This Privacy Policy explains the nature, scope and purpose of the processing of personal data (hereinafter referred to as data). Data is processed within our online software mite, its functions and contents, the websites linked to it and external online presences such as social media profiles (hereinafter jointly referred to as Online Service):

• The first section of this Privacy Policy contains information about the data controller and an overview of our processing operations.
• The second section contains information about your rights, the relevant legal standards and general information about our data processing.
• The third section contains information on the individual processing operations.
• The fourth and final section contains explanations and descriptions of the terms used in this Privacy Policy. If you are unfamiliar with terms such as cookie, please refer to the last section.

mite GmbH
Kaiser-Joseph-Straße 254, 79098 Freiburg im Breisgau, Germany
Managing Director: Sebastian Munz

Phone: +49 176 20772667
E-mail: hey@mite.de
Complete legal information: https://mite.de/en/imprint.html
The Controller is hereinafter also referred to as we or us.

• Customers, test users, business partners.
• Visitors and users of the Online Service.

In the following, we will also summarise the data subjects as users.

You have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the further information and a copy of the data in accordance with Article 15 GDPR.

In accordance with Article 16 GDPR, you have the right to obtain from the controller the rectification of inaccurate personal data concerning you, or the completion of the data concerning you.

In accordance with Article 17 GDPR, you have the right to demand that relevant data be erased without undue delay or, alternatively, to demand a restriction of the processing of the data in accordance with Article 18 GDPR.

In accordance with Article 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.

In accordance with Article 77 GDPR, you also have the right to file a complaint with a supervisory authority.

We store information in the browser on your device, both as cookies and in the browser’s local storage. Both terms are explained in the last section of this Privacy Policy.

In the web application mite, we use cookies to keep you logged in after signing in – if you wish, also beyond the end of the browser session (“Remember me”) – and to remember which account you have already signed in to. Our website (information pages, blog, API documentation) does not set any cookies.

We use local storage in mite and on our website for settings and convenience features, e.g. to keep the display options you chose or to preselect the entries you chose last in selection fields. We only store settings and internal identifiers (IDs), no content such as names or texts. This data stays in your browser and is not automatically transmitted to us.

We do not use cookies or local storage for analytics, tracking or advertising, nor do we allow third parties to do so.

You can delete cookies and locally stored data at any time, or prevent them from being stored, in your browser settings. Without cookies, you cannot log in to mite. Without local storage, mite and our website still work, but the settings you chose are not saved.

The legal basis for storing and accessing this information on your device is Section 25 (2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as it is strictly necessary for the use you requested. Any further processing is based on Article 6 (1) b or f GDPR.

In accordance with Article 22 GDPR, you have the right not to be subject to a decision based exclusively on automated processing – including profiling – which has legal effect concerning you or similarly significantly affects you.

We inform you that we do not use exclusively automated individual decision-making.

The data processed by us will be erased or its processing restricted in accordance with Articles 17 and 18 GDPR. Unless expressly stated in this Privacy Policy, the data stored by us will be erased as soon as it is no longer required for its intended purpose and there are no legal obligations to retain it. If the data is not erased because it is necessary for other and legally permissible purposes, its processing is restricted. This means that the data is excluded and not processed for other purposes. This applies, for example, to data that must be retained for commercial or taxation reasons.

Documents we must retain for commercial or tax reasons (in particular under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO), e.g. invoices, accounting records and business letters) are deleted once the retention periods set out there have expired. These periods begin at the end of the calendar year in which the document was created.

In accordance with Article 13 GDPR, we inform you of the legal basis of our data processing. If the legal basis is not explicitly stated in the Privacy Policy, the following applies: The legal basis for obtaining consents is Article 6 (1) a and Article 7 GDPR, the legal basis for processing for the performance of our services and performance of contractual measures as well as for answering inquiries is Article 6 (1) b GDPR, the legal basis for processing to fulfil our legal obligations is Article 6 (1) c GDPR, and the legal basis for processing to protect our legitimate interests is Article 6 (1) f GDPR. In the event that the vital interests of the data subject or another natural person require the processing of personal data, Article 6 (1) d GDPR serves as the legal basis.

We shall take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk in accordance with Article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons; the measures include in particular ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as the access, input, transfer, integrity and pseudonymity. Furthermore, we have established procedures that guarantee the assertion of data subjects’ rights, the erasure of data and the response to data hazards. In addition, we already consider the protection of personal data during the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design of technology and by data-protection-friendly default settings (Article 25 GDPR).

The security measures include in particular the encrypted transmission of data between your browser and our server.

If we disclose data to other persons and companies (processors or third parties) within the scope of our processing, transfer the data to them or otherwise grant them access to the data, this will only be carried out on the basis of a legal permission (e.g. if a transfer of the data to third parties, such as to payment service providers, is required for contract fulfilment pursuant to Article 6 (1) b GDPR), if you have consented, if a legal obligation requires this or on the basis of our legitimate interests (e.g. when using agents, web hosting services, etc.).

