Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR; German: Datenschutz-Grundverordnung, DSGVO) is:

MEVIO GmbH
Salzgasse 143
86899 Landsberg am Lech
represented by the Managing Director Verena Tauscher-Köstler
Phone: 08191 3318100
Email: info@mevio-mess.de

2. Contact person for data protection

For questions about data protection and to exercise your rights, please contact Ms Verena Tauscher-Köstler using the contact details above.

No data protection officer has been appointed, as the legal requirements for a mandatory appointment under Art. 37 DSGVO and § 38 of the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) are not met.

3. Processing when you visit the website

Server log files

When you access this website, the hosting provider automatically collects information that your browser transmits. This is:

• IP address of the requesting device
• date and time of access
• name and URL of the file accessed
• amount of data transferred and notification of successful retrieval
• browser type, browser version and operating system used
• previously visited page (referrer), if transmitted

Processing takes place on the basis of Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest lies in the secure and trouble-free operation of the website and in investigating and fending off attacks. This data is not combined with other data sources. The log files are only stored for as long as is necessary to ensure security, analyse errors and prevent misuse; no fixed period has been agreed with the hosting provider. They are then deleted, unless a specific security incident requires longer retention for investigation.

Connection to the application server

So that the contact form works, your browser establishes an encrypted connection to our application server (backend) when you open the page. For technical reasons, your IP address is transmitted to the operator of the backend (see section 4). No usage profiles are created. The legal basis is Art. 6 Abs. 1 lit. f DSGVO; our legitimate interest lies in providing a working means of contact.

No cookies, no analytics, no tracking

This website does not set any cookies that are not required for its operation. No web analytics services, advertising networks or social media plugins are used. Consent under § 25 of the Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) is therefore not required; for the same reason, no cookie banner is displayed.

Fonts

The font used is delivered from our own server. When you open the page, no connection is made to servers of Google or other third-party providers, and no IP address is transmitted to third parties.

Encryption

This website uses transport encryption (TLS). You can recognise this by the address bar of your browser, which begins with “https://”.

4. Hosting and technical service providers

Website platform

This website is created, operated and hosted using the Macaly platform. The provider is LANGTAIL.COM s.r.o., Záhřebská 562/41, Vinohrady, 120 00 Prague 2, Czech Republic (registered in the commercial register of the Municipal Court in Prague under C 393016). Macaly processes the data exclusively on our behalf and in accordance with our instructions. This is based on a data processing agreement under Art. 28 DSGVO, which forms part of Macaly’s terms of use.

Sub-processors

To operate this website, Macaly uses in particular the following sub-processors:

• Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA — hosting and delivery of the pages via a content delivery network; the data listed under “Server log files” is processed in this context.
• Convex, Inc., USA — application server and database in which contact enquiries and the form’s security challenges are stored. The data is held in a data centre in the European Union (Ireland).
• Resend (Astrodon Corporation), USA — sending the email notification of incoming contact enquiries; the details entered in the form are transmitted in this context.

Macaly publishes the complete list of sub-processors in its data processing agreement at macaly.com/dpa.

5. Contact form

You can send us an enquiry using the contact form on the home page. The details you enter are processed: name, email address and — if provided — phone number, property name, number of residential and commercial units and the text of your message. Name, email address and message are mandatory; without them we cannot answer the enquiry.

The legal basis is Art. 6 Abs. 1 lit. b DSGVO where the enquiry is aimed at concluding or performing a contract, and otherwise Art. 6 Abs. 1 lit. f DSGVO on the basis of our legitimate interest in answering enquiries.

The enquiry is sent to us by email and also stored in our database so that no enquiry is lost. We delete the data as soon as the matter has been finally resolved and no statutory retention obligations prevent this. For business correspondence, the retention periods under commercial and tax law of six and ten years respectively apply.

Protection against automated submissions (ALTCHA)

To protect the form against misuse by automated programs, we use the open-source software ALTCHA, which we run ourselves on our application server. When you confirm the check, your browser receives a signed calculation task (proof of work) from our server, solves it in the background and sends the result back with the form; our server checks the solution. In addition, the form contains a field that is invisible to you and is only filled in by automated programs.

No third-party service is integrated. No cookies are set, no usage profiles are created and your behaviour or device is not matched in any way. The legal basis is Art. 6 Abs. 1 lit. f DSGVO; our legitimate interest lies in protecting our systems against misuse. So that a solved task cannot be used more than once, we store its signature. It contains no personal reference and is automatically deleted after two hours at the latest.

6. Contacting us by email or phone

If you contact us by email or phone, we process the details you provide solely to deal with your request. The legal bases and deletion periods are the same as for the contact form.

7. Quote requests and documents sent to us

If you request a quote for a property, we process the details provided for this purpose — such as the property address, the number of residential and commercial units and a previous year’s statement sent to us — to prepare the quote. The legal basis is Art. 6 Abs. 1 lit. b DSGVO.

If documents you send contain personal data of users of the property, please redact this data before sending. Consumption and cost totals without names are sufficient for preparing a quote.

8. Recipients of data and transfers to third countries

Your data is only passed on to the extent necessary to fulfil the respective purpose. Recipients may be: the service providers named in section 4 as well as tax advisers and auditors in the context of statutory obligations.

Macaly is based in the European Union. The sub-processors Vercel, Convex and Resend are based in the USA; processing there is therefore possible, in the case of Convex for example through access for maintenance purposes, even though the data is stored in the EU. In the data processing agreement, Macaly has undertaken to carry out such transfers only on the basis of a suitable transfer mechanism under Chapter V DSGVO:

• Vercel Inc. is certified under the EU-US Data Privacy Framework. The transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 DSGVO).
• Convex, Inc. is not certified under the EU-US Data Privacy Framework. For Convex and for Resend, the transfer is based on the European Commission’s standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO), where no certification exists.

9. Your rights

You have the following rights with respect to us:

• access to the data processed about you (Art. 15 DSGVO)
• rectification of inaccurate or incomplete data (Art. 16 DSGVO)
• erasure, unless there is a reason for retention (Art. 17 DSGVO)
• restriction of processing (Art. 18 DSGVO)
• data portability (Art. 20 DSGVO)
• objection to processing based on legitimate interests (Art. 21 DSGVO)
• withdrawal of consent given, with effect for the future (Art. 7 Abs. 3 DSGVO)

To exercise these rights, an informal message to the contact details above is sufficient.

10. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 DSGVO). The authority responsible for us is the Bavarian State Office for Data Protection Supervision:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach

11. Processing as part of the metering service

This policy applies exclusively to visits to this website and to contacting us through the channels named here.

Separate information applies to the consumption data that we record and bill as part of an existing contract. The controller for this processing is usually the building owner or the owners’ association (Wohnungseigentümergemeinschaft); MEVIO acts as a processor under Art. 28 DSGVO. Informing the users under Art. 13 and 14 DSGVO is the responsibility of the controller. We can provide a standard text for this on request.

12. Changes to this policy

We will adapt this privacy policy as soon as the processing described or the legal situation changes. The version available on this page applies in each case.