Privacy Policy
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is: Etmita UG (haftungsbeschränkt) Nieder Straße 10 65795 Hattersheim am Main Deutschland Represented by managing director Mohammad Ghadery. Phone: +49 176 84263714 Email: info@etmita.com
No data protection officer has been appointed, as the statutory conditions for a mandatory appointment (Art. 37 GDPR, § 38 BDSG) are not met. Please address privacy enquiries to the email address above.
2. Principles
We process personal data only to the extent required to provide a functional website and our content and services. Data minimisation applies: by default this website sets no tracking cookies, uses no ad networks and no third-party CDNs; fonts are served locally from our own server (no connection to Google Fonts).
3. Hosting and server log files
This website is operated in a data centre in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider. Personal data is not transferred to third countries outside the EU/EEA.
When the website is accessed, the server automatically processes technical access data: IP address, date and time of access, requested resource, transferred data volume, referrer URL and user agent. This log data serves solely operational and attack security (legal basis: Art. 6 (1) (f) GDPR) and is deleted after 14 days at the latest, unless a security-relevant incident requires longer retention. It is not merged with other data sources.
4. Cookies and consent management
We use technically necessary cookies or comparable storage technologies on the basis of § 25 (2) TDDDG — in particular the cookie that stores your consent decision. All non-essential technologies (currently only the audience measurement described in section 5) are loaded only after your explicit consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR).
You make your choice via the cookie banner on your first visit; you can review, change or withdraw it at any time with effect for the future under “Cookie Policy” in the website footer. Details of all cookies used are set out in our Cookie Policy.
5. Audience measurement (Plausible Analytics)
Only after your consent do we use Plausible Analytics, a privacy-friendly analytics service that works without cookies, builds no cross-device profiles and does not permanently store IP addresses. Processing takes place on servers within the EU. The legal basis is your consent (Art. 6 (1) (a) GDPR); you can withdraw it at any time with effect for the future via the cookie settings. Without consent, no analytics script is loaded.
6. Contact and demo forms
Data from the forms (name, company, email, phone, message) is used exclusively to process your inquiry (Art. 6 (1) (b) GDPR). The details are not stored on the web server; they are transmitted directly by e-mail to our inbox and kept only as long as handling your request requires. No sharing with third parties, no newsletter without separate consent.
To protect against automated submissions we use an invisible form field (honeypot) and request-rate limiting; in doing so the IP address is processed briefly in memory (Art. 6 (1) (f) GDPR) but not stored permanently.
7. Email communication
If you contact us by email, we process your details to handle the enquiry and for any follow-up questions (Art. 6 (1) (b) or (f) GDPR). Emails are deleted once they are no longer required for the purpose, provided no statutory retention obligations (§ 257 HGB, § 147 AO) apply.
8. MITA Base as SaaS — data processing on behalf of customers
When our customers use the MITA Base software, we process personal data — including special categories under Art. 9 GDPR (e.g. trip destinations with a medical context, prescriptions) — exclusively as a processor on behalf of and under the instructions of the respective customer. The basis is a data processing agreement pursuant to Art. 28 GDPR, which forms part of every customer contract.
Technical and organisational measures include in particular: encryption in transit and at rest, role-based access control, audit-proof logging of security-relevant events and strict per-tenant data separation. All production data is processed exclusively in data centres in Germany.
9. Recipients and third-country transfers
Personal data is passed on to third parties only to the processors used to provide the service (hosting, email delivery), where a legal obligation exists, or where you have consented. No transfers to third countries outside the EU/EEA take place.
10. Retention
Personal data is deleted as soon as the purpose of processing ceases to apply and no statutory retention obligations stand in the way. The period stated in section 3 applies to server log files; the handling described in sections 6 and 7 applies to form and email data.
11. Your rights
With regard to personal data concerning you, you have the following rights against us: access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR). You may withdraw consent you have given at any time with effect for the future (Art. 7 (3) GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Wiesbaden.
12. No automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website.
13. Changes to this policy
We adapt this privacy policy whenever changes to the website, the legal situation or the services used require it. The version published here applies; the effective date is shown at the top of the page.
Controlling language
This English version is provided for convenience. The German version of this document is authoritative.