Privacy Policy

1. Data Protection at a Glance

1.1 General Information

The following information provides an overview of what happens to your personal data when you visit this website.

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with applicable data protection laws and this privacy policy.

This privacy policy informs you about what personal data we process when you visit our website, for what purposes we process it, what the legal basis for the processing is, and what rights you have as a data subject.

According to Article 4, paragraph 1, of the GDPR, personal data is any information that allows you to be personally identified. This includes, for example, your first and last names, address, phone number, email address, and IP address. Data that cannot be linked to you (e.g., after it has been anonymized) is not considered personal data.

Please be aware that transmitting data over the Internet (e.g., via email) may involve security risks. It is not possible to completely protect data from access by third parties.

1.2 Data Controller and Data Protection Officer

1.2.1 Data Controller

The data controller for this website is:

M.P.I. Pharmaceutica GmbH
An der Alster 47
20099 Hamburg
Germany

Phone: +49 (40) 30 37 24-0
Email: post@mpi-pharma.de
Website: www.masculan.com

The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g., names, email addresses, etc.).

1.2.2 Data Protection Officer

If you have any questions about the processing of your personal data or about exercising your rights as a data subject, you may contact our Data Protection Officer at any time:

Martin Büsing
Senior Data Protection Consultant

]init[ AG für digitale Kommunikation
Köpenicker Str. 9
10997 Berlin

Email: anfragen_datenschutz@init.de

1.3 General Information on Data Processing

1.3.1 Purposes of Data Processing

We process personal data only to the extent necessary to provide a functional website, respond to inquiries, fulfill contractual or legal obligations, and protect our legitimate interests.

In particular, we process personal data for the following purposes:

• Making our website available and optimizing it,
• Ensuring the technical security and stability of the website,
• Managing contact requests,
• Compliance with contractual or precontractual obligations,
• Compliance with legal obligations,
• Filing, pursuing, or defending claims.

The purposes and legal bases for each data processing operation are explained in greater detail in the following sections of this privacy policy.

1.3.2 Legal Basis for Processing

We process personal data solely on the basis of a legal authorization.

Depending on the type and purpose of the processing, we base it specifically on the following legal grounds:

• Consent: Article 6, paragraph 1, subparagraph (a) of the GDPR,
• Performance of a contract or implementation of precontractual measures: Article 6(1)(b) of the GDPR,
• Compliance with legal obligations: Article 6, paragraph 1, subparagraph (c) of the GDPR,
• Legitimate interest: Article 6, paragraph 1, subparagraph (f) of the GDPR.

If we process personal data based on your consent, you may revoke that consent at any time, effective for the future.

The specific legal basis for each processing operation is indicated in the relevant sections of this privacy policy.

1.3.3 Recipients of Personal Data

Within our company, only those departments that need personal data to perform their duties have access to it.

In addition, personal data may be disclosed to third-party service providers or other recipients when such disclosure is legally permitted or necessary for the performance of the contract. These may include, in particular:

• IT and web hosting service providers,
• Data processors within the meaning of Article 28 of the GDPR,
• Public authorities and agencies, when there is a legal obligation,
• Consultants or other service providers, to the extent necessary to protect legitimate interests.

When we engage external service providers as data processors, we enter into a data processing agreement with them in accordance with Article 28 of the GDPR.

You will find detailed information about the respective recipients in the processing operations described below.

1.3.4 Retention Period

Unless a more specific time frame is indicated in this privacy policy, we retain personal data only for as long as necessary to fulfill the respective purposes of the processing.

Subsequently, the data will be deleted, unless legal retention obligations or other legal grounds prevent its deletion.

If there are legal retention requirements, we will delete the data once the respective legal retention periods have expired.

1.3.5 SSL/TLS Encryption

To protect the transmission of confidential information, our website uses state-of-the-art SSL or TLS encryption.

You can usually tell if a connection is encrypted because the address bar in your browser starts with https:// and a padlock icon is displayed.

Thanks to encryption, the data you send us generally cannot be read by unauthorized third parties.

1.3.6 Rights of the Data Subject

As a data subject, the General Data Protection Regulation grants you, in particular, the following rights:

1.3.6.1 Right of access:

Pursuant to Article 15 of the GDPR, you have the right to request information about the personal data we process regarding you. You may request information regarding the purposes of the processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the intended retention period, the existence of the right to rectification, erasure, restriction of processing, or objection, the existence of the right to file a complaint, as well as the rectification of incorrect data or the completion of your personal data that we have stored.

