Privacy Policy

Last updated: 28 July 2026

1. General information

The protection of your personal data is important to us. This Privacy Policy explains how personal data is processed when you visit the UPSHIFT website, contact us or submit an inquiry through the website. Personal data means any information relating to an identified or identifiable natural person, such as a name, email address, telephone number or IP address. We process personal data in accordance with the General Data Protection Regulation (“GDPR”), the German Federal Data Protection Act and other applicable data protection and telecommunications legislation.

2. Controller

The controller responsible for processing personal data on this website is:

MA micro automation GmbH
Opelstraße 1
68789 St. Leon-Rot
Germany

Telephone: +49 6227 3412 0
General email: info@micro-automation.com
Data protection inquiries: privacy-protection@micro-automation.com

Represented by its Managing Directors: Joachim Hardt and Michael Alan Bostrom
MA micro automation GmbH operates the UPSHIFT website and acts as the initial contact point for inquiries submitted through the website.

3. Website hosting and server log files

When you access this website, certain technical information is automatically transmitted by your browser to the server on which the website is hosted.

This information may include:

  • IP address of the accessing device;
  • date and time of access;
  • requested page or file;
  • referrer URL;
  • browser type and browser version;
  • operating system;
  • host name of the accessing device;
  • amount of data transferred;
  • HTTP status code; and
  • information about errors and security-related events.

The processing is necessary to provide the website, ensure its technical stability and security, detect misuse and investigate technical problems or attempted attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests consist of the secure, stable and technically reliable operation of the website. Hosting and IT service providers may receive access to this information where this is necessary to provide, maintain or secure the website. Such service providers process personal data on our behalf and in accordance with our instructions where required under Article 28 GDPR. Server log data is deleted when it is no longer required for the operation or security of the website. Data may be retained for a longer period where this is necessary to investigate a security incident, prevent misuse or establish, exercise or defend legal claims.

4. SSL and TLS encryption

This website uses SSL or TLS encryption to protect data transmitted between your browser and our server. You can recognise an encrypted connection by the “https” prefix and the lock symbol displayed in your browser. Despite the use of appropriate technical and organisational security measures, complete protection against all risks associated with internet-based data transmission cannot be guaranteed.

5. Cookies and similar technologies

Cookies are small data files stored on your device. We may also use browser-based technologies such as Local Storage that serve similar technical purposes. Some storage technologies are technically necessary to provide the website, store privacy preferences or comply with legal obligations. Other technologies may only be used after you have provided your consent. Where consent is required, the legal basis for processing personal data is Article 6(1)(a) GDPR. Access to or storage of information on your device is based on your consent in accordance with Section 25(1) of the German Telecommunications Digital Services Data Protection Act. Technically necessary storage is based on Section 25(2) of the German Telecommunications Digital Services Data Protection Act. The associated processing of personal data is based on Article 6(1)(c) GDPR, where the processing is necessary to comply with our legal obligations, and Article 6(1)(f) GDPR, where necessary to provide a secure and functional website.

6. Real Cookie Banner

We use Real Cookie Banner to manage your privacy preferences, obtain consent where required and document the choices you make. Real Cookie Banner stores a consent identifier, the version of the cookie-banner configuration and information about the services and service groups you have accepted or rejected. The identifier is used to document the consent decision and is not intended to directly identify you as a website visitor. For this purpose, technically necessary HTTP cookies and browser Local Storage entries may be used. The HTTP cookies are generally stored for up to 365 days. Local Storage entries may be used temporarily until the consent decision has been successfully documented on the website server. The processing is necessary to comply with our legal obligations regarding the obtaining and documentation of consent. The legal basis is Article 6(1)(c) GDPR. Storage of information on your device is technically necessary within the meaning of Section 25(2) TDDDG. Detailed information about the technical storage mechanisms, their names, purposes and durations is available at any time in the privacy settings of this website. You may change or withdraw your privacy choices at any time using the “Privacy Settings” link displayed on the website. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

7. Contact form and inquiries

If you contact us through a contact form, by email, by telephone or through another communication channel, we process the information you provide in order to respond to and manage your inquiry.

Depending on the form and the nature of your inquiry, this may include:

  • name;
  • company or organisation;
  • position or department;
  • postal address;
  • country or region;
  • telephone number;
  • email address;
  • requested product, service or application;
  • technical project information;
  • uploaded documents or files;
  • message content;
  • preferred contact method; and
  • the date, time and circumstances of the inquiry.

Fields marked as mandatory are required to process the inquiry. Other information is voluntary. Where your inquiry relates to the preparation or performance of a contract, processing is based on Article 6(1)(b) GDPR. For general business, cooperation, media or technical inquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the efficient handling of inquiries addressed to us and the organisation of the UPSHIFT cooperation. Where we request separate consent for a specific type of processing, the legal basis is Article 6(1)(a) GDPR. Inquiry data is generally retained until the inquiry has been fully processed and any reasonable follow-up period has expired. Unless the inquiry results in a business relationship, data will normally be deleted no later than twelve months after the final substantive communication. Where the inquiry results in contractual documents, quotations, orders, invoices or other records subject to statutory retention obligations, the relevant data may be retained for the applicable statutory retention period.

8. Forwarding inquiries to UPSHIFT project partners

UPSHIFT is a cooperative project involving several independent companies with different areas of technical expertise. MA micro automation GmbH initially receives inquiries submitted through the UPSHIFT website and determines which person or project partner is technically or commercially responsible for the subject of the inquiry. Where necessary to process your inquiry, we may forward relevant parts of your contact details and inquiry to the UPSHIFT project partner responsible for the requested technology, product, service, region or application. Only the information reasonably required to process the inquiry will be forwarded. Not all UPSHIFT partners receive access to your information. There is no shared UPSHIFT customer database or shared CRM system to which all project partners have access. Recipients may include the UPSHIFT project partners identified on the website and their employees responsible for sales, technical consulting, project management or customer service.

