mentalport privacy policy

Status: September 18, 2023
Table of contents
person responsible
Mentalport GmbH
Trippstadter Strasse 110
67663 Kaiserslautern

Responsible for data protection law: Tim Kleber

email address: kontakt@mentalport.de

Impressum: https://www.mentalport.health/imprint
Relevant legal bases
Relevant legal bases under the GDPR: The following is an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that, in addition to the regulations of the GDPR, national data protection requirements may apply in your or our country of residence or home. Should more specific legal bases also apply in individual cases, we will inform you of these in the privacy policy.
National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. This includes in particular the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act — BDSG). In particular, the BDSG contains special rules on the right to information, the right to deletion, the right of objection, the processing of specific categories of personal data, processing for other purposes and transmission and automated decision-making in individual cases, including profiling. In addition, state data protection laws of the individual federal states may apply.

Note on the validity of the GDPR and Swiss DSG: This data protection notice is intended both to provide information in accordance with the Swiss Federal Data Protection Act (Swiss DSG) and the Basic Data Protection Regulation (GDPR). For this reason, please note that the terms of the GDPR are used due to the wider geographical application and comprehensibility. In particular, instead of the terms “processing” of “personal data”, “overriding interest” and “particularly sensitive personal data” used in the Swiss DSG, the terms “processing” of “personal data” as well as “legitimate interest” and “special categories of data” are used. However, the legal meaning of the terms will continue to be determined in accordance with the Swiss DSG within the scope of the Swiss DSG.
Overview of processing
The following overview summarizes the types of data processed and the purposes of their processing and refers to the persons concerned.
Types of data processed
Categories of affected persons
Purposes of processing
Safety measures
In accordance with legal requirements, taking into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing as well as the different chances of occurrence and the extent of the threat to the rights and freedoms of natural persons, we take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

The measures include in particular ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access, input, transfer, availability and separation of data relating to it. We have also set up procedures that ensure the exercise of data subject rights, deletion of data and responses to data risks. We also take the protection of personal data into account when developing or selecting hardware, software and processes in accordance with the principle of data protection, through technology design and through privacy-friendly default settings.

TLS encryption (https): To protect your data transmitted via our online offering, we use TLS encryption. You can recognize such encrypted connections by the prefix https://in the address bar of your browser.
International data transfers
Data processing in third countries: If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place as part of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this is only done in accordance with legal requirements. If the level of data protection in the third country has been recognized by means of an adequacy decision (Art. 45 GDPR), this serves as the basis for data transfer. In addition, data transfers only take place if the level of data protection is otherwise ensured, in particular by standard contractual clauses (Art. 46 para. 2 lit. c) GDPR), express consent or, in the case of contractual or legally required transfer (Art. 49 para. 1 GDPR). In addition, we will provide you with the principles of third-country transfers with the individual providers from the third country, with the appropriate decisions taking priority as the basis. Information on transfers to third countries and existing adequacy decisions can be found in the information offered by the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de.

EU-US Trans-Atlantic Data Privacy Framework: As part of the so-called “Data Privacy Framework” (DPF), the EU Commission has also recognized the level of data protection as secure for certain companies from the USA as part of the adequacy decision of 10.07.2023. The list of certified companies and further information about the DPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ Remove (in English). As part of the data protection policy, we will inform you which service providers we use are certified under the Data Privacy Framework.
Deletion of data
The data processed by us will be deleted in accordance with legal requirements as soon as their consent permitted for processing is withdrawn or other permits no longer apply (e.g. if the purpose of processing this data has ceased to apply or they are not necessary for the purpose). Unless the data is deleted because it is necessary for other and legally permitted purposes, its processing will be limited to these purposes. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be stored for commercial or tax reasons or whose storage is necessary to assert, exercise or defend legal claims or to protect the rights of another natural or legal person. Our data protection information may also contain further information on the storage and deletion of data, which applies primarily to the respective processing operations.
Rights of data subjects
Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 GDPR:
Use of cookies
Cookies are small text files or other memory notes that store information on end devices and read information from the end devices. For example, to save the login status in a user account, a shopping cart content in an e-shop, the content accessed or functions used on an online offer. Cookies can also be used for various purposes, e.g. for the purpose of the functionality, security and convenience of online offers and the preparation of analyses of visitor flows.

Cookie management service used: https://finsweet.com/cookie-consent

Information on consent: We use cookies in accordance with legal requirements
Set regulations. We therefore obtain prior consent from users, unless this is required by law. Consent is in particular
re not necessary if saving and reading out the information, i.e.
including cookies, are absolutely necessary to give users one of them
expressly requested telemedia service (i.e. our online offer) available
to make a statement. Strictly necessary cookies usually include cookies
Kick with functions that improve the display and operability of the online offer, the
load balancing, security, saving preferences and selection options
Features of users or similar with the provision of the main and secondary
relate to the functions of the online offer requested by users-
serve the purposes. The revocable consent is given to users
Clearly communicates and contains the information about the respective cookie
Zung.

