Privacy policy

01

Controller

MEDUSA-Sportwagen GmbH
Südliche Münchner Straße 15, 82031 Grünwald
Germany

Telephone: +49 (0) 89 568 266 31
Email: info@medusa-sportwagen.de

02

Website provision and Cloudflare

We use services provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA ("Cloudflare") to host, deliver and protect this website. Cloudflare acts as our data processor. All website content, including vehicle images, is delivered through our domain and the infrastructure provided by Cloudflare.

When you access the website, Cloudflare processes technically necessary connection and log data. This may include your IP address, date and time of access, requested address, HTTP method and status code, referrer, browser and device information, and data used to detect and prevent abusive access. This processing is necessary to provide the website securely, quickly and reliably, to prevent attacks and to investigate technical errors.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of our online service, the prevention of misuse and technical error analysis. Technical log data is retained only for as long as necessary for security, operational and error-analysis purposes and is then deleted or anonymised unless statutory obligations require otherwise.

Processing by Cloudflare may also take place outside the European Union and the European Economic Area, particularly in the USA. Cloudflare states that it is certified under the EU-U.S. Data Privacy Framework. Where required, Cloudflare's data processing agreement also provides for the EU Standard Contractual Clauses and supplementary safeguards.

Further information is available in the Cloudflare Privacy Policy and the Cloudflare Data Processing Addendum.

03

Cookies, language selection and browser storage

We do not use analytics, marketing or profiling services. The website itself does not set cookies for advertising or audience measurement and does not use a consent banner because no tracking technologies requiring consent are currently in use.

On your first visit, the website selects German or English using your browser's Accept-Language setting and a generalised country code supplied by Cloudflare. This information is used only for the current language selection and not to create a location or user profile. If you select a language manually, the technically necessary cookie medusa_locale stores the choice for up to one year.

For the requested "Back to inventory" function, the website stores the last vehicle-list URL, including filters and sorting, the scroll position and a timestamp in your browser's session storage. The website uses this saved state for no more than six hours. Your browser normally clears session storage when the tab session ends. This information does not leave your browser.

This storage is necessary to provide the language and navigation functions you have requested. It is based on Section 25(2)(2) TDDDG and, where personal data is involved, Article 6(1)(f) GDPR. Cloudflare may also set strictly necessary security cookies when an access attempt is checked automatically or a security challenge is performed. These cookies protect the website and are not used to create advertising profiles.

04

Contact by email or telephone

This website does not contain a contact form. Selecting "Enquire about vehicle" only opens a locally generated, prefilled draft in your email application. The website does not send a message or store contact details at this point. We process your information and enquiry only after you send the email yourself or contact us by telephone.

Processing is carried out to handle your enquiry and any follow-up questions. Where your enquiry concerns entering into or performing a contract, the legal basis is Article 6(1)(b) GDPR. For general enquiries, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is the appropriate response to and documentation of business enquiries.

The email and telecommunications providers used by you and by us may process connection and content data. We delete enquiries once they have been fully handled and there are no contractual, statutory or legitimate reasons for further retention. Correspondence relevant under commercial or tax law may be retained for longer in accordance with statutory retention periods.

05

Google Maps and social media links

The website contains links to Google Maps and to our profiles on Instagram, TikTok and Facebook. No maps, social media plugins, posts or tracking pixels from these providers are embedded in the website. No browser data is transferred to the relevant provider through these links until you open one of them.

When you open an external link, you leave our website. The relevant provider then receives technically necessary connection data, particularly your IP address, and processes further data under its own privacy policy. We have no control over this processing.

06

Recipients and disclosure

Within our company, access to personal data is limited to those who require it to handle your enquiry or operate the website securely. External recipients include Cloudflare as the hosting and infrastructure provider and, when you contact us, the email or telecommunications providers involved.

Any further disclosure takes place only where necessary to perform a contract, required by law, covered by your consent or permitted by another data-protection provision.

07

Your rights

Subject to the statutory requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on Article 6(1)(f) GDPR (Article 21).

To exercise your rights, email info@medusa-sportwagen.de. You also have the right under Article 77 GDPR to lodge a complaint with a data protection supervisory authority. For private-sector companies in Bavaria, this is in particular the Bavarian State Office for Data Protection Supervision.

08

Encryption and security

The website is provided exclusively over an encrypted HTTPS connection. We and our service providers implement appropriate technical and organisational measures to protect personal data against loss, manipulation and unauthorised access.

09

Updates to this privacy policy

We update this privacy policy when the website, the services used or legal requirements change. The version published on this page applies.