dotmec dotmec

Legal

Privacy policy

1. Controller and scope

This privacy policy informs you pursuant to Art. 13 and 14 of the General Data Protection Regulation (GDPR) about how we process personal data – when you visit this website and when you communicate or work with us, for example as a prospective customer, customer, project participant, business partner or applicant.

The controller within the meaning of the GDPR and other data protection provisions is:

dotmec GmbH
represented by its managing director Benjamin Mecheels
Willy-Brandt-Allee 31a
23554 Lübeck
Germany

Email: contact@dotmec.com
Phone: +49 451 40608674
Website: dotmec.com

If you have questions about data protection or wish to exercise your rights (sections 12 and 13), you can reach us using these contact details.

2. Hosting, server log files and encryption

This website is hosted by webhostone GmbH, Rheinvogtstraße 17, 79713 Bad Säckingen, Germany. The servers are located in data centres in Germany.

When you visit our website, the web server automatically processes information transmitted by your browser and stores it in so-called server log files:

  • IP address of the requesting device (stored in the log files only in truncated and thus anonymised form)
  • date and time of the request
  • requested page or file, HTTP status code and amount of data transferred
  • referrer URL (the previously visited page)
  • browser type and version and operating system used

This processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically error-free delivery, stability and security of our website, in particular in preventing and investigating attacks. This data is not merged with other data sources.

We have concluded a data processing agreement with the host pursuant to Art. 28 GDPR. The host processes the data only in accordance with our instructions. The log files are automatically deleted after 10 days at the latest.

For security reasons and to protect the transmission of confidential content – such as enquiries you send us via the contact form – this website uses TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

3. Fonts (locally hosted)

For a consistent presentation, this website uses the Montserrat and Numans typefaces. Both are installed locally on our own web server; no connection to third-party servers (such as Google Fonts) is established when you visit our website.

These fonts are used in the interest of a consistent and appealing presentation of our online services. This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR.

4. Technically necessary cookies and local storage

Without your consent, we store only the following technically necessary information on your device:

  • Cookie “lang” (language selection): is only set if you actively choose a language (German or English) via the language switcher, and stores this choice so that our home page opens directly in the selected language on your next visit. Lifetime: 12 months.
  • Local storage entries “stcm.…” (consent status): store whether you have made a choice in the cookie banner and which categories you have consented to, so that your decision is respected on all pages and the banner does not reappear. The entries remain until you change your choice or delete the site data in your browser.

The legal basis for storing and reading this information is § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), as it is strictly necessary to provide the website in the language you have chosen and to implement your consent decision. Further processing is based on our legitimate interest in a user-friendly website (Art. 6 (1) (f) GDPR) or – for the consent status – on Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) and (3) GDPR. No cross-user tracking takes place.

If you open our home page without a language path and no “lang” cookie has been set yet, we choose the language based on your browser’s language setting; this information is not stored.

5. Consent management, Google Tag Manager and Google Analytics 4

a. Consent management (Silktide Consent Manager)

We use Silktide Consent Manager to manage your consents. The tool is installed on our own web server; no data is transmitted to the manufacturer. It asks for your consent to non-essential services, technically implements your decision and allows you to withdraw your consent at any time. Your choice is stored locally in your browser as described in section 4.

The legal basis is Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) and (3) GDPR. You can withdraw your consent or adjust your selection at any time with effect for the future by clicking the cookie icon in the bottom left of our website. The lawfulness of processing carried out before the withdrawal remains unaffected.

b. Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Tag Manager is a tool that allows us to manage website tags via a single interface; we use it exclusively to deploy Google Analytics 4 (letter c).

Even loading the Tag Manager script transmits data such as your IP address to Google servers. We have therefore integrated Google Tag Manager in such a way that the script is only loaded after you have consented to the “Analytics” category in the cookie banner. Without your consent, no connection to Google servers is established. In addition, we use Google Consent Mode v2: all consent signals default to “denied”; the advertising-related signals (ad_storage, ad_user_data, ad_personalization) remain permanently denied.