Information on legal bases of data protection law: The legal basis on which data protection law we process users' personal data using cookies depends on whether we ask users for consent. If users consent, the legal basis for processing their data is their declared consent. Otherwise, the data processed using cookies will be processed on the basis of our legitimate interests (e.g. in operating our online offer and improving its usability) or, if this is done as part of fulfilling our contractual obligations, if the use of cookies is necessary to fulfill our contractual obligations. We will explain the purposes for which we process cookies in the course of this privacy policy or as part of our consent and processing processes.

Storage period: With regard to storage time, the following types of cookies are differentiated:
General information on withdrawal and objection (so-called “opt-out”): Users can withdraw their consent at any time and object to processing in accordance with legal requirements. For this purpose, users can, among other things, restrict the use of cookies in their browser settings (although this may also restrict the functionality of our online offering). You can also object to the use of cookies for online marketing purposes via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/ be explained.
Further information on processing processes, procedures and services:
Business services
We process data from our contract and business partners, e.g. customers and interested parties (collectively referred to as “contractual partners”) within the framework of contractual and comparable legal relationships and related measures and as part of communication with the contractual partners (or pre-contractual), e.g. to answer inquiries.

We process this data to fulfill our contractual obligations. In particular, this includes obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other performance problems. In addition, we process the data to maintain our rights and for the purpose of administrative tasks associated with these obligations and business organization. In addition, we process the data on the basis of our legitimate interests in proper and business management as well as in security measures to protect our contractual partners and our business operations from misuse, risk of their data, secrets, information and rights (e.g. to involve telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the framework of applicable law, we only pass on the data of contract partners to third parties to the extent necessary for the above purposes or to fulfill legal obligations. Contractual partners will be informed about other forms of processing, e.g. for marketing purposes, as part of this privacy policy.

We will inform the contract partners which data is required for the above purposes before or as part of data collection, e.g. in online forms, through special identification (e.g. colors) or symbols (e.g. asterisks, etc.), or personally.

We delete the data after expiry of legal warranty and comparable obligations, i.e., in principle after 4 years, unless the data is stored in a customer account, e.g. as long as it must be kept for legal archiving reasons. The legal storage period is ten years for tax-relevant documents as well as for commercial books, inventories, opening balance sheets, annual financial statements, the work instructions and other organizational documents and accounting documents required to understand these documents and six years for commercial and business letters received and reproductions of the commercial and business letters sent. The period begins at the end of the calendar year in which the last entry in the book was made, the inventory, the opening balance sheet, the annual financial statements or the management report was prepared, the commercial or business letter was received or sent or the accounting document was created, the recording was made or the other documents were created.

Insofar as we use third-party providers or platforms to provide our services, the business conditions and data protection notices of the respective third-party providers or platforms apply in the relationship between users and providers.
Further information on processing processes, procedures and services:
Vendors and services used in the course of business
As part of our business activities, we use additional services, platforms, interfaces or plug-ins from third-party providers (“services” for short) in compliance with legal requirements. Their use is based on our interests in the orderly, lawful and legally secure performance of our services.
Provision of online services and web hosting
We process users' data in order to be able to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transfer the content and functions of our online services to the user's browser or device.
Further information on processing processes, procedures and services:
Blogs and publication media
We use blogs or comparable means of online communication and publication (hereinafter “publication medium”). Readers' data is processed for the purposes of the publication medium only to the extent that it is necessary for its presentation and communication between authors and readers or for security reasons. In addition, we refer to the information on the processing of visitors to our publication medium within the framework of this data protection policy.
Contact and request management
When contacting us (e.g. by post, contact form, e-mail, telephone or via social media) and within the framework of existing user and business relationships, the information provided by the inquiring persons will be processed insofar as this is necessary to answer the contact requests and any requested measures.
Further information on processing processes, procedures and services:
Newsletters and electronic notifications
We only send newsletters, emails and other electronic notifications (hereinafter “newsletters”) with the consent of the recipients or legal permission. If the content of the newsletter is specifically described as part of a subscription to the newsletter, they are decisive for the consent of the users. In addition, our newsletters contain information about our services and us.

In order to subscribe to our newsletters, it is generally sufficient if you
Provide your email address However, we may ask you to provide a name in order to address you personally in the newsletter, or further information, provided that this is for
purposes of the newsletter are necessary to carry out.

Double opt-in process: In principle, registration for our newsletter takes place in a so-called double opt-in procedure. This means that after signing up, you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can log in with foreign email addresses. Subscriptions to the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes saving the time of registration and confirmation as well as the IP address. Changes to your data stored with the shipping service provider are also logged.

Deletion and restriction of processing: We can store the unsubscribed email addresses for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of possible defense against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. In the event of obligations to permanently comply with objections, we reserve the right to store the email address in a blocked list (so-called “block list”) for this purpose alone.

