Skip to content

Privacy policy

Last updated: 27 October 2026

1 – Introduction

1.1 – Privacy policy

Thank you for visiting our website and for your interest in our company, products and services. Protecting your personal data matters to us. MD Aircraft GmbH ("MD Aircraft", "we" or "us") puts a high priority on keeping user data secure and on complying with data protection law.

The md-aircraft.com pages may link to websites run by other providers. This privacy policy does not cover those sites. We don't know what data their operators may collect, and we have no control over it. Please see the privacy notice on each of those sites.

Below, we explain in detail how we handle your data.

1.2 – Definitions

This privacy policy uses the terms defined in the General Data Protection Regulation (GDPR).

  • "Personal data" means any information relating to an identified or identifiable natural person (the "data subject") (Art. 4(1) GDPR). Your personal data includes, for example, your basic details (first and last name, address, date of birth), your contact details (phone number, email address) and your billing details (bank account information).
  • "Processing" means any operation or set of operations performed on personal data, whether or not by automated means. This includes collecting, recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, dissemination or otherwise making available, aligning or combining, restricting, erasing or destroying it.
  • "Data subject" means any identified or identifiable natural person whose personal data is processed by the controller.
  • "Controller" means the natural or legal person, public authority, agency or other body that, alone or jointly with others, decides the purposes and means of processing personal data. Where EU or Member State law sets those purposes and means, the controller, or the specific criteria for naming it, may be set by EU or Member State law.
  • "Processor" means a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
  • "Recipient" means a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not it is a third party. Public authorities that may receive personal data as part of a specific inquiry under EU or Member State law are not considered recipients.
  • "Third party" means any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor, and the persons who are authorized to process personal data under the direct authority of the controller or processor.
  • "Consent" means any freely given, specific, informed and unambiguous indication of the data subject's wishes, by a statement or a clear affirmative action, showing that they agree to the processing of their personal data.

1.3 – Collection and processing of personal data

You can use our website without providing any personal data. If you send us an inquiry or an application through the website, we process the personal data you enter. If processing is necessary and there is no other legal basis for it, we will ask for your consent.

1.4 – Controller

The controller within the meaning of the GDPR is:

MD Aircraft GmbH
Streeker Straße 5b
26446 Friedeburg
Germany
Phone: +49(0)44 65 – 9 78 78 – 0
Fax: +49(0)44 65 – 9 78 78 – 99
E-mail: info@md-aircraft.com

Represented by: Gregor Müller / Tim Markwald, Managing Directors

For data protection questions, please contact: datenschutz@md-gruppe.com

2 – Purposes of collection, categories of data and legal basis for processing

2.1 – Server log files

You can visit our site without actively giving us any information about yourself. However, each time you access the site, our servers automatically store access data in server log files. This includes your browser and operating system, the website you came from, the date and time of your visit, and the address of the page or file requested. For security reasons, such as detecting attacks on our website, we also store your computer's IP address. We do not combine this data with data from other sources and do not use it to identify you.

We process and use this data to:

  • provide the md-aircraft.com website,
  • improve our website, and
  • prevent and detect errors, malfunctions and misuse of the website.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is keeping the website secure and working properly.

2.2 – Contact form and inquiries

You can send us inquiries through the contact form on our site. The form asks for your name and email address (required) and, if you wish, your job title, company and phone number. You choose the topic of your inquiry (investment, sales or media) and write your message. We store this information, with the date of your inquiry, so we can handle your inquiry and any follow-up questions. The form sends your inquiry by email to the staff responsible for the topic you chose. We do not share this data without your consent.

The legal basis is Art. 6(1)(b) GDPR where your inquiry concerns a possible contract with us, and Art. 6(1)(f) GDPR otherwise. Our legitimate interest is answering the inquiries we receive.

We keep the data you enter in the contact form until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing it no longer applies (for example, once your inquiry has been fully handled). Mandatory legal requirements, especially retention periods, are not affected.

2.3 – Contact by email

If you send us inquiries or information by email, we store the details you provide (email address, content, subject and date of your email) and any contact details you include (first name, last name, and phone number and address if given) so we can handle your inquiry and any follow-up questions. We do not share this data without your consent. The legal basis is Art. 6(1)(b) GDPR where your email concerns a possible contract with us, and Art. 6(1)(f) GDPR otherwise.

