Privacy notice

1. Controller

The controller within the meaning of the GDPR is Ascensus GmbH, Werstener Dorfstraße 152, 40591 Düsseldorf, Germany. Email: info@mice-cloud.de.

2. Overview of processing

We process account data (names, addresses and company names), contact data (email addresses and telephone numbers), content (text input and booking data), usage data (pages visited and access times), metadata and communication data (IP addresses and device information), and contract data (subject, term and customer category). Payment data is processed exclusively by Stripe.

3. Legal bases

We process personal data on the following bases: consent under Article 6(1)(a) GDPR, for example contact forms; performance of a contract under Article 6(1)(b), for example SaaS use and subscriptions; legal obligations under Article 6(1)(c), for example retention requirements; and legitimate interests under Article 6(1)(f), for example security and analysis.

4. Hosting and servers

The application and its database are hosted in Germany on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. External providers are also used for the payment, email and optional AI functions described below. Hetzner is ISO 27001 certified.

5. SaaS platform (app.mice-cloud.de)

5.1 Registration and user accounts

At registration, we collect your name, email address, company name and password (hashed with Argon2). This data is necessary to perform the contract.

5.2 Booking data

Use of the platform involves processing event details, room choices, catering, guest numbers and booker contact details. We process this data on behalf of the customer (hotel) as a processor.

5.3 Security measures

• HTTPS for transmission; AES-256-GCM for selected credentials and secrets, such as PMS credentials and TOTP secrets.
• Argon2 password hashing.
• Optional two-factor authentication (TOTP).
• Content Security Policy and security headers.
• Rate limiting to protect against brute-force attacks.
• Audit logging of security-relevant actions.

6. Payment processing

Payments are processed by Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA. Stripe is PCI DSS Level 1 certified. We do not store credit card or bank details. See Stripe’s privacy policy.

7. Email delivery

Transactional emails, such as booking confirmations and password resets, are sent through Brevo (formerly Sendinblue). Brevo processes email addresses as a processor.

7.1 Optional AI functions

If AI functions are configured and used for a hotel, event details and contact data they contain may be sent to the configured provider, OpenAI or Anthropic, to generate draft text. The scope depends on the function and configuration. Before enabling these functions, hotels should assess the provider, processing terms and whether the data may be transmitted. Information about the configured setup is available on request.

8. Contact form

When you submit the contact form, your name, email address, optional hotel or company, subject and message are sent to us through our server and the email provider Brevo and processed to handle your enquiry. This also applies if you contact us directly by email. The legal basis is Article 6(1)(b) GDPR (pre-contractual steps) or Article 6(1)(f) GDPR (legitimate interest in responding).

9. Website analytics

We currently do not use tracking or analytics tools. No cookies beyond those technically necessary are set.

10. Cookies

Our website uses only technically necessary cookies, such as login session cookies. No marketing or tracking cookies are used.

11. Your rights

You have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability in a machine-readable format (Article 20), objection (Article 21), withdrawal of consent at any time with future effect (Article 7(3)), and complaint to a supervisory authority (Article 77).

MICE Cloud provides GDPR export (all data as JSON) and account deletion functions under Settings in the application.

12. Data processing agreement

For hotels using MICE Cloud to process their guests’ booking data, we provide a data processing agreement under Article 28 GDPR. Please contact info@mice-cloud.de.

13. Retention period

Personal data is deleted when the purpose of storage no longer applies, unless statutory retention obligations prevent deletion (for example, 6–10 years for business records under the German Commercial Code and Fiscal Code). When a subscription is terminated, all data is deleted within 30 days unless a retention obligation applies.

14. Changes

We reserve the right to amend this privacy notice to reflect changes in the law or the service. The current version is always available on this page.