Data Act information

We run our SaaS products only in data centres in the European Union. The servers are located in Germany and are subject to German law and the law of the European Union; backups stored in Finland are also subject to Finnish law.

MITA Base

Servers: Nuremberg (Germany), Hetzner Online GmbH. Backups: Falkenstein (Germany), Hetzner Online GmbH; encrypted before transfer.

Passfest

Servers: Falkenstein (Germany), Hetzner Online GmbH. Backups: Helsinki (Finland), Hetzner Finland Oy; encrypted before transfer.

We store customer data only in data centres in the European Union with a provider established in the Union. We comply with requests from authorities of third countries only if they are based on an international agreement or the conditions of Art. 32 Data Act are met. We examine every request, disclose only the minimum and inform the customer beforehand where the law allows.

• Technical: encryption in transit and on the storage media of the production systems; backups are encrypted before transfer.
• Contractual: we use sub-processors only under the rules of the data processing agreement.

The customer may at any time request in text form to switch to another provider or to its own IT infrastructure, to have its data transferred, or to have it deleted. The procedure under § 7 of the SaaS contract:

1. Notice period: at most two months from receipt of the request. By then the customer names the target: another provider, its own infrastructure, or deletion.
2. Transitional period: 30 calendar days during which the contract continues and we support the switch. The customer may extend it once. If the period is technically not feasible, we say so with reasons within 14 working days and name a period of at most seven months.
3. Export: in a structured, commonly used and machine-readable format. Which data and digital assets are exported, in which format, and what is excluded is listed exhaustively in the SaaS contract (§ 7 (1)). We provide all information on data structures, formats and interfaces relevant to the switch as part of the exit strategy (§ 7 (4)).
4. Retrieval and deletion: after the transitional period the exportable data remain available for retrieval for 30 calendar days; we then delete them under § 7 (7) of the SaaS contract.

We charge nothing for the switch or the data export. The agreed usage fee runs until the contract ends. If a contract ends because of a switch before an agreed minimum term has expired, we charge a lump-sum compensation of three monthly fees, at most the fee for the remaining minimum term; the customer may prove that we suffered no loss or a substantially lower one. Fees paid in advance for the time after that are refunded within 30 days.

Questions about switching or data export: [email protected].