If we commission third parties with the processing of data on the basis of a so-called Data Processing Agreement, this is done on the basis of Article 28 GDPR.

We process the data of our customers within the scope of mite’s services in order to provide our contractual services.

• Data processed: customer master data (company name, contact person, address, VAT registration number, e-mail address), user and account data (name, e-mail address, cryptographic hash of password), payment data (account data and/or credit card data), contract data (type of service, fee, term, contract history, payment history), content data which is entered by customers/users themselves in mite (time entries, customers, projects, services), usage data and metadata (server logging: IP address, user agent, request parameter, time stamp).
• Special categories of personal data: In general, no special categories of data are processed unless they are submitted by the user.
• Data subjects: customers, test users, business partners.
• Purpose of processing: infrastructure and platform services, computing capacity, storage and database services, security services, technical maintenance services.
• Legal basis: Article 6 (1) b (performance of the contract) and c (archiving required by law) GDPR.
• Necessity / interest in processing: The data is necessary to establish and fulfil the contractual performance.
• External disclosure and purpose: for hosting purposes only or within the scope of legal permissions and obligations towards legal consultants and authorities.
• Processing in third countries: none.
• Deletion of data: Content data entered into mite by customers themselves will be deleted 14 days after termination of the account; data of test users will be deleted 28 days after expiry of the trial account or termination; customer master data will be stored indefinitely, unless it is no longer required; the necessity of storing the data will be checked every three years; in the case of statutory archiving obligations, the data will be deleted after these expire (see Section II).

The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage and database services, security services, technical maintenance services.

• Data processed: inventory data, contact data, content data, contract data, usage data, meta/communication data.
• Special categories of personal data: none.
• Legal basis: Article 6 (1) f GDPR.
• Data subjects: customers, prospective customers.
• Special security measures: Data Processing Agreement.
• Processing in third countries: none.
• External disclosure and purpose: SysEleven GmbH, Boxhagener Straße 80, 10245 Berlin, Germany (hosting mite).
• Privacy policy: https://www.syseleven.de/datenschutz-nutzungsbedingungen.
• Necessity / interest in processing: security, efficiency, business interests.

The hosting services we use serve to provide the following services: infrastructure services, security services, technical maintenance services.

• Data processed: inventory data, content data, contract data, meta/communication data.
• Special categories of personal data: none.
• Legal basis: Article 6 (1) f GDPR.
• Data subjects: customers, prospective customers, business partners.
• Processing in third countries: none.
• External disclosure and purpose: Heinlein Hosting GmbH, Schwedter Straße 8/9A, 10119 Berlin, Germany (hosting mail server).
• Necessity / interest in processing: sending and receiving e-mails to fulfil contractual obligations and inquiries, security, efficiency, business interests.

The hosting services we use serve to provide the following services: infrastructure services, computing capacity, storage services, security services, technical maintenance services.

• Data processed: usage data and metadata, communication data.
• Special categories of personal data: none.
• Legal basis: Article 6 (1) f GDPR.
• Data subjects: customers, prospective customers, visitors of the website.
• Special security measures: Data Processing Agreement.
• External disclosure and purpose: netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (hosting info website, blog and comment function).
• Privacy policy: https://www.netcup.com/en/contact/data-privacy.
• Processing in third countries: none.
• Necessity / interest in processing: security, efficiency, business interests.

We process information contained in inquiries that we receive, e.g. by e-mail, in order to answer them.

• Data processed: inventory data, contact data, contract data, meta/communication data.
• Data subjects: customers, prospective customers, business partners, website visitors.
• Purpose of processing: answering inquiries.
• Necessity / interest in processing: necessary to answer inquiries.
• Legal basis: Article 6 (1) b and f GDPR.
• External disclosure and purpose: Heinlein Hosting GmbH, Schwedter Straße 8/9A, 10119 Berlin, Germany (hosting mail server).
• Processing in third countries: none.
• Deletion of data: We delete the inquiries if they are no longer required. We review the requirement every two years; inquiries from customers who have a customer account are stored permanently and are linked to the customer account details for deletion. In the case of statutory archiving obligations, the data will be deleted after these expire (see Section II).

We process data within the framework of administrative tasks as well as the organisation of our company, financial accounting and compliance with legal obligations, such as archiving.

• Data processed: data that we process in the course of our contractual services.
• Special categories of personal data: none.
• Legal basis: Article 6 (1) c GDPR, Article 6 (1) f GDPR.
• Data subjects: customers, prospective customers, business partners, website visitors.
• Purpose of processing: administration, financial accounting, office organisation, archiving.
• Necessity / interest in processing: The processing is necessary to maintain our business and our services.
• External disclosure and purpose: financial administration, tax consultants, other fee agencies, payment service providers to carry out contractual or legal payment transactions; payment data is only stored at the following payment service providers (we do not store or process it ourselves): 1&1 Internet SE (iPayment), Germany; InterCard AG, Germany; BS PAYONE GmbH, Germany.
• Processing in third countries: none.
• Deletion of data: The erasure of the data with regard to contractual services and contractual communication corresponds to the information provided in these processing activities.

