This is a convenience translation. Only the German version is legally binding.
1. Data protection at a glance
General information
The following information provides a simple overview of what happens to your personal data when you visit this website or contact us. Personal data is any data that can be used to identify you personally.
Key points at a glance
- This website sets no cookies and uses no analytics, tracking or advertising tools (no Google Analytics, no Google Tag Manager, no advertising pixels). That is why there is no cookie banner.
- Fonts are loaded from our own server. When you open a page, there is no connection to Google Fonts or other third-party providers.
- The contact form only transmits the information you enter yourself. We use it exclusively to answer your enquiry.
- For email, scheduling and video calls we use Google Workspace (Gmail, Google Calendar, Google Meet), and WhatsApp for short exchanges.
Who is responsible?
The two owners of Mevia Solutions are responsible. You will find their contact details below under “Controller”.
What rights do you have?
You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You can also request the rectification or erasure of this data, withdraw any consent you have given and, under certain circumstances, request the restriction of processing. You also have the right to lodge a complaint with the competent supervisory authority. Details can be found in section 3.
2. Hosting
This website is hosted by Netlify. The provider is Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA (“Netlify”).
When you visit our website, Netlify processes the technically necessary data on its servers (see “Server log files” in section 4). Netlify does not set any cookies when you access our website.
Netlify is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in providing our website as reliably and securely as possible.
Netlify is certified under the EU-US Data Privacy Framework (DPF). Transfers to the USA are based on the European Commission’s adequacy decision (Art. 45 GDPR) and additionally on the European Commission’s standard contractual clauses. Further information: Netlify privacy policy.
Data processing agreement
We have concluded a data processing agreement (DPA) with Netlify. It ensures that Netlify processes our website visitors’ personal data only in accordance with our instructions and in compliance with the GDPR.
3. General information and mandatory information
Data protection
We take the protection of your personal data very seriously and treat it confidentially and in accordance with the statutory data protection regulations and this privacy policy. Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.
Controller
The joint controllers for data processing on this website are:
Sebastian Grossmann
Mevia Solutions
Am Panke-Park 55
16325 Bernau bei Berlin
Germany
Dávid Szandtner
Mevia Solutions
Schäftlarnstr. 135
81371 München
Germany
Email: hallo@mevia.solutions
You can exercise your rights against either of us. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
Storage period
Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for processing no longer applies. If you assert a justified request for erasure or withdraw your consent, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in that case, deletion takes place once these reasons no longer apply.
Legal bases
If your data is required to perform a contract or to take pre-contractual steps, we process it on the basis of Art. 6(1)(b) GDPR. To comply with legal obligations, we process data on the basis of Art. 6(1)(c) GDPR, and otherwise on the basis of our legitimate interest under Art. 6(1)(f) GDPR. If you have consented to processing, the legal basis is Art. 6(1)(a) GDPR; consent can be withdrawn at any time. The relevant legal basis in each case is stated in the following sections.
Recipients of personal data
We only pass on personal data to external bodies if this is necessary to perform a contract, if we are legally obliged to do so (e.g. to tax authorities), if we have a legitimate interest under Art. 6(1)(f) GDPR or if another legal basis permits the disclosure. We only use service providers that process data on our behalf (Netlify, Google) on the basis of a data processing agreement.
Withdrawal of your consent
You can withdraw any consent you have given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected.
Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)
If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right at any time to object to the processing of your personal data on grounds relating to your particular situation; this also applies to profiling based on these provisions. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims (Art. 21(1) GDPR).
If your personal data is processed for direct marketing purposes, you have the right to object at any time to processing for this purpose. Your data will then no longer be used for direct marketing (Art. 21(2) GDPR).
Right to lodge a complaint with the competent supervisory authority
In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authorities responsible for us are the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht) and the Brandenburg State Commissioner for Data Protection and the Right to Inspect Files. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. Direct transfer to another controller only takes place where technically feasible.
Access, rectification and erasure
Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing, and, where applicable, a right to rectification or erasure of this data.
Right to restriction of processing
You have the right to request the restriction of the processing of your personal data, in particular
- while we verify the accuracy of data that you dispute,
- if the processing was unlawful and you request restriction instead of erasure,
- if we no longer need your data but you need it to exercise, defend or establish legal claims,
- as long as, following an objection under Art. 21(1) GDPR, it has not yet been determined whose interests prevail.
Apart from being stored, restricted data may only be processed with your consent, to establish, exercise or defend legal claims, to protect the rights of another person or for reasons of important public interest.
SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, such as your enquiries via the contact form, this site uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in the address bar and the padlock symbol in your browser.