The legal basis for accessing your device is § 25 (1) TDDDG; the legal basis for the subsequent data processing is your consent pursuant to Art. 6 (1) (a) GDPR. For transfers to the USA, see letter c.

c. Google Analytics 4

If you have consented to the “Analytics” category, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited. Google Analytics 4 uses cookies and similar technologies to analyse the use of our website – for example pages viewed, time spent, where the visit came from (referrer), approximate location (country, region, city), device type, browser and operating system, and interactions such as scrolling, clicks on external links or downloads. For this purpose, Google Analytics stores a randomly generated pseudonymous identifier in the cookies “_ga” and “_ga_D5BJB2Q05Q” (lifetime of up to 2 years each).

Google Analytics 4 uses your IP address only to determine your approximate location; the IP address is neither logged nor stored. We only receive aggregated, pseudonymous reports and do not combine them with other data about you. We do not use advertising features such as Google Signals or links to advertising accounts, and we have disabled the sharing of data with Google for its own purposes (data sharing settings). User- and event-level data is automatically deleted after 14 months at the latest.

Google processes this data on our behalf on the basis of Google’s data processing terms (Google Ads Data Processing Terms). Data may be transferred to Google LLC in the USA. Such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified; in addition, the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR) form part of the data processing terms.

The legal basis for setting and reading the cookies is § 25 (1) TDDDG; the legal basis for the subsequent processing is your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the cookie icon in the bottom left. Further information can be found in Google’s privacy policy.

6. Contacting us and job applications

If you contact us via the contact form, by email or by phone, we process the information you provide in order to handle your enquiry and answer any follow-up questions. For the contact form, this is your name, email address and message and – optionally – company, phone number and topic; the language and time of the enquiry are also transmitted. We need the mandatory fields marked with * to process your enquiry and reply to you; without this information, you cannot contact us via the form.

Enquiries submitted via the contact form are transmitted to our web server in encrypted form and from there delivered as an email via our host’s mail server (section 2) to our mailbox in Microsoft Exchange Online (section 10). If, exceptionally, a message cannot be delivered, it is temporarily stored in a protected area of our web server that is not publicly accessible, so that we can handle it manually, and then deleted. To protect against spam, we use an invisible form field and a time check; no additional data is collected and no third-party services are involved.

a. General enquiries

The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to a contract to which you are or wish to become a party, or serves pre-contractual measures. In all other cases – in particular if you contact us as an employee of a company – processing is based on our legitimate interest in handling the enquiries addressed to us effectively (Art. 6 (1) (f) GDPR).

We delete your enquiry once it has been dealt with conclusively, i.e. when the circumstances show that the matter in question has been fully resolved. If your enquiry leads to a contract or constitutes business correspondence, we retain it for the statutory retention periods (section 11).

b. Job applications

You can apply to us via the contact form (topic “Application”) or by email. We process the data you send us – such as contact details, information on your qualifications and career, references and other documents – exclusively for the purpose of carrying out the application procedure. We store application documents in our Microsoft 365 environment (section 10); only the persons involved in the selection process have access to them.

The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering into an employment relationship). If you voluntarily provide special categories of personal data (e.g. information on a severe disability), we only process them insofar as this is necessary for the application procedure (Art. 9 (2) (b) GDPR in conjunction with § 26 (3) BDSG, the German Federal Data Protection Act). Providing your data is not mandatory; however, without it we cannot consider your application.

If an employment relationship is established, we transfer the necessary data to the personnel file. If your application is unsuccessful, we delete your application data no later than 6 months after the end of the application procedure. Retention until then serves to defend against potential claims under the German General Equal Treatment Act (cf. § 15 (4) AGG, § 61b ArbGG); the legal basis for this is Art. 6 (1) (f) GDPR.

Longer storage – for example to consider you for future vacancies – only takes place with your explicit consent (Art. 6 (1) (a) GDPR), which you may withdraw at any time with effect for the future.