1.3.6.2 Right to erasure:

Pursuant to Article 17 of the GDPR, you have the right to request the erasure of your personal data that we have stored, unless the processing is necessary to exercise the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.

1.3.6.3 Right to restriction of processing:

Pursuant to Article 18 of the GDPR, you have the right to request the restriction of the processing of your personal data when you contest the accuracy of the data, the processing is unlawful, you object to the erasure of the data and we no longer need it but you require it for the establishment, exercise, or defense of legal claims, or when you have objected to the processing pursuant to Article 21 of the GDPR.

1.3.6.4 Right to data portability:

Pursuant to Article 20 of the GDPR, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller.

1.3.6.5 Right to File a Complaint:

Pursuant to Article 77 of the GDPR, you have the right to file a complaint with a supervisory authority. As a general rule, you may contact the supervisory authority in your place of residence or habitual workplace, or the one where our company is headquartered. In this case, the competent supervisory authority is:

Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit)
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany

Website: https://datenschutz-hamburg.de/

1.3.6.6 Right to Object:

You may object at any time to the processing of your personal data when such processing is based on Article 6, paragraph 1, subparagraphs (e) or (f) of the GDPR and there are grounds relating to your particular situation. This also applies to profiling based on those provisions.

If your personal data is processed for direct marketing purposes, you may object to this processing at any time. This also applies to profiling related to such direct marketing.

1.3.6.7 Right to Withdraw Consent:

You have the right to withdraw your consent regarding data protection at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent given prior to its withdrawal.

2. Data Processing on This Website

2.1 Web Hosting

We use the services of a third-party web hosting provider to operate this website. All personal data processed in connection with the use of this website is processed on the hosting provider's servers.

This may include, in particular, the following information:

• IP address,
• Date and time of access,
• Browser type and version,
• Operating system used,
• Referrer URL,
• Hostname of the accessing computer,
• Pages and files accessed,
• Other technically necessary connection details.

We process this data to make the website available, ensure the security and stability of the system, defend against attacks, and analyze errors.

The legal basis for the processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing our online presence in a secure and technically flawless manner.

To the extent that the hosting provider processes personal data on our behalf, it does so based on a data processing agreement in accordance with Article 28 of the GDPR.

We host our website's content with the following provider: www.ionos.com

2.2 Cookies

Our website uses cookies. Cookies are small pieces of data that do not harm your device or contain viruses. They are stored on your device either temporarily during a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted when you end your visit. Persistent cookies remain stored on your device until you delete them yourself or your browser automatically deletes them.

Cookies may be set by us (first-party cookies) or by third-party companies (third-party cookies). Third-party cookies allow us to integrate certain third-party services into our websites (e.g., cookies for managing payment services).

Cookies serve various purposes. Many cookies are technically necessary, as certain website features would not work without them (e.g., the shopping cart feature or video playback). Other cookies may be used to analyze user behavior or for advertising purposes.

Cookies that are necessary to carry out the electronic communication process, to provide certain features you have requested, or to optimize the website (e.g., audience measurement cookies) are stored pursuant to Article 6(1)(f) of the GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing the cookies necessary to provide its services in a technically flawless and optimized manner. If consent has been given for the storage of cookies and similar tracking technologies, processing is carried out exclusively on the basis of that consent (Article 6(1)(a) of the GDPR and Article 25(1) of the TTDSG); consent may be revoked at any time.

You can configure your browser to notify you when cookies are being installed, allow cookies only in specific cases, block them in certain cases or generally, and enable the automatic deletion of cookies when you close your browser. If you disable cookies, the functionality of this website may be limited. You can also delete stored cookies through your browser settings.

The following links explain how to adjust the settings in the most common browsers:

• Microsoft Edge: Manage Cookies in Microsoft Edge
• Firefox: Enhanced Tracking Protection in Firefox for Desktop
• Chrome: Delete, Allow, and Manage Cookies in Chrome
• Safari: Clear the cache and cookies in Safari on a Mac

Once the data transmitted to us via cookies is no longer needed for the purposes described, this information will be deleted. In specific cases, the data may be retained for a longer period if required by law.

2.3 Sales Form

If you send us inquiries through the sales form, we will store the information you provide in that form—including the contact information you provide—in order to process your inquiry and in case any follow-up questions arise. We do not share this information without your consent.

We process this data pursuant to Article 6(1)(b) of the GDPR when your inquiry relates to the performance of a contract or is necessary for the implementation of precontractual measures. In all other cases, processing is based on our legitimate interest in effectively managing the inquiries we receive (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR), if such consent has been requested; consent may be withdrawn at any time.

