Privacy Policy
1. Controller
The controller for data processing on this website and in the customer portal within the meaning of the General Data Protection Regulation (GDPR) is:
Medius Consulting
Ostkamp 22
59174 Kamen
DE
Email: infos@medius-tickets.de · Phone:
Please address privacy enquiries to the email address above.
2. Overview
We process personal data only as far as necessary to provide the website, perform contracts, answer enquiries, secure our systems or comply with legal obligations. We do not use advertising or audience analytics (tracking) and set no marketing cookies. There is no automated decision-making, including profiling, with legal effect on you.
3. Hosting and server log files
This website is operated by a hosting provider with whom a data processing agreement under Art. 28 GDPR exists. When pages are called up, the web server processes technically necessary data: IP address, date and time, requested address (URL), amount of data transferred, HTTP status code, browser and operating system information (user agent) and, where applicable, the previously visited page (referrer). This is necessary to deliver the pages, ensure stability and defend against attacks (Art. 6(1)(f) GDPR). Log files are deleted or anonymised after a short period.
4. Cookies and local storage
We only use strictly necessary cookies (session, language, security functions, remembering a reminder). They are permitted without consent under § 25(2) TDDDG; the subsequent processing is based on Art. 6(1)(f) or (b) GDPR. An overview of names, purposes and durations is in the Cookie Policy.
5. Contact form, enquiries and cost calculator
When you send an enquiry through the contact form or the website cost calculator we process your name, email address, optionally phone number and company, your interest, your message or the configuration you chose, the language, your IP address and the time of the enquiry. The data is stored as an enquiry in our system, reported to our internal mailbox, and you receive an automatic confirmation by email. The purpose is to handle your enquiry and prepare an offer (Art. 6(1)(b) GDPR; for general enquiries (f)). We delete enquiries once they are dealt with and no contract results, as a rule after six months at the latest; if a contract is concluded, the retention periods in section 17 apply. Abuse protection of the forms is described in section 10.
Through the "Cancel contracts here" button you can terminate contracts without logging in. For this we process your name, email address, contract/customer number, type and date of termination, an optional reason, your IP address and the time, in order to assign and process the termination and to confirm its receipt (Art. 6(1)(b) and (c) GDPR in conjunction with § 312k BGB). The data is kept with the contract and for the periods in section 17.
6. Customer account and registration
To use the customer portal you create an account. We process first and last name, email address, password (only as an irreversible hash), customer type (private/business), for business customers company name and VAT ID, optionally phone number, billing and delivery addresses and language setting. To confirm your email address we send a confirmation link. The legal basis is the performance of the user or contractual relationship (Art. 6(1)(b) GDPR). You can view and change your data in the portal and request deletion of your account unless retention obligations prevent it.
7. Orders, projects, files, tickets and documents
To process orders we handle order and contract data (items, prices, addresses, status), messages and support tickets, files you upload (e.g. designs, logos, print data, engineering and manufacturing data such as Gerber, bill-of-materials or 3D files), project histories and generated documents (quotes, invoices, credit notes). Uploaded files are stored in a non-public area and only delivered to authorised staff and to you. The legal basis is contract performance (Art. 6(1)(b) GDPR) and compliance with legal obligations (c). To carry out manufacturing orders we may pass the necessary technical data and the delivery address to manufacturing and logistics partners (see section 15).
8. Payments
Invoice/bank transfer: We process invoice and payment receipt data for accounting. PayPal: If you pay with PayPal in the portal, the PayPal payment module is loaded from servers of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg ("PayPal"); PayPal thereby receives, among other things, your IP address and device information and may set its own cookies. The payment is then processed through PayPal; we receive the transaction number, amount and status, but no payment data such as card numbers or credentials. PayPal processes your data as an independent controller under its own privacy policy. The legal basis is Art. 6(1)(b) GDPR. A transfer of data to the USA cannot be ruled out (see section 16). The PayPal module is only loaded when you choose it during payment or open the payment page.
9. Email dispatch
We send transactional emails (email confirmation, password reset, confirmation of enquiries, order, project, ticket and payment notifications, documents, security notices). They are sent through the mail server we configured (SMTP or Exchange relay) or our host's server. For evidence and troubleshooting we log recipient, subject, time and delivery status (Art. 6(1)(b) and (f) GDPR). Emails may be read in transit despite transport encryption if the other side does not support encryption; please send confidential data preferably through the customer portal.
10. Abuse protection: Cloudflare Turnstile, rate limiting, security logs
To protect login, registration, password and contact forms against automated access we may use the "Turnstile" service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (in the EU: Cloudflare Germany GmbH). When a protected form loads, your IP address and technical browser and interaction data used to distinguish humans from bots are transmitted to Cloudflare; your response is verified server-side at Cloudflare. The legal basis is our legitimate interest in the security and functionality of the website (Art. 6(1)(f) GDPR; for access to terminal-device information § 25(2) no. 2 TDDDG). Cloudflare is certified under the EU-US Data Privacy Framework.