7. Map display (OpenStreetMap)

We embed a map from the OpenStreetMap service on our contact page. The operator is the OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

When you open the contact page, your browser establishes a direct connection to the OSMF servers. In the process, your IP address and technical information about your browser and device are transmitted to the OSMF. We have embedded the map in such a way that your browser does not transmit any information about the referring page (referrer); the map does not set cookies or use local storage in your browser. The OSMF uses the data to deliver the map and to ensure the security of its services. For delivery, it uses a global network of cache servers (content delivery network), currently provided by Fastly, Inc., USA; requests from Germany are usually answered by servers in the EU.

OpenStreetMap is used in the interest of an appealing presentation of our online services and to make our location easy to find. This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR.

The transfer of data to the United Kingdom is based on the European Commission’s adequacy decision pursuant to Art. 45 GDPR (Implementing Decision (EU) 2021/1772, renewed by Implementing Decision (EU) 2025/2574). Where data reaches the USA in the process, Fastly, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Further information can be found in the OSMF privacy policy: https://osmfoundation.org/wiki/Privacy_Policy.

8. Links to social media profiles (LinkedIn, Xing, YouTube)

The footer of our website contains links to our company profiles on the social networks LinkedIn, Xing and YouTube. These links are static hyperlinks and expressly not social media plugins.

Simply visiting our website therefore does not transmit any personal data to the operators of these social networks. Only when you actively click on the icon of the respective network will you be redirected to the provider's website, where the privacy policies of the respective operators apply:

  • LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland – privacy policy
  • Xing: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany – privacy policy
  • YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – privacy policy

9. Customers, prospects, business partners and project participants

a. Purposes and categories of data

To initiate and provide our consulting, implementation, training and operations services, we process personal data of our customers, prospective customers, business partners and suppliers as well as of their contact persons and project participants. This includes in particular:

  • master and contact data (e.g. name, company, position, business email address and phone number),
  • communication data (e.g. emails, chat messages, meeting appointments and notes),
  • project and contract data insofar as they contain personal data (e.g. offers, contracts, requirements, concepts, minutes, documentation, work results and records of services performed),
  • billing data (e.g. billing address, payment information) and
  • for trainings: name and contact details of participants, booked courses and certificates of attendance.

b. Source of the data

As a rule, we collect this data from you directly. Otherwise, we receive it from your employer or our client, who names you as a contact person, project participant or training participant, or from publicly accessible sources (e.g. company websites, commercial register).

c. Legal bases

  • Art. 6 (1) (b) GDPR, insofar as you yourself are our contractual partner (e.g. as a sole trader or freelancer) or the processing serves pre-contractual measures taken at your request;
  • Art. 6 (1) (f) GDPR, insofar as we process data of contact persons and project participants of our customers and business partners – our legitimate interest lies in initiating, performing and documenting the business relationship and the project collaboration;
  • Art. 6 (1) (c) GDPR, insofar as we are subject to statutory retention and documentation obligations, in particular under commercial and tax law.

d. Processing on behalf of our customers

If, in a project, we process personal data on behalf of our customer – for example data of its employees or customers during a migration, implementation or in operations – our customer is the controller within the meaning of the GDPR. We then act exclusively on its instructions on the basis of a data processing agreement pursuant to Art. 28 GDPR; data subjects receive information on such processing from the respective controller. If we work in our customer’s Microsoft 365 or Azure environment (tenant or subscription), the customer’s contracts with Microsoft and its privacy notices apply.

e. Trainings and official Microsoft courses (MOC)

For the hands-on exercises in official Microsoft courses (Microsoft Official Courseware, MOC), we use practice environments (labs) from lab providers authorised by Microsoft for this purpose. To give you access, we send the respective provider the information required – usually your name, email address and the course and date – or you register yourself using an access code we provide. The provider also processes usage data from the lab environment (e.g. IP address, sign-in times, progress in the exercises). We will tell you which lab provider is used no later than in the course invitation.

