Privacy Policy
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is: Etmita UG (haftungsbeschränkt) Nieder Straße 10 65795 Hattersheim am Main Deutschland Represented by managing director Mohammad Ghadery. Email: info@mitabase.com
We have not currently appointed a data protection officer. Please address privacy enquiries to the email address above.
2. Principles
We process personal data only to the extent required to provide a functional website and our content and services. Data minimisation applies: this website sets no tracking cookies and uses no ad networks and no third-party CDNs; fonts are served from our own server (no connection to Google Fonts).
3. Hosting and server log files
This website is operated in a data centre in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider. Personal data is not transferred to third countries outside the EU/EEA.
When the website is accessed, the server automatically processes technical access data: IP address, date and time of access, requested resource, transferred data volume, referrer URL and user agent. This log data serves solely operational and attack security (legal basis: Art. 6 (1) (f) GDPR) and is deleted as soon as it is no longer required for these purposes, unless a security-relevant incident requires longer retention. It is not merged with other data sources.
4. Cookies and consent management
We use technically necessary cookies or comparable storage technologies on the basis of § 25 (2) TDDDG; in particular the cookie that stores your consent decision. Non-essential technologies would be loaded only after your explicit consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR); currently no such technology is in use (see section 5).
This website sets one cookie: “mb_consent” stores your decision in the cookie banner (lifetime six months). Only if you allow “Convenience” in the cookie banner does it also read the “mb_who” cookie, which a customer's MitaBase installation sets after you sign in there, and greet you by name; your profile picture is then loaded from that installation (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). This website never sets “mb_who” itself. Your language follows from the page address; no cookie is set for it. You can change your choice or withdraw it with effect for the future at any time under “Cookies” in the website footer.
5. No web analytics
No web analytics or tracking service is currently in use on this website. No analytics scripts are loaded, no tracking cookies are set and no visit data is transmitted to third parties.
Should we introduce audience measurement in the future, it will be designed in a privacy-friendly way (no tracking cookies, no cross-device profiles), loaded only after your prior consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), and the service used will be named here beforehand.
6. Contact form
Data from the contact form (name, email address, topic, message) is used exclusively to process your enquiry (Art. 6 (1) (b) GDPR where your enquiry concerns a contract with us, otherwise Art. 6 (1) (f) GDPR). The details are not stored on the web server; they are transmitted directly by email to our inbox and kept only as long as handling your request requires. No sharing with third parties, no newsletter without separate consent.
To protect against automated submissions we use an invisible form field (honeypot) and request-rate limiting; the IP address is held in memory for no more than ten minutes (Art. 6 (1) (f) GDPR) and is not stored permanently.
7. Email communication
If you contact us by email, we process your details to handle the enquiry and for any follow-up questions (Art. 6 (1) (b) or (f) GDPR). Emails are deleted once they are no longer required for the purpose, provided no statutory retention obligations (§ 257 HGB, § 147 AO) apply.
8. MitaBase as SaaS: processing on behalf of customers
When our customers use the MitaBase software, we process personal data, including special categories under Art. 9 GDPR (e.g. trip destinations with a medical context, prescriptions), exclusively as a processor on behalf of and under the instructions of the respective customer. The basis is a data processing agreement pursuant to Art. 28 (3) GDPR. We conclude it with the customer in text form before we process any personal data on its behalf.
Technical and organisational measures include in particular: encryption in transit and at rest, access rights by role enforced on the server, a log of working-time and money entries that cannot be trimmed, and a separate installation with its own database for each customer. All production data is processed exclusively in data centres in Germany, except for the notifications via Apple and Google named in section 10 and a Google Sheet the customer connects themselves.
9. The MitaBase Driver app
This section applies to the “MitaBase Driver” app for iOS and Android, published by Etmita UG (haftungsbeschränkt). The app is the working tool of drivers at medical-transport companies that use MitaBase. It works only with an account the company creates for you; nobody can open an account inside the app. The app connects to your company's MitaBase installation (an address of the form company-code.app.mitabase.com) and to our server app.mitabase.com, which maps the company code to that address and serves the map tiles.
The controller for the data created when you use the app is the company that gave you access (Art. 4 (7) GDPR), usually your employer or client. We process this data on its behalf and under its instructions as a processor (Art. 28 GDPR, see section 8). The company determines the legal basis. The main candidates are Art. 6 (1) (b) GDPR (employment or service relationship), (c) (legal obligations such as recording working time and keeping receipts) and (f) (dispatching rides, evidence towards payers), and for health data additionally a basis under Art. 9 (2) GDPR. Please address requests about your data to your company first. You may also contact us (section 1); we will forward your request to the company without delay.
9.1 Sign-in and account
To sign in you enter your company's company code. The app sends it to app.mitabase.com and receives the installation's address and the company's name. Your IP address is processed briefly in memory to limit the number of requests. You then sign in with the email address and password your company set up for you. The installation stores the password only as a hash. The app receives a sign-in token valid for 7 to 90 days depending on the company's setting (30 days by default).