The forwarding of an inquiry is based on:

  • Article 6(1)(b) GDPR, where the forwarding is necessary to take steps at your request before entering into a contract or to perform a contract; or
  • Article 6(1)(f) GDPR, where the forwarding is necessary to respond efficiently to a general business or technical inquiry.

Our legitimate interests and those of the responsible project partner consist of ensuring that your inquiry is handled by the company with the relevant technical, regional or commercial expertise. Once an inquiry has been forwarded, the receiving project partner normally acts as an independent controller for its subsequent processing of the data. The partner is responsible for providing any additional information required under Article 14 GDPR and for complying with your data protection rights regarding its own processing.

9. Use of contact data for sales and marketing

The responsible UPSHIFT project partner may use your contact details without separate marketing consent where this is necessary to:

  • respond to your specific inquiry;
  • provide technical or commercial information requested by you;
  • prepare or follow up a quotation;
  • discuss a project directly related to your inquiry; or
  • perform pre-contractual or contractual measures requested by you.

Use of your contact details for broader advertising, newsletters or the promotion of additional products and services that is not necessary to process your original inquiry will only take place where:

  • you have provided separate and voluntary consent;
  • the processing is otherwise permitted by applicable law; or
  • the statutory requirements for communicating with existing customers are met.

Where you provide consent, the legal basis is Article 6(1)(a) GDPR. Consent is voluntary and may be withdrawn at any time with effect for the future. You also have the right to object at any time to the use of your personal data for direct marketing. Following an objection, your personal data will no longer be used for direct-marketing purposes. A minimum record may be retained in a suppression list where this is necessary to ensure that your marketing objection is observed in the future.

10. Recipients of personal data

Depending on the individual processing activity, personal data may be disclosed to:

  • hosting, website maintenance and IT-security providers;
  • email and communication service providers;
  • employees and authorised representatives of MA micro automation GmbH;
  • the UPSHIFT project partner responsible for an inquiry;
  • professional advisers, auditors or legal representatives;
  • public authorities, courts or other recipients where disclosure is legally required; and
  • other recipients where you have expressly consented to the disclosure.

Service providers acting on our behalf are contractually bound in accordance with Article 28 GDPR where required. We do not sell personal data.

11. Transfers outside the European Economic Area

As a general rule, we process personal data within the European Union or the European Economic Area. If an inquiry requires involvement by a recipient located outside the European Economic Area, personal data will only be transferred where the requirements of Articles 44 to 49 GDPR are met.

Depending on the recipient and destination country, this may include:

  • an adequacy decision issued by the European Commission;
  • the EU Standard Contractual Clauses;
  • supplementary technical and organisational safeguards;
  • Binding Corporate Rules; or
  • an applicable exception under Article 49 GDPR.

Further information about a specific transfer may be provided in connection with the relevant inquiry or upon request.

12. General retention principles

Unless a specific retention period is stated in this Privacy Policy, personal data is retained only for as long as necessary for the purpose for which it was collected.

Data may be retained for a longer period where this is necessary to:

  • comply with statutory retention obligations;
  • establish, exercise or defend legal claims;
  • investigate security incidents;
  • comply with an objection to direct marketing; or
  • comply with another legal obligation.

When the relevant purpose and retention obligations no longer apply, the data will be deleted or anonymised.

13. Your rights

Subject to the conditions of the GDPR, you have the following rights:

  • the right to obtain information about whether and how your personal data is processed;
  • the right of access under Article 15 GDPR;
  • the right to rectification under Article 16 GDPR;
  • the right to erasure under Article 17 GDPR;
  • the right to restriction of processing under Article 18 GDPR;
  • the right to data portability under Article 20 GDPR;
  • the right to object under Article 21 GDPR;
  • the right to withdraw consent under Article 7(3) GDPR; and
  • the right to lodge a complaint with a supervisory authority under Article 77 GDPR.

Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is required for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct-marketing purposes, you may object at any time without stating reasons.
To exercise your rights, please contact: privacy-protection[at]micro-automation.com

We may request appropriate information to verify your identity before responding to a request.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for MA micro automation GmbH is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Germany

Telephone: +49 711 615541-0
Email: poststelle[at]lfdi.bwl.de

You may also contact the supervisory authority at your usual place of residence, your place of work or the place of the alleged infringement.

15. Obligation to provide personal data

You are not legally required to provide personal data merely to visit the website. Certain information may be required in order to process an inquiry, prepare a quotation or take requested pre-contractual measures. Without the required information, we may be unable to respond to or fully process the inquiry. Any separate consent for advertising or marketing is voluntary and is not a condition for submitting an inquiry.

16. Automated decision-making and profiling

We do not use the personal data collected through the UPSHIFT website to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you. We do not create advertising profiles from website inquiries unless this is expressly disclosed and based on an appropriate legal basis.

17. External links

The website may contain links to websites operated by UPSHIFT project partners or other third parties. When you follow an external link, the operator of the destination website is responsible for the processing of personal data on that website. Please consult the privacy policy of the relevant website operator. A simple external link does not generally result in personal data being transmitted to the destination website until you select the link.

18. Changes to this Privacy Policy

We may update this Privacy Policy where the website, the UPSHIFT cooperation, applicable legal requirements or the services used on the website change. The version published on this website at the time of your visit applies. The date of the most recent update is stated at the beginning of this Privacy Policy.