The lab providers process this data on our behalf on the basis of data processing agreements (Art. 28 GDPR); if you accept the provider’s terms of use when you first open a lab, its privacy policy also applies. Some providers are based outside the EU or operate the lab environments there, in particular in the USA. Transfers there are based on an adequacy decision (Art. 45 GDPR, e.g. the EU-US Data Privacy Framework for certified providers) or on the EU standard contractual clauses (Art. 46 (2) (c) GDPR). The legal bases listed under letter c apply. Lab access is time-limited; the lab environments are deleted afterwards. Please do not enter any real personal or confidential data in the lab environments – they are used exclusively with test accounts and test data.

Microsoft provides the course content via Microsoft Learn. For learning paths, practice assessments and certification exams, you use your own Microsoft Learn profile; you take the exams with an exam provider engaged by Microsoft (currently Pearson VUE). Microsoft and the exam provider are independent controllers for this, and their privacy policies apply.

At the end of official Microsoft courses, you will receive a link to a course evaluation on the “Metrics That Matter” (MTM) platform of Explorance Inc., Montréal, Canada. Microsoft uses it to measure the quality of its training partners’ courses and requires them to provide the link to all participants – for example by email, during the course or on the lab provider’s course page. Participation is voluntary. Your answers and technical access data (e.g. IP address, browser and device information) are processed. Microsoft is responsible for the survey; Explorance processes the data as a service provider and, according to its own information, uses Microsoft Azure data centres or its own data centres in Canada, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). We receive access to the results for our courses and use them to improve our trainings. If the link is shown on a lab provider’s course page, the provider may also show us whether you have opened the link; this helps us comply with Microsoft’s survey requirements. The legal basis for this processing by us is Art. 6 (1) (f) GDPR. Further information can be found in Explorance’s privacy policy.

f. Retention period

We store this data for the duration of the business relationship or the project. Afterwards, we delete it as soon as it is no longer required, unless statutory retention obligations (section 11) prevent this or we need it to establish, exercise or defend legal claims. Data processed on behalf of customers is returned or deleted after the end of the project, at the customer’s choice, as set out in the data processing agreement.

10. Use of Microsoft 365 and Microsoft Azure

a. Provider and services used

For our communication, collaboration and document storage – including the storage of customer and project documents – we use cloud services from Microsoft. The provider and contractual partner for customers in the European Economic Area is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA). In particular, we use:

  • Microsoft 365: Exchange Online with Exchange Online Protection (email, calendar, contacts, spam and malware filtering), Microsoft Teams (chat, audio and video conferencing, file sharing), SharePoint Online and OneDrive for Business (storage, co-authoring and sharing of documents), Microsoft 365 Copilot (AI-supported assistance) and Viva Connections (internal information portal);
  • Microsoft Azure: storage services (e.g. Azure Storage) for storing, archiving and backing up customer and project documents and – depending on the project – development and test environments;
  • Microsoft Entra ID: management of user accounts and access rights and, when collaborating with external persons, of guest accounts.

b. Data processed and purposes

Depending on the service, we process content data (e.g. emails, documents, chat messages, meeting content, Copilot prompts and results), contact and account data (e.g. name, email address, phone number, company, guest account) as well as usage, log and diagnostic data (e.g. IP address, device and browser information, sign-in and access times). The purposes are internal and external communication, organising appointments and meetings, creating, storing and co-editing documents, carrying out projects and ensuring IT security. This notice also applies to external communication partners, for example when you send us emails, take part in a Teams meeting or exchange documents with us. Enquiries submitted via our contact form are also received in an Exchange Online mailbox.

c. Legal bases

Where processing serves the performance of a contract with you or pre-contractual measures, the legal basis is Art. 6 (1) (b) GDPR. Otherwise, we rely on our legitimate interest in efficient, secure and location-independent communication and collaboration and in ensuring IT security (Art. 6 (1) (f) GDPR) and on statutory retention obligations (Art. 6 (1) (c) GDPR). For recordings and transcriptions, see letter g.

