Privacy policy

In accordance with Art. 13 of the General Data Protection Regulation (GDPR), this policy explains which personal data are processed when you visit and use this file upload, for what purposes and on what legal basis.

1. Controller

MHI-Solutions
Owner: Marco Hölzemer
Vor Selms 87
54472 Kommen
Germany

Phone: +49 6536 9337955
Email: info@mhi-solutions.de

2. Summary

• Your details and files are used solely to receive and process your files.
• There is no tracking, no analytics or advertising services and no third-party content (fonts, scripts, maps).
• Only one technically necessary session cookie is set, which is deleted when you close your browser.
• Data are transmitted in encrypted form, stored in Germany and not transferred to countries outside the EU/EEA.

3. Visiting the site and server log files

With every request, the web server automatically stores: IP address, date and time, requested address, amount of data transferred, status code, previously visited page (referrer) and browser and operating system (user agent).

The purpose is to deliver the site and to ensure secure and stable operation, in particular to prevent and investigate attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing a secure and functional service. Log files are deleted after 7 days at the latest, unless they are needed for longer in an individual case to investigate a security incident.

4. Cookie and browser storage

This site sets a single session cookie (PHPSESSID). It contains only a random identifier; linked to it, the server stores your language choice, a security token against forged form requests, an identifier for the transaction log (section 5) and, where applicable, details pre-filled from your upload link (e.g. company, email address). The cookie is deleted when you close your browser.

So that an interrupted transfer can resume after reloading the page, your browser keeps a random transfer ID in its session storage (sessionStorage). It only leaves your browser together with the upload itself and is deleted when you close the tab.

Both are strictly necessary for the service you requested (Section 25(2) no. 2 of the German TDDDG), so no consent is required. The related processing is based on Art. 6(1)(f) GDPR.

5. File upload

When you submit files, we process:

• the details you enter in the form: company or agency (required), email address (required), contact person, customer name, customer number, description or order reference,
• the uploaded files including file names and sizes,
• the time of submission and an internal reference number.

In addition, we keep a transaction log: when the upload link was opened, from which IP address and with which browser, the details contained in the link, which files were transferred (name, size, checksum) whether the transfer was completed, cancelled or interrupted and when the files were retrieved by our staff. The purpose is to provide evidence that your files were received, to resolve queries and transfer errors and to detect misuse. After repeated access attempts with invalid links, the IP address concerned is blocked for 24 hours. The legal basis is Art. 6(1)(f) GDPR. The log is deleted automatically after 90 days.

The purpose is to receive your files, assign them to your order or enquiry and process them further. The legal basis is Art. 6(1)(b) GDPR where the submission serves the performance of a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR (legitimate interest in handling the business relationship with you or your company).

The required details and the files are necessary for the submission; without them, no upload is possible. All other details are voluntary.

If your files contain personal data of other people, please make sure you are entitled to pass them on to us.

Retention: Incomplete transfers are deleted automatically once they are older than 24 hours; deletion takes place during the next upload on this server. Completed uploads are stored in an area of the server that is not publicly accessible, only until they are retrieved by the responsible staff via an encrypted connection (SFTP). This happens regularly, usually within a few days; the files are then removed from the upload server. For processing your order, they are subsequently stored in our internal systems and deleted once they are no longer needed for that purpose and no statutory retention obligations (e.g. under commercial or tax law) apply.

6. Email notifications

Once an upload is complete, the responsible staff at MHI-Solutions receive an email with your form details and the list of file names; the files themselves are not sent by email. You also receive a confirmation with the same details at the address you provided. Emails are sent via the operator's mail server in Germany, encrypted where the receiving server supports it. The legal basis is Art. 6(1)(b) or (f) GDPR as described in section 5.

7. Recipients

Only the persons at MHI-Solutions responsible for processing have access to your data.

We also use the following service providers, who process data solely on our instructions under a data processing agreement (Art. 28 GDPR):

• Data centre: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany (data centre in Germany)

No data are transferred to countries outside the EU/EEA. Data are only disclosed to other third parties if we are legally obliged to do so.

8. Security

The connection is encrypted throughout using TLS (HTTPS). Uploaded files are stored outside the publicly accessible web area and are only accessible to authorised persons.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). To exercise these rights, simply contact us using the details above.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is: The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Germany (www.datenschutz.rlp.de).

10. No automated decision-making

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

Last updated: October 2026