Privacy policy

Controller

The controller responsible for processing personal data on this website is:

Company

m2 development gmbh

Address

Schochenmühlestrasse 2 , 6340 Baar , Switzerland

E-mail for data protection questions

info@m2remote.ch

No third-party trackers, no cookies

This website uses no third-party analytics services, no social media plugins and no embedded third-party content. Fonts, images and scripts are delivered from our own server. We advertise with Google Ads, but the website loads no scripts from Google, and we transmit no data about your visit or your request to Google. Your browser makes no requests to other providers when you visit. For visitor statistics we use our own Matomo on our subdomain stats.m2remote.ch (see below). We do not set any cookies.

Visitor statistics (Matomo)

To see which pages are visited and how the website is found, we use the open-source software Matomo. It is self-hosted on our hosting at Hostpoint in Switzerland (stats.m2remote.ch); the data is not passed on to third parties. We record the page visited without parameters, the previously visited page, date, time and length of visit, information on browser, operating system, screen size and language, clicked links to other websites and downloads and, without any details from the form, whether a trial request was sent. Matomo sets no cookies. Your IP address is shortened by 2 bytes before it is stored (for example 192.168.x.x), so it can no longer be attributed to you. We delete the raw data after 180 days; only aggregated reports without reference to individual visits are kept. If your browser sends the “Do Not Track” signal, the website does not record your visits.

The legal basis is our legitimate interest in improving the website using anonymous statistics (Art. 6(1)(f) GDPR, Art. 31(1) FADP). You can object at any time using the switch below. The website stores your choice in your browser’s local storage (localStorage, “m2r-matomo-optout”); if you clear the website data, the objection no longer applies.

Settings stored in the browser

If you choose light or dark mode or a language, the website stores this choice in your browser’s local storage (localStorage). It stays on your device and is not sent to us. You can delete it at any time by clearing the website data in your browser.

Server logs

The website is hosted by a provider in Switzerland (Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil). When a page is requested, its web server stores technically necessary data: IP address, date and time, requested address, amount of data transferred, the previously visited page and browser information. This data serves the operation and security of the website and is deleted by the host after 6 months at the latest.

The legal basis under the GDPR is our legitimate interest in secure operation (Art. 6(1)(f)).

Contact form

Using the form, you request the trial or ask us a question. We process: company, name, e-mail address, phone number (optional), requested plan, number of channels, your message and your confirmation that your company is based in Switzerland.

• Purpose: to answer your request and send you the download links for the trial.
• Transmission: the form sends the details encrypted to our web server, which forwards them to us by e-mail. To prevent misuse, the number of requests per IP address is briefly limited: at most 5 requests per hour. Only a non-reversible hash of the IP address is stored for this; it is no longer used after one hour and is then deleted.
• Retention: we keep your request as part of our ordinary business correspondence and delete it when it is no longer needed. If a contract is concluded, the statutory retention periods apply.
• Legal basis under the GDPR: steps prior to entering into a contract (Art. 6(1)(b)).

Download links for the trial

After you send the form, we e-mail you personal download links. When you click a link, we store the time, the related request (company, name, e-mail address), the file, your IP address, your browser’s identifier (user agent) and whether the transfer was complete. For every download we receive an e-mail with these details.

• Purpose: to know who obtained the software, to support you during the trial and to detect links being passed on. For this we store the IP address in plain text.
• Retention: the links are valid for 7 days. We automatically delete the download log after 3 months at the latest.
• Legal basis under the GDPR: steps prior to entering into a contract (Art. 6(1)(b)) and our legitimate interest in protecting our software (Art. 6(1)(f)).

Self-hosted: the data stays with the operator

m2 remote support runs on the operator’s server, that is the company using the service. Server, connection log and certificate authority are located there. The operator is therefore responsible for processing personal data in the service. m2 development gmbh has no access to this data.

Server location: wherever the operator runs its server. m2 development gmbh does not run a server for the sessions.

