PRIVACY POLICY
==============
Last updated: June 2026
This Privacy Policy explains how MesH Engineering GmbH, Ulrichstraße 23,
73230 Kirchheim/Teck, Germany ("we", "us", or "the controller") collects, uses,
and protects your personal data when you use RegViento Explorer (the
"Service"). It supplements the Terms of Use, in particular Sections 6 and 7.
------------------------------------------------------------------------
1. CONTROLLER AND CONTACT
The controller within the meaning of the General Data Protection Regulation
(GDPR) is:
MesH Engineering GmbH
Ulrichstraße 23
73230 Kirchheim/Teck
Germany
E-mail: wind@mesh-engineering.de
Phone: +49 (0) 711 68 68 818 0
------------------------------------------------------------------------
2. DATA WE PROCESS AND WHY
a) Account data
When you register, we process your e-mail address, chosen username, a
hashed password (we never store passwords in plain text), your account
preferences, your marketing consent status with the date of its most
recent change, and, only if you enable two-factor authentication, a
two-factor authentication secret. If you sign in via Google or Microsoft
(see Section 4), we store the provider name and the account identifier
supplied by the provider instead of a password.
Purpose: providing and securing your user account.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
b) Security-related data
We record failed login attempts (to protect accounts against brute-force
attacks), e-mail verification status, and temporary tokens for e-mail
verification and password reset. Tokens are invalidated after use or
expiry.
Purpose: account security and abuse prevention.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in securing the
Service).
c) Server logs
Our hosting provider (see Section 5) records technical access logs,
including IP address, date and time of access, requested resource, and
browser identification (user agent). We retain administrative logs for up
to 90 days, after which they are deleted automatically.
Purpose: operating, securing, and troubleshooting the Service.
Legal basis: Art. 6(1)(f) GDPR.
d) Transactional e-mails
We send e-mails that are necessary to operate your account: registration
confirmation, e-mail address verification, password reset messages,
security notifications (for example when a new sign-in method is linked to
your account), and important service notices.
Legal basis: Art. 6(1)(b) GDPR.
Marketing e-mails (information about RegViento Explorer and our wind farm
evaluation services, as well as occasional news about other MesH
Engineering products and services) are sent only with your prior,
separate, and freely revocable consent (Art. 6(1)(a) GDPR), which you may
give via the optional checkbox at registration or later in your account
settings. We record
whether you have consented and the date of the most recent change to your
consent, as proof of consent (Art. 7(1) GDPR). You can withdraw consent at
any time in your account settings, via the unsubscribe link in any
marketing e-mail, or by contacting us; see also Section 8 of the Terms of
Use.
e) Contact form and analysis requests
If you use the contact form, your username, e-mail address, and message
are transmitted to us by e-mail so that we can process your enquiry. If
you use the "Detailed Analysis Request" function, your farm configuration
and simulation results are additionally attached to that e-mail as a YAML
file so that we can prepare the requested analysis.
Legal basis: Art. 6(1)(b) GDPR (handling your request) or Art. 6(1)(f)
GDPR.
f) In-app messages
Messages exchanged via the Service's internal messaging function (for
example notices from the administrators) are stored in our database
together with sender, recipient, and timestamp. They are deleted
automatically when the associated account is deleted.
Legal basis: Art. 6(1)(b) GDPR.
g) Wind farm data
Turbine layouts, wind rose configurations, and calculation results are
stored locally in your browser's local storage (see Section 3). By default
this data does not leave your device. When the server-side calculation
service is enabled and you run a calculation, your farm layout and wind
data are transmitted to our server and forwarded to the calculation
service solely to perform the calculation; they are not stored beyond the
duration of the request.
Legal basis: Art. 6(1)(b) GDPR.
------------------------------------------------------------------------
3. COOKIES AND LOCAL STORAGE
The Service uses only strictly necessary cookies:
- A session cookie that keeps you signed in for the duration of your visit.
- A CSRF protection cookie that protects forms against cross-site request
forgery.
In addition, the Service uses your browser's local storage to save your wind
farm inputs, wind rose data, calculation results, and interface preferences
on your own device.
These cookies and storage entries are technically required to provide the
Service (§ 25(2) TDDDG); no consent banner is therefore required. We do not
use any advertising, tracking, or analytics cookies, and we do not use any
third-party analytics services.