For your account the installation keeps your name, role (driver or co-driver), the assigned vehicle, your language and the time of your last sign-in. You can enter and change your phone number, address, date of birth and profile picture in the app yourself. If you use “Passwort vergessen” (forgot password), you receive a temporary password by email; the company sees that one was requested.
If you turn on unlocking with Face ID, Touch ID or a fingerprint, only the operating system checks your biometric feature. The app receives only the result “recognised” or “not recognised”, never biometric data.
9.2 Location
The app reads your location only if you have allowed it in the operating system, and only in the following three cases. Without that permission, rides, clocking and the cash desk keep working.
Clocking: when you clock in, start and end a break, and clock out, the app records your location once (coordinates and accuracy) while it is open. It is stored with the time entry as evidence of working time and kept as long as the working-time record: two years by default (§ 16 (2) ArbZG), which the company may extend.
Navigation and address search: when you start navigation or search for an address, the app sends your current location to the routing and address service of your company's installation. This service runs on our own servers in Germany; no map or routing service of another provider is used. Calculated routes are cached for 30 minutes.
Live location: only if you have confirmed “Position teilen” (share position) in the app does it send the vehicle's position to your company's installation during an open shift, so that dispatch can see the vehicle on its map. The company can limit this to running rides. The transfer continues in the background, i.e. when the app is not open or the phone is locked. The app sends coordinates, accuracy, speed, heading and time, and during navigation also the remaining time and distance of the ride, at short intervals (every five seconds by default). On iPhone the system shows its location indicator meanwhile, on Android a persistent notification. Clocking out and signing out end the transfer at once. If the vehicle has an active GPS unit installed, the phone does not send.
You can stop sharing at any time: in the app under “Mehr” (more) on the “Live-Standort” card, or by withdrawing the app's location permission in the phone's settings. You still see your rides. The app stores no location history on the phone. The installation shows only the trail of the last few minutes, 5 to 60 minutes depending on the company's setting (15 by default); older points are discarded continuously. Only the calculated arrival time and the time of arrival remain recorded on the ride. If such a trail is in the system at the time of the backup (every 24 hours), it is contained in the encrypted backup and disappears when that backup expires (section 9.8).
9.3 Camera and photos
The app uses the camera and photo library only when you take or choose a photo yourself, and then only that one picture. Photos are taken of: the transport prescription (Verordnung einer Krankenbeförderung, form 4) and the exemption card for a ride, receipts for expenses and refuelling, vehicle-check photos, attachments to requests (such as a sick note), photos in the chat with dispatch, driving licence and passenger-transport licence, and your profile picture. The app does not access the microphone.
The app downsizes each picture before sending it and transfers it encrypted to your company's installation. Without a connection it waits in the app's storage and is sent once a connection is available. Once the server has confirmed receipt, the app deletes the file from the phone.
Transport prescriptions, exemption cards and sick notes contain health data (Art. 9 GDPR). If the company switches on the AI-assisted check of the transport prescription, it runs exclusively on the servers of its installation; it flags fields, and a person always decides about the prescription. Default retention periods, which the company may change within the statutory limits: transport prescriptions, rides and receipts eight years (§ 147 (3) AO, § 257 (4) HGB), attachments to requests three years, chat messages and photos one year, driving licence and passenger-transport licence until three years after employment ends.
9.4 Notifications
If you allow notifications, the app receives a device identifier (push token) from the operating system. It is stored with platform and app version in your company's installation, so that dispatch can tell you about new, changed and cancelled rides, messages and answers to requests. You choose which kinds you receive in the app.
Notifications are delivered on iPhone through Apple's Apple Push Notification service and on Android through Firebase Cloud Messaging of Google LLC. On Android, the Firebase component this requires also sends an installation identifier to Google. A notification contains only a title and one short line, for a ride the time and the street without house number. It never contains a patient's name, phone number or health details, and never the text of a chat message.
During a running ride the app shows a Live Activity on the iPhone lock screen: time, stage of the ride, street and town of the destination without house number, and the arrival time, without names. For this, a separate token for that ride is stored in the installation and deleted when the ride ends, at the latest after 24 hours. On Android a notification generated by the phone itself appears instead; nothing is transferred for it.
The device identifier is deleted when you sign out, when you switch notifications off entirely in the app, and when Apple or Google report it as invalid.
9.5 Rides and what you enter
The app shows you the rides your company assigned to you, with the details you need for the ride: the patient's name and, where given, phone number, pickup and destination address, ward, type of transport, notes and payer. The app keeps these details only in memory; they are not stored on the phone. On screens with patient or money details the app prevents screenshots and screen recordings as far as the operating system allows, and hides the content in the app switcher.
What you enter in the app is transferred to your company's installation: accepting, starting and completing a ride, delays and corrected addresses, messages to dispatch, cash desk entries (co-payments, expenses, refuelling with odometer reading and litres, advances), clock times and the shift's odometer readings, requests (leave, sick leave, advance, shift swap, account deletion), vehicle-check results and addresses you save.