License check

For the license check, the server regularly contacts the license portal of m2 development gmbh. In doing so it transmits the license, its computer name and its host name. If the operator requests a trial license in the team app, the company, postcode, first and last name, e-mail address and, optionally, the phone number of the person requesting it are added. Session content is end-to-end encrypted and is not part of this.

Purpose: checking licenses and issuing trial licenses. m2 development gmbh is the controller for this data.

Retention: the host name and server name of an installation become part of the contract and are kept with it for 10 years (statutory retention obligation, Art. 958f CO). We keep the other data from the licence check for as long as the licence runs and delete it 12 months after the contract ends. We delete confirmed trial requests after 90 days and unconfirmed ones no later than one day after the code expires. If a purchase follows, the details become contract data.

Connection log

The server keeps a minimal log with these details per session:

• Start of the session
• Device ID of the customer PC
• Staff member who ran the session
• Duration
• Amount of data transferred

The log contains no IP addresses and no session content. It is deleted automatically after 90 days; the operator can change this period.

Session content

Screen, input, clipboard and files are end-to-end encrypted (ECDH P-256, AES-256, HMAC-SHA256). Even the server only sees encrypted data. Sessions are not recorded; the content only passes through memory. The programs send no telemetry to third parties.

You will find further technical information on the Security page.

Android app m2 remote support

For Android phones and tablets, the customer app “m2 remote support” is available on Google Play (package ch.m2remote.app). It only connects to the operator’s server, which you choose in the app or receive via a link. As described above, the operator is responsible for the data of the sessions.

• Screen sharing: the app transmits the screen via the Android feature MediaProjection, only during a session you have allowed and only after you confirm in the Android dialog. The image is end-to-end encrypted and is not stored.
• Remote control (optional): if you turn it on, the Android accessibility service carries out the taps, swipes and text input of the person helping you. It only works during a session, does not read any content and stores nothing.
• Device ID and device key: the app creates its own device ID and a device key so that the server recognises your device. Both are used only for the connection, not for advertising. The device key is protected by a key in the Android Keystore.
• Connection log: the server keeps the log described above with the device ID, without IP addresses and without content, and deletes it automatically after 90 days.
• Installation via a link: if you installed the app via an invitation link, it reads the Google Play Install Referrer once to take over the server and code. For nothing else.
• No advertising, no advertising ID, no analytics or crash reporting services and no sharing with third parties. Only the chosen servers, the language and the device ID and key remain on the device; uninstalling removes everything.

Contract data of our customers

For the licence, invoicing and support by e-mail, we process details of the company, the contact details of the contact persons and the number of channels. We keep them for the duration of the contract and then within the statutory retention obligations.

If m2 provides support for an operator or maintains their server, we conclude a data processing agreement (DPA).

Emails to companies

We write individually by email to companies in Switzerland for which m2 remote support could be a fit. For this we process the company name, the name and role of the contact person and their business email address. The details come from public sources such as the company’s website and the commercial register.

• Purpose: to make your company aware of our offer and to process your reply.
• Legal basis: our legitimate interest in presenting our products to companies (Art. 31(1) FADP, Art. 6(1)(f) GDPR).
• Objection: simply reply to the email, for example with “No more emails”. We will then no longer write to you and keep only your email address on a block list.
• Deletion: if no contact results, we delete the details after 12 months.

Disclosure and transfers abroad

We do not sell personal data and only disclose it as far as necessary for the purposes stated, for example to our host as processor. The forms and our e-mails also go through Hostpoint’s mail system, and the visitor statistics (Matomo) run on our hosting at Hostpoint. The data does not leave Switzerland; no transfer abroad takes place.

Your rights

Within the scope of applicable law, you have the right to:

• information about your personal data processed by us
• correction of inaccurate data
• deletion or restriction of processing
• object to processing and withdraw consent
• receive or transfer your data

You can also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) and, within the scope of the GDPR, with a supervisory authority in the EU.

For data in the m2 remote support service, please contact the operator using the service.

Contact

For questions about data protection and to exercise your rights, you can reach us at the address above or by e-mail. We reply within 30 days.