Please note that emails can be read or altered by unauthorized parties without anyone noticing while they are in transit. MD Aircraft uses software that filters unwanted email (a spam filter). The spam filter may reject emails that it wrongly flags as spam based on certain characteristics.

We keep the data you provide until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing it no longer applies (for example, once your inquiry has been fully handled). Mandatory legal requirements, especially retention periods, are not affected.

2.4 – Careers section and applications

You can apply for jobs through the application form on our careers page, or by sending your application documents (such as cover letter, CV, references and certificates) by email to bewerbung@md-gruppe.com. The form asks for your name and email address (required) and, if you wish, your job title, company, phone number and a message. The form does not accept documents; please send those by email. The form sends your application by email to bewerbung@md-gruppe.com.

We collect and process applicants' personal data (basic details, contact details and documents) solely to manage the application process. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into an employment contract).

If you are hired, your data will be transferred to your personnel file. If you are not hired, we will delete your application data 6 months after the end of the application process, unless you have consented to us keeping it longer for future vacancies (Art. 6(1)(a) GDPR). We keep the data for this period based on our legitimate interest in being able to defend against claims under the German General Equal Treatment Act (AGG) (Art. 6(1)(f) GDPR). The copy of a form application that the website stores is deleted automatically 6 months after it is received. Backup copies of the website are kept for up to 12 months and are then deleted.

2.5 – Cookies, analytics and third-party content

This website does not use analytics or tracking tools, and does not set cookies for visitors. It loads no content from other providers: the fonts, pictures, videos and the 3D model are served from our own servers. The only cookie the site can set is a technical cookie for our editors, which lets them preview unpublished content; it is not set for visitors.

2.6 – Hosting and email delivery

The website is hosted for us by Digitalist on servers of UpCloud in Helsinki, Finland. Digitalist and UpCloud process the data described in this policy on our behalf as processors.

The emails that the contact and application forms send to our staff are delivered through Resend (Resend, Inc., USA), which acts as a processor. This means the content of a form submission is transferred to the USA. The transfer complies with Art. 44 et seq. GDPR.

3 – Data transfers

3.1 – Internal transfers within MD Aircraft

We share your data internally with administration, human resources and payroll so we can meet our contractual and legal obligations. We transfer or disclose your data only as far as needed for this, and in line with applicable data protection rules.

3.2 – Transfers within the group

Inquiries and applications sent through the website are stored on servers in Finland (see 2.6) and emailed to the responsible staff of MD Aircraft. If data is shared within the group, this is done to perform a contract or as a condition of using the website. We may also have an interest in sharing this data for internal administrative purposes. If your data is processed outside Europe, the transfer complies with all applicable data protection laws, in particular Art. 44 et seq. GDPR.

3.3 – Transfers to third parties

We share your data with certain third parties that provide external services to us, so we can offer the relevant applications and services. These are "processors", such as our hosting and email providers (see 2.6), IT providers and our tax advisors. We may also share data with other third parties where needed to meet our obligations (for example, public authorities, banks and social security agencies). Third parties process the data only on our instructions and may not use it for their own commercial purposes beyond those agreed.

We must disclose personal data if we are required to do so in ongoing legal proceedings, by court order, or by law (Art. 6(1)(c) GDPR).

We share your personal data with third parties only if:

  • you have given your express consent under Art. 6(1)(a) GDPR;
  • the disclosure is necessary under Art. 6(1)(f) GDPR to establish, exercise or defend legal claims, and there is no reason to believe you have an overriding legitimate interest in your data not being shared;
  • there is a legal obligation to disclose it under Art. 6(1)(c) GDPR; or
  • the disclosure is legally permitted and necessary under Art. 6(1)(b) GDPR to perform a contract with you.

If your data is processed outside Europe, the transfer complies with all applicable data protection laws, in particular Art. 44 et seq. GDPR.