The data you enter in the sales form will remain in our possession until you request that we delete it, revoke your consent to its retention, or the purpose for which it is retained no longer applies (e.g., once your inquiry has been processed). Mandatory legal provisions, in particular retention periods, remain unaffected.

2.4 Contact by email or phone

If you contact us by email or phone, we will store and process your inquiry, including all personal data contained therein (name, inquiry), in order to handle your request. We do not disclose this data without your consent.

We process this data pursuant to Article 6(1)(b) of the GDPR when your inquiry relates to the performance of a contract or is necessary for the implementation of precontractual measures. In all other cases, processing is based on our legitimate interest in effectively managing the inquiries we receive (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR), if such consent has been requested; consent may be withdrawn at any time.

The data you submit to us through contact requests will remain in our possession until you request its deletion, revoke your consent to its retention, or the purpose for which it is retained no longer applies (e.g., once your request has been processed). Mandatory legal provisions, in particular statutory retention periods, remain unaffected.

3. External Services and Providers Used

3.1 Google Tag Manager

This website uses Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is used to manage and integrate website tags from a single interface. The service itself does not create user profiles and generally does not store cookies. However, it allows other tags to be executed that may process personal data.

For technical reasons, the use of Google Tag Manager may involve the processing of personal data, in particular IP addresses. If services that require consent (e.g., analytics or marketing services) are integrated via Google Tag Manager, these will only be executed after you have provided the corresponding consent in accordance with Article 6(1)(f) of the GDPR. The use of Google Tag Manager itself, to the extent that it serves solely to ensure the technically correct management of the tags used on the website, is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

You can find more information about data protection at Google at:
https://policies.google.com/privacy?hl=en

3.2 Vimeo

This website uses plugins from the Vimeo video platform. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, U.S.

When you visit one of our pages that includes Vimeo videos, a connection is established with Vimeo's servers. This tells the Vimeo server which of our pages you have visited. In addition, Vimeo obtains your IP address.

We use Vimeo to ensure an attractive presentation of our online offerings. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. If the relevant consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR; consent may be withdrawn at any time.

Data transfers to the U.S. are based on the European Commission's standard contractual clauses and, according to Vimeo, on "legitimate business interests." For more details, see: https://vimeo.com/privacy.

You can find more information about how user data is processed in Vimeo's privacy policy: https://vimeo.com/privacy.

The company is certified under the “EU-U.S. Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States that aims to ensure compliance with European data protection standards for data processing carried out in the United States. Every company certified under the DPF commits to complying with these standards. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5711.

3.3 YouTube

This website embeds videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit a page with an embedded YouTube video, a connection is established with YouTube's servers. This tells YouTube which page you have visited. In addition, personal data may be processed, including your IP address and technical information about your device and browser.

If you are signed in to your Google or YouTube account, YouTube may associate your visit to our website with your user account. You can prevent this by signing out of your YouTube account before visiting our website.

If the embedding or playback of the video requires consent, we process personal data exclusively on the basis of your consent in accordance with Article 6(1)(a) of the GDPR and Article 25(1) of the TTDSG. Consent may be revoked at any time with future effect.

If you click the “Watch on YouTube” button, you will be redirected to the YouTube website. From that point on, YouTube’s privacy policy and terms of use apply. We have no control over how data is processed there.

You can find more information about data protection on YouTube at:
https://policies.google.com/privacy.

3.4 Facebook and Instagram Plugins

Our website includes plugins from the social network Facebook, provided by Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA. You can recognize Facebook plugins by the Facebook logo or the “Like” button on our page. You can find an overview of Facebook plugins here: https://developers.facebook.com/docs/plugins/.

We use the “two-click” solution for this plugin. The Facebook plugin is disabled by default and is only activated when the user clicks on it, so data is only transmitted to Facebook after an active action by the website visitor. A second click allows users to share content or “like” it. Please note that we are jointly responsible with Facebook and have entered into a joint responsibility agreement.

The legal basis is consent pursuant to Article 6(1)(a) of the GDPR. You may withdraw your consent at any time, effective for the future. The lawfulness of the processing carried out on the basis of your consent until its withdrawal remains unaffected.

You can find more information in Facebook's privacy policy: https://de-de.facebook.com/policy.php.