We also limit the number of requests and login attempts per IP address and email address (rate limiting, account lock after several failed attempts) and keep security logs (event type, time, IP address, browser identifier, where applicable user account, e.g. for failed logins, blocked access or payment webhooks). The legal basis is Art. 6(1)(f) in conjunction with Art. 32 GDPR. Security logs are kept only as long as necessary to detect and investigate abuse, as a rule up to twelve months.
11. Login, two-factor authentication and sign-in alerts
To protect your account we optionally offer two-factor login with an authenticator app. We store the secret key material encrypted and recovery codes only as hashes. On every successful login we store the time and IP address of the last login. To warn you about logins from a previously unknown browser we set a security cookie with a random identifier after login (only a hash is stored) and store per device the IP address, browser/operating system label and, where applicable, a rough location (country or city). For a new login we send you an email with time, device, IP address and location. A location is derived from the country code supplied by an upstream service (Cloudflare); only if we have explicitly enabled it is the IP address sent to the geolocation service ipwho.is to determine the city. You can see the known devices in your account under "Security", forget them, or sign out all other sessions. After a password reset or change all other sessions are ended automatically. The legal basis is Art. 6(1)(f) GDPR in conjunction with Art. 32 GDPR (account security).
12. Optional AI-assisted text functions
To create and adapt website texts and building blocks we (not you as a visitor) may use third-party AI services, depending on configuration from OpenAI, Anthropic, Google (Gemini) or OpenRouter. What is transmitted are instructions and the information needed for the respective project (e.g. company name, industry, desired style, facts supplied by the customer and existing texts of the website block). We do not transmit credentials, payment data or customer accounts and try not to enter unnecessary personal data. The providers are mainly based in the USA (see section 16). The legal basis is contract performance or our legitimate interest in efficient service delivery (Art. 6(1)(b), (f) GDPR). We review the results before they are published.
13. Price and availability queries for electronics manufacturing
Where enabled, for quotes in the circuit board/electronics area we transmit technical details (board parameters, quantities, part numbers) to interfaces of manufacturing and component providers (e.g. JLCPCB, LCSC) to query prices and availability. No personal data is meant to be transmitted. When we commission a manufacturing partner we pass on the data needed for manufacturing and delivery (section 15). Some of these providers are located outside the EU (e.g. China).
14. Demo websites
Our demo websites run in an isolated area with a random session identifier in the address, without cookies and without any link to your account. Data you enter in a demo (e.g. shopping cart, test orders, bookings) is stored in a temporary sandbox for display and deleted automatically after 24 hours. Please do not enter real personal data in demos. The demo preview remembers the chosen device size only in the memory of your browser tab (session storage).
15. Recipients and processors
Recipients of personal data, as far as necessary for the respective purpose, are: our hosting and email provider, PayPal (payment processing), Cloudflare (abuse protection), optional AI and component/manufacturing services (sections 12 and 13), manufacturing partners, suppliers and shipping providers for order fulfilment and delivery, tax advisers and accounting, banks as well as authorities and courts where legally required. We have data processing agreements (Art. 28 GDPR) with service providers processing data on our behalf. Through our system's API, connected business partners (shops) can retrieve or submit order and customer data; accesses are logged (time, endpoint, IP address, excerpt of the request).
16. Transfers to third countries
With some services (Cloudflare, PayPal, AI providers, possibly geolocation and manufacturing/component providers) processing may take place in countries outside the EEA. Where the provider is certified under the EU-US Data Privacy Framework, an adequacy decision of the EU Commission exists; otherwise we rely on standard contractual clauses (Art. 46 GDPR) or Art. 49(1)(b) GDPR (necessary for contract performance).
17. Retention periods
We store personal data only as long as necessary for the respective purpose. After that it is deleted or blocked unless a statutory retention obligation applies. Accounting records and invoices are kept for eight years, commercial and business letters for six years (§ 147 German Fiscal Code, § 257 German Commercial Code), each from the end of the calendar year. Customer accounts without ongoing contracts are deleted at your request. Uploaded project files are deleted at the latest after the warranty and retention periods expire, unless you want them kept longer. Demo data is deleted after 24 hours.
18. Provision of data
Providing the mandatory fields (marked * in the forms) is required for enquiries, registration and conclusion of a contract; without them we cannot provide the respective service. All other information is voluntary.
19. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw any consent given at any time with effect for the future (Art. 7(3)). Please contact infos@medius-tickets.de.
Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR) you may object at any time on grounds relating to your particular situation. You also have the right to lodge a complaint with a data protection supervisory authority, in particular the state data protection authority responsible for our registered office.
20. Data security
We protect your data through encrypted transmission (TLS/HTTPS), hashed passwords, encrypted storage of credentials and keys, role-based access rights, optional two-factor login, protection against brute-force attacks and logging of security-relevant events. No system is completely secure; please choose a strong password used only here and enable two-factor login.
21. Changes
We update this privacy policy when our services or the legal situation change. The version published here applies.