User comments on the blog are stored and can be validated to ensure they are not spam.

• Data processed: inventory data (names, e-mail addresses, links to own website); content data (comment); usage data (IP address, for the spam check).
• Special categories of personal data: none.
• Legal basis: Article 6 (1) b GDPR; Article 6 (1) f GDPR.
• Data subjects: authors of comments.
• Purpose of processing: storage of the comment.
• Necessity / interest in processing: security purposes (spam check).
• Protective measures: Users are welcome to use pseudonyms.
• Special security measures: Data Processing Agreement.
• External disclosure and purpose: netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (hosting the comment function).
• Processing in third countries: none.
• Deletion of data: IP addresses used for the spam check are deleted after 28 days. If a comment was identified as spam, we add the IP address to a blocklist and delete it as soon as it is no longer needed to prevent spam; we review this annually.

We maintain online presences within social networks and platforms in order to communicate with active customers, interested parties and users and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and the privacy policy of their respective providers apply. Unless otherwise stated in our Privacy Policy, we will process the data of users who communicate with us within social networks and platforms, e.g. send us messages.

The links to social networks and platforms (hereinafter referred to as social media) used within our Online Service do not establish a data transmission between social networks and users until users click on the links and access the respective networks or their websites.

Social networks/platforms used by us: mastodon.social.

The controller for data processing on mastodon.social is generally Mastodon gGmbH (Germany).

The server on which this Online Service is hosted collects so-called log files each time the Online Service is accessed, in which user data is stored. The data is used for statistical analysis to maintain and optimise server operation and for security purposes, e.g. to detect potential unauthorised access attempts.

• Data processed: usage data and metadata (name of the accessed website, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user’s operating system, IP address).
• Special categories of personal data: none.
• Legal basis: Article 6 (1) f GDPR.
• Data subjects: customers, prospective customers, visitors of the Online Service.
• Purpose of processing: optimisation of server operation and security monitoring.
• Necessity / interest in processing: security, business interests.
• Processing in third countries: none.
• Deletion of data: deleted 28 days after collection.

We monitor servers and track errors to ensure the availability and integrity of our Online Service and use the data for technical and user-friendly optimisation.

• Data processed: aggregated performance data, in the event of an error or problem: pseudonymised requests (account ID).
• Special categories of personal data: none.
• Legal basis: Article 6 (1) f GDPR, Article 28 (3) sentence 1 GDPR.
• Data subjects: customers, users.
• Purpose of processing: server logging; server monitoring & error tracking.
• Type, scope and mode of operation of the processing: collected on our servers only; nothing is embedded in the website or browser, no cookies.
• Special security measures: no transmission of IP addresses.
• Necessity / interest in processing: security, efficiency of the Online Service.
• External disclosure and purpose: New Relic, Inc., Attn: Legal Department, 188 Spear Street, Suite 1200, San Francisco, CA 94105, provider of the services required to fulfil the purpose.
• Privacy policy: https://newrelic.com/termsandconditions/privacy.
• Processing in third countries: USA.
• Guarantee when processing in third countries: EU standard data protection clauses.
• Deletion of data: aggregated data: 3 months; pseudonymised data: 7 days.

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Cookies are small files that are stored on the user’s computer. Different data can be stored in the cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after his or her visit to a website. Temporary cookies or session cookies or transient cookies are cookies that are deleted after a user leaves a website and closes his or her browser. In such a cookie, for example, the login status can be stored. Cookies are referred to as permanent or persistent if they are stored even after the browser is closed. For example, the login status can be saved permanently.

Error tracking detects, for example, faulty program code so that it can be fixed, thus ensuring the functionality and security of online services.

Local storage is an area in the browser in which a website or web application can store data on the user’s device. Unlike cookies, this data is not automatically sent to the server with every request. It remains stored until the website or the user deletes it.

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person; e.g. if an exact interest profile of the computer user is stored in a cookie, but not the name of the user, then data is processed pseudonymously. If his or her name is stored (e.g. as part of an e-mail address) or the IP address is stored, the processing is no longer pseudonymous.

Data identifying racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data uniquely identifying a natural person, health data or data relating to a natural person’s sex life or sexual orientation.

Third countries are countries in which the GDPR is not directly applicable law, i.e. in general states that do not belong to the European Union (EU) or the European Economic Area (EEA).

Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Tracking refers to cases where the behaviour of users can be traced across several online services, e.g. for remarketing purposes. The behavioural and interest information collected with regard to the online services used is stored as user profiles in cookies or on the servers of marketing service providers (e.g. Google or Facebook).