Privacy Policy

This policy explains which personal data we process when you visit this website or contact us, why we process it, and which rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for data processing on this website is:

No data protection officer has been appointed, as none is required for this website.

2. What this website does not do

• It does not set cookies, and it uses no local storage.
• It uses no analytics, tracking, advertising or social media pixels.
• It embeds no third-party content. Fonts are served from our own server, so your browser makes no requests to font providers.
• It has no user accounts and no newsletter.

Personal data is processed only in two situations: technically, when your browser requests a page, and when you choose to contact us.

3. Hosting and access logs

This website is hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare serves the pages from its global network, from a data center close to you, and protects the site against attacks.

When you access a page, your browser automatically transmits technical data that Cloudflare processes on our behalf: your IP address, the date and time of the request, the page requested, the referring page if any, your browser type and version, your operating system, and the response status. When you submit the contact form, the function that handles it also writes technical logs (time, outcome and any error, without the content of your message).

Purpose and legal basis: this processing is necessary to deliver the website to your device, to keep it secure, and to detect and analyse faults and attacks. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in the secure and reliable operation of the site.

Retention: this data is kept only as long as needed for the purposes above and is then deleted automatically; the contact form's technical logs after a few days. Log data is not merged with other data about you.

Transfers: Cloudflare may process data in the United States. Transfers are safeguarded by Cloudflare's certification under the EU-U.S. Data Privacy Framework and by the EU standard contractual clauses included in our data processing agreement with Cloudflare.

4. Contact form and email

If you use the form on our contact page, we process the data you enter: your name, email address and company, the options you select about your focus, the kind of support you are looking for and your timeline, and the message you write.

Purpose and legal basis: we use this data solely to handle your inquiry, to respond to you, and, where applicable, to prepare an engagement. The legal basis is Article 6(1)(b) GDPR, steps taken at your request prior to entering into a contract, and Article 6(1)(f) GDPR, our legitimate interest in answering inquiries addressed to us.

Processing: your submission is handled by a function that runs on Cloudflare's network and is sent as an email via Cloudflare Email Service (Cloudflare, Inc., see section 3) to our mailbox, which is hosted by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as part of Google Workspace. Google may transfer data to the United States; such transfers are safeguarded by Google's certification under the EU-U.S. Data Privacy Framework and by the EU standard contractual clauses.

Spam protection: the form uses a hidden field that only automated submissions fill in, and a limit on the number of submissions per IP address within a short period. Cloudflare counts this limit for about a minute; the IP addresses used for it are not stored.

If you contact us directly by email, we process the data contained in your message on the same legal bases and for the same purposes.

Retention: we keep inquiries for as long as needed to handle them and any resulting business relationship, and delete them afterwards, unless we are legally required to retain them for longer.

5. Recipients and international transfers

The providers named above process data on our behalf as processors under Article 28 GDPR. We do not sell personal data and do not share it with third parties for their own purposes. Where data is transferred outside the European Economic Area, this happens only on the basis of an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework, or subject to appropriate safeguards, in particular the EU standard contractual clauses.

6. Links to other websites

This website links to external sites, including our documentation, LinkedIn and GitHub. When you follow such a link, the privacy policy of the respective operator applies. We have no influence on the processing carried out there.

7. Your rights

Under the GDPR you have the following rights with respect to your personal data:

• the right of access (Article 15),
• the right to rectification (Article 16),
• the right to erasure (Article 17),
• the right to restriction of processing (Article 18),
• the right to data portability (Article 20),
• the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) (Article 21).

To exercise these rights, contact us at contact@mechamental.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

8. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Article 22 GDPR.

9. Changes to this policy

We may update this policy when the website or the legal requirements change. The current version is always available at this address, with the date of the last update shown at the top.

See also our imprint.