Objection to advertising emails
We hereby object to the use of the contact details published under the legal notice obligation for sending advertising and information material that we have not expressly requested. We expressly reserve the right to take legal action in the event of unsolicited advertising, for example by spam email.
4. Data collection on this website
Cookies
This website does not set cookies and does not access information on your device that is not strictly necessary for its operation. Consent under § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) is therefore not required.
Server log files
Our host Netlify automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are:
- browser type and version
- operating system used
- referrer URL
- address accessed
- date and time of the server request
- IP address
This data is not merged with other data sources. It is collected on the basis of Art. 6(1)(f) GDPR; we have a legitimate interest in providing our website securely and without technical errors.
Contact form
When you submit the contact form on our home page, you transmit the selected topics, your name and your email address and, voluntarily, your practice, phone number and message. The form is processed via our host’s Netlify Forms service and stored there; we also receive the enquiry by email in our Google Workspace mailbox. A hidden field protects against spam; no cookies are set for this. Please do not send any patient data via the form.
Processing is based on Art. 6(1)(b) GDPR if your enquiry is related to a contract or is necessary to take pre-contractual steps, and otherwise on our legitimate interest in handling enquiries effectively (Art. 6(1)(f) GDPR). The data remains with us until you ask us to delete it or the purpose no longer applies (e.g. once your enquiry has been dealt with). Statutory retention periods remain unaffected.
Enquiries by email or phone
If you contact us by email or phone, we process your enquiry, including the resulting personal data (name, contact details, content of the enquiry), in order to deal with your request. We do not pass this data on without your consent. The legal bases and storage period are the same as for the contact form.
5. Communication, appointments and video calls
Google Workspace
For email (Gmail), scheduling (Google Calendar) and video calls (Google Meet) we use Google Workspace. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
When you write to us, arrange an appointment with us or take part in a video call, your data is processed on Google’s servers. This includes in particular your name, your email address, the content of your messages, appointment data and, for video calls, technical connection data (e.g. IP address, device and browser information), the start and end of your participation and the content shared in the call. We do not record video calls without your express consent.
Google Workspace is used on the basis of Art. 6(1)(b) GDPR where it concerns initiating or performing a contract, and otherwise on the basis of our legitimate interest in simple and fast communication (Art. 6(1)(f) GDPR).
Data may also be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework (DPF); transfers are based on the European Commission’s adequacy decision and additionally on the standard contractual clauses. Further information: Google’s DPF certification and Google privacy policy.
We have no influence on how long Google stores data for its own purposes. We delete the data we store ourselves as soon as the purpose no longer applies and no statutory retention periods prevent this.
Data processing agreement
We have concluded a data processing agreement (DPA) with Google for Google Workspace. It ensures that Google processes personal data only in accordance with our instructions and in compliance with the GDPR.
Among other channels, we use the messaging service WhatsApp to communicate with clients, prospective clients and business partners. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Communication is end-to-end encrypted, so neither WhatsApp nor other third parties can access the content. However, WhatsApp has access to metadata generated during communication (e.g. sender, recipient and time). According to its own statements, WhatsApp shares its users’ personal data with its US-based parent company Meta. Further information: WhatsApp privacy policy. Please do not send us any patient data via WhatsApp.
WhatsApp is used on the basis of our legitimate interest in communication that is as fast and straightforward as possible (Art. 6(1)(f) GDPR). The content exchanged remains with us until you ask us to delete it or the purpose no longer applies (e.g. once your enquiry has been dealt with); statutory retention periods remain unaffected.
Meta is certified under the EU-US Data Privacy Framework (DPF). Further information: Meta’s DPF certification.
6. Links to LinkedIn and other websites
On our website we link to our company profile on LinkedIn (provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). These are simple links, not embedded plugins: no data is transferred to LinkedIn when you visit our website. Only when you click the link does the LinkedIn page open, and the LinkedIn privacy policy applies.
Our guides also link to sources from other providers. Here too, data is only transferred when you click a link; the respective provider’s privacy policy then applies.
7. Fonts
The fonts used on this website are stored locally on our server. No connection to Google or other font providers is established when you open a page.
8. Client and contract data
If you commission us, we process the client and contract data required to establish, perform and invoice our contractual relationship (Art. 6(1)(b) GDPR). We delete this data after completion of the assignment or the end of the business relationship and expiry of the statutory retention periods. We do not need any patient data for our consulting; we process practices’ financial data only to the extent required by the respective assignment.
9. No automated decision-making
We do not make automated decisions or carry out profiling.