have access. Your personal data will only be stored for as long as knowledge of the data is required for the initiation or, if applicable, execution of an employment relationship. If a contractual relationship is not established, we will store your application data for a maximum of six months for the purposes of AGG verifiability. If a contractual relationship is established (= employment), we will transfer the necessary information to the personnel file.
 

2.4 Information for employees

2.4.1 Voluntary nature of the provision of data

The processing of personal data in the context of the employment relationship is largely subject to the fulfillment of contractual requirements from the employment contract and regulatory tasks that are imposed on the employer (controller) to fulfill a legal obligation.
 

2.4.2 Data from the employment relationship

• We process data that you provide to us in the context of the employment relationship, but also data that arises in the context of the employment relationship. This includes the following data in particular:
  
  - Business contact data, in particular title, name, business address, telephone number, mobile telephone number and e-mail address; personnel number and access data for information and communication systems
• - Private contact details, in particular private address, private telephone numbers, private e-mail address, -contact information for emergencies
• - Personal information (e.g. date of birth, marital status, health data, bank details, ...)
   
• Data from the employment relationship (e.g. information on employee status and position, start of employment, payroll data, citizenship and nationality, qualification data, ...).
   

2.4.3 Legal bases

We collect and process your personal data as part of the employment relationship (Section 26 BDSG) to fulfill our contractual and legal obligations (Article 6 (1) (b) and (c) GDPR). In addition, we process your personal data insofar as this is necessary to safeguard our legitimate interests or those of a third party (Article 6 (1) (f) GDPR), e.g. when implementing measures to secure our operational infrastructure when using login data or checking communication data using vulnerability scanners (virus scanners, spam filters, etc.), implementing measures to improve and develop services and products, telematics data, investigating criminal offenses, using your data anonymously or pseudonymously for analysis purposes. In individual cases, we may obtain your consent (pursuant to Art. 6 para. 1 a GDPR or Art. 9 para. 2 a GDPR) to the processing or transmission of your data. This may be the case, for example, before taking employee photos or including you in a birthday list.
 

2.4.4 Will my data be passed on?

Within the group of companies, we process your data in connection with centrally provided infrastructure services (electronic communication networks and services, security technologies) to ensure the availability of the networks and services, to safeguard functionality (availability, confidentiality, authenticity and integrity) and to identify and rectify faults. Also, depending on the individual case, to: Print service providers for payroll accounting, financial and tax authorities, police and investigating authorities (only if a legal basis exists), public authorities (if transmission is required by law), insurance companies, banks and credit institutions (payment processing), auditors, clients and suppliers as well as contractual partners as required.
 

2.4.5 How long will my data be stored?

We only process and store your personal data for as long as we need it to fulfill contractual, legal or internal process obligations. In most cases, the statutory retention obligations for social security, accounting and tax reasons amount to 10 years from the date of leaving the company.
 

3. Data collection on our website

3.1 Server log files

The website operator or site provider collects data about access to the site and stores it as "server log files".

The following data is logged in this way:
- IP address used (anonymized)
- Time at the time of access
 - Visited website
- Protocols
- Statuscode
- Data volume
- Referrer URL
- User Agent
- Host name of the accessing computer

This data is not merged with other data sources. The basis for data processing is to display our website to you and to ensure stability and security, Art. 6 para. 1 lit. f GDPR.Further details on the data collected can be found here: https://www.mittwald.de
 

3.2 Cookies and third-party services

Some of the Internet pages use so-called cookies. They serve to make our offer more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and saved by your browser. "Session cookies" are automatically deleted at the end of your visit. Other cookies remain stored on your end device for a longer period of time or until you delete them. These cookies enable us to recognize your browser on your next visit.You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.Cookies that are required to carry out the electronic communication process or to provide certain functions that you have requested (e.g. shopping cart function) are stored on the basis of Section 25 (2) TDDDG in conjunction with Art. 6 (1) lit. f GDPR. Art. 6 para. 1 lit. f GDPR stored. The website operator has a legitimate interest in the storage of cookies for the technically error-free and optimized provision of its services.This site uses different types of cookies (e.g. cookies to analyze your surfing behavior). Some cookies are placed by third parties that appear on our pages. The legal basis for the processing of personal data using cookies that are not technically necessary is Section 25 (1) TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. 

Please state your consent ID and date when you contact us regarding your consent.
 

