Please note: This English version is provided for convenience only. Only the German version is legally binding.
Does melibo have a data protection officer?
melibo relies on NOTOS Xperts GmbH for advice on data protection matters.
NOTOS Xperts GmbH
Heidelberger Strasse 6
64283 Darmstadt, Germany
For any questions about data protection, please contact legal@melibo.de
Can a data processing agreement (DPA) be concluded with melibo?
Yes, we offer to conclude a data processing agreement (DPA). We are happy to provide the details of this agreement as soon as you officially submit a request to us.
If you are interested in concluding a DPA with us, we kindly ask you to contact us officially so that we can provide you with the relevant information and documents. We strive to make this process as smooth as possible for you and are happy to answer any questions.
Have you implemented technical and organizational measures?
Yes, we have. We have a detailed TOMs document describing all measures. We are happy to provide the document on request.
Where is data stored in melibo?
For hosting our software, melibo relies on Microsoft Azure OpenAI, server location Frankfurt.
Has it been ensured that melibo's sub-processors are familiar with the current legal situation and act accordingly?
Data processing agreements or EU Standard Contractual Clauses (SCCs) have been concluded with all subcontractors. Until the CJEU ruling of July 16, 2020, there were also US service providers working with us on the basis of the EU-US Privacy Shield. These contracts are now being converted to SCCs.
In addition, we make sure that the TOMs (technical and organizational measures) of our subcontractors meet the high standard we require.
How does melibo deal with the invalid EU-US Privacy Shield?
Our standard contract variant uses subcontractors from third countries such as the USA, as this allows us to offer you, our customers, even better and more comprehensive advice and service quality.
As you have surely seen in the media, on July 16, 2020, the CJEU issued a far-reaching decision in case C-311/18 on the transfer of personal data to third countries.
The ruling concerns the conditions under which a transfer of personal data to a company headquartered in the USA is permissible. In the past, cooperation with American companies was often based on the EU-US Privacy Shield certificate, which was valid until the ruling.
American companies often obtained this certificate to demonstrate an adequate European level of data protection.
The CJEU ruling now classifies the transfer of personal data on the basis of the EU-US Privacy Shield as entirely inadmissible. The use of standard contractual clauses or Binding Corporate Rules (BCR) is still regarded as a possible basis for GDPR-compliant data exchange, but it must be ensured that an adequate European level of data protection exists. In our cooperation with partner companies, we apply equally high security requirements to all national and international partners to ensure a uniform standard.
As a commissioned service provider, we may come into contact with our clients' personal data. That is why it is always our goal to combine the greatest possible data security with very good performance and simple, customer-friendly and intuitive usability.
We select our cooperation partners carefully and conclude appropriate data protection agreements with them to ensure secure data processing. In our view, completely avoiding transatlantic data transfers is currently not feasible.
As a European company based in Bensheim, we cannot assess whether and to what extent US companies are subject to the laws in question and may be required to hand over data in individual cases. However, in our view, the likelihood of US investigative authorities actually accessing data that we process as your processor is extremely low. The personal data we process is presumably not classified by US investigative authorities as significant and therefore relevant for collection.
With the "EU" variant, we offer a solution that concentrates the processing of personal data on subcontractors within the EU.
As the melibo team, we are committed to a secure, high-performance product with data storage within the EU. We will continue to work hard every day to make our product even better, and we regard data protection and data security as essential building blocks of our corporate strategy.
Is there an ISO certification?
melibo itself is not ISO-certified. However, Azure, as one of our subcontractors, holds multiple certifications.
Azure holds the following ISO certifications: ISO20000-1, ISO22301, ISO27001, ISO27017, ISO27018, ISO27701, ISO9001
To ensure secure data processing, we conduct regular penetration tests and have our systems checked for vulnerabilities through external audits.
Is there a passage I can use for my website?
Yes, there is:
On our website, we use the chatbot melibo provided by ThinkingTech GmbH (Darmstädter Str. 5, 64625 Bensheim, Germany). When you use this service, the following personal data about you is processed:
· necessary connection data (e.g. IP address);
· the content of the conversation held via the chatbot; and
· background information that the chatbot processes to answer requests.
The service only processes personal data about you once you activate the widget via the "Accept" field. By activating it, you give your express consent to the processing of your personal data via the chatbot. You can withdraw this consent at any time with effect for the future by emailing legal@melibo.de. The processing is based on your consent pursuant to Art. 6 (1) (a) GDPR.
After your communication with the chatbot ends, the dialogs are stored in anonymized log files and used to improve the chatbot. From this point on, you can only be identified if you shared personal data in your communication with the chatbot.
The questions and analytics data are transmitted securely via SSL encryption. Access is also protected by several firewalls that prevent unauthorized external access.