Our website also includes plugins from the Instagram social media platform, provided by Meta Platforms Ireland Ltd., 4 Grand Canal Harbour, Dublin 2, Ireland. You can recognize Instagram plugins by the Instagram logo or by the corresponding buttons on our page. You can find an overview of Instagram plugins here: https://de-de.facebook.com/policy.php.

We use the “two-click” solution for this plugin. The Instagram plugin is disabled by default and is only activated when the user clicks on it, so data is only transmitted to Instagram after the website visitor takes active action. A second click allows content to be shared. Please note that we are jointly responsible with Meta and have entered into a joint responsibility agreement.

The legal basis is consent pursuant to Article 6(1)(a) of the GDPR. You may withdraw your consent at any time, effective for the future. The lawfulness of the processing carried out on the basis of your consent until its withdrawal remains unaffected.

You can find more information in Instagram's privacy policy: https://de-de.facebook.com/policy.php.

3.5 Social Media Presence

3.5.1 Facebook, Instagram

We manage a Facebook fan page and an Instagram page, for which we are jointly responsible with Meta Platforms Ireland Ltd., 4 Grand Canal Harbour, Dublin 2, Ireland, in accordance with Article 26 of the GDPR. We have entered into a joint controller agreement with Meta regarding data protection (Page Controller Addendum). Through this agreement, Meta acknowledges its joint responsibility regarding so-called Insights data and assumes key data protection obligations: informing data subjects, ensuring data security, and reporting data security breaches.

Our Facebook fan page and Instagram page feature the latest news, videos, and photos, which users can comment on and react to with emojis. Users can also send us messages that are not publicly visible.

Through what are known as Insights, we can view certain anonymized statistical data about user behavior. This includes, for example, the total number of page views, “Likes,” page activity, interactions with posts, reach, video views, and post reach.

It cannot be ruled out that some of the information collected may also be processed outside the European Union. Meta Platforms Inc. is certified under the EU-U.S. Privacy Shield Framework.

We manage these Facebook and Instagram pages to introduce ourselves to users, other interested parties, and our customers who visit our page, as well as to interact and communicate with them. The processing of users’ personal data is based on our legitimate interest in optimally presenting the company and its products (Art. 6, para. 1, letter f) of the GDPR). Additional processing may take place if you have given your consent (Article 6(1)(f) of the GDPR) or if it is necessary to comply with a legal obligation (Article 6(1)(c) of the GDPR).

Your data will be deleted once the purpose for which it was collected no longer applies, unless there is a legal obligation to retain it.

You can find information about the data Facebook collects about you in its privacy policy:
https://www.facebook.com/privacy/explanation

When you use the Facebook fan page, Facebook stores cookies on your computer or smartphone. You can find more information in the cookie policy:
https://www.facebook.com/policies/cookies/

You can find information about the data Instagram collects about you in its privacy policy:
https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect

When you use the Instagram fan page, Facebook stores cookies on your computer or smartphone. For more information, see the cookie policy:
https://privacycenter.instagram.com/policies/cookies/

3.5.2 X (formerly Twitter)

We manage a page on X, for which we are jointly responsible with X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland, in accordance with Article 26 of the GDPR. We have entered into a joint controller agreement with X regarding data protection (Page Controller Addendum). Through this agreement, X acknowledges its joint responsibility regarding so-called Insights data and assumes essential data protection obligations: informing data subjects, ensuring data security, and reporting data security breaches.

The X page features the latest news, videos, and images that users can comment on and react to with emojis. Users can also send us messages that are not publicly visible.

Through what are known as Insights, we can view certain anonymized statistical data about user behavior. This includes, for example, the total number of page views, “Likes,” page activity, interactions with posts, reach, video views, and post reach.

It cannot be ruled out that some of the information collected may also be processed outside the European Union. X Internet Unlimited Company is certified under the EU-U.S. Privacy Shield Framework.

We manage this X page to introduce ourselves to users, other interested parties, and our customers who visit our page, as well as to interact and communicate with them. The processing of users’ personal data is based on our legitimate interest in optimally presenting the company and its products (Art. 6, para. 1, subparagraph f) of the GDPR). Additional processing may take place if you have given your consent (Article 6(1)(f) of the GDPR) or if it is necessary to comply with a legal obligation (Article 6(1)(c) of the GDPR).

Your data will be deleted once the purpose for which it was collected no longer applies, unless there is a legal obligation to retain it.

You can find information about the data that X collects about you in its privacy policy:
https://x.com/de/privacy

When you use the X website, X stores cookies on your computer or smartphone. For more information, see the cookie policy:
https://help.x.com/de/rules-and-policies/x-cookies

July 2026