9.6 Data on the phone
The app keeps the sign-in token, the company code and name, your language and your settings in the operating system's protected storage (Keychain on iOS, Keystore on Android). Photos and entries not yet transferred stay in the app's storage until the server has confirmed them. Storing these details is strictly necessary for the app to provide the service you requested (§ 25 (2) no. 2 TDDDG). The app accesses location, camera, photos and notifications only after you have allowed it in the operating system (§ 25 (1) TDDDG).
9.7 No third parties, no advertising
The app contains no analytics, advertising, tracking or crash-reporting services and does not track you across other apps or websites. It connects only to your company's installation, to app.mitabase.com, to Apple or Google for notifications (section 9.4) and to services of the operating system. The imprint and privacy links open this website. Data from the app is neither sold nor used for advertising.
9.8 Retention and signing out
Your company's installation deletes data according to the deletion concept the company sets; the defaults are listed in sections 9.2 and 9.3. Backups are kept encrypted in Germany and overwritten in a fixed cycle. Until then, a deleted record may still be contained in a backup.
When you sign out, the app deletes the sign-in token from the phone, ends the live-location transfer and unregisters the device identifier for notifications.
How to request the deletion of your account and your data is set out in section 9.9.
9.9 Deleting your data (MitaBase Driver)
How to request deletion: in the app under “Mehr” → “Einstellungen” → “Konto” → “Konto löschen” (more → settings → account → delete account), or by email to info@mitabase.com with the subject “Löschung MitaBase Driver”, naming your company and the email address you sign in with. Your company is responsible for your data (section 9) and decides on the request. We forward an email sent to us to the company without delay and carry out the deletion on its instructions.
If the company approves, you receive a confirmation by email. Your access is then closed, and the following are deleted: email address, address, phone number, date of birth, driving licence, passenger-transport licence, profile picture, bank details, saved addresses and the device identifiers for notifications. We keep no location history; the live trail expires after a few minutes anyway (section 9.2).
Only data the company must keep for legal reasons is retained, and only until the respective period ends; it is deleted afterwards (Art. 17 (3) (b) GDPR). Defaults, which the company may change within the statutory limits: rides, transport prescriptions and cash desk entries eight years (§ 147 AO, § 257 HGB), time records with the location taken when clocking in or out two years (§ 16 (2) ArbZG), requests three years, chat messages and photos one year. Your name remains in these records. Deleted data may still be contained in the encrypted backups until the backup is overwritten.
10. Recipients and third-country transfers
We pass personal data only to the service providers we use for the service (hosting, backup and email with Hetzner Online GmbH in Germany; delivery of driver-app notifications by Apple and Google, section 9.4), to our bank for collecting direct debits (Qonto SA, section 14), to bodies towards which a legal obligation exists, or where you have consented.
We ourselves transfer data outside the EU and the EEA in one case only: for notifications of the driver app (section 9.4). Apple and Google may process the device identifier and the short notification in the USA. For Google, the transfer relies on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), in which Google LLC states that it participates. Apple states that it bases its transfers from the EEA on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR).
If a customer connects a Google Sheet as a source of rides, MitaBase reads that sheet read-only through a service account the customer has authorised; nothing is written back. The controller for this transfer to Google is the customer.
11. Retention
Personal data is deleted as soon as the purpose of processing ceases to apply and no statutory retention obligations stand in the way. The period stated in section 3 applies to server log files, the handling described in sections 6 and 7 to form and email data, section 9.8 to the driver app and section 14 to contract and payment data.
12. Your rights
With regard to personal data concerning you, you have the following rights against us: access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR). You may withdraw consent you have given at any time with effect for the future (Art. 7 (3) GDPR).
Right to object: where we process your data on the basis of Art. 6 (1) (f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 (1) GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Wiesbaden.
13. No automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website or in the driver app.
14. Registration, contract and payment
Anyone who wants to use MitaBase for their company registers at app.mitabase.com. In doing so we process, as controller, the company details (name, address, contact person, email address, phone number), the vehicles booked and the plan chosen, and the SEPA direct debit mandate (account holder, IBAN). The legal basis is the contract (Art. 6 (1) (b) GDPR).
The direct debit is executed by our bank, Qonto SA (Qonto, Paris, France) through its German branch; for this it receives the account holder, IBAN, amount and payment reference. We do not collect or store card details.
We keep invoices and other accounting vouchers for eight years (§ 147 (1) no. 4, (3) AO, § 257 (1) no. 4, (4) HGB), and contract documents, direct debit mandates and business correspondence for six years (§ 147 (1) nos. 2, 3 and 5 AO, § 257 (1) nos. 2, 3 HGB), in each case from the end of the calendar year in which they were created (Art. 6 (1) (c) GDPR). They are deleted afterwards.
15. Changes to this policy
We adapt this privacy policy whenever changes to the website, the legal situation or the services used require it. The version published here applies; the effective date is shown at the top of the page.
Controlling language
This English version is provided for convenience. The German version of this document is authoritative.