d. Processing by Microsoft on our behalf

Microsoft processes the data as our processor on the basis of the Microsoft Products and Services Data Protection Addendum (DPA), which implements the requirements of Art. 28 GDPR. Under the DPA, Microsoft may only process the data in accordance with our instructions, is bound to confidentiality and to appropriate technical and organisational security measures, and engages sub-processors only under the contractually defined conditions. To a limited extent, Microsoft is an independent controller: for its own business operations related to providing the services (billing and account management, compensation calculations, internal reporting and business modelling, financial reporting) – for which, according to the DPA, Microsoft only creates aggregated, non-personal statistics from pseudonymised data without accessing content –, for Copilot web searches (letter h) and for optional connected experiences of the Office applications (e.g. online image search), where these are used. In this respect, the Microsoft privacy statement applies.

Where we process data on behalf of our customers in our own Microsoft environment (section 9, letter d), we engage Microsoft as a further processor; this is governed by the data processing agreement with the respective customer.

e. Storage locations (EU Data Boundary)

Germany is set as the data location of our Microsoft 365 tenant. Under Microsoft’s product terms, in particular mailbox content (Exchange Online), files in SharePoint Online and OneDrive for Business, Teams chat messages, meeting recordings and stored Copilot interactions are stored at rest in data centres in Germany. For other services, such as Exchange Online Protection and Viva Connections, storage within the EU or EFTA applies. We operate the Azure resources in which we store customer and project documents in data centre regions in Germany; data at rest – including geo-redundant copies – remains in Germany.

In addition, under the EU Data Boundary, Microsoft has committed to store and process customer data and personal data of the covered Microsoft 365 and Azure services within the EU and the EFTA states as a rule.

f. Transfers to third countries

Despite these commitments, access from third countries – in particular by Microsoft Corporation in the USA – cannot be completely ruled out, for example when Microsoft engineers access data remotely in support and maintenance cases, for security services that analyse globally aggregated security data to detect malware, phishing and compromised accounts, or for globally operated services (limited transfers documented by Microsoft). Such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Microsoft Corporation is certified, and additionally on the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR), which Microsoft Ireland and Microsoft Corporation have agreed for all transfers out of the EU. Microsoft has also contractually committed to redirect government demands for data to the customer where possible, to challenge unlawful orders and to inform the customer where legally permitted.

g. Microsoft Teams: meetings with external participants

If you take part in a Teams meeting with us, we process – depending on use – your display name and, where applicable, your email address, audio and video data, screen shares, chat messages and shared files as well as meeting metadata (e.g. time, duration, participants). You can switch off your camera and microphone at any time. We only use recordings, transcriptions and AI-supported meeting summaries (Copilot) after prior announcement and with the consent of the participants (Art. 6 (1) (a) GDPR); Teams indicates an ongoing recording or transcription to all participants.

h. Microsoft 365 Copilot

Microsoft 365 Copilot supports our staff, for example in summarising emails and documents or drafting texts. Copilot only accesses content that the respective person is already authorised to access, and processes prompts and results within the Microsoft 365 services in accordance with the DPA. Processing by the AI models takes place within the EU Data Boundary; we have disabled the option to shift it to data centres in the USA, Canada or Australia during peak load (“flex routing”). Third-party AI models operated outside the EU Data Boundary (e.g. models from Anthropic) are not enabled in our organisation. Microsoft does not use prompts, responses or data accessed via Microsoft Graph to train the underlying AI models. AI results are reviewed by our staff; Copilot does not make decisions that produce legal effects concerning you.

