Privacy Policy

Last updated: October 2026

This privacy policy informs you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), about how we process personal data when you visit this website (www.ma-co.de), book a seminar, use a customer account, apply to us or contact us. Personal data means any information that can be used to identify you personally.

1. Controller

The controller responsible for data processing on this website is:

ma-co maritimes competenzcentrum GmbH Köhlbranddeich 30 20457 Hamburg, Germany

Telephone: +49 40 756082-0 Email: info@ma-co.de

Represented by the Managing Director Gerrit Küther.

2. Data Protection Officer

We have appointed a Data Protection Officer:

Dipl.-Inform. Tobias Mauß Mauß Datenschutz GmbH Neuer Wall 10 20354 Hamburg, Germany

Telephone: +49 40 9999952-0 Email: datenschutz@datenschutzbeauftragter-hamburg.de

For data protection enquiries and to exercise your rights, you can also reach us at info@ma-co.de.

3. Overview of Processing Activities

4. Hosting and Server Log Files

4.1 Hosting

This website is developed and operated for us (hosting and maintenance) by leasyro GmbH, Solmsstr. 21, 10961 Berlin, Germany. leasyro GmbH processes personal data of website visitors exclusively on our behalf and in accordance with our instructions. We have concluded a data processing agreement with leasyro GmbH pursuant to Art. 28 GDPR.

For the provision of hosting and cloud services, leasyro GmbH uses the following sub-processors, whose use we have approved:

• netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

• Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA

• Neon Inc., 209 Orange Street, Wilmington, Delaware 19801, USA

According to leasyro GmbH, processing takes place on servers in Frankfurt am Main, Germany. Vercel Inc. and Neon Inc. are based in the USA. Access to data from the USA, for example in the context of support or maintenance, can therefore not be ruled out. Any such transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, where the respective company is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Art. 45, 46 GDPR).

When media content (e.g. images and videos) is accessed, your browser may establish a connection to the servers of the infrastructure providers used, so that they process your IP address. This is technically necessary for the content to be displayed.

The legal basis is our legitimate interest in a secure, fast and reliable provision of our online services by a professional service provider (Art. 6(1)(f) GDPR).

4.2 Server Log Files

Each time the website is accessed, the following data transmitted by your browser to our server is automatically recorded:

• IP address

• date and time of the request

• page or URL accessed

• referrer URL (previously visited page)

• browser type and version

• operating system used

• amount of data transferred and HTTP status code

This data is required to deliver the website, ensure its stability and detect and defend against attacks or misuse. The data is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and error-free operation of the website).

Log data is stored only for as long as necessary for these purposes, as a rule for a short time, and is then deleted or anonymised. It may be retained for longer in order to investigate a specific security incident.

5. Cookies, Local Storage and Consent Management

Our website stores information on your device (e.g. cookies or local storage entries) and reads such information. The following applies:

Strictly necessary storage. Some storage is required for the website and functions you have requested to work, for example storing your cookie decision or, after you log in to your customer account, a session identifier. This storage is based on Section 25(2) no. 2 TDDDG; the subsequent processing is based on Art. 6(1)(f) GDPR. Consent is not required for this.

Non-essential storage. We use all other technologies, in particular for audience measurement (Section 6), only if you have given your consent beforehand (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can decline consent without any disadvantage when using the website.

Consent management

To obtain and document your consent, we use a consent tool integrated into the website. It stores your selection so that it is taken into account on later visits and so that we can meet our obligation to demonstrate consent. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

Withdrawing or changing your consent

You can change your selection or withdraw your consent at any time with effect for the future by reopening the cookie settings of this website. The lawfulness of processing carried out before withdrawal remains unaffected. In addition, you can delete cookies and stored website data in your browser or block their storage; individual functions of the website may then be restricted.

6. Web Analytics with Google Analytics

If you consent to analytics, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Without your consent, Google Analytics is not loaded and no data is transmitted to Google.

What data is processed? Google Analytics collects pseudonymous usage data, for example pages viewed, time spent, interactions (e.g. clicks), origin of the visit (referrer), device and browser information, language setting and the approximate location (country, region or city). Cookies or similar technologies with a pseudonymous identifier are used for this purpose. According to Google, IP addresses are not logged or stored in Google Analytics 4.

Purpose. We want to understand how our website is used in order to improve content, seminar search and the booking process.

Legal basis. Your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time (see Section 5).

Transfers to third countries. Google may also transfer data to the USA. The transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Google LLC is certified under it, see https://www.dataprivacyframework.gov/participant/5780) and, in addition, on the European Commission's Standard Contractual Clauses.

Data processing agreement. We have a data processing agreement with Google.

Retention period. Data in Google Analytics is stored for 14 months and then automatically deleted.

Settings. The functions for advertising purposes (Google Signals, ad personalisation) are deactivated. We do not use the collected data for advertising.