3.3 Request by contact form, e-mail, telephone or fax

If you contact us by contact form, e-mail, telephone or fax, your request, including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request.This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR.The data you send to us via contact requests will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.
 

4. Social media

As we are represented with our content on platforms such as YouTube, Facebook, Instagram or Twitter, we would like to inform you here about data processing in connection with platforms, insofar as we know and can influence them.
 If we open a profile or channel on a platform, the operator sets cookies (explanation, see above) as soon as a user visits the profiles or channels. The platform operators use cookies or other technologies to collect personal data from users in order to evaluate user behavior. This applies in particular if you are already registered on these platforms. You can find more detailed information on this in the respective data protection information of the platforms.

We only receive evaluations of the use of our content from the operators of the platforms in non-personal form, which are used for the analysis of user behavior for statistical purposes. This enables us to better tailor our offers to the needs and interests of the target group.

We can use the filters provided by the operators of the platforms to select the categories of data according to which the operators provide visitor statistics in aggregated form. The operators provide us with the following criteria or categories to evaluate the activities of our content in aggregated form, provided that the corresponding information has been provided by the user or is collected by the operator. These may be Age range, gender, location (state and country), language, mobile or stationary page views (YouTube additionally individual device types and operating system), interactions in the context of posts (e.g. reactions, comments, shares, clicks, views, video usage time), time of use.

We do not know what personal data the operators of the platforms collect overall and for what other purposes the operators process user data. We have no influence on the data protection regulations of a platform or the collection, analysis and use of user data. As we do not process any personal data from users, but only receive anonymized statistical data, it is not possible for us to establish a reference to individuals and provide corresponding data information. Please contact the operator of the respective platform for this purpose.
We advise you to use the various data protection and security settings on the respective platform and to check them regularly.
In its data guidelines, the respective platform operator explains which data is collected during use:

LinkedIn
https://de.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy
Users have the option of requesting a copy of the recorded data https://www.linkedin.com/help/linkedin/answer/50191

XING
https://privacy.xing.com/de/datenschutzerklaerung
Users have the option of requesting a copy of the recorded data: https://privacy.xing.com/de/datenschutzerklaerung/welche-rechte-koennen-sie-geltend-machen/auskunftsrecht

YouTube
https://policies.google.com/privacy 
Users have the option of requesting a copy of the recorded data: https://takeout.google.com/

Facebook
https://www.facebook.com/policy
Users have the option of requesting a copy of the recorded data: https://www.facebook.com/settings?tab=your_facebook_information

X
https://x.com/de/privacy
Users have the option of requesting a copy of the recorded data: https://twitter.com/personalization

YouKu
https://terms.alicdn.com/legal-agreement/terms/suit_bu1_unification/suit_bu1_unification202005141916_91107.html?spm=a2ha1.14919748_WEBHOME_GRAY.footer-container.5~5~5~DL!2~5~A!4
 

4.1 Meta Platforms

We operate so-called fan pages on the social media platforms Facebook and Instagram (Meta Platforms Ireland Limited (Facebook), 4 Grand Canal Square, Dublin 2, Ireland) in order to communicate with the users active there who have marked our fan page with "Like" and to inform them about our products and services, among other things.Facebook generally stores cookies on users' devices, in which the usage behavior and interests of the users are stored. The user data processed in this way is used in particular for market research and advertising purposes. Among other things, user profiles are created from the usage behavior and the resulting interests. These can be used, for example, to display interest-based advertising within and outside of Facebook. In addition, data can also be stored in the user profiles independently of the devices used by the users, especially if the users are logged in as registered members of Facebook.This data processing is carried out on the basis of our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR (information about our products and services; communication with users).If requests for information or other data subject rights are asserted in accordance with the GDPR, we would like to point out that these should be asserted most effectively with Facebook or Instagram. As the operator of the fan page, we generally have no access to the data processed by Facebook itself. Although we and Facebook are considered joint controllers within the meaning of the GDPR, only Facebook as the provider can access user data and therefore provide full information or fulfill other obligations, such as user requests for deletion.As a Fanpage operator, we cannot guarantee that all data subject rights can be enforced against Facebook or that user data will not be processed outside the European Union.

For more information on the purpose and scope of data collection and processing, your rights as a data subject within the meaning of the GDPR and your objection and setting options to protect your personal data on Facebook, please refer to Facebook's privacy policy: 
Facebook Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour
Dublin 2, Ireland

Privacy Policy: https://www.facebook.com/about/privacy/.
Facebook offers the option to remove cookies by opting out: https://www.facebook.com/settings?tab=ads.
 