Where Copilot uses web search for a response, search terms derived from the prompt are sent to the Microsoft Bing search service without user or tenant identifiers. Microsoft is an independent controller for these search queries; they are not covered by the DPA or the EU Data Boundary.

i. Security

To protect the data, we use measures including: encryption in transit (TLS 1.2 or higher) and at rest (for Azure Storage, among others, AES-256), sign-in exclusively with personal accounts and multi-factor authentication, role-based access rights on a need-to-know basis, revocable sharing for external persons and logging of security-relevant events.

j. Diagnostic data

When the Microsoft 365 applications are used, Microsoft collects diagnostic data to keep the software secure and up to date and to fix errors. We have limited this to required diagnostic data; optional diagnostic data is not transmitted.

k. Retention and deletion

We delete data in Microsoft 365 and Microsoft Azure as soon as it is no longer required for the respective purpose and neither statutory retention obligations (section 11) nor contractual agreements with our customers prevent deletion. For technical reasons, deleted content may still be kept for a limited recovery period (e.g. up to 93 days in the SharePoint and OneDrive recycle bin) before it is permanently removed. After termination of our contract with Microsoft, Microsoft keeps the stored data available for export for 90 days in accordance with the DPA and then deletes it within a further 90 days.

11. Recipients, retention periods and further mandatory information

a. Recipients

Within our company, only those persons who need access to your data to fulfil the purposes described receive it. Depending on the processing, external recipients are our processors (in particular our host and Microsoft, for trainings the lab providers and, if you have consented, Google; see sections 2, 5, 9 and 10), subcontractors engaged in projects with our customers’ approval, our tax adviser, banks for payment processing, and authorities and courts where we are legally obliged to disclose data. We do not sell your data or pass it on for advertising purposes.

b. Retention periods and statutory retention obligations

Unless a more specific retention period is stated in this privacy policy, we process personal data only for as long as necessary for the respective purpose. Where data is subject to statutory retention obligations, we restrict its processing and delete it once the period has expired. The relevant provisions are in particular § 257 HGB (German Commercial Code) and § 147 AO (German Fiscal Code): business correspondence 6 years, accounting vouchers (e.g. invoices) 8 years, books of account, annual financial statements and inventories 10 years, each starting at the end of the calendar year in which the document was created.

c. Obligation to provide data

Unless stated otherwise, you are under no statutory or contractual obligation to provide us with personal data. However, without the information marked as required, we cannot process your enquiry or application or conclude or perform a contract.

d. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

12. Your rights as a data subject

As a data subject, you have the following rights vis-à-vis the controller under the GDPR:

  • Right of access (Art. 15 GDPR): You can request information about the personal data we process about you and a copy of this data.
  • Right to rectification (Art. 16 GDPR): You can request the immediate rectification of inaccurate data or the completion of incomplete data.
  • Right to erasure (Art. 17 GDPR): You can request the erasure of your data unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.
  • Right to restriction of processing (Art. 18 GDPR): You can request the restriction of processing, for example if you contest the accuracy of the data, if the processing is unlawful, if we no longer need the data but you require it for the establishment, exercise or defence of legal claims, or if you have objected and it has not yet been determined whether our grounds override yours.
  • Right to data portability (Art. 20 GDPR): You can request to receive data that you have provided to us on the basis of consent or a contract in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
  • Right to withdraw consent (Art. 7 (3) GDPR): You can withdraw consent you have given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
  • Right to object (Art. 21 GDPR): see section 13.

To exercise your rights, an informal message to the contact details stated in section 1 is sufficient. We generally respond within one month (Art. 12 (3) GDPR).

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority responsible for our registered office is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98, 24103 Kiel, Germany
Postal address: Postfach 71 16, 24171 Kiel
Phone: +49 (0) 431 988-1200
Email: mail@datenschutzzentrum.de
Website: https://www.datenschutzzentrum.de

13. Right to object pursuant to Art. 21 GDPR

If we process your personal data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If we process your data for direct marketing purposes, you can object to this processing at any time; we will then no longer process your data for these purposes.

No particular form is required for the objection; you can, for example, send an email to contact@dotmec.com.

14. Validity and amendment of this privacy policy

This privacy policy is currently valid as of September 2026. Due to the further development of our website and services or changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can be accessed and printed at any time on our website at https://dotmec.com/en/privacy.