Further information can be found in Google's privacy policy (https://policies.google.com/privacy) and at https://support.google.com/analytics/answer/6004245. As an alternative to withdrawing consent via our cookie settings, you can use the browser add-on to deactivate Google Analytics: https://tools.google.com/dlpage/gaoptout.

7. Contact and Enquiries

Contact form

If you write to us using the contact form, we process the data you enter: name, email address and message (mandatory fields) and, if you wish, company and telephone number. We use this data to handle your enquiry and for follow-up questions.

Your enquiry is stored in our database and additionally forwarded to us by email. This is done via the service providers named in Section 4.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, we store and process your enquiry, including the personal data contained in it (e.g. name, contact details, content of the enquiry), in order to handle your request.

Legal basis and retention period

If your enquiry relates to an existing contract or the initiation of a contract, for example a quotation request for an in-house seminar, the legal basis is Art. 6(1)(b) GDPR. In all other cases, we process the data on the basis of our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR).

We delete your enquiry as soon as it has been finally processed and no statutory retention obligations apply. If the enquiry leads to a contract, the periods set out in Section 8 apply.

8. Seminar Booking and Contract Performance

What data do we process?

• Information on the person or company making the booking: company, name, billing address, email address, telephone number, VAT ID where applicable, invoicing and payment data

• Information on participants: name, contact details, date of birth, place of birth and nationality, as well as the documents required for the respective seminar, examinations or certificates

• Booking data: seminar booked, date, price, time of booking, attendance and, where applicable, examination results

For what purpose and on what legal basis? We process this data to conclude and perform the seminar contract, issue invoices, issue certificates of attendance and certificates, and send you organisational information about the event (Art. 6(1)(b) GDPR). We fulfil statutory accounting, retention and documentation obligations on the basis of Art. 6(1)(c) GDPR. If a company registers employees, we also process their data on the basis of our legitimate interest in the proper delivery of the training towards the client (Art. 6(1)(f) GDPR).

Documents and evidence. We request information and documents about participants (e.g. proof of identity, qualifications or fitness) only to the extent that authorities or certification and examination bodies require them for admission to a seminar, an examination or the issuing of a certificate. The legal basis is Art. 6(1)(c) GDPR where the requirement is based on a legal or official obligation, and otherwise Art. 6(1)(b) GDPR (performance of the seminar contract, including certification).

Source of data where registration is made by third parties (Art. 14 GDPR). If employers or other clients register participants, we receive their data from that party. The clients are responsible for informing the participants about the transfer; you can pass this privacy policy on to them for that purpose.

Recipients. Where necessary for admission, examination, certification or recognition, we transmit data to the competent bodies, for example authorities, chambers of industry and commerce, and certification and examination bodies. In addition, service providers that support us in processing receive data, for example tax advisers, banks and IT service providers, in each case only to the extent necessary.

Payment. Payment is currently made by invoice or bank transfer; direct online payment does not take place.

Special categories of personal data. For certain seminars, the competent bodies require documents that contain health data, for example regarding fitness for sea service. We collect such documents only where they are mandatory for the respective seminar. Processing is based on your explicit consent (Art. 9(2)(a) GDPR) or, where a legal provision provides for it, on the relevant exception under Art. 9(2) GDPR.

Retention period. We store your data for as long as it is needed to perform the contract. Thereafter we retain it only where statutory obligations or the requirements of the competent examination and certification bodies so require. Retention periods under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO) apply to commercial letters and accounting records, between six and ten years depending on the document.

9. Customer Account and Learning Platform

Customer account

If you create a customer account, we process your name, email address, your password (in encrypted form only), where applicable company and invoicing data, and your booking history. We use the account to manage your bookings and give you access to your data. The legal basis is Art. 6(1)(b) GDPR. While you are logged in, a strictly necessary session cookie is set (Section 25(2) no. 2 TDDDG).

We delete your account and the associated data at your request or when the account is no longer used permanently. Data that we must retain due to statutory obligations (Section 8) remains unaffected and its processing is restricted.

ILIAS learning platform

The "Ilias-Login" link takes you to our ILIAS learning platform at ilias.ma-co.de. This is a separate system. Data processing in the learning platform is not covered by this policy; you will receive information on it when you use the platform or on request from us.

10. Job Applications

If you apply to us by email, we process the data you send us: contact details, cover letter, CV, references and qualification documents and any further information you provide voluntarily.

We process your data to decide on establishing an employment relationship (Section 26(1) BDSG, Art. 6(1)(b) GDPR). The data is accessible only to the persons involved in the process (HR managers and the relevant department).

If you voluntarily submit special categories of personal data (e.g. information on a severe disability), we process it only to the extent that you consent or it is necessary to exercise rights under employment and social law (Art. 9(2)(a) and (b) GDPR, Section 26(3) BDSG).

Retention period. If no employment results, we regularly delete your application documents six months after the end of the process in order to be able to defend ourselves against possible claims (e.g. under the German General Equal Treatment Act, AGG) (Art. 6(1)(f) GDPR). If you wish to be included in our applicant pool, we store your documents for longer only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. If we hire you, we transfer the documents to your personnel file.

