Trust Center · Register
Processing activities as controller
Every processing MIHOS performs for its own purposes.
Version 1.0 of 25 October 2026
Controller: MuuM Sàrl, Route de Champ-Colin 12, 1260 Nyon, Switzerland, privacy@mihos.ai. Legal bases are those of the GDPR where it applies. Under Swiss law, a private company needs a justification only where its processing would otherwise unlawfully infringe personality (art. 30 FADP): consent, an overriding private or public interest, or the law (art. 31 FADP).
Security: the measures described in our privacy policy apply to these processing operations as well.
1. Website enquiries and demo bookings
Purpose
Answer messages and arrange demonstrations.
Data subjects
Website visitors who write to us or book a demonstration.
Personal data
Name, email, company, time zone, message.
Legal basis
Steps taken at your request before a contract; legitimate interest.
Recipients and country
Website and forms: United States. Booking: United States. CRM: Germany.
Safeguard
Adequacy where the provider is certified under the Data Privacy Framework for the data concerned, otherwise Standard Contractual Clauses.
Retention
24 months after our last exchange.
2. Email updates
Purpose
Send the updates people subscribed to.
Data subjects
Subscribers.
Personal data
Email address.
Legal basis
Consent, withdrawable in every email.
Recipients and country
Website and forms: United States. CRM: Germany.
Safeguard
Adequacy where the provider is certified under the Data Privacy Framework for the data concerned, otherwise Standard Contractual Clauses.
Retention
Until the person unsubscribes.
3. Prospecting
Purpose
Present our services to companies that may need them.
Data subjects
Professional contacts at those companies.
Personal data
Name, role, company, professional email and phone, notes of our exchanges; source of the details.
Legal basis
Legitimate interest. Objection possible at any time; the source is named at first contact.
Recipients and country
CRM: Germany. Contact enrichment: United States. Professional network: Ireland.
Safeguard
Adequacy where the provider is certified under the Data Privacy Framework for the data concerned, otherwise Standard Contractual Clauses.
Retention
24 months after our last exchange. An objection is kept so that it is respected.
4. Customer contracts
Purpose
Conclude and manage contracts with customers.
Data subjects
Customer representatives and signatories.
Personal data
Name, role, professional contact details, electronic signature data (name, email, IP address, time).
Legal basis
Contract.
Recipients and country
Electronic signature: Ireland, United States. Email and documents: Ireland, United States.
Safeguard
Binding corporate rules, or adequacy where the provider is certified under the Data Privacy Framework for the data concerned, and Standard Contractual Clauses.
Retention
Duration of the contract, then 10 years.
5. Billing, payments and accounting
Purpose
Invoice customers, collect payments and keep the accounts.
Data subjects
Customer billing contacts.
Personal data
Name, billing address, VAT number, invoices; card data is handled by the payment provider.
Legal basis
Contract; legal obligation to keep accounting records.
Recipients and country
Payments: Ireland, with transfers to the United States. Accounting firm: Switzerland. Banks: Switzerland, Lithuania.
Safeguard
Payments: adequacy where the provider is certified under the Data Privacy Framework for the data concerned, otherwise Standard Contractual Clauses. Switzerland: not applicable. Lithuania: country recognised as adequate by Switzerland.
Retention
10 years.
6. Support and satisfaction surveys
Purpose
Help users and customers, and ask them what to improve.
Data subjects
Users and customer contacts.
Personal data
Name, contact details, messages, answers to surveys.
Legal basis
Legitimate interest in improving the service.
Recipients and country
Email and messaging services: Ireland, United States.
Safeguard
Adequacy where the provider is certified under the Data Privacy Framework for the data concerned, otherwise Standard Contractual Clauses.
Retention
24 months.
7. Security of the website and services
Purpose
Protect our website and services, detect and handle incidents.
Data subjects
Visitors and users.
Personal data
IP address, browser, technical and security logs.
Legal basis
Legitimate interest.
Recipients and country
Hosting: Switzerland. Website: United States. Error monitoring: Germany.
Safeguard
Adequacy where the provider is certified under the Data Privacy Framework for the data concerned, otherwise Standard Contractual Clauses.
Retention
As long as security requires.
8. Usage statistics
Purpose
Understand which features are used, to improve the product.
Data subjects
Users.
Personal data
Pseudonymised usage events and recordings of sessions in the interface, in which all text and every input are masked. Statistics are then produced in anonymous form.
Legal basis
Legitimate interest.
Recipients and country
Usage measurement: Germany, provider based in the United States.
Safeguard
Adequacy where the provider is certified under the Data Privacy Framework for the data concerned, otherwise Standard Contractual Clauses.
Retention
Pseudonymised events: up to seven years at the provider. Anonymous statistics are not personal data and are kept without limit.
9. Trust Center requests and rights requests
Purpose
Send the documents requested, answer requests to exercise rights, keep the evidence that they were handled.
Data subjects
People who make a request.
Personal data
Identity, contact details, organisation, content of the request and of our answer.
Legal basis
Legal obligation; legitimate interest.
Recipients and country
Website and forms: United States. Email: Ireland, United States.
Safeguard
Adequacy where the provider is certified under the Data Privacy Framework for the data concerned, otherwise Standard Contractual Clauses.
Retention
3 years after the request is closed.
10. Recruitment
Purpose
Assess applications.
Data subjects
Candidates.
Personal data
Name, contact details, CV, cover letter, notes of interviews.
Legal basis
Steps before a contract.
Recipients and country
Email and documents: Ireland, United States.
Safeguard
Adequacy where the provider is certified under the Data Privacy Framework for the data concerned, otherwise Standard Contractual Clauses.
Retention
Until the end of the process; longer only with the candidate's consent.
11. Staff and contractors
Purpose
Manage employment and service contracts, pay and social insurance.
Data subjects
Employees and contractors.
Personal data
Identity, contact details, bank details, contract, salary and social insurance data.
Legal basis
Contract; legal obligation.
Recipients and country
Accounting firm: Switzerland. Banks: Switzerland, Lithuania. Email and documents: Ireland, United States.
Safeguard
Switzerland: not applicable. Lithuania and Ireland: countries recognised as adequate by Switzerland. United States: adequacy where the provider is certified under the Data Privacy Framework for the data concerned, otherwise Standard Contractual Clauses.
Retention
Legal retention periods, 10 years for accounting and payroll records.
12. Suppliers
Purpose
Order from suppliers and pay them.
Data subjects
Supplier contacts.
Personal data
Name, professional contact details, bank details, invoices.
Legal basis
Contract; legal obligation.
Recipients and country
Accounting firm: Switzerland. Banks: Switzerland, Lithuania.
Safeguard
Switzerland: not applicable. Lithuania: country recognised as adequate by Switzerland.
Retention
10 years.