Privacy Policy

The controller responsible for processing personal data on this website is:

David Lemke
miraTEQ (sole proprietorship)
208/74 Siwalee Lakeview, Moo 7, Soi 22, Serene Lake Road
Tambon Suthep, Amphoe Mueang Chiang Mai
50200 Chiang Mai, Thailand

Postal address in Germany: Breitensteinstraße 50, 85567 Grafing bei München
Phone: +49 8092 2550428
Email: contact@mirateq.com

Representative in the EU (Art. 27 GDPR): Nicole Binsteiner, Breitensteinstraße 50, 85567 Grafing bei München, Germany, email: datenschutz@mirateq.de. You and the supervisory authorities can contact her about any data protection question.

No data protection officer has been appointed because the legal requirements for one are not met (Art. 37 GDPR, Section 38 BDSG).

Personal data is any information that relates to an identifiable person, such as a name, email address, phone number or IP address. It is processed only where this is needed to run this website, to answer an enquiry or to perform a contract, where you have given consent, or where the law requires it. Personal data is never sold and is shared only with the recipients named here. If the provider becomes unavailable, a stand-in appointed by the provider continues operations and is given access to this data for that purpose; the stand-in is bound to confidentiality.

The provider is based in Thailand. The GDPR applies because this website is also directed at people in the European Union (Art. 3(2) GDPR). Because of where the provider is based, the Thai Personal Data Protection Act B.E. 2562 (PDPA) applies as well. The legal basis is stated in each section. Under the PDPA these correspond to Section 19 (consent) and Section 24 (contract, legitimate interest, legal obligation). There are no decisions made solely by a program (Art. 22 GDPR).

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located exclusively in Germany. Hetzner processes connection data on the provider's behalf under a data processing agreement pursuant to Art. 28 GDPR.

The website is delivered through the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare sits between your browser and the server, processes technical connection data including your IP address and protects the website against attacks. Cloudflare is certified under the EU-U.S. Data Privacy Framework; the European Commission's standard contractual clauses apply in addition.

Fonts, images and videos are served from the provider's own server. No fonts are loaded from Google or any other provider.

Legal basis: Art. 6(1)(f) GDPR, legitimate interest in a secure, fast and stable website.

On every visit the server automatically stores what your browser transmits:

• IP address, shortened only: without the last block for IPv4, without the last 88 bits for IPv6
• browser and version
• operating system
• previously visited page (referrer)
• date and time of the request
• amount of data transferred

The server needs this data to deliver the page and to detect errors and attacks. It is not combined with other data.

Legal basis: Art. 6(1)(f) GDPR, legitimate interest in operation and security.
Retention: 31 days.

The contact form transmits your name, email address, industry and message. A quote request from the price calculator also transmits the services you selected and, if you provide them, your phone number, LINE ID and a note. In both forms you can also say how you heard about miraTEQ, if you wish.

Both forms also send which page you submit from, whether you arrived through an ad or a link (campaign code and referring website) and the language you are reading the site in. Nothing is stored on your device for this.

Both forms are processed by the provider's own script on the server in Germany, which forwards the request by email. The script itself stores nothing; the email sits in the provider's mailbox, also with Hetzner in Germany. Cloudflare Turnstile protects the forms against spam: it checks technical signals such as IP address and browser behaviour to tell people from bots, without advertising cookies and without profiles.

Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract at your request); for spam protection, the origin details and your answer on how you heard about miraTEQ, Art. 6(1)(f) GDPR, legitimate interest in a secure form, in knowing which page led to an enquiry and in learning how people find miraTEQ.
Retention: until the enquiry is handled, at most 6 months if no contract follows.

If you get in touch by email or phone, your details and message are stored in order to answer your enquiry.

You can also write via a messenger. This is optional; email and phone always work.

• WhatsApp by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. Your phone number, message and metadata are processed. Meta also transfers data to the USA; Meta is certified under the EU-U.S. Data Privacy Framework.
• LINE by LY Corporation, Tokyo, Japan. Your LINE ID, message and metadata are processed. An adequacy decision of the European Commission covers Japan.
• Facebook Messenger by Meta Platforms Ireland Ltd. Your profile name, message and metadata are processed.

Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract), otherwise Art. 6(1)(f) GDPR, legitimate interest in answering enquiries.
Retention: until the enquiry is handled, at most 6 months if no contract follows. If a contract is concluded, the periods in section 8 apply.

Appointments are booked through the provider's own booking system, miraBOOK. It runs on tools.mirateq.com, on the same servers in Germany, and is not a third-party service.

A booking stores your name, email address, phone number, topic, message and your answer to how you heard about miraTEQ (the last four optional), the requested appointment, your language and the time of booking. This data is used to arrange, confirm and, if needed, reschedule the appointment. The confirmation is sent by email. Your IP address is not stored with the booking; to prevent abuse, the system only counts booking attempts per IP address and deletes this count after one day.

Calendar: only your first name, the topic, your language, the appointment and the video call link go into the provider's calendar at Apple iCloud (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland). Your surname, email address, phone number and message stay in the booking system. Apple may transfer data to Apple Inc. in the USA and uses the European Commission's standard contractual clauses for this. The system deletes the calendar entry automatically together with the booking, 12 months after the appointment.

Video call: for a call by video, your confirmation contains a link to Jitsi Meet (meet.jit.si) operated by 8x8, Inc., USA. When you join the call, 8x8 processes your IP address, the name you enter there, and the video, audio and chat of the call. Nothing is recorded. 8x8 is certified under the EU-U.S. Data Privacy Framework. More: meet.jit.si privacy notice.

Opening a page with the booking window already connects your browser to tools.mirateq.com; the server log files in section 4 apply. Personal details are transmitted only when you submit a booking.

Legal basis: Art. 6(1)(b) GDPR; for abuse prevention Art. 6(1)(f) GDPR.
Retention: the system deletes bookings automatically 12 months after the appointment, backups after 14 days. On request a booking is deleted sooner unless a retention obligation applies.

For contracts, name, company, address, contact details, contract and invoice data and the communication about the order are processed.

Payment is by bank transfer, direct debit or card. Direct debit and card payments are handled by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). Stripe processes the name, email address, bank or card details and the amount, and checks payments for fraud. The provider never sees card details. Stripe may transfer data to Stripe, Inc. in the USA and is certified under the EU-U.S. Data Privacy Framework. More: Stripe Privacy Policy.

For the online shop, a client connects their own Stripe account to the provider's Stripe platform. In doing so, the provider receives information about this account from Stripe (business name, email address, country, account status) and about the payments in the shop, as far as he needs it to run the shop.

Data that the provider's clients collect with their website and apps, such as bookings, orders or online shop purchases, is processed by the provider on their behalf (Art. 28 GDPR). The business in question is then the controller; its privacy policy is on its website. The provider forwards enquiries about this to the business.

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR, legitimate interest in meeting tax retention obligations.
Retention: for the term of the contract; invoices and accounting records for as long as tax law requires.

Without consent, only what the website needs to work is stored (Section 25(2) no. 2 TDDDG):

• the cookie mirateq-consent with your choice from the cookie notice, 180 days
• your choice of light or dark display in the browser's storage
• security signals from Cloudflare and Turnstile that protect the website and the forms

Only with your consent do statistics and marketing load (section 10). You choose each category separately and can change or withdraw your choice at any time through “Cookie settings” at the bottom of every page. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Proof of consent: each decision is recorded on the server: the date, the categories chosen, the language and, instead of your IP address, a check value. It is created with a secret key that is deleted after one day; after that the address can no longer be recovered from it. The record is kept for three years and then deleted automatically (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Statistics: Cloudflare Web Analytics

Measures how often pages are opened and how fast they load. It sets no cookies, stores no IP addresses and builds no profiles. Because it reads technical details of your device to do this, it loads only with your consent. Provider: Cloudflare, Inc., USA (section 3).

Advertising: Meta Pixel

With your consent, the Meta Pixel by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland, loads. It measures whether ads on Facebook and Instagram reach people interested in the offer and can show relevant ads to visitors of this website. It processes IP address, browser and device details, the pages you open and certain actions: visiting a service page, clicking a contact channel, sending a form (for quote requests with the estimated order value) and booking an appointment. Meta stores the cookies _fbp, _fbc and fr for this. If you are logged in to Facebook or Instagram, Meta can link this data to your account and transfer it to the USA; Meta is certified under the EU-U.S. Data Privacy Framework.