The registration process is logged on the basis of our legitimate interests for the purpose of proving that it has been completed correctly. Where we engage a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure delivery system.
Content:
Information about us, our services, promotions and offers.
Further information on processing processes, procedures and services:
Promotional communication via e-mail, post, fax or telephone
We process personal data for the purposes of advertising communication, which can be carried out via various channels, such as e-mail, telephone, post or fax, in accordance with legal requirements.

Recipients have the right to withdraw their consent at any time or to object to promotional communication at any time.

After revocation or objection, we will store the data required to prove previous authorization to contact or send you information for up to three years after the end of the year of withdrawal or objection on the basis of our legitimate interests. The processing of this data is limited to the purpose of possible defense against claims. On the basis of the legitimate interest in permanently observing the user's revocation or objection, we also store the data required to avoid being contacted again (e.g. email address, telephone number, name, depending on the communication channel).
Web analysis, monitoring and optimization
Web analysis (also known as “reach measurement”) is used to evaluate the flow of visitors to our online offering and may include behavior, interests or demographic information about visitors, such as age or age, as pseudonymous values. With the help of reach analysis, we can, for example, identify at what time our online offering or its functions or content are used most frequently or invite them to be reused. We can also understand which areas need optimization.

In addition to web analysis, we can also use test methods to test and optimize different versions of our online offering or its components, for example.

Unless otherwise stated below, profiles, i.e. data summarized about a usage process, can be created for these purposes and information can be stored in a browser or in a terminal device and read from it. The information collected includes in particular websites visited and elements used there, as well as technical information, such as the browser used, the computer system used and information on usage times. If users have agreed to the collection of their location data with us or with the providers of the services we use, location data may also be processed.

The IP addresses of users are also stored. However, we use an IP masking process (i.e. pseudonymization by shortening the IP address) to protect users. In general, as part of web analysis, A/B testing and optimization, no clear user data (such as email addresses or names) is stored, but pseudonyms. This means that we as well as the providers of the software used do not know the actual identity of the users, but only the information stored in their profiles for the purpose of the respective processes.
Further information on processing processes, procedures and services:
Presences on social networks (social media)
We maintain online presences within social networks and, within this framework, process user data in order to communicate with users active there or to offer information about us.


We would like to point out that user data may be processed outside the area of the European Union. This may result in risks for users because, for example, it could make it more difficult to enforce users' rights.

Furthermore, user data within social networks is usually processed for market research and advertising purposes. For example, user profiles can be created based on user behavior and the resulting interests of users. The user profiles can in turn be used, for example, to place advertisements within and outside the networks that correspond to the presumed interests of the users. For these purposes, cookies are usually stored on users' computers, in which user behavior and interests are stored. In addition, data can also be stored in the usage profiles regardless of the devices used by the users (in particular if the users are members of the respective platforms and are logged in to them).

For a detailed description of the respective forms of processing and the options for objection (opt-out), we refer to the data protection declarations and information provided by the operators of the respective networks.

Even in the case of requests for information and the assertion of data subject rights, we would like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can directly take appropriate measures and provide information. Should you still need help, you can contact us.
Further information on processing processes, procedures and services:
Plug-ins and embedded features and content
We integrate functional and content elements into our online offering, which are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos or city maps (hereinafter uniformly referred to as “content”).

Integration always requires that the third-party providers of this content process the users' IP addresses, as they would not be able to send the content to the browser without the IP address. The IP address is therefore required to display these contents or functions. We make every effort to only use content whose respective providers only use the IP address to deliver the content. Third parties can also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information, such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on the user's device and contain, among other things, technical information about the browser and operating system, referring websites, the time of visit and further information on the use of our online offering, as well as be linked to such information from other sources.
Further information on processing processes, procedures and services:
Created with free Datenschutz-Generator.de by Dr. Thomas Schwenke
mentalport logo | one stop shop for corporate mental health
Contact
Do you have any questions or would you like get in touch?
+49 631 20691829
hi@mentalport.health
navigation
SolutionsROI checkZero-tariff modelTry it for freeROI checkPricingResourcesResourcesFor coaches
Thank you! Your submission has been received!
Yikes! Something went wrong while submitting the form.
Or discover our live events
Twice a month: Live insights, practical examples and strategies related to mental wellbeing, compliance & ROI. Participate free of charge, immediately have more insight.
Sign up now for free
Copyright © YEAR Mentalport GmbH.
mentalport is not suitable in acute psychological and medical crisis or emergency situations. Please contact your doctor or a crisis hotline such as telephone counseling immediately at 0800 111 0 111 or 0800 111 0 222 (telefonseelsorge.de).

By clicking “Accept,” you agree to the storage of cookies on your device to improve website navigation, analyze site usage, and support our marketing efforts. You can find more information in our privacy policy.

Select your preferencesRejectaccepting
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Preferences