4 – Final provisions

4.1 – How long we keep your data

We generally keep your data for as long as needed to provide our website and related services, or for as long as required by EU law or any other laws or regulations the controller is subject to. In all other cases, we delete your personal data once its purpose has been fulfilled. The exception is data we must keep to meet legal obligations. For example, tax and commercial law requires us to keep documents such as contracts and invoices for a set period.

4.2 – Technical security

MD Aircraft GmbH uses technical and organizational security measures to protect the data we manage against accidental or deliberate manipulation, loss, destruction and unauthorized access. We continuously improve these measures as technology develops.

For security, and to protect confidential content you send us as site operator (such as inquiries), this site uses TLS (Transport Layer Security) encryption. You can tell a connection is encrypted when the browser's address bar shows "https://" and a padlock icon.

When TLS encryption is active, third parties cannot read the data you send us.

Please note that data sent over the internet (for example, by email) can have security gaps. Complete protection of data against access by third parties is not possible.

4.3 – Legal basis for processing

  • Art. 6(1)(a) GDPR (consent): We rely on this when we ask for your consent for a specific processing purpose.
  • Art. 6(1)(b) GDPR (contract): We rely on this when processing is needed to perform a contract you are party to, for example to deliver goods or provide another service. The same applies to steps taken before entering a contract, such as when you ask about our products or services.
  • Art. 6(1)(c) GDPR (legal obligation): We rely on this when we are legally required to process personal data, for example to meet tax obligations.
  • Art. 6(1)(d) GDPR (vital interests): In rare cases, we may need to process personal data to protect the vital interests of the data subject or another person. For example, if a visitor were injured on our premises, we might need to pass their name, age, health insurance details or other vital information to a doctor, hospital or other third party.
  • Art. 6(1)(f) GDPR (legitimate interests): We rely on this for processing not covered by the bases above, where it is necessary to protect a legitimate interest of our company or a third party, as long as your interests, fundamental rights and freedoms do not override it. Where we rely on this basis, our legitimate interest is carrying out our business for the benefit of all our employees and customers.

4.4 – Whether you are required to provide personal data, and what happens if you don't

Providing personal data is sometimes required by law (for example, tax regulations) or by contract (for example, details about the contracting party). Sometimes you may need to give us personal data, which we then have to process, in order to enter into a contract. For example, you must give us personal data if our company enters into a contract with you. If you don't provide it, we cannot enter into the contract.

Before you provide personal data, please contact one of our staff. They will explain, for your specific case, whether providing the data is required by law or contract, or needed to enter into the contract, whether you are obliged to provide it, and what would happen if you don't.

4.5 – Your rights

You have the right to:

  • Access (Art. 15 GDPR): Ask for information about the personal data we process about you. This includes the purposes of processing, the categories of data, the categories of recipients your data has been or will be disclosed to, the planned storage period, your rights to rectification, erasure, restriction or objection, your right to complain, where your data came from if we didn't collect it from you, and whether automated decision-making (including profiling) takes place, with meaningful information about how it works.
  • Rectification (Art. 16 GDPR): Have inaccurate data corrected, or incomplete data completed, without delay.
  • Erasure (Art. 17 GDPR): Have your stored personal data deleted, unless processing is needed to exercise the right to freedom of expression and information, to meet a legal obligation, for reasons of public interest, or to establish, exercise or defend legal claims.
  • Restriction (Art. 18 GDPR): Have the processing of your data restricted if you dispute its accuracy, if the processing is unlawful but you don't want the data deleted, if we no longer need the data but you need it to establish, exercise or defend legal claims, or if you have objected to processing under Art. 21 GDPR.
  • Data portability (Art. 20 GDPR): Receive the personal data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller.
  • Objection (Art. 21 GDPR): Object to processing based on legitimate interests under Art. 6(1)(f) GDPR, on grounds relating to your particular situation, or where the objection concerns direct marketing. For direct marketing, you have a general right to object, and we will act on it without you needing to give a reason.
  • Complaint (Art. 77 GDPR): Lodge a complaint with a supervisory authority. Usually, you can contact the authority where you normally live or work.

4.6 – Withdrawing your consent

Some processing is only possible with your express consent. You can withdraw consent you have given at any time by sending an informal email to datenschutz@md-gruppe.com. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.