The provider and Meta are joint controllers for collecting the data and transmitting it to Meta (Art. 26 GDPR, Meta's agreement: Controller Addendum). Meta alone is responsible for anything it does with the data afterwards. More: Meta Privacy Policy.

Legal basis for both: your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG, for people in Thailand Section 19 PDPA. You can withdraw it at any time through “Cookie settings”; the service then no longer loads.

The website, the forms and the booking system run on servers in Germany. The provider works from Thailand and accesses the data from there, for example to answer your enquiry. There is no European Commission adequacy decision for Thailand. The GDPR still applies to this processing in full, including all your rights under Section 12.

Through the services named above, data also goes to the USA (Cloudflare, Meta, Stripe and 8x8 for video calls, all certified under the EU-U.S. Data Privacy Framework, Art. 45 GDPR; Apple under the European Commission's standard contractual clauses, Art. 46 GDPR) and to Japan (LINE, covered by an adequacy decision of the European Commission).

Under the PDPA, these transfers rely on the level of protection in the destination country, on contractual safeguards of the services, or on being necessary for your enquiry or your contract (Sections 28 and 29 PDPA).

You have the right to:

• access the data stored about you and receive a copy (Art. 15 GDPR)
• rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR)
• erasure, unless a retention obligation applies (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability in a common, machine-readable format (Art. 20 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object: where processing is based on a legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). Processing then stops unless there are compelling legitimate grounds that override your interests.

You have the same rights under the PDPA (Sections 30 to 36).

Just write to contact@mirateq.com or to the representative in the EU (Section 1). You get an answer within one month, free of charge.

You can lodge a complaint with any data protection supervisory authority in the EU, in particular in the country where you live or work (Art. 77 GDPR). In Bavaria, where the representative in the EU is based, this is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, phone +49 981 180093-0, www.lda.bayern.de.

In Thailand, the Office of the Personal Data Protection Committee (PDPC) is responsible, www.pdpc.or.th.

This section is for businesses that use miraBOOK, the provider's booking system, and connect a Google Calendar to it. It covers the data miraBOOK receives from Google. Guests who book an appointment on this website are covered by section 7.

Access: when a business connects its calendar, Google asks for two permissions.

• View your availability in your calendars (calendar.freebusy). miraBOOK reads when the main calendar is busy, as start and end times only. It cannot see titles, descriptions, places or attendees. Busy times can then no longer be booked online.
• See, create, change, and delete events on Google calendars you own (calendar.events.owned). miraBOOK adds one event to the main calendar for each booking. It deletes that event again when the booking is cancelled, moved or deleted, or when its retention period ends. Other events are never opened, changed or deleted.

What goes into the calendar: the service, the guest's name, the staff member and the language of the booking, plus the guest's email address, phone number, message, the link to manage the booking and, for video appointments, the call link. A business can switch to a short entry with the guest's first name only and no contact details. These guest details are processed on the business's behalf (section 8).

What the provider stores: the access and refresh tokens from Google, encrypted, until the business disconnects. The busy times (start and end only) of the months in which guests can book, until the business disconnects; past months are removed automatically. The ID of each event miraBOOK created, for as long as the booking exists, by default 12 months after the appointment. Everything is stored on the provider's servers at Hetzner in Germany and reaches the admin panel through Cloudflare (section 3).

Sharing: the provider does not sell data received from Google and does not pass it on. It is not used for advertising, to assess creditworthiness or to train AI models. Nobody at miraTEQ reads it, unless the business asks for support, abuse or a security problem has to be investigated, or the law requires it.

Disconnecting: in the miraBOOK admin panel under Settings → Connect your calendar → Google → Disconnect. miraBOOK then deletes the tokens and the stored busy times and revokes its access at Google. Access can also be removed on the linked apps page of the Google Account. Events that miraBOOK has already created stay in the calendar until the business deletes them.

Limited Use: miraBOOK's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google Workspace User Data and Developer Policy, including the Limited Use requirements.

Legal basis: Art. 6(1)(b) GDPR, performance of the contract with the business.
Retention: as stated above.

This policy was last updated in October 2026. It is updated when the website, the services used or the law change. The version on this page always applies.