11. Social Media Presences and External Links

Our profiles

We maintain profiles on Facebook and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland), LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland) and YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

When you visit our profiles or interact with our posts, the platform operators process your data for their own purposes, for example using cookies and usage profiles, including outside the EU. We receive aggregated statistics on the use of our pages from the platforms. Where we are joint controllers with the respective provider for the creation of these statistics (Art. 26 GDPR), the providers have made joint controllership agreements available to us. We process messages and comments that you send us via the platforms in order to respond to them.

The legal basis is our legitimate interest in public relations and communication with interested parties (Art. 6(1)(f) GDPR). You can assert your data subject rights most effectively directly with the respective platform, as only it has access to all data. You can also contact us.

Privacy policies of the providers:

• Facebook: https://www.facebook.com/privacy/policy

• Instagram: https://privacycenter.instagram.com/policy

• LinkedIn: https://www.linkedin.com/legal/privacy-policy

• YouTube/Google: https://policies.google.com/privacy

Links to social networks on this website

On our website we refer to these profiles using simple links. Merely visiting our website does not transmit any data to the networks. Only when you click a link are you redirected to the respective provider's site, and its privacy terms apply.

12. Recipients and Transfers to Third Countries

We pass on personal data only where this is necessary for the respective processing, a legal basis exists and, where required, a data processing agreement has been concluded. Recipients may include:

• leasyro GmbH as processor, and its sub-processors netcup GmbH, Hetzner Online GmbH, Vercel Inc. and Neon Inc. (Section 4)

• Google Ireland Limited as provider of Google Analytics (Section 6)

• Authorities, chambers of industry and commerce, and examination and certification bodies (Section 8)

• Tax advisers, auditors, banks and insurers

• Authorities and courts, where we are legally obliged to do so

A transfer to countries outside the EU or the EEA (in particular the USA) takes place only if an adequacy decision of the European Commission exists (e.g. the EU-US Data Privacy Framework under Art. 45 GDPR), appropriate safeguards under Art. 46 GDPR are in place (in particular Standard Contractual Clauses) or you have given your explicit consent (Art. 49(1)(a) GDPR). You can obtain a copy of the respective safeguards on request using the contact details in Sections 1 and 2.

13. Retention Period

We store personal data only for as long as necessary for the respective purpose. The specific periods can be found in the individual sections. In addition, we delete data if you withdraw your consent or assert a legitimate request for deletion and no statutory retention obligations or other legally permissible grounds (e.g. defence of legal claims) prevent this. Where statutory retention periods apply, we delete after they have expired.

14. Your Rights

You have the following rights against us with regard to your personal data:

• Access (Art. 15 GDPR)

• Rectification of inaccurate data (Art. 16 GDPR)

• Erasure (Art. 17 GDPR)

• Restriction of processing (Art. 18 GDPR), in particular if you contest the accuracy of the data, the processing is unlawful and you want restriction instead of erasure, we no longer need the data but you need it for the establishment, exercise or defence of legal claims, or you have objected and it has not yet been determined whose interests prevail

• Data portability (Art. 20 GDPR): you can receive data that we process automatically on the basis of your consent or a contract in a commonly used, machine-readable format or have it transferred to another controller, where technically feasible

To exercise your rights, an informal message to info@ma-co.de or to our Data Protection Officer (Section 2) is sufficient.

Withdrawal of consent

You can withdraw any consent you have given at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected. You withdraw consent for cookies and analytics via the cookie settings (Section 5).

Right to object (Art. 21 GDPR)

Objection on grounds relating to your particular situation: Where we process your data on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to the processing; this also applies to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Objection to direct marketing: Where we process your data for direct marketing purposes, you have the right to object at any time to the processing of data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. After your objection, we will no longer use your data for direct marketing purposes.

Please send your objection informally to info@ma-co.de.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The supervisory authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information) Ludwig-Erhard-Straße 22, 7th floor 20459 Hamburg, Germany Email: mailbox@datenschutz.hamburg.de Website: https://datenschutz-hamburg.de

15. Provision of Data and Automated Decisions

The provision of personal data is neither legally nor contractually required, unless stated otherwise. However, for the conclusion and performance of a seminar contract and for handling your enquiries, we need certain information (e.g. name, contact details); without it we cannot handle your request or perform the contract. Mandatory fields are marked in the forms.

Solely automated decision-making, including profiling, that produces legal effects concerning you or significantly affects you (Art. 22 GDPR) does not take place.

16. Data Security

This website uses TLS encryption (recognisable by "https://" and the padlock symbol in your browser). This protects data you transmit to us from being read by third parties in transit. We also take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Please note that complete protection against access by third parties cannot be guaranteed when communicating by ordinary email.

17. Changes to This Privacy Policy

We amend this privacy policy when the functions of the website, the services used or the legal situation change, for example when we introduce an online payment function. The version published here at the relevant time applies.