Mitratech Alyne

GDPR overview

GDPR implementation is concrete and named. The controller is Alyne GmbH, Ganghoferstr. 70a, D-80339 Munich, and the data protection officer is reachable at privacy@alyne.com. The lead supervisory authority is identified as the Bayerisches Landesamt für Datenschutzaufsicht in Ansbach. The privacy notice cites the legal bases article by article — 6(1)(b) for contract, 6(1)(f) for legitimate interest, 6(1)(a) for consent, 6(1)(c) for legal obligation — and lists the rights of access, rectification, erasure, restriction, portability and objection under articles 15 to 21. Transfers outside the EEA rely on standard contractual clauses under article 46(2) or binding corporate rules under article 47, with supplementary measures. Clause 11 of the terms covers article 28 processing and offers a data processing addendum on request. No article 27 representative is designated, which is consistent with a controller established in Germany.

Who owns the data?

Clause 4.1 of the Alyne terms is unambiguous: the customer owns all right, title and interest in the data it submits and remains its sole controller. Alyne receives only a limited-term, worldwide licence to access, process and display that data for the purpose of running the service, and clause 11.2 states that it neither assumes ownership nor control, processing solely on the customer's instruction. Alyne keeps ownership of the platform itself and of any improvement to it. Feedback is treated differently: under clause 4.3 suggestions and enhancement requests are licensed to Alyne perpetually and irrevocably. After termination the customer has thirty days to retrieve its data electronically.

Reuse rights

The customer may reuse its own content freely, since it never transfers ownership of it. What it may not do is treat the platform's own material as its own. Clause 4.6 spells this out: selecting a value in an Alyne Control Statement, adding a custom value, creating a custom control set, funnel or assessment, or generating an Alyne report does not affect Alyne's intellectual property rights and grants no usage rights beyond the subscription term. Clause 4.5 places the service and its documentation under Alyne's copyright, so unauthorised copying, redistribution or public display is an infringement. In practice, outputs can be used inside the subscription, but the underlying control library stays licensed rather than owned, and clause 4.1 warns customers to extract their data before the contract ends. Separately, clause 12.8 allows Alyne to name the customer as a reference in its marketing unless asked to stop.

Data retention & training

Hosting summary

No hosting location specific to Alyne is published. The Mitratech group privacy policy, which covers the parent company and its subsidiaries including Alyne GmbH, names the United States, Australia, India, Mexico and the European Union as places where data may be hosted and processed, and states that data about clients and site visitors is stored primarily in the United States. Access may come from further countries where the group operates, including the United Kingdom, Singapore and India. Alyne's own privacy notice covers transfers outside the EEA with standard contractual clauses under article 46(2) or binding corporate rules under article 47, plus supplementary measures; a copy of the mechanism is available on request. Clause 10.6 of the terms says a subprocessor outside the EEA is only selected where an adequate level of protection is provided. On the infrastructure side, Mitratech states that client databases and file structures are kept separate with no co-mingling, that data at rest is encrypted to FIPS 140-2, and that only the customer's designates can export or modify the keys.