------------------------------------------------------------------------
4. SIGN-IN VIA GOOGLE OR MICROSOFT (OPTIONAL)
You may optionally sign in via:
- Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4,
Ireland)
- Microsoft (Microsoft Ireland Operations Limited, One Microsoft Place,
South County Business Park, Leopardstown, Dublin 18, Ireland)
If you choose one of these providers, you are redirected to the provider,
which authenticates you and transmits identification data to us (e-mail
address, name, and a provider account identifier). We use this data solely to
create and sign in to your account. The provider processes your data under
its own privacy policy:
- Google: policies.google.com/privacy
- Microsoft: privacy.microsoft.com
Legal basis: Art. 6(1)(b) GDPR. Using these providers is entirely optional;
you can always register with e-mail and password instead.
------------------------------------------------------------------------
5. HOSTING
The Service and its database are hosted by IONOS SE, Elgendorfer Str. 57,
56410 Montabaur, Germany, in data centres located in Germany. IONOS processes
data on our behalf under a data processing agreement pursuant to Art. 28
GDPR.
------------------------------------------------------------------------
6. THIRD-PARTY SERVICES CALLED FROM YOUR BROWSER
Certain features load data directly from third-party servers. When you use
these features, your browser transmits requests, including your IP address
and the relevant query parameters (for example GPS coordinates or a map
section), directly to the respective provider. We have no control over this
processing; it is governed by the providers' own privacy policies.
a) Map tiles and imagery: OpenStreetMap (OpenStreetMap Foundation, UK), Esri
(Esri Inc., USA), and OpenTopoMap. Loaded whenever the map is displayed.
b) Location search and existing turbine locations: Nominatim and the Overpass
API (services based on OpenStreetMap data). Used when you search for a
place or display existing wind turbines.
c) Wind resource data: NASA POWER API (National Aeronautics and Space
Administration, USA). Used when you fetch a wind rose for GPS coordinates;
the coordinates and the selected year are part of the request.
d) Turbine library: Open Energy Platform (openenergyplatform.org). Used to
load the list of available turbine types and their curves.
Some of these providers are located in countries outside the European Union
(in particular the USA) where the level of data protection may differ from
that in the EU. The data transmitted is limited to what is technically
required for the request (IP address and query parameters).
Legal basis: Art. 6(1)(b) GDPR (providing the features you actively use) and
Art. 6(1)(f) GDPR.
------------------------------------------------------------------------
7. RETENTION
- Account data is retained until you delete your account (directly in your
account settings or on request), after which it is removed.
- In-app messages are deleted automatically together with the associated
account.
- Server logs are retained for up to 90 days.
- E-mail verification and password reset tokens are invalidated after use or
expiry.
- Wind farm data in local storage remains on your device until you clear it
(for example via the Reset function or your browser settings).
------------------------------------------------------------------------
8. YOUR RIGHTS
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15),
- rectification of inaccurate data (Art. 16),
- erasure ("right to be forgotten", Art. 17),
- restriction of processing (Art. 18),
- data portability (Art. 20),
- object to processing based on legitimate interests (Art. 21), and
- withdraw any consent at any time with effect for the future (Art. 7(3)).
To exercise any of these rights, contact us at the address in Section 1. You
also have the right to lodge a complaint with a data protection supervisory
authority, in particular in the EU member state of your habitual residence,
place of work, or place of the alleged infringement. The authority
responsible for us is the Landesbeauftragte für den Datenschutz und die
Informationsfreiheit Baden-Württemberg.
------------------------------------------------------------------------
9. DATA SECURITY
All communication with the Service is encrypted in transit (TLS/HTTPS).
Passwords are stored only as salted hashes using a current, recognised
hashing algorithm. Access to the database is restricted and protected by
credentials.
------------------------------------------------------------------------
10. NO AUTOMATED DECISION-MAKING
We do not use your personal data for automated decision-making or profiling
within the meaning of Art. 22 GDPR.
------------------------------------------------------------------------
11. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy to reflect changes to the Service or legal
requirements. The current version is always available within the Service.
Material changes will be announced in the same way as changes to the Terms of
Use.
------------------------------------------------------------------------
End of Privacy Policy