5. Analysis Tools

5.1 Web analytics with Matomo 

We use the web analytics service Matomo on our website, provided by InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand. Processing is carried out via the Matomo Cloud on servers within the European Union. For more information about data processing by Matomo, please refer to Matomo's privacy policy at: https://matomo.org/privacy-policy/

Purpose of processing
Matomo is used to evaluate the use of our website and to improve its functionality and content. 

Processed data
The following information may be processed:

• - Shortened and anonymized IP address 
• - Technical data of the end device (e.g., browser type, operating system, screen resolution)
• - Usage data (e.g., pages accessed, length of stay) 
• - Date and time of access
• - Referrer-URL
   

5.2 Friendly Captcha

We use the Friendly Captcha service on our website to protect our website from abusive automated spying and spam (e.g., by so-called bots). The use of this service serves to ensure the security of our website and is in our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.
Friendly Captcha is a privacy-friendly bot protection service that does not set cookies or create user profiles. Instead, a cryptographic calculation task is solved in the background of the user's device.

The following information in particular is processed:
- IP address (abbreviated or anonymized),
- Information about the browser and operating system used,
- Anonymized counters for detecting misuse.
- Processing is carried out solely for the purpose of preventing abuse and spam.

Transfer to third countries
According to the provider, personal data is not transferred to third countries outside the European Union or the European Economic Area, and processing takes place exclusively on servers within the EU.
The provider of the service is: 

Friendly Captcha GmbH
Am Anger 3–5
82237 Wörthsee
Germany

Further information on data processing by Friendly Captcha can be found in the provider's privacy policy at: https://friendlycaptcha.com/privacy/
 

6. Plugins and tools

6.1 Using the Neos content management system

Our website uses Neos CMS, an open source content management system provided by the Neos open source project / Neos Foundation e.V., to manage and provide web content. What data is processed?When you use a website based on Neos CMS, the following data may in particular be processed, insofar as this is technically necessary for operating the website: 
- Technically necessary cookies and/or local storage or session storage entries
- Server log files that are automatically collected by the web server, in particular:  
- IP address  
- Date and time of access 
- Browser type and version  
- Operating system used  
- Referrer URL  
- Requested subpages / accessed content 
- Internet service provider and comparable technical information used for security and defense against attacks

This data is processed to ensure the secure, stable and technically correct operation of the website. Legal basis for processingThe processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and efficient provision of our website. Storage and disclosure of dataServer log data is generally stored only for as long as necessary for technical operation, IT security and troubleshooting, and is then deleted. Disclosure to third parties only takes place where there is a legal obligation to do so or where this is necessary for legal enforcement or IT security purposes. Please note that the exact scope of processing depends on the specific configuration of this website. Further general information on data protection in connection with Neos can be found in the Neos privacy statement: https://www.neos.io/de/footer-content/privacy-statement.html
 

6.2 YouTube

Our website uses plugins from YouTube, which is operated by Google. The operator of the pages is Google Ireland Limited (Google), Gordon House, Barrow Street, Dublin 4, Ireland.When you visit one of our pages equipped with a YouTube plugin, a connection to the YouTube servers is established. This tells the YouTube server which of our pages you have visited.If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.YouTube is used with your consent (Art. 6 para. 1 lit. a GDPR). A transfer of data to the United States of America by Google cannot be ruled out on our part.Further information on the handling of user data can be found in YouTube's privacy policy at https://www.google.de/intl/de/policies/privacy.
 

6.3 Vimeo

Our website uses plugins from the video portal Vimeo. The provider is Vimeo.com, Inc (Vimeo). 555 West 18th Street, New York, New York 10011, USA.When you visit one of our pages equipped with a Vimeo plugin, a connection to the Vimeo servers is established. This tells the Vimeo server which of our pages you have visited. Vimeo also obtains your IP address. This also applies if you are not logged in to Vimeo or do not have a Vimeo account. The information collected by Vimeo is transmitted to the Vimeo server in the USA. Vimeo is used with your consent (Art. 6 para. 1 lit. a GDPR).If you are logged into your Vimeo account, you enable Vimeo to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your Vimeo account.Further information on the handling of user data can be found in Vimeo's privacy policy at https://vimeo.com/privacy.